Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > CCSK > Flashcards

CCSK Flashcards

1
Q

Core of Big Data, the 3 V’s

A

Volume
Velocity
Variety

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

5 Essentials of Cloud Computing per NIST

A

Broad Network Access, Rapid elasticity, Measured Service, On Demand Self Service, Resource Pooling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

3 A’s of Vulnerability

A

Authentication
Authorization
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Service Models

A

Software as a Service (SaaS)
Platform as a Service (PaaS)
Infrastructure as a Service (IaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Deployment Models

A

Public
Private
Hybrid
Community

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

IaaS

A

provider is responsible for foundational security, while the cloud user is responsible for everything they build on the infrastructure. Unlike PaaS, this places far more responsibility on the client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

PaaS

A

Cloud provider is responsible for the security of the platform, while the consumer is responsible for everything they implement on the platform, including how they configure any offered security features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SaaS

A

cloud provider is responsible for nearly all security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Logical Model

A

Infrastructure
Metastructure
Infostructure
Applistructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cloud Security Process Model

A 
Identify Requirements
Select Provider
Define Architecture
Assess Security Controls
Identify Gaps
Design and Implement Controls 
Manage Changes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Cloud Security Models

A

Conceptual Model/Framework
Control Model/Framework
Reference Architecture
Design Patterns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Design patterns

A

are reusable solutions to problems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Reference architectures

A

templates for implementing cloud security, typically generalized They can be very abstract, bordering on conceptual, or quite detailed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Controls models or frameworks

A

specific cloud security controls or

categories of controls, such as the CSA CCM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Conceptual models or frameworks

A

visualizations and descriptions used to explain cloud security concepts and principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Infrastructure

A

Core components of a computing system: compute, network, and storage foundation that everything else is built on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Metastructure

A

protocols and mechanisms that provide the interface between the infrastructure layer and the other layers. The Glue that holds it all together. Main difference between cloud and traditional computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Infostructure

A

data and information. Content in a database, file storage, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Applistructure

A

applications deployed in the cloud and the underlying application services used to build them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Three main aspects of BC/DR

A
  • Ensuring continuity and recovery. tools and techniques to best architect cloud deployment, keep things running.
  • Preparing for and managing provider outages.
  • Considering options for portability in case you need to migrate providers or platforms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

BC/DR

A

is a shared responsibility takes a risk-based approach must account for the entire logical stack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Enterprise risk management (ERM)

A

includes managing overall risk for the organization, aligned to the organization’s governance and risk tolerance. Enterprise risk management includes all areas of risk, not merely those concerned with technology
Based on Shared Responsibility Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Governance

A

(Cannot be Outsourced)
includes the policy, process, and internal controls that comprise how an organization is run. Everything from the structures and policies to the leadership and other mechanisms for management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Information risk management

A

covers managing the risk to information, including information technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Information security

A

is the tools and practices to manage risk to information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Contracts:

A

primary tool of governance is the contract between a cloud provider and a cloud customer (this is true for public and private cloud). The contract is your only guarantee of any level of service or commitment—assuming there is no breach of contract

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Supplier Assessments:

A

assessments are performed by the potential cloud customer using available information and allowed processes techniques. They combine contractual and manual research with third-party attestations and technical research

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Attestation

A

legal statements often used to communicate the results of an assessment or audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Compliance reporting

A

The documentation on a provider’s internal (i.e. self) and external compliance assessments Can be performed by provider, customer or 3rd party (preferred)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Cloud Security Alliance STAR Registry

A

an assurance program and documentation registry for cloud provider assessments based on the CSA Cloud Controls Matrix and Consensus Assessments Initiative Questionnaire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Risk tolerance

A

amount of risk that the leadership and stakeholders of an organization are willing to accept. It varies based on asset and you shouldn’t make a blanket risk decision about a particular provider; rather, assessments should align with the value and requirements of the assets involved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Cloud Risk Management Tools

A
  • Request or acquire documentation.
  • Review their security program and documentation.
  • Review any legal, regulatory, contractual, and jurisdictional requirements for both the provider and yourself.
  • Evaluate the contracted service in the context of your information assets.
  • Separately evaluate the overall provider, such as finances/stability, reputation, and outsourcers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Residual risk

A

after all your assessments and the controls that you implement yourself there is still residual risk your only options are to transfer it,
accept the risk, or avoid it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Data Protection

