Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH > Chapter 1 - Getting Started: Essential Knowledge > Flashcards

Chapter 1 - Getting Started: Essential Knowledge Flashcards

1
Q

hack value

A

The idea a hacker holds about the perceived worth or interest in attacking a target.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

vulnerability

A

Weakness in an information system, system security procedure, internal controls, or implementation that could be exploited or triggered by a thread source.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

zero day attack

A

An attack carried out on a system or application before the vendor becomes aware and before a patch or fix action is available or correct underlying vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

payload

A

the contents of a packet. A system attack requires the attacker to deliver a malicious payload that is acted upon and executed by the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

exploit

A

Software code, a portion of data, or a sequence of commands intended to take advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software or hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Daisy-chaining

A

A method of external testing where by several systems or resources are used together to make an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security Controls

A

Safeguards or counter measures to avoid, counteract, or minimize security risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Security Controls Types

A

Physical (Guards, lights, camera)
Technical (Encryption, Smart Cards, ACLs)
Administrative (Training, Awareness, Policy)
Preventative (Authentication)
Detective (Audits, Alarm Bells, Alerts)
Corrective (Backups)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Business impact analysis (BIA)

A

An organized process to gauge the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

maximum tolerable downtime

A

A measurement of potential cost due to a particular asset being unavailable, used as a means to prioritize the recovery of assets should the worst occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

business continuity plan

A

A set of plans and procedures to follow in the event of a failure or a disaster security related or not to get business services back up and running. BCPs include a disaster recovery plan (DRP) that addresses exactly what to do to recover any lost data or services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

disaster recovery plan

A

A documented set of procedures to recover business infrastructures in the event of a disaster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CIAA

A

securities holy trinity triad; confidentiality, integrity, availability. Also, authenticity (guarantee someone is who they say they are i.e. digital signature)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

National Computer Security Center (NCSC)

A

In 1983, some guys from DoD and NSA worked to create security manuals and steps known as “Rainbow Series”. “Orange Book” held “Trusted Computer System Evaluations Criteria”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Trusted Computer System Evaluation Criteria (TCSEC)

A

Old DoD standard with a goal to set security controls built into a computer system. Lasted until 2005.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Common Criteria for Information Technology Security Evaluation (CC)

A

Been around since 1999, but started in 2005. Provides a way for vendors to follow a set of standard of controls and testing methods resulting in (Evaluation Assurance Level (EAL))

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Target of Evaluation (TOE)

A

Term associated with Common Criteria (CC) .What is being tested.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Security target (ST)

A

Term associated with Common Criteria (CC). The documentation describing the TOE and security requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Protection profile (PP)

A

Term associated with Common Criteria (CC). A set of security requirements specifically for the type of product being tested.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Access Control

A

Restricting access to a resource in some selective manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Mandatory access control (MAC)

A

A method of access control where security policy is controlled by a security administrator. (i.e. users can’t set the access controls.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Discretionary access control (DAC)

A

A method that allows users to set access controls on the resources they own or control. (e.g. Linux users, groups,other read/write/execute permissions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Access Control Policy

A

This identifies the resources that need protection and the rules in place to control access to those resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Information Security Policy

A

This identifies to employees what company systems may be used for, what they cannot be used for, what they cannot be used for, and what the consequences are for breaking the rules. Generally employees are required to sign a copy before accessing resources. Version of this policy are also known as an Acceptable Use Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Information Protection Policy

A

This defines information sensitivity levels and who has access to those levels. It also addresses how data is stored, transmitted, and destroyed.

26
Q

Password Policy

A

This defines everything imaginable about passwords within the organization, including length, complexity, maximum and minimum age, and reuse.

27
Q

E-mail Policy

A

Sometimes also called the E-mail Security Policy, this addresses the proper use of the company e-mail system.

28
Q

Information Audit Policy

A

This defines the framework for auditing security within the organization. When, where, how, how often, and sometimes even who conducts information security audits are described here.

