7 - Cyber Systems Flashcards
1
Q
Standard Computer Capabilities and Characteristics
– Four
A
- Speed
- Accuracy
- Diligence
- Versatility
2
Q
Computer Speed
– Limits
– Comparison
A
- Fastest possible = Speed of Light
- Limited by algorithm efficiency
- Thousands of times faster than humans
3
Q
Computer Accuracy
A
- High accuracy
- Errors due to human error/inaccurate data
4
Q
Computer Diligence
A
- Computers don’t suffer fatigue, lapse in concentration, etc. regardless of number of calculations
5
Q
Computer Versatility
A
- Perform multiple tasks at once w/ multi-processing
- Perform various types of tasks
6
Q
Workstation
– Other names
– Types
A
- Personal computer/client workstation
- Two Types
– Thin Client
– Thick Client
7
Q
Thin Client
A
- Software or computer relying on another computer to do most of the work
- Acts as interface connecting to network server doing the actual processing
8
Q
Thick Client
A
- Functions independent of the server
- May pull some data from server or run without being connected at all
9
Q
Server
A
- Computer managing shared resources for other network systems
- Common Types
– Application
– Catalog
– Database
– DHCP
– File
– Mail
– Proxy
– Web
10
Q
Vulnerability
A
- Weakness in a computer system that is open to exploitation
11
Q
Threat
A
- Possible danger that may take advantage of a vulnerability
- Could be an individual, an event, etc.
12
Q
Risk
A
- Likelihood that a threat will take advantage of a vulnerability
13
Q
Virus
A
- Code that spreads from one computer to another by attaching itself to other files
14
Q
Worms
A
- Code that spreads from one computer to another on its own
- Does not attach to another file
15
Q
Logic Bombs
A
- Code that sits dormant on a target computer until it’s triggered by a specific event
- Ex: Specific date/time or starting specific process
16
Q
Spyware
A
- Stealthily installed malicious software
- Intended to track/report data defined by author from a target system
17
Q
Adware
A
- Software that automatically displays or downloads ads
- “Not all malicious”
18
Q
Rootkits
A
- Code intended to take full or partial control of a system at low levels
19
Q
Botnets
A
- Collection of software robots run by a C2 program, controlled by a person
20
Q
Common Vulnerability Causes
A
- Configuration / Familiarity
- Implementation
- Design
21
Q
Configuration / Familiarity (Vulnerability Cause)
A
-
Misconfigured system/app
– Ex: bad firewall rules - Using well-known software increases probability of vulnerability/exploit
– Ex: Default PW from application user manual
22
Q
Implementation (Vulnerability Cause)
A
-
Lack of input validation
– Program assumes all user input is safe, allowing attacks such as XSS or SQL injection
23
Q
Design (Vulnerability Cause)
A
- Inherent in a protocol, application, or architecture
– Ex: Using Telnet or FTP to administer a network
24
Q
Unstructured Threat
A
- “Script Kiddy”
-
Unfocused attack often by individuals w/ limited skills
– “Unfocused” - system isn’t specifically targeted
25
Q
Structured Threat
A
- “CWO”
- Focused attack by individual(s) w/ high skills against specific system
- Tend to be motivated by specific cause
– Money, politics, etc.
26
Q
Internal Threat
A
- Originate from individuals who have/had authorized access
– Disgruntled/opportunistic employee
27
Q
External Threat
A
- Originate outside the organization, often through the internet
28
Q
Common Vulnerability and Exposure (CVE)
A
- Developed by MITRE in 1999
– Non-profit research and dev organization -
List of vulnerabilities, each containing:
– ID number
– Description
– At least one public reference - ID format: CVE-YYYY-NNNN
29
Q
U.S. National Vulnerability Database (NVD)
A
- Launched by NIST in 2005
- Vulnerability database built upon and sychronized w/ CVE
- Provides Common Vulnerability Scoring System (CVSS)
30
Q
Exploit Database
A
- Maintained by Offensive Security
- Archive of exploits, shellcode, and security papers
31
Q
Motherboard
A
- Main electronic circuit board housing other sub-components
– CPU
– Chipsets
– Bus
– System Clock
– Expansion Slots
– BIOS
– CMOS
32
Q
CPU
A
- Brain of computer
- Controls number of simultaneous tasks and task completion speed
33
Q
Chipsets
A
- Circuitry responsible for managing specific hardware components
34
Q
Bus
A
- Controls speed at which data is transferred between hardware components
35
Q
System Clock
A
- Synchronizes and controls timing of computer ops
36
Q
Expansion Slots
A
- Small plastic slots used to install additional devices such as video or network cards
- 1-6 in long x 1/2 in wide
37
Q
BIOS
A
- Translates processor requests into instructions
- Executes POST
38
Q
CMOS
A
- Contains computer’s inventory list and advanced setup options
- Stores data read by BIOS
39
Q
Memory
A
2 Types
- Random Access Memory (RAM)
– Volatile
– Temporary data storage which may be quickly accessed by CPU - Read Only Memory (ROM)
– Non-volatile
– Stores programs the same way RAM does, but once the data is stored it cannot be changed (hence, read only)
– Stores frequently used instructions and data, often for things such as BIOS
40
Q
Hard Drives
A
- Stores changing data in relatively permanent form
