Chapter 2: Pervasive Attack Surfaces & Controls Flashcards
What is Social Engineering?
Means of eliciting info or convincing a user to take action that weakens security
What is Phishing?
Sending Fraudulent messages/emails to elicit personal information
What is BEC?
Business Email Compromise - takes advantage of electronic payments or transferring funds - Request for funds appear to come from a legitimate source
What is typo squatting?
Similar names of trusted sites (google.com to goggle.com)
What is Cybersquatting?
Registering a domain that contains trademarks and then selling it
What is bit flipping?
Flipping memory (1’s and 0’s) of a site
What is Pharming?
URL Redirection (DNS infection) - typing one site and going to another site
What is a faraday cage?
A metallic enclosure that prevents the entry or escape of an electromagnetic field
What is a PDS?
Protective Distribution System - system of cable units to protect classified info transmitted between two areas
What is a Hardened Carrier PDS?
Special electrical metalic tubing in the conduit to prevent physical tampering and protect the data cables
What is an Alarmed Carrier PDS?
Optical fibers in the conduit that transmits a noise that triggers an alarm if someone tries to gain physical access to the conduit (Best for classified info)
What is the description of the Confidential data classification?
Highest level of data sensitivity
What is the description of the Private data classification?
Restricted with medium level of confidentiality
What is the description of the Sensitive data classification?
should be restricted to employees who have a business need to access the data with prior approval.
What is the description of the Critical data classification?
Data classified based on availability needs
What is the description of the Restricted data classification?
Data not available to the public
What is data segmentation?
Tagging data with classification then separating most sensitive data from the rest of the data
What is a pretexting?
Impersonation/Masquerading as a real or fictitious character to a threat vector to obtain private information
