501 Chapter 1 Flashcards by Christian Ramos

Describes a goal an organization wants to achieve

use case

How well did you know this?

Not at all

Perfectly

____ prevents unauthorized disclosure of data

Confidentiality

How well did you know this?

Not at all

Perfectly

____ scrambles the data

Encryption

How well did you know this?

Not at all

Perfectly

____ helps ensure that only authorized persons can access the data through Identification, Authentication, Authorization

Access Controls

How well did you know this?

Not at all

Perfectly

the practice of concealing a data on to another data

Steganography

How well did you know this?

Not at all

Perfectly

the practice of making a data uninterpretable

Obfuscation

How well did you know this?

Not at all

Perfectly

____ provides assurance that the data has not changed. Ensures that no one has modified, tampered with or corrupted the data.

Integrity

How well did you know this?

Not at all

Perfectly

A ____ is a number created by a hashing algorithm

hash

How well did you know this?

Not at all

Perfectly

commonly used in emails, provides nonrepudiation

digital signatures

How well did you know this?

Not at all

Perfectly

an electronic password that allows a user to securely transfer data over the Internet using PKI

digital certificate

How well did you know this?

Not at all

Perfectly

____ indicates that data and services are available when needed

Availability

How well did you know this?

Not at all

Perfectly

adds duplication to critical systems and provides fault tolerance

redundancy

How well did you know this?

Not at all

Perfectly

the common goal of redundancy is to remove

SPOF

How well did you know this?

Not at all

Perfectly

SPOF stands for

Single Point of Failure

How well did you know this?

Not at all

Perfectly

a redundancy technique: see RAID 1, RAID 5, RAID 10, allows a system to operate even if a disk fails

Disk Redundancies

How well did you know this?

Not at all

Perfectly

a redundancy technique: see backup servers, remote servers

Server Redundancies

How well did you know this?

Not at all

Perfectly

a redundancy technique: uses multiple servers to support a single service

Load Balancing

How well did you know this?

Not at all

Perfectly

a redundancy technique: see alternate site or hot site where in the event of the original site is no longer capable of functioning

Site Redundancies

How well did you know this?

Not at all

Perfectly

a site that is available 24/7 with employees

hot site

How well did you know this?

Not at all

Perfectly

a site where employees need to go move to and start systems

cold site

How well did you know this?

Not at all

Perfectly

a redundancy technique: see data backup, Grandfather-Father-Son backup

Backups

How well did you know this?

Not at all

Perfectly

a redundancy technique: see UPS, Generator

Alternate Power

How well did you know this?

Not at all

Perfectly

a redundancy technique: reduces outages from overheating

Cooling Systems

How well did you know this?

Not at all

Perfectly

use a set of changes to update, improve or debug

Patching

How well did you know this?

Not at all

Perfectly

basic goal of IT security is to

reduce risk

is the possibility or the likelihood of a threat exploiting a vulnerability resulting in a loss

Risk

is any circumstance or event that has the potential to compromise confidentiality, integrity, availability

Threat

is a weakness. It can be in hardware, software, configuration or OS

Vulnerability

is an adverse event or series of events that can negatively affect the CIA of an organization. includes: attacks, malware, data loss, etc

Security Incident

reducing the risk or reducing the chance a threat will exploit a vulnerability: by implementing controls and many more actions to be discussed at later chapters

Risk Mitigation

reduces risk

Security Control

List the three primary control types

Technical Controls Administrative Controls Physical Controls

____ is a technical control used to protect the confidentiality of data. This includes data transferred over a network and data stored in devices, such as servers, PC, mobile

Encryption

once installed, provides protection against malware infection

Antivirus Software

both can monitor a network or host for intrusions and provide ongoing protection against various threats

IDS (Intrusion Detection System) and | IPS (Intrusion Prevention System).

this restrict network traffic going in and out of a network

Firewall.

specifies that individuals or processes are granted only the privileges they need to perform their assigned task or function