A

Laws and regulations vary greatly depending on location of provider, user, servers, data subject, treaties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Cross-border Data Transfers

A

countries prohibit or restrict the transfer of information out of their borders. In most cases, the transfer is permitted only if the country to which the data is transferred offers an “adequate level of protection”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

General Data Protection Regulation (GDPR)

A

directly binding on any corporation that processes the data of EU citizens, and will be adjudicated by the data supervisory authorities or the courts of the member states that have the closest relationship with the individuals or the entities on both sides of the dispute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Applicability

A

processing of personal data in the context of the activities of an establishment of a controller or processor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Processing of personal data is allowed if?

A

(a) the data subject has freely given specific, informed, and unambiguous indication of his/her consent to the processing of his/her personal data or
(b) the processing is authorized by a statutory provision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Accountability Obligations

A

requirements placed companies to keep records of their data processing activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Data Subjects’ Rights

A

subjects have rights to information regarding the processing of their data: the right to object to certain uses of their personal data; to have their data corrected or erased; to be compensated for damages suffered because of unlawful processing; the right to be forgotten; and the right to data portability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Network Information Security Directive

A

framework to enable networks and information systems to resist, at a given level of confidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Scope of Preservation

A

Data that a requesting part is entitled to. It is hosted in the cloud and contains, or is reasonably calculated to lead to, relevant, probative information for the legal issue at hand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Dynamic and Shared Storage

A

cloud environment that programmatically modifies or purges data, or one where the data is shared with people unaware of the need to preserve, preservation can be more difficult.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Access and Bandwidth

A

Clients ability to access it own data.
Determined by Service Level Agreements.
Ability to collect large volumes of data quickly and in a forensically sound manner may be limited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Forensics

A

by-bit imaging of a cloud data source is generally difficult or impossible. For obvious security reasons, providers are reluctant to allow access to their hardware, particularly in a multitenant environment where a client could gain access to other clients’ data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Reasonable Integrity

A

reasonable steps to validate that its collection from its cloud provider is complete and accurate, especially were ordinary business procedures for the request are unavailable and litigation-specific measures are being used to obtain the information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Limits to Accessibility:

A

When Cloud customer cannot access their data due to access rights, privileges and how data is stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Compliance

A

validates awareness of and adherence to corporate obligations (e.g., corporate social responsibility, ethics, applicable laws, regulations, contracts, strategies, and policies)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Audits

A

key tool for proving (or disproving) compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

pass-through audits

A

providers certified for various regulations and industry requirements, such as PCI DSS, SOC1, SOC2, HIPAA, best practices/frameworks like CSA CCM, and global/regional regulations like the EU GDPR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Artifacts

A

The logs, documentation, and other materials needed for audits and compliance; they are the evidence to support
compliance activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Multitenancy data governance

A

data is stored in the public cloud, it’s stored on shared infrastructure with other, untrusted tenants

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Shared security responsibility

A

Data is now more likely to be owned and managed by different teams or even organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Ownership

A

Owner of the data, may not always be clear and depends on laws, contracts, and policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Custodianship

A

Refers to who is managing the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Jurisdictional boundaries and data sovereignty

A

Locations where the data is stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

3 things that are impacted by cloud due to the combination of a third-party provider and jurisdictional changes

A

Compliance, regulations, and privacy policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Destruction and removal of data

A

ties into the technical capabilities of the cloud platform. Can you ensure the destruction and removal of data in accordance with policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Information Classification

A

Tied to compliance, determines how and where data can and cannot be stored. (Personnel files, Medical files etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Information Management Policies

A

tie to classification and the cloud needs to be added if you have them. They should also cover the different SPI tiers, since sending data to a SaaS vendor versus building your own IaaS app is very different

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Data Security Lifecycle

A

Create, Store, Use, Share, Archive, Destroy ↻

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Create

A

Creation is the generation of new digital content, or the alteration/updating/modifying of existing content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Store

A

Storing is the act committing the digital data to some sort of storage repository and typically occurs nearly simultaneously with creation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Use

A

Data is viewed, processed, or otherwise used in some sort of activity, not including modification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Share

A

Information is made accessible to others, such as between users, to customers, and to partners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Archive

A

Data leaves active use and enters long-term storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Destroy

