Chapter 10 - Social Engineering & Other Foes Flashcards
why is social engineering also called wetware?
10 - 355
because it doesn’t require software or hardware, is dependent on the gray matter of the brain
tell me the 7 types of social engineering attacks
10 - 356 thru 361
shoulder surfing - watching someone over their shoulder, fight this with privacy filters
dumpster diving - just what it sounds like
tailgating - follow someone through the door they just unlocked
impersonation - can be done in person, over the phone, by email, etc.
hoaxes - phony threats
whaling - phishing or spear phishing for big users
vishing - VoIP phishing
there are reasons why social engineering is effective. there are 7 of them. tell me what they are.
10 - 362,363
authority intimidation consensus/social proof scarcity urgency familiarity/liking trust
the only preventative measure to combat social engineering is what?
10 - 365
educating yourself and never handing stuff out
as far as physical barriers go, your system should have a minimum of 3. tell me what they are.
10 - 367
the perimeter
a door locked by ID badges, prox readers, keys, all for the computer center
a locked door on the computer room
tell me 2 types of hardware locks and security
10 - 369
cable lock
safe and locking cabinets
how does a mantrap work?
10 - 371
you need visual identification AND authentication to gain access
what is the purpose of an access list?
10 - 373
to identify specifically who can enter a facility
protected distribution system. tell me what it is.
10 - 376
one in which the network is secure enough to allow for the transmission of classified information in non-encrypted format
so, physical security has been substituted for encryption security
what is HVAC?
10 - 378
heating, ventilation, and air conditioning
there are 4 types of fire extinguishers. tell me their letters, their use, their retardant composition
10 - 378
a - wood and paper, largely water or chemical
b - flammable liquids, fire-retardant chemicals
c - electrical, non-conductive chemicals
d - flammable metals, varies; type specific
tell me the 2 things that most common fixed systems combine
10 - 379
fire detectors
fire-suppression systems
what can you use to provide electronic shielding for the computer room?
hint: constant trap
10 - 380
Faraday cage
Tell me the difference between EMI and RFI.
10 - 380, 381
EMI will distort the signal in the data cable, and the receiver reads the wrong message or doesn’t read it at all.
RFI adds too much energy to the RF energy pool, and so the receivers become deaf and don’t hear the signal they’re supposed to hear.
you are eavesdropping on CRT and LCD displays by detecting their electromagnetic emissions. what is this called?
what’s a good countermeasure for this?
10 - 381
Van Eck phreaking
shielding
The U.S. government had a project back in the 50s for reducing electronic noise from devices that would divulge intelligence about systems and information. What was this project called?
10 - 382
TEMPEST
In your hot and cold aisles setup, will you find the air conditioning units adjacent to the hot aisles or the cold aisles?
10 - 382
the hot aisles
Most fire-suppression systems work off of the concept of removing one of the three elements needed for a fire. tell me the three elements.
10 - 383
heat, fuel, oxygen
if your humidity gets too low, electrostatic damage is likely to occur. what’s the humidity percentage that your computer center should never drop below?
10 - 383
50%
what is the deterrent security control type?
10 - 384
anything intended to warn a would-be attacker that they should not attack
what is the preventive security control type?
10 - 384
stop something from happening
what is the detective security control type?
10 - 384
to uncover a violation
what is the compensating security control type?
10 - 384
backup controls that come into play when other controls have failed
what is the technical security control type?
10 - 384
controls implemented through technology. they can be any of the other types of control EXCEPT for administrative
what is the administrative security control type?
10 - 384
comes down through policies, procedures, and guidelines
a data policy should be focused on what 4 issues?
10 - 385,386
wiping - data removal
disposing - physical media is discarded
retention - how long do you keep it?
storage - where is the data kept?
tell me the 3 steps to destroying a flash drive
10 - 386,387
crack open the drive
turn the chip to powder
finish it off
tell me the two frequencies that RFID readers run at.
10 - 367
13.56MHz and 125kHz
