Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity > Chapter 1 > Flashcards

Chapter 1 Flashcards

1
Q

Threat Mode

A

Structured way of identifying potential threats, vulnerabilities and risks to a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NIST Definition of computer security

A

Measures/Control to ensure:

  • Confidentiality
  • Integrity
  • Availability

of system assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The CIA triad

A

Core principles of computer security:

  • Confidentiality
  • Integrity
  • Availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Confidentiality

A

Sensitive/private data not accessible to unauthorized individuals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrity

A

Guards against unauthorized modification and destruction of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Availability

A

Service is not denied to authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Two concepts some argue should be added to CIA triad

A

Authenticity and Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Authenticity

A

Verifies genuinity and trustworthiness of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Accountability

A

Trace actions back to responsible entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Confidentiality example

A
  • Student grades (high)
  • Student entollment info (moderate)
  • Staff directory (low - public)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Integrity example

A
  • Patient allergy database (high)
  • Website hosting forums (moderate)
  • Anonymous polls (low, known for inaccuracy)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Availability example

A
  • authentication services for finance (high) or Airport surveillance system
  • Public Uni website (moderate)
  • Non-critical applications like phone directories (low, alternatives are available for accessing the information)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Vulnerability

A

Weakness in system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Threat

A

Potential danger that may exploit vulnerability (cause harm to system)

Phishing emails, malware, hacker exploiting software bug

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attack

A

Deliberate action taken to exploit vulnerability

Ransomware, SQL injection, DoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the first challenge of computer security?

A

Complexity: Security requirements may seem straightforward, but fulfilling may not be

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Why is it difficult to anticipate attacks in computer security?

A

Must consider potential threats from different perspectives to identify unexpected weaknesses (Anticipate what hasn’t been done)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Counterintuitive Procedures

A

address non-obvious threats by adding “annoying” complexity (MFA) - threats not immediately obvious from requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Challenge of Deployment decision

A

Deciding where and how to implement security mechanisms (Physically - where and Logically - which layer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Additional considerations in security challenges

A

Security measures often rely on secret information distribution or complex algorithms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Battle of Wits

A

Attackers only have to exploit one vulnerabiltiy, defenders must close all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Perception of benefits challenge in security

A

Users dont see value of security investments (until a breach occurs)

23
Q

Monitoring challenge

A

Security requires ongoing monitoring - difficult in today’s fast-paced environments

24
Q

Why is integration into Design important?

A

Security is often treated as an afterthought, instead of being integrated into design process from beginning

25
Q

Challenge of balancing security and usability

A

adding security measures often reduces usability

26
Q

Why is software critical to system’s security?

A

Large attack surface, often accessible remotely, containing vulnerabilities

27
Q

Examples of software

A

Applications, operating systems, system utilities

28
Q

Communication facilities and network examples

A

LANs and WANs communication links, bridges, routers

29
Q

Categories of vulnerabilities

A

Leakage - info accessed by unauthorized parties
Corruption - System corrupted to operate wrongly
Unavailability - Using system becomes impractical or impossible

Hint (CIA)

30
Q

Threats

A

capable of exploiting vulnerabilities, if carried out, its called an attack

31
Q

Entity performing attack

A

Attacker or threat agent

32
Q

Two types of attacks

A

Active: attempt to later system resources
Passive: Gain info from system

33
Q

Inside attack

A

Authorized users use resources in unapproved way

34
Q

Outside attack

A

from a system outsider

35
Q

Countermeasure

A

Any measure taken to deal with a security attack (Prevent, detect, recover)

36
Q

Why should you be really careful with countermeasures?

A

They can introduce new vulnerabilities or past may remain

37
Q

Unauthorized disclosure (threat consequence)

A

threats to confidentiality

38
Q

4 threat actions that cause unauthorized disclosure

A
  • Exposure (release of sensitive info)
  • Interception (access data while traveling from source to destination)
  • Inference (derive info from patterns in traffic analysis, repeated queries, etc)
  • Intrusion (overcoming access controls to get data)
39
Q

Deception (threat consequence)

A

Threat to system or data integrity

40
Q

3 threat actions that cause deception

A
  • Masquerade
  • Falsification
  • Repudiation (denying responsibility of attack)
41
Q

Disruption (threat consequence)

A

Threat to system availability or integrity

42
Q

3 threat actions that cause disruption

A

Incapacitation - disable a system component
Corruption - modify system functions or data
Obstuction - hinder delivery of system services

43
Q

Usurpation (threat consequence)

A

threat to system integrity

44
Q

2 threat actions that cause usurpation

A

Misappropriation - unauthorized party takes control of system resource
Misuse - force system to perform action detrminental to security

45
Q

Most vulnerable asset in system

A

Hardware

46
Q

Fundamental Security Design Principles (every foolish cat often sleeps lazily purring in every major layer lovingly)

A

Economy of Mechanism:

Keep security measures simple to reduce vulnerabilities and ease testing.
Fail-safe Defaults:

Deny access by default and grant it only when explicitly permitted.
Complete Mediation:

Check access permissions every time, avoiding reliance on cached decisions.
Open Design:

Security mechanisms should be transparent and open to scrutiny.
Separation of Privilege:

Require multiple privilege attributes for access (e.g., multifactor authentication).
Least Privilege:

Give users only the access needed to complete their tasks.
Least Common Mechanism:

Minimize shared resources to reduce unintended consequences.
Psychological Acceptability:

Make security measures user-friendly and non-intrusive.
Isolation:

Separate critical resources from public or less secure systems.
Encapsulation:

Restrict access by wrapping resources in secure boundaries.
Modularity:

Design security features in independent modules for easier updates.
Layering:

Use multiple defense methods so the failure of one doesn’t compromise the system.
Least Astonishment:

Make system behavior predictable and intuitive for users.

47
Q

Attack surface

A

Vulnerabilities that are reachable and exploitable

48
Q

Network attack surfaces example

A

Attack: DoS
Vulnerability: Listening on network, services not prtected by a firewall

49
Q

Software attack surfaces example

A

Web server code with thousands of lines of code (huge attack surface)

50
Q

Human attack surfaces example

A

social engineering

51
Q

Attack tree

A

hierarchical structure used to represent potential methods for exploiting vulnerabilities

52
Q

security policy

A

statement of rules on how a system provides security services

53
Q

4 complementary actions in Security Implementation

A

Prevention (try)
Detection
Response
Recovery

54
Q

Assurance and Evaluation

A

Ensure confidence that security system operates as intended (degree, because absolute is not possible)

Evaluation involves examining security systems against specific criteria

Cybersecurity (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions