Chapter 1 - Introduction Flashcards
assets
items you value
vulnerability
a weakness in the system that might be exploited to cause loss or harm.
threat
a set of circumstances that has the potential to cause loss or harm
attack
A human who exploits a vulnerability
availability:
the ability of a system to ensure that an asset can be used by any authorized parties
integrity:
the ability of a system to ensure that an asset is modified only by authorized parties
confidentiality:
the ability of a system to ensure that an asset is viewed only by authorized parties
authentication:
the ability of a system to confirm the identity of a sender
nonrepudiation or accountability
the ability of a system to confirm that a sender cannot convincingly deny having sent something
Auditability
ability of a system to trace all actions related to a given asset.
subject
the person, process, or program
object
the data item
access mode
the kind of access (such as read, write,
or execute)
the authorization
policy
Nonmalicious
someone’s accidentally spilling a soft drink on a laptop, unintentionally deleting text, inadvertently sending an email message to the wrong person, and carelessly typing “12” instead of “21” when entering a phone number or clicking “yes” instead of “no” to overwrite a file.
malicious, human-caused harm
person actually wants to cause harm, and so we often use the term attack
random attack
the attacker wants to harm any computer or user;
directed attack
the attacker intends harm to specific computers, perhaps at one organization or belonging to a specific
individual
advanced persistent threat
attacks come from organized, well financed, patient
assailants. Often affiliated with governments or quasi-governmental groups, these attackers engage in long term campaigns. They carefully select their targets, crafting attacks that appeal to specifically those targets; email messages called spear phishing are intended to seduce their recipients.
harm
The negative consequence of an actualized threat
risk management
Involves choosing which threats to control and what
resources to devote to protection.
residual risk.
The risk that remains uncovered by controls
impact
the amount of damage it can cause
likelihood
threat is not just one that someone might want to pull off but rather one that could actually occur.
feasibility
Is it even possible to accomplish the attack?
method
the skills, knowledge, tools, and other things with which to perpetrate the attack.
script kiddie
describes someone who downloads a complete attack code package and needs only to enter a few details to identify the target and let the script perform the attack.
Opportunity
the time and access to execute an attack
motive
reason to want to attack.
“attractive targets,”
very appealing to attackers
attack surface
the system’s full set of vulnerabilities—actual and
potential.
control or countermeasure
a means to counter threats
Physical controls
stop or block an attack by using something tangible
Procedural or administrative controls
use a command or agreement that requires or advises people how to act
Technical controls
counter threats with technology (hardware or software),
overlapping controls or defense in depth:
more than one control or more than one class of control to achieve protection.
