Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Work > chap 4 - Security architecture and engineering > Flashcards

chap 4 - Security architecture and engineering Flashcards

1
Q

Security engineering : what are the technical processes

A
  1. business & mission analysis process -> the scope
  2. Stakeholder need & requirement definition process -> security requirements
  3. system requirements definition process -> translate sec requirements to system requirements
  4. Architecture definition process -> security view of system architecture
  5. design definition process -> security-related data and information about system
  6. system analysis process -> essential data & info for tech understanding of the security aspects
  7. implementation process
  8. integration process
    verification process
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

technical management process

A
  1. project planning
  2. project assessment & control
  3. decision mgmt
  4. risk mgmt
  5. configuration mgmt
  6. information mgmt
  7. measurement
  8. quality assurance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are the enabling process

A
  1. lifecycle model mgmt
  2. infrastructure mgmt
  3. portfolio mgmt
  4. human resources mgmt
  5. quality mgmt
  6. knowledge mgmt
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what are the agreement process

A
  1. acquisition
  2. supply
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what are the 4 key security models (architecture)

A
  1. state machine model
  2. information flow model
  3. non-interference model
  4. ring model
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is the security ring model

A

Ring 0 -> OS & security kernel
Ring 1 -> device driver
Ring 2 -> system utilities -> admin
Ring 3 -> Applications -> users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security architecture for establish a secure system

A
  1. privileged mode instructions
  2. processor states
  3. memory mgmt
  4. abstraction layers
  5. data & code space isolation & code & data segregation
  6. file system attribute
  7. security kernel
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what are the key extensions to basic security architecture

A
  1. access control
  2. virtual machine
  3. sandbox environment
  4. cryptographic systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is the fundamental building block of info system architecture

A

Service model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what are the types of service models (systems)

A
  1. client based system
  2. server based system
  3. Database system
  4. Industrial control system (ICS)
  5. embedded systems
  6. Internet of things IoT)
  7. distributed systems
  8. Virtualized systems
  9. cloud based system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

five essential characteristics of cloud computing

A
  1. on-demand self-service
  2. broad network access
  3. resource pooling
  4. rapid elasticity
  5. measured services
    (6. multi-tenancy)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what are the main cloud services models

A
  1. software as a service (SaaS)
  2. Platform as a Service (PaaS)
  3. Infrastructure as a Service (IaaS)
  4. Network as a Service (NaaS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what are the cloud deployments models

A
  1. private cloud
  2. community cloud
  3. public cloud
  4. hybrid cloud
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what are cloud vulnerabilities & mitigations

A

vulnerabilities:
- exposure to external communication & access
- misconfiguration
- becoming outdated

mitigation:
- stron SLA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are microservices vulnerabilities & mitigations

A

vulnerabilities:
- authorization
- quality of service
- denial of service

mitigation:
- IAM
- containers
- API gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

containerization vulnerabilities & mitigations

A

vulnerability
- insecure image
- excessive privilege
- unrestricted comms
- rogue malicious process
- improper isolation

mitigation
- image mgmt
- immutable infra
- granular sec
- micro segmentation
- proper config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Serverless architecture vulnerabilities & mitigations

A

vulnerability:
- malicious injection into function
- insecure conf.
- cross execution’s data persistency

mitigation
- train staff for conf
- secure coding practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

High performance computing sys vulnerabilities & mitigations

A

vulnerabilities:
- latency constraints
- improper workload

mitigation
- proper architecture design
- monitoring & log practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

edge & Fog computing vulnerabilities & mitigations

A

vulnerability
- network compromise
- increase attack surface

mitigation
- network monitoring
- incident response
- asset inventory
accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

industrial control system vulnerabilities & mitigations

A

vulnerabilities:
- limited functions
- limited protection
- long service life
- misconf & misuse
- susceptible DoS
- attack have physical effect
- remote/unattended locations

mitigation
- isolated network infra
- access control & monitoring
- high segmentation & microsegmentation
- protect comms chanels
- configuration controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

type of industrial control systems

A
  1. supervisory control & data acquisition (SCADA)
  2. Distributed control system (DCSs)
  3. Programmable logical controllers (PLCs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

embedded system vulnerabilities & mitigations

A

vulnerabilities
- programming errors
- web-based vulnerability
- weak access control
- poor crypto
- reverse engineering
- malware
- eavesdropping

mitigations
- risk assessment
- patching & updating
- secure coding technique
- implementing 3rd party risk mgmt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