- Most popular drives today are SCSI, SAS, and SATA
41
Q
Operating System
A
- Significant impact on overall performance
- Ex:
– Windows
– Red Hat
– Solaris
42
Q
Distributed System Architectures (2)
A
- Client-Server Model (Centralized Environment)
- Peer-to-Peer Model (Decentralized Environment
43
Q
Client-Server Model
A
- Smart clients contact server for data, then format/display it for user
- Permanent changes at the client are committed back to the server
44
Q
Peer-to-Peer Model
A
- No special machines providing a service or managing network resources
- All responsibilities divided among all machines
- Peers can be both clients and servers
45
Q
CIA Triad
A
- Confidentiality - Protect data from being accessed by unauthorized parties
- Integrity - Ensure data authenticity
- Availability - Ensure data accessibility for authorized users
46
Q
Enforce System Policies/Procedures
A
- Policy Statement
– Outlines a plan for the user security component - Standards
– Defines how to measure the level of adherence to the policy - Guidelines
– Recommendations or best practices for how to meet the policy standard - Procedures
– Step-by-step instructions that detail how to implement the components of the policy
47
Q
Four A’s
A
- Authentication
– Uniquely ID’ing a particular individual/entity - Authorization
– Determining what rights/privileges a particular entity has - Access Control
– Determining and assigning privileges to resources, data, etc. - Auditing or Accounting
– Tracking & recording system activities / resource access
48
Q
System Hardening
A
- Eliminate as many security risks as possible
– Disable unnecessary services/accounts
– Protect management interfaces/apps
– Password protection
49
Q
Vulnerability Management
A
-
Ongoing, comprehensive process or program that aims at managing an organization’s vulnerabilities in a holistic and continuous manner
– Asset Management - devices
– Software Management - software
– Vulnerability Assessment - continuous vuln scans/remediation
– Patch Management - obtaining, evaluating, testing, deploying new patches
– Change Management - approving/executing change to assure CIA
50
Q
Due Care
A
- Describes how individuals should use/maintain organization-issued hardware/software
- Includes both using equipment safely and in an approved manner
51
Q
Due Diligence
A
- Investigating/researching all issues and options relating to a particular subject
- Ensure security policies/practices are effective
- Ensure no violation of laws, statutes, or human rights
52
Q
Due Process
A
- Organization does not assume an individual is guilty w/o due process
53
Q
Operations Continuity Plan
A
Defines how an org will maintain normal day-to-day ops during disruption or crisis
54
Q
Disaster Recovery Plan
A
- Defines how people and resources will be protected in the case of a natural or man-made disaster
55
Q
Benefits of Websites
A
- Reduces communication costs
- Enhances communication and coordination
- Accelerates the distribution of knowledge
- Improves customer service and customer satisfaction
56
Q
Database Capabilities and Benefits
A
- Improved data sharing
- Improved data security
- Effective data integration
- DBMS minimize data inconsistency
- Better access to data
- Increase in productivity of end user
- Quick decision making
57
Q
10 Most Critical Security Risks
A
- Injection
- Broken Authentication
- Sensitive Data Exposure
- XML External Entities (XXE)
- Broken Access Control
- Security Misconfiguration
- Cross-Site Scripting (XSS)
- Insecure Deserialization
- Using Components with Known Vulnerabilities
- Insufficient Logging and Monitoring
58
Q
Injection
A
- Untrusted data sent to an interpreter as part of command or query
- Tricks interpreter into accessing data w/o proper authorization
59
Q
Broken Authentication
A
- Assuming another user’s identity temporarily or permanently
60
Q
Sensitive Data Exposure
A
- Lack of encryption for data at rest or in transit
61
Q
XML External Entities (XXE)
A
- Older or poorly configured XML
- Ability to upload hostile XML content, exploiting vulnerable code or dependencies
62
Q
Broken Access Control
A
- Exploitation of access control
- Failing to enforce authenticated user restrictions
63
Q
Security Misconfiguration
A
- Exploiting Default configurations or unpatched flaws
64
Q
Cross-Site Scripting (XSS)
A
- Insufficient input validation
- Attacker able to add malicious content to a website; content executed on other victim’s browser
65
Q
Insecure Deserialization
A
- Existing data structures used but content changed
- Serialization used for persistence/caching
66
Q
Using Components w/ Known Vulnerabilities
A
- Using preconfigured client/server-side components
- Not understsanding component patch state
67
Q
Insufficient Logging/Monitoring
A
- Not validating logging and monitoring capabilities
68
Q
Website Components
A
- Web Page
- Web Content
- Websites
- Web Browser
- Web Application
- Browser Engine
69
Q
Web Page
A
- Computer file suitable for the world wide web / a web browser
- Two types
– Static - Flat/stationary page
– Dynamic - Controlled by Application Server processing server-side scripts and Client Web Browser processing client-side scripts