Least privilege

are combinations of rights and permissions

Privileges

____ use methods mandated by organizational policies or other guidelines

Administrative Controls

these help quantify and qualify risks within an organization so that the organization can focus on the serious risks

Risk Assessments

use cost and asset values to quantify risks based on the monetary value

quantitative risk assessment

uses judgments to categorize risks based on probability and impact

qualitative risk assessment

these attempts to discover current vulnerabilities or weaknesses

Vulnerability Assessments

are a step further from vulnerability assessments by attempting to exploit these vulnerabilities

Penetration Tests

many administrative controls are also known as ____ | they help ensure that day-to-day operations of an organization comply with their overall security plan

operational or management controls

training helps users maintain password security, follow a clean desk policy, understand threats such as phishing and malware and more

Awareness and Traning

conf management use baselines to ensure the system started in a secure, hardened state. change mgmt helps ensure that changes don't result in unintended configuration errors"

Configuration and change management

methods to help prepare for potential system outages

Contingency planning

includes USB, external drives, backup tapes

Media protection

such as cameras and door locks and heating and ventilation

Physical and environmental protection

are any controls you can physically touch: lighting, signs, fences, security guards, etc

Physical Controls

the goal is to prevent security incidents

Preventive Controls

is the practice of making a system or application more secure than its default configuration. This uses a defense-in-depth strategy with layered security: includes disabling unnecessary ports and services, implementing secure protocols, using strong passwords along with robust password policy and disabling default and unnecessary accounts"

Hardening

ensuring that users are aware of security vulnerabilities and threats helps prevents incidents

Security Awareness and Training

guards prevent and deter many attacks

Security Guards

attempt to detect when vulnerabilities have been exploited resulting in an incident

Detective Controls

logs record details of all traffic that firewall blocked

Log Monitoring

monitor logs to detect trends by analyzing past logs

Trend Analysis

examines the security posture of an organization

Security Audit

CCTV system records activity and detects what occurred. can be used as a deterrent control too

Video Surveillance

detect motion from potential intruders

Motion Detection

attempt to reverse the impact of an incident or problem after it has occurred

Corrective Controls

attempts to detect an attack and then modify the environment to block the attack from continuing

IPS

backups ensure that personnel can recover data if it is lost or corrupted. also system recovery procedures

Backups and system recovery

attempt to discourage a threat

Deterrent Controls

deters thieves from stealing laptops

Cable Locks

such as locked doors

Hardware Locks

are alternative controls used instead of a primary control

Compensating Controls

is a popular technology used within large data centers and can also be used on a regular personal computer. It allows you to host one or more virtual systems or VMs (Virtual Machine) on a single physical system

Virtualization

the software that creates, runs and manages the VMs

Hypervisor

the physical system hosting the VMs

Host

Operating systems running on the Host

Guest

the ability to resize computing capacity based on the load

Host elasticity and scalability

run directly on the system hardware. often called bare-metal hypervisors because they don't need to run within an operating system

Type I

run as software within a host operating system

Type II

is a specialized version of a Type II hypervisor. It allows services or applications to run within their own isolated cells or containers. Containers don't have a full operating system but instead, use the kernel of the host

Container Virtualization

it captures the state of a VM at a moment in time. Administrators often take a snapshot before performing a risky operation.

Snapshot

can occur if personnel within the organization don't manage the VMs.

VM sprawl

attack allow an attacker to access the host system from the VM. Primary protection for this is to keep the host and guests up to date with current patches.

VM escape

can be used to check the connectivity; check name resolution; verify that routers, firewalls, and IPS system block ICMP

Ping command

on windows allows you to view the configuration of network interfaces

Ipconfig command

on Linux and MAC allows you to view the configuration of network interfaces

Ifconfig command

allows you to view statistics for TCP/IP protocols and view all active network connections. Can be useful if you suspect malware is causing a computer to connect with a remote computer

Netstat command

lists the routers (also called hops) between two systems. It can be used to verify a path has not changed

Tracert command

allows you to view and manipulate the ARP cache. This is useful is you suspect a system's ARP cache has been modified during an attack

Arp (Address Resolution Protocol) command