Chapter 1 Flashcards
What is a threat environment?
A threat environment consists of all the attacks and attackers that a company faces.
What are the three goals of security?
It’s the CIA triad:
Confidentiality - No one else can read your information, either while it’s on a computer, or while it’s traveling across a network. Encryption is an example of this.
Integrity - The attacker cannot change or destroy information, or at the worst, the owner can detect the change or destruction.
Availability - Those that are authorized to use the information are not prevent from doing so. This might include failsafe servers and things like that.
What is a compromise?
A compromise (also known as an incident or a breach), is basically a successful attack.
What are countermeasures? What types of countermeasures are there?
A countermeasure is a tool that is used to thwart attacks. There are three main kinds of countermeasures: Preventative, detective, and corrective.
What is a preventative countermeasure?
A preventative countermeasure is there to prevent a certain attack from working (like a firewall).
What is a detective countermeasure?
A detective countermeasure detects (duh) that something is wrong. An anti-virus program is this, as well as a corrective.
What is a corrective countermeasure?
A corrective countermeasure is a countermeasure that is deployed in order to actually correct a specific attack.
Why are employees and ex-employees the most dangerous threats?
Employees and ex-employees are dangerous because they often have knowledge of internal systems, have permissions to access systems, often know how to avoid detection, and they’re generally trusted.
Who watches the watchmen, eh?
What sort of things can employees do?
Sabotage - Destruction of hardware, software, or data, or worse, planting of a time bomb or logic bomb on a computer.
Hacking - Accessing things that they don’t have authorization to.
Financial Theft - Theft of assets or money, or the big one, Intellectual Property.
Extortion - Threatening to release information in order to manipulate someone.
Sexual or Racial Harassment of Other Employees - Displaying pornographic material, often via email.
Internet Abuse - Pornography, piracy, excessive personal use.
Carelessness - Loss of computers or media devices that contain sensitive information due to neglect or carelessness.
Contract Workers -
What is hacking?
Hacking is defined as intentionally accessing a computer resource without authorization, or going beyond authorization. Authorization is the key here.
What is separation of duties?
Separation of duties is the principle in which you only give each employee permissions necessary to complete their jobs.
What is malware?
Malware (evil software) is a generic name for… well, “evil software”.
What are some examples of malware?
Viruses - Programs that attach themselves to legitimate programs. When those programs are executed, it causes the “virus” to spread to other executables. Primarily, they’re spread by e-mail.
Worms - Programs that do not attach themselves to other programs. They can spread via “direct-propagation”, allowing them to jump between computers without human intervention on the receiving computer, provided it has a targeted vulnerability. They can spread fast.
Blended Threats - Malware that propagates in multiple ways. Think a blend between virus and worm.
Nonmobile malware - Malware that must be placed on the user’s computer through deception of the user.
Trojan Horse - Remote Access Trojan, allows for remote control of the victim’s PC. It masquerade as a good program, until the victim runs it, at which point the payload is delivered.
What is a payload?
Payload is the term for the piece of code in malware that does the actual damage.
What is spyware?
Spyware is a form of Trojan that gathers information about you and sends it back to someone. It’s subtle. Some only send rather benign information, others do things like logging keys.
What is a rootkit?
A rootkit takes control of the super user account, and uses this authority to hide the malware in a far more effective way.
What is mobile code?
Mobile code is code embedded in a webpage that is executed automatically (Javascript, Active-X, etc).
What is social engineering?
Social engineering is an attempt to trick a user in order to do something that would normally go against security policies. Spam, phishing, hoaxes, that sort of thing.
Who are traditional hackers?
Traditional hackers are people who are motivated to bypass security to get a thrill, validation, or a sense of power. Mostly motivated by reputation among their peers, but their crimes are petty at most. Not really relevant any longer.
What are Reconnaissance probes?
Reconnaissance probes are the first step of a hack, scanning IP addresses and ports, looking for open ports and services are running. These packets, should they be received, will generate a response, signalling an opening.
