Chapter 1: Mastering Security Basics Flashcards
A use case
helps professionals identify and clarify requirements to achieve a goal.
Confidentiality ensures
that data is only viewable by authorized users. Encryption is the best choice to provide confidentiality. Access controls also protect the confidentiality of data.
Steganography
(hiding data inside other data) is one method of supporting obfuscation by making the hidden data harder to see.
Integrity
provides assurances that data has not been modified, tampered with, or corrupted through unauthorized or unintended changes. Data can be a message, a file, or data within a database. Hashing is a common method of ensuring integrity.
Non-repudiation
prevents entities from denying they took an action. Digital signatures and audit logs provide non-repudiation. Digital signatures also provide integrity for files and email.
Availability
ensures that data and services are available when needed. A common goal is to remove single points of failure. Methods used to increase or maintain availability include fault tolerance, failover clusters, load balancing, backups, virtualization, HVAC systems, and generators.
Risk
the possibility of a threat exploiting a vulnerability and resulting in a loss.
A threat
is any circumstance or event that has the potential to compromise confidentiality, integrity, or availability.
A vulnerability
is a weakness. It can be a weakness in the hardware, software, configuration, or users operating the system.
Risk mitigation
reduces risk by reducing the chances that a threat will exploit a vulnerability or by reducing the impact of the risk.
Security controls
reduce risks. For example, antivirus software is a security control that reduces the risk of virus infection.
The three primary security control types are
technical (implemented with technology), administrative (using administrative or management methods), and physical (using controls that you can physically touch).
A technical control is
one that uses technology to reduce vulnerabilities. Encryption, antivirus software, IDSs, firewalls, and the principle of least privilege are technical controls.
Administrative controls are
primarily administrative and include items such as risk and vulnerability assessments. Some administrative controls help ensure that day-to-day operations of an organization comply with their overall security plan. Some examples include security awareness and training, configuration management, and change management.
Preventive controls
attempt to prevent security incidents. Examples include system hardening, user training, guards, change management, and account disablement policies.
