Chapter 12 - Security Flashcards
Vulnerability
An opportunity for threats to gain access to individual or organizational assets.
Threat
Person or organization that seeks to obtain or alter data or other assets illegally, without the owner’s permission and often without the owner’s knowledge.
Safeguard
Some measure that individuals or organizations take to block the threat from obtaining the asset.
Target
The asset that is desired by the threat.
Three Sources of Threats
- Human Error
- Computer Crime
- Natural Disasters
Five Types of Security Loss
- Unauthorized Data Disclosure
- Incorrect Data Modification
- Faulty Service
- Denial of Service
- Loss of Infrastructure
Usurpation
Computer criminals invade a computer and replace legitimate programs with their own, unauthorized ones.
Advanced Persistent Threat (APT)
Sophisticated, possibly long-running, computer hack that is perpetrated by large, well-funded organizations such as governments. A means to engage in cyber warfare. Examples are Stuxnet and Flame.
Intrusion Detection System (IDS)
A computer program that senses when another computer is attempting to scan the disk or otherwise access a computer.
Gramm-Leach-Bliley Act
Protects consumer financial data stored by financial institutions.
Privacy Act of 1974
Protects records of individuals held by the U.S. Government.
HIPAA
Health Insurance Portability and Accountability Act. Gives individuals the right to access health data and sets rules and limits on who can read and receive your health information.
Identification
User name
Authentication
Password, smart card with pin, biometric authentication.
Biometric Authentication
Uses personal physical characteristics such as fingerprints, facial features, and retinal scans to authenticate users.
Encryption
The process of transforming clear text into coded, unintelligible text for secure storage and communication.
Symmetric Encryption
The same key is used to encode and decode.
Asymmetric Encryption
Two keys are used; one key encodes and the other key decodes. This is used in the public key/private key method used on the internet.
Firewall
Device or program that prevents unauthorized network access. A perimeter firewall sits outside the organizational network. An internal firewall is inside the internal network.
Malware
Viruses, worms, Trojan horses, spyware and adware.
Virus
A computer program that replicates itself.
Payload
The program code that causes unwanted or harmful activity.
Trojan Horses
Viruses that masquerade as useful programs.
Worm
A virus that propagates using the Internet or other computer network.
Spyware and Adware
Programs installed on the user’s computer without the users knowledge or permission. Adware watches user activity and produces pop-up ads.
Malware Definitions
Patterns that exist in the malware code.
SQL Injection Attack
In a poorly designed app an attacker might write SQL code in a text entry box that then gets executed by the database. This can cause improper data disclosure or data damage.
Key Escrow
A trusted party holds a copy of an encryption key, in case the original is lost or damaged.
Hardening
Hardened sites use special version of the operating system, and they lock down or eliminate operating system features and functions that are not required by the application.
