CH 1 Mastering the basics of Security

Question 1

___, ___, and ___ together form the security triad.

Answer 1

Confidentiality, integrity, and availability

Question 2

____ helps prevent the unauthorized disclosure of data. It uses multiple methods, such as authentication combined with access controls, and cryptography.

Answer 2

Confidentiality

Question 3

______ provides confidentiality by encrypting data. Many different encryption algorithms are available to provide confidentiality.

Answer 3

Cryptography

Question 4

Many elements of security help to enforce confidentiality beyond encryption. These include elements such as ____, ____, ____, and ____ that combine to ensure only authorized personnel can access the data.

Answer 4

authentication
access control methods
physical security
permissions

Question 5

______ ensures that data is only viewable by authorized users. If there is a risk of sensitive data falling into the wrong hands, it should be encrypted to make it unreadable. Any data should be protected with access controls to enforce ____.

Answer 5

Confidentiality

Question 6

_____ provides assurances that data has not been modified, tampered with, or corrupted. Ideally, only authorized users modify data.

Answer 6

Integrity

Question 7

a____ is simply a number created by executing a hashing algorithm against
data such as a file or message.

Answer 7

hash

Question 8

____ provides assurances that data has not modified, tampered with, or corrupted.

Answer 8

Integrity

Question 9

____verifies integrity.

Answer 9

Hashing

Question 10

___is used to verify that data has not been modified, and loss of ____ can occur through
unauthorized or unintended changes. Hashing algorithms such as MD5, HMAC, or SHA1 can calculate hashes to
verify integrity.

Answer 10

Integrity

Question 11

A___ is simply a number created by applying the algorithm to a file or message at different
times. The ___ are compared to each other to verify that integrity has been maintained.

Answer 11

hash

Question 12

____ indicates that data and services are ____ when needed. For some companies, this simply means that the data and services must be ____ between 8 a.m. and 5 p.m., Monday through Friday. For other companies, this means they must be ____ twenty-four hours a day, seven days a week, 365 days a year.

Answer 12

Availability

Question 13

(Availability):
Fault-tolerant disks such as RAID-1 (mirroring) and RAID-5 (striping with parity) allow a system to
continue to operate even if a disk fails.

Answer 13

Disk redundancies.

Question 14

(Availability):
Failover clusters can be implemented that will allow a service to continue to be provided even
if a server fails. In a failover cluster, the service switches from the failed server in a cluster to an operational server in the same cluster. Virtualization (covered in chapter 5) can also increase availability of servers by reducing unplanned downtime.

Answer 14

Server redundancies.

Question 15

(Availability):
If a site can no longer function due to a disaster, such as a fire, flood, hurricane, or earthquake,
the site can move functionality to an alternate site. The alternate site can be a hot site (ready and available 24/7), a cold site (a location where equipment, data, and personnel can be moved to when needed), or a warm site (somewhere in the middle of a hot site and cold site).

Answer 15

Site redundancies.

Question 16

(Availability):
If important data is backed up, it can be restored when it is lost. Data can be lost due to corruption,
deletion, application errors, human error, and even hungry gremlins that can randomly eat your data. If data backups do not exist, then when it is lost, it will be lost forever.

Answer 16

Backups.

Question 17

(Availability):
Uninterruptible power supplies (UPSs) and power generators can provide power to key systems
even if commercial power fails.

Answer 17

Alternate power.

Question 18

(Availability):
Heating, ventilation, and air-conditioning (HVAC) systems improve the availability of systems by
reducing outages from overheating.

Answer 18

Cooling systems.

Question 19

____ ensures that systems are up and operational when needed and often addresses single points of
failure. You can increase availability by adding fault tolerance and redundancies such as RAID, clustering, backups, and generators. HVAC systems also increase availability.

Answer 19

Availability

Question 20

___ is used to prevent entities from denying they took an action. Digitally signed e-mail prevents
individuals from later denying they sent it. An audit log provides ____ since audit log entries include who took an action in addition to what the action was, where the action took place, and when it occurred.

Answer 20

Non-repudiation