9. Security Flashcards
Confidentiality =
Permitting authorized access while protecting information and resources from improper disclosure
Confidentiality - 5 main threats
Snooping; Dumpster Diving; Eavesdropping; Wiretapping (electronic eavesdropping - use encryption); Social Engineering
Integrity =
protecting against unauthorized changes to information
Integrity - 4 main types of attacks
Unauthorized modification; Impersonation; Man in the Middle; Replay
Availability
Insuring systems and information are accessible by authorized users when they need access
Availability - 5 main types of disruptions
DDoS; Power Outages; Hardware Failures; Destruction of Equipment; Service Outages
Device Security - 5 ways to protect
Anti-virus software; Host Firewalls; Passwords/MFA; Security Updates; secure browsing
3 Main privacy concerns
protecting our own data; educating our users; protecting data collected by our organization
2 Common types of private information
PHI and PII
PII =
all information that can be tied back to a specific individual
PHI =
health care records regulated under HIPPA
Security Policy Framework - 4 types of documents
policies (mandatory); standards (mandatory); Guidelines (optional); procedures
3 elements of access control
Identification; authentication; authorization
Identification (access control)
Individual makes a claim of their identity (username)
Authentication (access control)
proving a claim of identity (password/mfa)
Authorization (access control)
verifying that the user is allowed access (regulating specific access and permissions)
Security Policy Framework (4 different types of documents)
Policies, Standards, Guidelines, Proceedures
3 Steps for Access Control
Identification; Authentication; Authorization
3 Types of access control systems
Mandatory Access Control (MAC) - OS; Discretionary Access Control (DAC) - xrw; Role-based Access Control - job-based roles/permissions
Account Types (5)
User; System Administrator; Guest; Shared/Generic; Service
2 different environments for encryption
Data at rest; Data in transit
Business continuity scope (3)
Activities covered; systems covered; controls implemented
Tools to remediate availability (2):
Redundancy (duplication of data); Fault tolerance (automatic failover)