A

Data is permanently destroyed using physical or digital means (e.g., cryptoshredding)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

3 Function with Data

A

Read: ad the data, including creating, copying, file transfers, dissemination, and other exchanges
Process: transaction on the data; update it, use it
Store. Hold the data (in a file, database, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

management plane

A

is the single most significant security difference between traditional infrastructure and cloud computing
• The cloud provider is responsible for ensuring the management plane is secure and necessary security features are exposed to the cloud user, such as granular entitlements to control what someone can do even if they have management plane access.
• The cloud user is responsible for properly configuring their use of the management plane, as well as for securing and managing their credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Architect for Failure

A

Do not rely on traditional strategies (lift and shift) when migrating to the cloud. They will be less resilient. Leverage new cross platform and isolation technologies to improve failover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Ways to access the Management Plane

A

APIs and web consoles are the way the management plane is delivered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Software Development Kits (SDKs) and Command Line Interfaces (CLIs)

A

Tools provided by the cloud provider to make integration easier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Identity and Access Management (IAM)

A

identification, authentication, and authorizations. How you determine who can do what within your cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

authentication mechanisms in REST

A

HTTP request signing and OAuth are the most common; both leverage cryptographic techniques to validate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Protecting from attacks against the management plane’s components itself, such as the web and API servers. It includes both lower-level network defenses as well as higher-level defenses against application attacks

A

Perimeter Security

76
Q

Customer authentication

A

Providing secure mechanisms for customers to authenticate to the management plane should support MFA as an option or requirement

77
Q

Internal authentication and credential passing

A

mechanisms your own employees use to connect with the non-customer-facing portions of the management plane

78
Q

Authorization and entitlements

A

Right and access given to customer and administrators.

79
Q

Logging, monitoring, and alerting

A

Are essential for effective security and compliance Alerting of unusual events is an important security control to ensure that monitoring is actionable

80
Q

Chaos Engineering

A

used to help build resilient cloud deployments. Since everything cloud is API-based, Chaos Engineering uses tools to selectively degrade portions of the cloud to continuously test business continuity

81
Q

two macro layers to infrastructure

A

Fundamental resources and abstract/virtual layer

82
Q

Cloud Network Types

A

service network for communications between virtual machines and the Internet
&
storage network to connect virtual storage to virtual machine
&
management network for management and API traffic

83
Q

Software Defined Networking (SDN):

A

complete abstraction layer on top of networking hardware, SDNs decouple the network control plane from the data plane

84
Q

Challenges of Virtual Appliances

A

Bottlenecks, resource consumption, auto-scaling, geographical location, resiliency

85
Q

SDN Security Benefits

A

Isolation is easier, firewalls with more flexible parameters and more granular

86
Q

Microsegmentation

A

leverages virtual network topologies to run more, smaller, and more isolated networks without incurring additional hardware costs that historically make such models prohibitive

87
Q

3 Parts of Software Defined Perimeter (SDP)

A

SDP controller for authenticating and authorizing
SDP clients and configuring the connections to
SDP gateways for terminating

88
Q

Bastion

A

Hybrid cloud architecture to allow connections to multiple cloud networks to data centers using a single hybrid connection

89
Q

Containers

A

code execution environments that run within an operating system only has access to the processes and capabilities defined in the container configuration

90
Q

Platform-based workloads

A

Stored procedure running inside a multitenant database, or a machine-learning job running on a machine-learning Platform as a Service

91
Q

Serverless computing

A

any situation were the cloud user doesn’t manage any of the underlying hardware or virtual machines, and just accesses exposed functions

92
Q

Immutable workloads Benefits

A

No longer patching running systems
You can, and should, disable remote logins to running workloads
faster to roll out updated versions
easier to disable services and whitelist applications/processes
security testing can be managed during image creation, reducing the need for vulnerability assessment

93
Q

Immutable requirements

A

Constant image creation
Security testing built into image creation
Image config needs to be able to disable logins
Increased complexity to manage

94
Q

Challenges to Vulnerability Assessment

A

Cloud owner will typically require notification of assessments and place limits on the nature of assessments
Default deny networks further limit the potential effectiveness of an automated network Assessment
Assessments can be run during the image creation process for immutable workloads
Penetration testing is less affected since it still uses the same scope as an attacker

95
Q

Cloud Provider Compute Virtualization responsibilities

A

Ensure isolation

Secure underlying infrastructure and virtualization technology

96
Q

Cloud User Compute Virtualization responsibilities

A

Security settings, such as identity management, to the virtual resources
Monitoring and logging
Image asset management
Use of dedicated hosting, if available

(Everything they build on top of the providers network )

97
Q

Cloud Overlay Networks

A

Special kind of WAN virtualization technology for created networks that span multiple “base” networks

98
Q

2 main types of Storage virtualization

A

Storage Area Network (SAN) and Network-Attached Storage (NAS)

99
Q

3 components of a Container

A

Execution environment
Orchestration and scheduling
Repository for execution

100
Q

Incident Response Lifecycle

A

Preparation
Detection & Analysis
Containment, Eradication, Recovery
Post-Mortem

101
Q

Preparation:

A

Establishing an incident response capability so that the organization is ready to
respond to incidents.
• Process to handle the incidents.
• Handler communications and facilities.
• Incident analysis hardware and software.
• Internal documentation (port lists, asset lists, network diagrams, current baselines of
network traffic).
• Identifying training.
• Evaluating infrastructure by proactive scanning and network monitoring, vulnerability
assessments, and performing risk assessments.
• Subscribing to third-party threat intelligence services.

102
Q

Detection and Analysis

A
  • Alerts, indicators of compromise, baseline and anomaly detection
  • Validate alerts (reducing false positives) and escalation.
  • Estimate the scope of the incident.
  • Assign an Incident Manager who will coordinate further actions.
  • Designate a spokes person to communicate to senior management.
  • Build a timeline of the attack.
  • Determine the extent of the potential data loss.
  • Notification and coordination activities.
103
Q

Containment, Eradication, Recovery

A

• Containment: Taking systems offline. Considerations for data loss versus service
availability. Ensuring systems don’t destroy themselves upon detection.
• Eradication and Recovery: Clean up compromised devices and restore systems to normaloperation. Confirm systems are functioning properly. Deploy controls to prevent similar incidents.
• Documenting the incident and gathering evidence (chain of custody).

104
Q

Post Mortem

A

What could have been done better? Could the attack have been detected sooner? What
additional data would have been helpful to isolate the attack faster? Does the IR process
need to change? If so, how?

105
Q

Cloud jump kit

A

tools needed to investigate in a remote location

106
Q

Forensics and investigative support

A

Snapshotting the storage of the virtual machine.
Capturing any metadata at the time of alert
If your provider supports it, “pausing” the virtual machine, which will save the volatile memory state.

107
Q

Service Level Agreement (SLA)

A

Contract describing the level of support users will get from providers incase of an incident

108
Q

How often should IR Testing be done?

A

will be conducted at least annually or whenever there are significant changes to the application architecture

109
Q

Application Sec Opportunities

A 
Higher baseline security.
Responsiveness
Isolated environments
Independent virtual machines
Elasticity
DevOps
Unified Interface
110
Q

Application Sec Challenges

A

Limited detailed visibility
Increased application scope.
Changing threat models
Reduced transparency

111
Q

Secure Software Development Lifecycle (SSDLC):

A

series of security activities during all phases of application development, deployment, and operations

112
Q

Five main phases in secure application design and development

A 
Training
Define
Design
Develop
Test
113
Q

Benefits of DevOps and Continuous Integration/Continuous Deployment (CI/CD)

A 
Standardization:
Automated testing:
Immutable: CI/CD pipelines
Improved auditing and change management:
SecDevOps/DevSecOps and Rugged DevOps:
114
Q

SSDLC Model

A

Secure Design and Development
Secure Deployment
Secure Operations

115
Q

Training

A
  • Secure Coding Practices
  • Writing security tests
  • Provider/Platform Technical Training
116
Q

Define

A

When the cloud user determines the approved architectures or features/tools for the provider, security standards, and other requirements

117
Q

Design

A

Threat modeling

Secure design

118
Q

Develop

A

Code review
Unit testing
Static Analysis
Dynamic Analysis

119
Q

Test

A
  • Vulnerability Assessment
  • Dynamic Analysis
  • Functional tests
  • QA
120
Q

Secure Deployment

A

security and testing activities when moving code from an isolated
development environment into production such as
Code Review
Unit, regression, and functional testing
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)