IoT vulnerabilities & mitigations

A

vulnerabilities
- DoS
- Device security
- crypto security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

distributed system vulnerabilities & mitigations

A

vulnerabilities
- lack of monitoring
- lack of access control

mitigation
- IAM
- IDS/IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

virtualized system vulnerabilities & mitigations

A

vulnerabilities
- image mgmt (VM sprawl)
- VW escape
- underlying hardware weakness
- knowledge gap

mitigation
- IAM
- change mgmt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

why is cryptography critical to security

A

confidentiality
integrity
authenticity
availability
non-repudiation
access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what is “work factor” in cryptography

A

the cost of breaking the code must be higher than the reward

28
Q

key challenge of cryptography

A

key managment

29
Q

type of cryptography

A
  1. symmetric
  2. asymmetric
30
Q

what are the cryptosystem components (steps)

A
  1. plaintext
  2. encryption algorithm –> using an encryption Key
  3. ciphertext
31
Q

what are the critical properties of Key strengh

A
  1. No collisions
  2. difficult to invert
  3. large key space -> minimal or no key space clumping
  4. deterministic decrytion
32
Q

what is the difference between block VS. Stream processing

A

Stream mode encryption: encrypt one symbol of the plaintext input at a time

block mode encryption: process fixed length groups of symbols (block size measure in 8 bites)

33
Q

Asymmetric encryption

A

uses 2 keys (public & private)

advantage: digital signature & no key exchange

issue: slower & longer Key

type of encryption:
- RSA 2048
- Elgamal
- ECC (ecliptic)
- Diffie helmann

34
Q

Symmetric encryption

A

uses a single key

advantage: faster & shorter key

issue: key exchange

type of encryption:
- DES (56) -> not secured anymore
- 3DES (168)
- AES (128/ 192 / 256)
- Rijindal
- RC 5 / RC 6 -> RC 4 is stream encryption
- Blowfish
- twofis
- IDEA
- CAST
- SAFER

35
Q

Hashing

A

it is a 1 way math process
- variable inputs
- fixed length outputs
- unique inputs generate a unique output

advantage: no key required

use case: concealment and integrity (check)

types of hashing:
- MD-5 (128) -> 32 character
- SHA1 (160) -> 40 character
- SHA2 (224/512)
- SHA3 (512)
- HAVAL
- RIPEMD 160

36
Q

what are the key requirements of Hashing

A
  1. uniformly distributed
  2. collision resistant
  3. impossible to invert
  4. computed on full message
  5. deterministic
37
Q

what is a distributed ledger (blockchain)

A

decentralized register of transactions that is protected by and graph-linked together with cryptographic controls –> rely on asymmetric crypto

38
Q

what is the Kerckoff’s principle about encryption

A

if everything is known except the encryption key, then the cipher must be safe

39
Q

on which mathematical concept is RSA algorithm build on

A

prime number factoring

40
Q

what is a public Key infrastructure (PKI)

A

system, software, protocol required to use, manage & control public Key cryptography

41
Q

what type of encryption does PKI use

A

Diffie-Hellman-Merkle key negotiation algorithm

42
Q

what is a message digest

A

hash representation of a plaintext used to verify integrity of the message

43
Q

what is the Key management lifecycle

A
  1. generating
  2. recording
  3. transcribing
  4. distributing
  5. installing
  6. storing
  7. changing
  8. using
44
Q

what is Key recovery

A

a backup mechanism that ensures an organization can have continued access to its own encrypted information if the key are lost/damaged

45
Q

key methods of key recovery

A
  • Key escrow
  • key registration
  • digital wallet
46
Q

main issues regarding key creation

A
  1. random & pseudorandom number generator
  2. symmetric key generation, storage, distribution and management
  3. asymmetric key length
47
Q

what can be a solution to symmetric key distribution

A

Key wrapping and key encrypting keys (KEKs)

use a special purpose long-term use Key called Key encrypting Keys (KEK) to distribute symmetrics keys

KEKs is currently used in TLS / PGP / S/MIME sessions

48
Q

what are the methods to protect stored Keys

A
  1. trusted, tamperproof hardware security module (HSM)
  2. passphrase-protected smart cards
  3. key wrapping using a long term KEKs
  4. splitting cipher keys and storing in physically seperated storage location
  5. protecting key using strong password, passphrase and key expiry & related policies
49
Q

what are main cihertext-based attacks

A
  • brute force
  • known plaintext
  • chosen plaintext
50
Q

type of attack on encryption (algorithm attack)

A
  • brute force
  • pass the hash attack -> capture authentic hash and re-use it
  • man-in-the-middle attack (MITM)
  • side channel attack -> use time, frequency
  • fault analysis –> make error and check result for clue
  • probing -> analyze the circuitry surrounding the crypto module
  • replay -> resent of repeated files to host
  • rainbow table -> look-up table of sorted hash outputs (good for password)
  • algebraic -> math structure
  • frequency analysis
  • birthday attack –> percentage of collision
  • factoring attack –> RSA
  • dictionary attack-> dictionary of words
  • attacking the random number -> hybrid
  • fault injection
  • temporary files –> find in RAM, SWAP, Hyberfiles.sys
51
Q

what is the best language to support a federated identity management system?

A

Security Assertion Markup Language SAML

52
Q

If a system’s security goal is that no subject can gain access to any object without authorizations what should be implemented?

A

The security kernel implementing the reference monitor concept

53
Q

When a company is considering adopting a biometric systems which is the LEAST important consideration?

A

Technology type.

54
Q

In a SAML 2.0 systems when a user across the internet is attempting to access a web services what happens?

A

The web server uses a federated login system to authenticate the user

55
Q

What type of encryption would be appropriate for HIPAA documents in transit?

A

TLS

56
Q

Which attack helped drive vendors to move away from SSL toward TLS-only by default?

A

POODLE

57
Q

Ed has been asked to send data that his organization classifies as confidential and proprietary via email. What encryption technology would be appropriate to ensure that the contents of the files attached to the email remain confidential as they traverse the Internet?

A

PGP

PGP, or Pretty Good Privacy (or its open-source alternative, GPG) provide strong encryption of files, which can then be sent via email.

58
Q

Harry would like to retrieve a lost encryption key from a database that uses m of n control with m = 4 and n = 8. What is the minimum number of escrow agents required to retrieve the key?

A

4

In an m of n control system, at least m of n possible escrow agents must collaborate to retrieve an encryption key from the escrow database

59
Q

Bob is a security administrator with the federal government and wishes to choose a digital signature approach that is an approved part of the federal Digital Signature Standard under FIPS 186-4. Which one of the following encryption algorithms is not an acceptable choice for use in digital signatures?

A

HAVAL

HAVAL is a hash function, not an encryption algorithm

60
Q

If Alice wishes to send Bob an encrypted message, what key does she use to encrypt the message?

A

Bob’s public key

61
Q

When Bob receives the encrypted message from Alice, what key does he use to decrypt the message?

A

Bob’s private key

62
Q

Alice would also like to digitally sign the message that she sends to Bob. What key should she use to create the digital signature?

A

Alice’s private key

Alice creates the digital signature using her own private key. Then Bob, or any other user, can verify the digital signature using Alice’s public key.

63
Q

James is working with a Department of Defense system that is authorized to simultaneously handle information classified at the Secret and Top Secret levels. What type of system is he using?

A

Multistate

64
Q

Which one of the following terms accurately describes the Caesar cipher?

A

Shift cipher

65
Q

Sherry conducted an inventory of the cryptographic technologies in use within her organization and found the following algorithms and protocols in use. Which one of these technologies should she replace because it is no longer considered secure?

A

MD5

The MD5 hash algorithm has known collisions and, as of 2005, is no longer considered secure for use in modern environments.

66
Q

What standard governs the creation and validation of digital certificates for use in a public key infrastructure?

A

X.509

67
Q

In a Software as a Service cloud computing environment, who is normally responsible for ensuring that appropriate firewall controls are in place?

A

Vendor

Work (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions