Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity > Chapter 1 > Flashcards

Chapter 1 Flashcards

1
Q

What are the three fundamental questions in cybersecurity?

A
  1. What assets do we need to protect?
  2. How are those assets threatened?
  3. What can we do to counter those threats?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Threat Model

A

Structured way of identifying potential threats, vulnerabilities and risks to a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Privacy

A

Individuals control what infromation rtelated to them may be collected, stored and who can access it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the NIST definition of computer security?

A

The protection afforded to an automated information system to preserve confidentiality, integrity and availability of its resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the CIA Triad in cybersecurity?

A

Confidentiality: Ensuring information is not disclosed to unauthorized individuals; Ensure privacy
Integrity: Ensuring data/system isn’t modified or destroyed by unauthorized individuals
Availability: Ensuring timely access to data and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the two additional security concepts beyond the CIA Triad?

A

Authenticity: Ensuring genuinity and trustworthiness, ability to verify
Accountability: Tracing actions back to responsible entity

Authenticitity: Confidence in validity of message or message originator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define vulnerability, threat and attack

A

Vulnerability: Weakness in a system (Flaw in design, implementation or management that can be exploited)
Threat: A potential for security violation, causing harm
Attack: Deliberate action to breach security by exploiting vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define Risk

A

Probability of a threat exploiting a vulnerability (Rare - almost certain)
AND
Impact it would have on system (insig. - catostrophic)

Helps determine what to fix first.

Expectation of loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

6 Computer Security Challenges

Computers n’ security, I miss u

A
  1. Procedures often counterintuitive
  2. Not as simple as appears (multiple algorithms or protocols)
  3. Attackers only need to find a single weaknesses (developers must find all!)
  4. Good Security is Invisible
  5. Requires constant monitoring
  6. Impediment to efficient and user-friendly operation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the two types of attacks?

A

Passive: Eavesdropping system without altering resources
Active: Attempt to modify or disrupt the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a countermeasure?

A

Action or device that reduces vulnerability, threat or attack by eliminating it, preventing it or minimizng the harm it can cause

** Prevent Detect Recover**

May introduce new vulnerabilties or residuals remain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Security Policy

A

Set of rules and practices that speicfy how a system or org. provides security services

Ex: Strong passwords and their expiration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the 4 major threat consequences? (UDDU)

A
  1. Unauthorized Disclosure: Breaching confidentiality (interception)
  2. Deception: Tampering with integrity (masquerade, falsification)
  3. Disruption: Affecting availability or integrity (incapacitation)
  4. Usurpation: Gaining unauthorized control (misappropriation, misuse)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Unauthorized Disclosures (4)

Threat Consequances

The IEEE discloses stuff! Well switch that around to EIII

A
  1. Exposure (deliberate or error)
  2. Interception (unauthorized access to data)
  3. Inference (traffic analysis to get detailed information)
  4. Intrusion (unauthorized access to sensitive data)

CONFIDENTIALITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Deceptions (3)

Threat Consequances

“Make false reasons!”

A
  1. Masquerade (trojan horse)
  2. Falsification (alter or replace valid data, introduce false data)
  3. Repudiation (I didn’t do it)

INTEGRITY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Disruptions (3)

Threat Consequances

“I can’t operate!”

A
  1. Incapacitation (destroy or damage system hardware) availability
  2. Corruption (unauthorized modification) Integrity
  3. Obstruction (overload system to interfere with communications) availability

AVAILABILITY, INTEGRITY, AVAILABILITY

17
Q

Usurpations (2)

Threat Consequances

mm

A
  1. Misappropriation (enity takes control of system resource)
  2. Misuse (Make system component perform damaging function or service)

Integrity

18
Q

Attack Surface

A

Set of all reachable and exploitable vulnerabilities in a system

Open ports, firewall, APIs, SQL queries, web forms

19
Q

4 main types of Active Attacks

A
  1. Masquerade
  2. Replay
  3. Modification of messages
  4. Denial of Service
20
Q

Passive attack example and category of countermeasure we should emphasize

A

eavesdropping/monitoring of transmissions

prevention, because it is difficult to detect

21
Q

3 Main Attack Surface Categories

A

Network
Software
Human

22
Q

Attack Tree

A

A hierarchical diagram representing possible attack methods, used for analyzing vulnerabilities and improving defenses.

used for attack surface analysis

23
Q

13 Security Design Principles

Eric, focus closely on security, like lions in prairies, even more like leopards

A
  1. Economy of mechanism
  2. Fail-safe default
  3. Complete mediation
  4. Open design
  5. Separation of privileges
  6. Least privilege
  7. Least common mechanism
  8. Isolation
  9. Psychological accapetability
  10. Encapsulation
  11. Modularity
  12. Layering
  13. Least Astonishment
24
Q

Economy of mechanism

Security Design Principles

A

Security mechanisms should be as simple as possible to reduce errors and vulnerabilities.

25
Q

Fail-safe default

Security Design Principles

A

Access desicions should be based off permissions, rather than exclusion

26
Q

Complete mediation

Security Design Principles

A

Every access request must be checked against the access control system without relying on cached decisions

27
Q

Open design

Security Design Principles

A

The design should be open, rather than secret

28
Q

Separation of Privileges

Security Design Principles

A

Multiple priveleges should be required to gain access to a restricted resource (or to complete some tasks)

29
Q

Least privilege

Security Design Principles

A

Every user (or process) should operate with the least set of principles necessary to perform a task

Ex: SysAdmin not surfing web using administrator user.

30
Q

Least common mechanism

Security Design Principles

A

A design should minimize the functions shared by different users/entities

Sharing state among different software programs

31
Q

Isolation

Security Design Principles

A
  • Critical resources should be separated from public access.
  • User files separated from one another
  • Security mechanism isolated (prevent access to them)

Firewalls example?

32
Q

Psychological acceptability

Security Design Principles

A

Security mechanisms should not interfere **unduly **with usability, ensuring user acceptance.

33
Q

Encapsulation principle

Encapsulation

Security Design Principles

A

hiding internal structures/limiting exposure to only the necessary details

similar to object-oriented programming concepts

Simplify the interface exposed to external entities, so they can’t interact with sensitive info

34
Q

Modularity

Security Design Principles

A

Development of security functions as separate, protected modules

Modular Architecture

35
Q

Layering

Security Design Principles

A

use of multiple overlapping protection approaches

multiple firewalls based on different technologies and approaches

36
Q

Least Astonishment

Security Design Principles

A

Program interface should always respond in a way that is least likely to astonish the user

an error window that belong to what running program?

37
Q

What is the scope of computer security?

A
  1. Access to data must be controlled (protection)
  2. Access to computer must be controlled (user authentication)
  3. Data securely transmitted through networks (network security)
  4. Sensitive files must be secured (file security

Cybersecurity (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions