Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > Assets, Threats, & Vulnerabilities > Flashcards

Assets, Threats, & Vulnerabilities Flashcards

1
Q

Asset

A

item perceived as having value to an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Asset inventory

A

catalog of assets that need to be protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Asset classification

A

practice of labeling assets based on sensitivity and importance to an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Asset management

A

process of tracking assets and the risks that affect them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Compliance

A

process of adhering to internal standards and external regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data

A

information that is translated, processed, or stored by a computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data at rest

A

data not currently being accessed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data in transit

A

data traveling from one point to antoher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Data in use

A

data being accessed by one or more users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Information security (InfoSec)

A

practice of keeping data in all states away from unauthorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)

A

voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Policy

A

set of rules that reduce risk and protect information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Procedures

A

step-by-step instructions to perform a specific security task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Regulations

A

Rules set by a government or other authority to control the way something is done

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Risk

A

Anything that can impact confidentiality, integrity, and availability of an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Standards

A

References that inform how to set policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Threat

A

Any circumstances or event that can negatively impact assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Vulnerability

A

weakness that can be exploited by a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Access controls

A

security controls that manage access, authorization, and accountability of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Algorithm

A

set of rules used to solve a problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Application programming interface (API) token

A

small block of encrypted code that contains information about a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Asymmetric encryption

A

use of public and private key pair for encryption and decryption of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Basic auth

A

technology used to establish a user’s request to access a server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Bit

A

smallest unit of data measurement on a computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Brute force attack

A

the trial and error process of discovering private information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Cipher

A

algorithm that encrypts information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Cryptographic key

A

mechanism that decrypts ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Cryptography

A

process of transforming information into a form that unintended readers can’t understand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data custodian

A

Anyone or anything that’s responsible for the safe handling, transport, and storage of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Data owner

A

person that decides who can access, edit, use, or destroy their information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Digital certificate

A

a file that verifies the identity of a public key holder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Encryption

A

process of converting data from a readable format to an encoded format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Hash collision

A

instance when different inputs produce the same hash value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Hash table

A

data structure that’s used to store and reference hash values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Hash function

A

algorithm that produces a code that can’t be decrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Identity and access management (IAM)

A

collection of processes and technologies that helps organizations manage digital identities in their environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Information privacy

A

protection of unauthorized access and distribution of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Multi-factor authentication (MFA)

A

A security measure that requires a user to verify their identity in two or more ways to access a system or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Non-repudiation

A

concept that the authenticity of information can’t be denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

OAuth

A

open-standard authorization protocol that shares designated access between applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Payment Card Industry Data Security Standards (PCI DSS)

A

set of security standards formed by major organizations in the financial industry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Personally identifiable information (PII)

A

Any information used to infer an individual’s identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Principle of least privilege

A

concept of granting only the minimal access and authorization required to complete a task or function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Protected health information (PHI)

A

Information that relates to the past, present, or future physical or mental health or condition of an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Public key infrastructure (PKI)

A

encryption framework that secures the exchange of online information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Rainbow table

A

file of pre-generated hash values and their associated plaintext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Salting

A

additional safeguard that’s used to strengthen hash functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Security assessment

A

check to determine how resilient current security implementations are against treats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Security audit

A

review of an organization’s security controls, policies, and procedures against a set of expectations

50
Q

Security controls

A

safeguards designed to reduce specific security risks

51
Q

Separation of duties

A

principle that users should not be given levels of authorization that would allow them to misuse a system

52
Q

Session

A

sequence of network HTTP basic auth requests and responses associated with the same user

53
Q

Session cookie

A

token that websites use to validate a session and determine how long that session should last

53
Q

Session hijacking

A

event when attackers obtain a legitimate user’s session ID

54
Q

Session ID

A

unique token that identifies a user and their device while accessing a system

55
Q

Single Sign-On (SSO)

A

technology that combines several different logins into one

56
Q

Symmetric encryption

A

use of a single secret key to exchange information

57
Q

user provisioning

A

process of creating and maintaining a user’s digital identity

58
Q

Advanced persistent threat APT

A

instance when a threat actor maintains unauthorized access to a system for an extended period of time

59
Q

Attack surface

A

all the potential vulnerabilities that a threat actor could exploit

60
Q

Attack tree

A

diagram that maps threats to assets

61
Q

Attack vector

A

pathways attackers use to penetrate security defenses

62
Q

Bug bounty

A

Programs that encourage freelance hackers to find and report vulnerabilities

63
Q

Common Vulnerabilities and Exposures CVE list

A

openly accessible dictionary of known vulnerabilities and exposures

64
Q

Common Vulnerability Scoring System CVSS

A

measurement system that scores the severity of a vulnerability

65
Q

CVE Numbering Authority CNA

A

organization that volunteers to analyze and distribute information on eligible CVEs