29
Q

promiscuous policy

A

Wide Open

30
Q

permissive policy

A

blocks only things that are dangerous.

31
Q

prudent policy

A

maximum security, but allows some potentially dangerous services because of business needs.

32
Q

paranoid policy

A

locks everything down, not even allowing to open the browser.

33
Q

Standards

A

mandatory rules used to achieve consistency.

34
Q

Baselines

A

provide minimum security level necessary.

35
Q

Guidelines

A

flexible recommended actions users are to take in event there is no standard.

36
Q

Procedures

A

step by step instructions for accomplishing a task or goal.

37
Q

Infowars

A

use of offensive and defensive techniques to create an advantage over your adversary.

38
Q

Tiger Team

A

A group of people gathered together by a business entity working to address a specific problem or goal.

39
Q

HIPAA

A

Health Insurance Portability and Accountability Act

40
Q

Information Assurance

A

(IA) refers to the integrity, availability, confidentiality, and authenticity of information and information systems is protected during usage, processing, storage, and transmission of information.

41
Q

Processes that help achieve IA

A
  1. Developing local policy, processes, and guidance
    2 Designing network and user authentication strategies.
  2. Identify network vulnerabilities and threats.
  3. Identifying problems and resource requirements.
  4. Creating a plan for identified resource requirements.
  5. applying appropriate IA controls
  6. Performing cert and accreditation.
    8 provide Information Assurance training.
42
Q

Advanced Persistent Threats (APT)

A

Focuses on stealing user information without the user being aware.

43
Q

Internet of Things (IoT)

A

Internet for all the small smart devices out there (e.g. toilets, phones, thermostats, etc.)

44
Q

Internet

A

Outside the boundary and uncontrolled. You don’t apply security polices on the Internet.

45
Q

Internet DMZ.

A

Demilitarized Zone controlled buffer network between you and the uncontrolled chaos of the internet.

46
Q

Production Network Zone

A

A very restricted zone that strictly controls direct access from uncontrolled zones. PNZ does not hold users.

47
Q

Intranet Zone

A

A controlled zone that has little-to-no heavy restrictions. This is not to say everything is wide open on the Intranet Zone, but communcations requires fewer strict controls internally.

48
Q

Management Network Zone

A

Usually an area you’d find rife with VLANs and maybe controlled via IPSec and such. This is a highly secured zone with very strict policies.

49
Q

Misconfiguration Vulnerabilities

A

A misconfiguration of the service or application settings.

50
Q

Default Installation Vulnerabilities

A

Sometimes the installation of an application or service using default locations and settings opens a vulnerability (sometimes discovered well after the release of the application or service).

51
Q

Buffer Overflows

A

Covered later in this book, buffer overflows are flaws in execution allowing an attacker to take advantage of bad coding.

52
Q

Missing Patches (Unpatched Servers) Vulnerabilities

A

Despite patching for a known security flaw being available, many systems are not patched for a variety of reasons, leaving them vulnerable to attack.

53
Q

Design Flaws Vulnerabilities

A

These are flaws universal to all operating systems things like encryption, data validation, logic flaws, and so on.

54
Q

OS Flaws

A

These are flaws in a specific OS

55
Q

Application Flaws

A

Flaws inherit to the application coding and function itself.

56
Q

Open Services

A

Services that are not actively used on the system but remain open anyway (usually due to negligence or ignorance) can be targets.

57
Q

Default Passwords

A

Leaving a default password in place on a system is asking for trouble.

58
Q

Risk Identification

A

Identifies the sources, causes, consequences, etc. of internal and external risks affecting security of organization

59
Q

Risk Assessment

A

Assesses organizations risks and determines likelihood and impact of a risk

60
Q

Risk treatment

A

Selects and implements appropriate controls on identified risks

61
Q

Risk Tracking

A

Ensures appropriate controls are implemented.

62
Q

Risk Review

A

Evaluates the performance of implemented risk management and strategies

CEH (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions