Architecture and Design Flashcards
Staging/Sandboxing
Staging environments can mimic the actual production environment, leading to realistic test environment that minimizes the risk of failure during a push to the production environment
good for testing and patches
Tokenization
An example of deidentification control; all or part of the data in a field is replaced with a randomly generated token
ex. protecting PHI data
What type of cloud would you use if you want to purchase cloud storage resources that will be dedicated soley for your organizations use?
Private Cloud
SHA-1 creates what fixed output? (bit)
160-bit fixed output
SHA-2 creates what fixed output? (bit)
256-bit fixed output
MD-5 creates what fixed output? (bit)
128-bit fixed output
RIPEMD creates what fixed output? (bit)
160-bit fixed output
Defense in depth
the concept of layering various network appliances and configurations to create a more secure and defensible architecture
Data in transit
(or data in motion)
occurs when data is transmited over a network
Data at rest
data is in persistent storage media using whole disk encryption, database encryption, and file- or folder-level encryption
Data in use
when data is present in volatile memory, such as system RAM or CPU registers and cache
What is a reverse proxy commonly used for?
Directing traffic to internal services if the contents of the traffic comply with the policy
Positioned at the cloud network edge and directs traffic to cloud services
Symmetric or Asymmetric?
Blowfish
Symmetric-key block cipher
Symmetric or Asymmetric?
ECC
Asymmetric
allow the use of shorter key for the same strength that an RSA key would require, reducing the computation overhead required to encrypt and decrypt data
Symmetric or Asymmetric?
PGP
Aymmetric
Symmetric or Asymmetric?
RSA
Asymmetric
Data soverignty
refers to a jurisdiction preventing or restricting processing and storage from taking place on systems that do not physically reside within that jurisdiction
(like France or the European Union)
Symmetric or Asymmetric?
Diffie-Hellman
Asymmetic
Symmetric or Asymmetric?
AES
Symmetric
Symmetric or Asymmetric?
RC4
Symmetric
What are the two types of containment?
regarding attacks
Segmentation and Isolation
Hypervisor
(virutal machine monitor)
a process that creates and runs virtual machines (VMs)
allows one host computer to support multiple guest VMs by sharing its resources, like memory and processing
Stream cipher vs. Block cipher
A block cihper is used to encrypt multiple bits at a time before moving to the next set of data
A stream cipher encrypt a single bit (or byte) at a time during their encryption process
Which is faster?
Asymmetric vs. Symmetric
Symmetric encryption is faster than asymmetric encryption
Non-repudiation
when a sender cannot claim they didn’t send an email when they did
Which protocol is paired with OAuth2 to provide authentication of users in a federated identity management solution?
OpenID Connect
OAuth2 is explicitly designed to authorize claims and not to authenticate users.
OpenID Connect is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields
Rapid Elasticity
used to describe scalable provisioning or the capability to provide scalable cloud computing services
rapid elasticity is very critical to meet the fluctuating demands of cloud users
Data Wiping
occurs by using a software tool to overwrite the data on a hard drive to destroy all electronic data on a hard disk or other media
may be performed with a 1x, 7x, or 35x overwriting, with a higher number of times being more secure
Degaussing
involves demagnetizing a hard drive to erase its stored ddata
you CANNOT reuse a hard drive once it has been degaussed
classified as a form of PURGING
Purging
removing sensitive data from a hard drive using the device’s interal electronics or an outside source sush as a degausser, or by using a cryptographic erase function if the drive supports one
Shredding
involves the physical destruction of the hard drive
CER
Crossover Error Rate
describes the point where the False Reject Rate (FRR) and False Accept Rate (FAR) are equal
describes the overall accuracy of a biometric system
UPS
Uninterruptible Power Supply
making certain that power isn’t disupted during an outage and can be maintained for a short time until alternate power like a generator can come online is critical
Faraday Cage
invloves placing wire mesh around an area or device to block electromagnetic signals
RAID 0
provides data striping across multiple disks (or only 2?) to increase performance
RAID 1
provides redundancy by mirroring the data identically on two hard disks
RAID 5
provides redundancy by striping data and parity data across the disk drives
requires minimum of 3 disk drives
RAID 6
provides redundancy by striping and double parity data across the disk drives
requires at least 4 hard disks
RAID 10
creates a striped RAID of two mirrored RAIDS (combines RAID 1 & RAID 0)
requires at least 4 hard disks
IaaS, SaaS, IPSECaaS, Paas, FaaS
CSR
Certificate Signing Request
CSR is what is submitted to the CA to request a digital certificate
OCSP
a status of certificates that provide validity such as good, revoked or unknown
Fuzzing
an automated software testing technique that invovles providing invalid, unexpected, or random data as inputs to a computer program
the program is monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks
Attestation
prove the hardware is really yours, a system you can trust
easy when it’s just your computer, more difficult when there are 1,00
remote attestation
Federation
allows members of one organization to authenticate using the credentials of another organization
RP
Relying parties
provide services to members of a federation
VM escape
leveraging access from a single virtual machine to other machines on a hypervisor
VM sprawl
when the number of virtual machines on a network reaches a point where the administrator can no longer manage them effectively
Hardware write blocker
primary purpose is to intercept and prevent (or ‘block’) any modifying command operation from every reaching the storage device
hardware and software write blockers are designed to ensure that forensic software and tool scannot change a drive inadvertently by accessing it
Hardware write blocker
primary purpose is to intercept and prevent (or ‘block’) any modifying command operation from every reaching the storage device
hardware and software write blockers are designed to ensure that forensic software and tool scannot change a drive inadvertently by accessing it