66
Q

Defense in depth

A

layered approach to vulnerability management that reduces risk

67
Q

Exploit

A

way of taking advantage of a vulnerability

68
Q

Exposure

A

mistake that can be exploited by a threat

69
Q

Hacker

A

any person who uses computers to gain access to computer systems, networks, or data

70
Q

MITRE

A

collection of non-profit research and development centers

71
Q

Security hardening

A

process of strengthening a system to reduce its vulnerability and attack surface

72
Q

Threat actor

A

any person or group who presents a security risk

73
Q

Vulnerability

A

weakness that can be exploited by a threat

74
Q

Vulnerability assessment

A

internal review process of a company’s security systems

75
Q

Vulnerability management

A

process of finding and patching vulnerabilities

76
Q

Vulnerability scanner

A

software that automatically compares existing common vulnerabilities and exposures against the technologies on the network

77
Q

Zero-day

A

an exploit that was previously unknown

78
Q

Angler phishing

A

technique where attackers impersonate customer service reps on social media

79
Q

Advanced persistent threat APT

A

instances when a threat actor maintains unauthorized access to a system for an extended period of time

80
Q

Adware

A

type of legitimate software that is sometimes used to display digital advertisements in applications

81
Q

Attack tree

A

diagram that maps threats to assets

82
Q

Baiting

A

social engineering tactic that tempts people into compromising their security

83
Q

Botnet

A

collection of computers infected by malware that are under the control of a single threat actor, known as the bot-herder

84
Q

Cross-site scripting XSS

A

injection attack that inserts code into a vulnerable website or web application

85
Q

DOM-based XSS attack

A

instance when malicious script exists in the webpage a browser loads

86
Q

Cryptojacking

A

form of malware that installs software to illegally mine cryptocurrencies

87
Q

Dropper

A

type of malware that comes packed with malicious code which is delivered and installed onto a target system

88
Q

Fileless malware

A

malware that does not need to be installed by the user because it uses legitimate programs that are already installed to infect a computer

89
Q

Hacker

A

any person or group who uses computers to gain unauthorized access to data

90
Q

Identity and access management IAM

A

collection of processes and technologies that helps organizations manage digital identities in their environment

91
Q

Injection attack

A

Malicious code inserted into a vulnerable application

92
Q

Input validation

A

programming that validates inputs from users and other programs

93
Q

Intrusion detection system IDS

A

application that monitors system activity and alerts on possible intrusions

94
Q

Loader

A

type of malware that downloads strains of malicious code from an external source and installs them onto a target system

95
Q

Malware

A

software designed to harm devices or networks

96
Q

Process of Attack Simulation and Threat Analysis PASTA

A

popular threat modeling framework that’s used across many industries

97
Q

Phishing

A

use of digital communications to trick people into revealing sensitive data or deploying malicious software

98
Q

Phishing kit

A

collection of software tools needed to launch a phishing campaign

99
Q

prepared statement

A

coding technique that executes SQL statements before passing them onto the database

100
Q

Potentially unwanted application PUA

A

type of unwanted software that is bundled in with legitimate programs which might display ads, cause device slowdown, or install other software

101
Q

Quid pro quo

A

type of baiting used to trick someone into believing that they’ll be rewarded in return for sharing access, info, or money

102
Q

Ransomware

A

type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access

103
Q

Reflected XSS attack

A

instance when malicious script is sent to a server and activated during the server’s response

104
Q

Rootkit

A

malware that provides remote, administrative access to a computer

105
Q

Scareware

A

Malware that employs tactics to frighten users into infecting their device

106
Q

Smishing

A

use of text messages to trick users to obtain sensitive info or to impersonate a known source

107
Q

Social engineering

A

manipulation technique that exploits human error to gain private info, access, or valuables

108
Q

Spear phishing

A

malicious email attack targeting a specific user or group of users, appearing to originate from a trusted source

109
Q

Spyware

A

malware that is used to gather and sell info without consent

110
Q

SQL Structured query language

A

programming language used to create, interact with, and request info from a database

111
Q

SQL injection

A

an attack that executes unexpected queries on a database

112
Q

Stored XSS attack

A

instance when malicious script is injected directly on the server

113
Q

Tailgaiting

A

social engineering tactic in which unauthorized people follow an authorized person into a restricted area

114
Q

Threat

A

any circumstance or event that can negatively impact assets

115
Q

threat actor

A

any person or group who presents a security risk

116
Q

threat modeling

A

process of identifying assets, their vulnerabilities, and how each is exposed to threats

117
Q

Trojan horse

A

malware that looks like a legitimate file or program

118
Q

Vishing

A

exploitation of electronic voice communication to obtain sensitive info or to impersonate a known source

119
Q

Watering hole attack

A

type of attack when a threat actor compromises a website frequently visited by a specific group of users

120
Q

Whaling

A

category of spear phishing attempts that are aimed at high-ranking executives in an organization

121
Q

Web-based exploits

A

malicious code or behavior that’s used to take advantage of coding flaws in a web application

Cyber Security (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions