Chapter 1: Confidentiality, Integrity, Availability, and Non-repudiation Flashcards
Understand the security Concepts of Information Assurance
What are the three main goals of the CIA Triad?
- Confidentiality
- Integrity
- Availability
{BLANK} ensures that only authorized individuals have access to information and resources.
Confidentiality
What are the major threats to confidentiality?
- Snooping
- Dumpster Diving
- Eavesdropping
- Wiretapping
- Social Engineering
The individual engaging in {BLANK} wanders around your ofiice or other facility and simply looks to see what information they can gather.
Snooping
What can organizations do to protect against snooping?
Enforce a clean desk policy
{BLANK} attacks also look for senstive materials, but the attacker doesn’t walk around the office; instead, they look through the trash, trying to find senstive documents that an employee threw in the garbage or recycling bin.
Dumpster Diving
What can organizations do to protect against dumpster diving?
Using a paper shredder
What are the two types of eavesdropping?
- Physical
- Electronic
In a physical eavesdropping attack, the attacker simply positions themselves where they can overhear conversations, such as in a cafeteria or hallway, and then listens for sensitive information.
How can an organization protect against this type of attack?
By putting rules in place limiting where sensitive conversations may take place.
Electronic eavesdropping attacks are also known as wiretapping. They occur when an attacker gains access ro a network and monitors the data being sent elctronically within an office.
What can an organization do to protect against this type of attack?
They can use encryption to protect information being sent over the network.
In a {BLANK} attack, the attacker uses psychological tricks to persuade an employee to give them sensitive information or access to internal systems.
Social Engineering
What is the best defense against social engineering?
The best defense against this attack is educating users to recognize the dangers of social engineering and empower them to intervene when they suspect an attack i staking place.
{BLANK} means there aren’t any unauthorized changes to information.
Integrity
What are the major threats to integrity?
- Unauthorized modification of information
- Impersonation attacks
- Man-in-the-middle (MitM) attacks
- Replay attacks
The {BLANK} occurs when an attacker gains access to a system and makes changes that violate a security policy.
Unauthorized Modification of Information
Whats is the best way to protect against unathorized modification of information?
Following the priciple of least privilege.
Organizations should carefully consider the permissions that each employee needs to perform their job and then limit employees to the smallest set of permissions possible.
In an {BLANK} attack, the attacker pretends to be someone other than who they actually are.
The best defense these attacks is strongt user education.
Impersonation
Sometime impersonation attacks are electronic. In a {BLANK}, the attacker intercepts network traffic as a user is logging into a system and pretends to be that system. They then sit in the middle of the communication, relaying information between the user and the system while they monitor everything that is occuring.
Man-in-the-middle (MitM) attack
In a {BLANK}, the attacker doesn’t get in the middle of the communication but finds a way to observe a legitimate user logging into a system. They then capture the information used to log in to the system and later replay it on the network to gain access.
Relay Attack
What is the best defense against replay and MitM attacks?
The use of encryption to protect communications.
{BLANK} controls ensure that information and systems remain available to authorized users when needed. They protect against disruptions to normal system operation or data availability.
Availability
What are the major threats to availability?
- Denial-of-service attacks
- Power outages
- Hardware Failures
- Destruction of Equipment
- Service Outages
{BLANK} occur when a malicious individual bombards a system with an overwhelming amount of network traffic.
Denial-of-Service (DoS) attack
How can an organization protect its systems against a DoS attack?
By using firewalls that block illegitimate request and by partnering with your Internet service provider to block DoS attacks before the reach your network.
What can an organization do to protect against power outages?
By having redundant power sources and backup generatiors that supply power to your system when commerical power is not available.
What can an organization do to protect against hardware failures?
By building a system that has built-in redundancy so that if one component fails, another is ready to pick up the slack.
What can an organization do to protect destruction of equipment?
They can protect against small-scale destruction with redundant systems and for large-scale disasters, they can have backup data centers in remote locations or in a cloud that can keep running when your primary data center is disrupted.
What can an organization do to protect against service outages?
By building systems that are resilient in the face of errors and hardware failures.
{BLANK} is a security goal that prevents someone from falsely denying that something is true.
Non-repudiation
The {BLANK} references the three main goals of information security: confidentiality, intergrity, and availability.
CIA Triad
{BLANK} protects senstive information from unauthorized access.
Confidentiality
{BLANK} protects information and systems from unauthorized modification.
Integrity
{BLANK} ensures that authorized users have access to information when they need it.
Availability
{BLANK} uses technical measures to ensure that a user is not able to later deny they took some action.
Non-repudiation
Which one of the following security risks would most likely be considered an availability issue?
A. Replay attack
B. Power outage
C. Social enineering
D. Snooping
Power outage
What are the three major obectives of sysbersecurity programs?
A. Confidentialy, integrity, and availability
B. Confidentialy, integrity, and authorization
C. Confidentialy, infrastructure, and availability
D. Communications, infrastructure, and authorization
Confidentialy, integrity, and availability