121
Q

How Cloud Impacts Application Design and Architectures

A

Segregation by default
Immutable infrastructure
Increased use of micro-services
PaaS and “serverless” architectures

122
Q

Event driven security:

A

Management plane detects various activities—such as a file being uploaded to a designated object storage location or a configuration change to the network or identity management—which can in turn trigger code execution through a notification message, or via serverless hosted code

123
Q

Data security Buckets

A

Controlling what goes in
Protecting and Managing
Enforcing information lifecycle management security

124
Q

Data Storage types

A

Object: storage is like a file system
Volume storage: This is essentially a virtual hard drive
Database: Like any other database
Application/platform: Examples of these would be a content delivery network (CDN), files stored in SaaS, caching, and other novel options

125
Q

Data dispersion aka data fragmentation of bit splitting

A

redundant, durable storage mechanisms takes chunks of data, breaks them up, and then stores multiple copies on different physical storage to provide high durability

126
Q

Cloud Access and Security Brokers (CASB) aka Cloud Security Gateways

A

Used to discover internal use of cloud services using various mechanisms such as network monitoring, integrating with an existing network gateway or monitoring tool, or even by monitoring DNS queries

127
Q

URL filtering

A

Tool to monitor network traffic, gateway may help you understand which cloud services your users are using

128
Q

Data Loss Prevention (DLP)

A

tool may also help detect data migrations to cloud services

129
Q

Cloud Data Access Controls 3 layers

A

Management plane
Public and internal sharing controls
Application-level controls

130
Q

Encryption

A

Encryption

protects data by applying a mathematical algorithm that “scrambles” the data, which then can only be recovered by running it through an unscrambling (decryption) process with a corresponding key

131
Q

Tokenization

A

takes the data and replaces it with a random value. often used when the format of the data is important

132
Q

Instance-managed encryption

A

encryption engine runs within the instance, and the key is stored in the volume but protected by a passphrase
or keypair

133
Q

Externally managed encryption

A

Encryption engine runs in the instance, but the keys are managed externally and issued to the instance on request

134
Q

Key management options

A

HMS/Appliance
Virtual Appliance
Cloud Provider
Hybrid

135
Q

HSM/appliance

A

Traditional hardware security module needs to be on-premises, and deliver the keys to the cloud over a dedicated connection

136
Q

Virtual appliance/software

A

Software-based key manager in the cloud

137
Q

Cloud provider Encryption

A

Key management service offered by the cloud provider understand the security model and SLAs to understand if
your key could be exposed

138
Q

Hybrid Encryption

A

combination, such as using a HSM as the root of trust for keys but then delivering application-specific keys to a virtual appliance

139
Q

Digital Rights Management (DRM)/Enterprise Rights Management (ERM)

A

are based on encryption and existing tools may break cloud capabilities especially in SaaS

140
Q

Full DRM

A

Full digital rights management using an existing tool

141
Q

Provider-based control:

A

cloud platform may be able to enforce controls very similar to full DRM by using native capabilities

142
Q

Data Masking and Test Data Generation

A

These are techniques to protect data used in development and test environments, or to limit real-time
access to data in applications

143
Q

Test data generation

A

creation of a database with non-sensitive test data based on a “real” database

144
Q

Dynamic masking

A

rewrites data on the fly, typically using a proxy mechanism, to mask all or part of data delivered to a user

145
Q

Managing data location/residency

A

Ability to disable unneeded locations and protect the data even it it changes locations

146
Q

Identity:

A

the unique expression of an entity within a given namespace. An entity can have
multiple digital identities

147
Q

Entity

A

the person or “thing” that will have an identity. It could be an individual, a system, a device, or application code.

148
Q

Identifier

A

how an identity can be asserted. For digital identities this is often a cryptological token

149
Q

Attributes:

A

facets of an identity

150
Q

Persona:

A

the expression of an identity with attributes that indicates context

151
Q

Role

A

identities can have multiple roles which indicate context

152
Q

Authentication

A

the process of confirming an identity (Username and password)

153
Q

Multifactor Authentication (MFA):

A

use of multiple factors in authentication. Common options include one-time passwords generated by a physical or virtual device/token (OTP)

154
Q

Access control

A

restricting access to a resource

155
Q

Authorization:

A

allowing an identity access to something

156
Q

Entitlement:

A

mapping an identity (including roles, personas, and attributes) to an authorization

157
Q

Federated Identity Management

A

the process of asserting an identity across different systems (Single Sign on)

158
Q

Authoritative source

A

the “root” source of an identity, such as the directory server that manages employee identities

159
Q

Identity Provider

A

the source of the identity in federation

160
Q

Relying Party

A

the system that relies on an identity assertion from an identity provider

161
Q

IAM Standards

A 
SAML
OAuth
OpenID
XACML
SCIM
162
Q

Security Assertion Markup Language (SAML)

A

OASIS standard for federated identity management that supports both authentication and authorization. It uses XML to make assertions between an identity provider and a relying party

163
Q

OAuth

A

is an IETF standard for authorization that is very widely used for web services as it was designed for HTTP

164
Q

OpenID

A

is a standard for federated authentication that is very widely supported for web
services. It is based on HTTP with URLs

165
Q

eXtensible Access Control Markup Language (XACML)

A

is a standard for defining attribute-based access controls

166
Q

System for Cross-domain Identity Management (SCIM)

A

is a standard for exchanging identity information between domains

167
Q

Identity Broker Models

A

Hub and Spoke

Free Form

168
Q

Free-Form

A

internal identity providers/sources (often directory servers) connect directly to cloud providers

169
Q

Hub and spoke:

A

internal identity providers/sources communicate with a central broker or repository that then serves as the identity provider for federation to cloud providers

170
Q

Identity brokers

A

handle federating between identity providers and relying parties

171
Q

Security as a Service (SecaaS)

A

security products or services that are delivered as a cloud service meet the essential NIST characteristics

172
Q

SecaaS Benefits

A 
Cloud-computing benefits
Staffing and expertise.
Intelligence-sharing.
Deployment flexibility.
Insulation of clients.
Scaling and cost
173
Q

SecaaS Concerns

A 
Lack of visibility.
Regulation differences
Handling of regulated data
Data leakage
Changing providers
Migration to SecaaS.
174
Q

Intrusion Detection/Prevention (IDS/IPS)

A

monitoring behavior patterns using rule-based, heuristic, or behavioral models to detect anomalies in activity which might present risks to the enterprise

175
Q

Security Information & Event Management (SIEM)

A

Collecting (via push or pull mechanisms) log and event data from virtual and real networks, applications, and systems

176
Q

Big data

A

collection of technologies for working with extremely large datasets that traditional data-processing tools are unable to manage

177
Q

Distributed data collection:

A

Mechanisms to ingest large volumes of data, often of a streaming nature

178
Q

Distributed storage

A

ability to store the large data sets in distributed file systems

179
Q

Distributed processing

A

Tools capable of distributing processing jobs for the effective analysis of data sets so massive and rapidly changing that single origin processing can’t effectively handle them

180
Q

Internet of Things (IoT)

A

Blanket term for non-traditional computing devices used in the physical world that utilize Internet connectivity

181
Q

ENISA Security Benefits

A 
SECURITY AND THE BENEFITS OF SCALE
SECURITY AS A MARKET DIFFERENTIATOR
STANDARDISED INTERFACES FOR MANAGED
RAPID, SMART SCALING OF RESOURCES
AUDIT AND EVIDENCE-GATHERING
MORE TIMELY, EFFECTIVE AND EFFICIENT UPDATES AND DEFAULTS
BENEFITS OF RESOURCE CONCENTRATION
182
Q

ENISA Risks

A 
LOSS OF GOVERNANCE:
LOCK-IN:
ISOLATION FAILURE
COMPLIANCE RISKS
MANAGEMENT INTERFACE COMPROMISE
DATA PROTECTION
INSECURE OR INCOMPLETE DATA DELETION
MALICIOUS INSIDER
183
Q

CAIQ

A

is a standard template for cloud providers to document their security and compliance controls.

184
Q

Cloud Controls Matrix (CCM)

A

lists cloud security controls and maps them to multiple security and compliance standards

185
Q

True or False

NIS Directive establishes a framework to enable networks and information systems to resist at a given level of confidence actions that compromise the availability authenticity integrity or confidentiality of stored transmitted or processed data or the related services that are offered by or accessible through those networks and information systems

A

TRUE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

186
Q

Granular Entitlements

A

Enable customers to securely manage their own users and administrators. Internally, granular entitlements reduce the impact of administrators’ accounts being compromised or employee abuse

Cyber Security (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions