Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security Plus > Chapter 1 > Flashcards

Chapter 1 Flashcards

1
Q

CIA/AIC Triad

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SOP

A

Standard Operating Procedure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AAA

A

Authentication, Authorization, and Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Operational category of security controls

A

Security controls operated by PEOPLE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

MFA

A

Multi-Factor Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data plane

A

transmits data in real time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Control plane

A

Manages actions of the data plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Adaptive identity

A

Part of control plane- adapts and makes authentication process stronger if necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Policy-driven access control

A

Part of control plane- combines adaptive identity with established policies to further authenticate end user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Policy enforcement point

A

Part of data plane- end users must pass through the policy enforcement point, which can then allow, monitor, or terminate connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

PEP

A

Policy Enforcement Point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

PDP

A

Policy decision point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Policy decision point

A

Part of control plane- the policy engine and policy administrator come together to make an authentication decision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Policy engine

A

Part of control plane- looks at all requests coming through, and grants, denies, or revokes request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Policy administrator

A

Part of control plane- Can generate access credentials or tokens. Communicates with Policy Enforcement Point (PEP) in data plane to allow or disallow access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Access control vestibule

A

A physical security entry system with two gateways, only one of which is open at any one time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Honeypot

A

A virtual world set up to entice attackers- forces attackers to discern whether they are actual systems or fake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Honeynet

A

A larger deception network with multiple honeypots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Honeyfile

A

Files with fake information or may appear to be important, such as passwords.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

API

A

Application Programming Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Honeytoken

A

A piece of traceable data in a honeynet to track attackers. Could be fake API credentials, browser cookies, or a fake email address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Allow list

A

Nothing runs unless it’s approved. Very restrictive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Deny list

A

Nothing on the “bad list” can be executed. Uses anti-virus, anti-malware. More liberal than an allow list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Dependencies

A

Having to update extra items just so you can execute a different update. Ex: I want to study, but I have to clean my room so I can focus first.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Legacy applications

A

Applications no longer supported by developer - here before you, will be here after you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Version control

A

Keeps detailed documentation of each version of software, allows us to keep a copy to revert back to if necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

PKI

A

Public Key Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Symmetric encryption

A

A single shared key to encrypt and decrypt. Fast to use but not as secure as asymmetric encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Public key

A

Encrypts data in an asymmetric encryption relationship

27
Q

Private key

A

Decrypts data in an asymmetric encryption relationship

28
Q

Key escrow

A

3rd party stores your private keys

29
Q

SSD

A

Type of hard drive that has no moving part, so they are more efficient, run with no noise, emit little heat, and require little power

30
Q

Full-disk/volume level encryption

A

Everything on device is encrypted

31
Q

FDE

A

Full Disk Encryption

32
Q

SSL/TLS

A

Secure Sockets layer / Transport Layer Security - An encryption layer of HTTP that uses public key cryptography to establish a secure connection.

33
Q

Database encryption

A

An encryption method that targets databases and the data they contain, rather than individual files or whole disks.

34
Q

Cryptography

A

the art of protecting information by transforming it into an unreadable format, called cipher text

35
Q

IPSec

A

Internet Protocol Security. Used to encrypt traffic on the wire and can operate in both tunnel mode and transport mode.

36
Q

TPM

A

Trusted Platform Module

37
Q

Trusted Platform Module

A

Hardware device that provides cryptographic/encryption functions for a single device. Stores encryption keys. Not vulnerable to brute force or dictionary attacks.

38
Q

HSM

A

Hardware Security Module

39
Q

Secure enclave

A

CPU extensions that protect data stored in system memory so that an untrusted process cannot read it.

40
Q

CPU

A

Central Processing Unit; the brain of the computer.

41
Q

Obfuscation

A

the action of making information unintelligible or unclear unless you know how to read it; hiding information in plain sight

42
Q

Steganography

A

A type of obfuscation; hiding information within an image

43
Q

Tokenization

A

One-time tokens for phone payments. Replaces sensitive data with a placeholder

44
Q

Data masking

A

Data obfuscation- hides some or most of original data. Think credit card numbers on receipts with asterisks.

45
Q

Hashes

A

Used to store passwords; represents data as a short string of text; a “fingerprint”- can’t recreate a password with a hash or a person with a fingerprint. Can be a digital signature providing non-repudiation, authentication, and integrity.

46
Q

SHA256

A

SHA-256 is one of the strongest hash functions available.

47
Q

Collision

A

When 2 diff input info produce the same hash. MD5 hashing algorithm had this issue.

48
Q

Salt

A

Random data added to password when hashing

49
Q

Key stretching

A

Hashing the hash to stretch and strengthen stored passwords. Can add additional salt and help thwart brute force and rainbow table attacks.

50
Q

Digital Signatures

A

Sender signs with private key and recipients verify with public key. Proves message was not altered (integrity), proves the source of the message (authentication), ensures signature is not fake (non-repudiation).

51
Q

Blockchain

A

A ledger available for anyone to see to keep track of transactions- think Bitcoin, digital voting, and supply chain monitoring. Provides integrity as it throws out unauthorized modified blocks on the chain.

52
Q

Certificate Authority

A

A trusted third party that validates user identities by means of digital certificates.

53
Q

CA

A

Certificate Authority

54
Q

CSR

A

Certificate signing request. A method of requesting a certificate from a CA. Requester sends public key, CA digitally signs with private key.

55
Q

Wildcard certificate

A

A certificate that can be used for any device associated with the same domain name. It starts with an asterisk.

56
Q

CRL

A

Certificate Revocation List

57
Q

Certificate Revocation List

A

A list of all certificates that have been dismissed, stored on the Certificate Authority itself.

58
Q

OCSP

A

Online Certificate Status Protocol

59
Q

Online Certificate Status Protocol

A

Allows a browser to check certificate revocation status without relying on CRL (Certificate Revocation List) stored on the Certificate Authority. OCSP is not an option on outdated browsers.

60
Q

Code signing

A

The process of assigning a certificate to code. The certificate includes a digital signature and validates the code.

61
Q

Threat scope reduction

A

Part of control plane- decreases # of potential access or entry points to system

62
Q

Backout Plan

A

Action that allows a change to be reverted to its previous baseline state

63
Q

Asymmetric encryption

A

2 or more mathematically related keys: a public key and a private key.

64
Q

Transport Encryption

A

The technique of encrypting data that is in transit, usually over a network like the Internet. Think Https or VPN.

65
Q

Hardware Security Module

A

Provides cryptographic/encryption functions for hundreds of devices in a large-scale environment. Securely stores thousands of encryption keys.

66
Q

Root of trust

A

An inherently trusted component of hardware or software that provides trust for an unknown entity/third party

67
Q

Third-Party Certificate Authority

A

If your browser visits a new website, and a trusted CA has digitally signed it, your computer will trust the website. This function is built into your browser.

68
Q

Self-signed certificate

A

A digital certificate that has been signed by the entity that issued it, rather than by a CA.

Security Plus (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions