Chapter 1: Introduction to Security Flashcards
The protection of information from harm; protection of the integrity, confidentiality, and availability of information through practices, people, and procedures on the devices that store, manipulate, and transmit information
Information security
The CIA triad
Confidentiality
Integrity
Availability
An individual or entity responsible for cyber incidents against the technology equipment of enterprises and users
Threat actor (malicious actor, attacker, hacker)
The hardware device and OS which run applications, programs, or processes
Platforms
Three types of platforms
Legacy
On-premises
Cloud
The array of features and security settings that must be properly implemented to repel attacks
Configurations
7 weak configurations include …
- Default settings
- Open ports and services
- Unsecured root accounts
- Open permissions
- Insecure protocols
- Weak encryption
- Errors
External entities outside of the org, engaging in outsourced code development, data storage, vendor management, and system integration
Third parties
The Principle of the Weakest Link
If the security of the third party has any weaknesses, it can provide an opening for attackers to infiltrate the organization’s computer network
An officially released software security update intended to repair a vulnerability
Patches
3 patching vulnerabilities include …
- Difficulty patching firmware
- Few patches for application software
- Delays on in patching OSs
A vulnerability that is exploited by attackers before anyone else even knows it exists
Zero-day
A pathway or avenue used by a threat actor to penetrate a system
Attack vector
7 Common attack vectors include …
- Wireless
- Direct access
- Social media
- Removable media
- Supply chain
- Cloud
Gathering data by relying on the weaknesses of individuals
Social engineering
Common psychological principles exploited by social engineering include …
- Authority
- Intimidation
- Consensus
- Scarcity
- Urgency
- Familiarity
- Trust
Influencing a subject before an event occurs
Prepending
Masquerading as a real or fictitious character and then playing out the role of that person with a victim
Impersonation
Using impersonation to obtain private information
Pretexting
Sending an email or displaying a web announcement that falsely claims to be from a legitimate enterprise in an attempt to trick the user into surrendering private information or taking action
Phishing
Targeting specific users through email
Spear phishing
Targeting wealthy individuals or senior executives within a business through phishing
Whaling
Using a telephone to perform a phishing attack
Vishing
Using SMS to perform a phishing attack
Smishing
Tricking users into visiting malicious websites by exploiting similarly spelled domain names and spelling errors
Redirection
Purchasing the domain names of sites that are spelled similarly to actual sites
Typosquatting
The registration of domain names one bit different than popular domains
Bitsquatting
Exploiting how a URL is converted into its corresponding IP address to redirect traffic away from its intended target to a fake website
Pharming
Unsolicited email (or IM) sent to a large number of people
Spam and Spim
A false warning often contained in an email message claiming to come from the IT department
Hoaxes
An attack directed toward a smaller group of specific individuals, such as the major executives working for a manufacturing company
Watering-hole attack
Digging through trash to find information that can be useful in an attack
Dumpster diving
Using advanced Google search techniques to look for information that unsuspecting victims have carelessly posted on the web
Google dorking
Following an authorized user through a door
Tailgating
An employee conspires with an unauthorized person to allow him to walk in with him through an open door
Piggybacking
Watching an individual enter a security code on a keypad
Shoulder surfing
The destruction of data that cannot be recovered
Data loss
Stealing data to distribute it to other parties
Data exfiltration
Stealing data to distribute it in an unauthorized way
Data breach
Taking personally identifiable information to impersonate someone
Identity theft
The loss that results from making systems inaccessible
Availability loss
The monetary loss as a result of lost productivity
Financial loss
Public perception
Reputation
