Chapter 4: Endpoint And Application Development Security Flashcards
A metric of the upper and lower bounds of specific indicators of normal network activity
Key Risk Indicators (KRIs)
An indicator that malicious activity is occurring but is still in the early stages
Indicator of compromise (IOC)
An evaluation used for discovering an attack before it occurs
Predictive analysis
Anything that can be used freely without restrictions
Open source
A repository by which open source cybersecurity information is collected and disseminated
Public information sharing centers
Four CISCP privacy protection umbrellas include …
- Cybersecurity Information Sharing Act (CISA)
- Freedom of Information Act (FOIA)
- Traffic-Light Protocol (TLP)
- Protected Critical Infrastructure Information (PCII)
A technology that enables the exchange of cyber threat indicators between parties through computer-to-computer communication
Automated Indicator Sharing (AIS)
A language and format used to exchange cyber threat intelligence
Structured Threat Information Expression (STIX)
An application protocol for exchanging cyber threat intelligence over Hypertext Transfer Protocol Secure (HTTPS)
Trusted Automated Exchange of Intelligence (TAXII)
Proprietary information owned by an entity that has an exclusive right to it
Closed source
Organizations participating in closed source information that restrict both access to data and participation
Private information sharing centers
A repository of known vulnerabilities and information as to how they have been exploited
Vulnerability database
An illustration of cyber threats overlaid on a diagrammatic representation of a geographical area
Threat map
A storage area in which victims of an attack can upload malicious files and software code that can then be examined by others to learn more about these attacks and craft their defenses
File and code repositories
Part of the internet beyond the reach of normal search engines and is the domain of threat actors
Dark web
Securing endpoint computers primarily involves three tasks, including …
- Confirming that the computer had started safely
- Protecting the computer from attacks
- Hardening the computer for even greater protection
An improved firmware interface developed to replace the BIOS
Unified Extensible Firmware Interface (UEFI)
When each element in the boot process relies on the confirmation of the previous element to know that the entire process is secure
Chain of trust
Security checks that begin with hardware checks
Hardware root of trust
The process of determining that the boot process is valid
Boot atteststion
A boot security mode where the computer’s firmware logs the boot process so the OS can send it to a trusted server to assess the security
Measured Boot
Software that can examine a computer for file-based virus infections as well as monitor computer activity and scan new documents that might contain a virus
Antivirus
A suite of software intended to provide prophecy ions against multiple types of malware, such as ransomware, cryptomalware, Trojans, and other malware
Antimalware
A protocol that forgets everything that occurs between browser client and the server
Stateless protocol
A protocol that remembers everything that occurs between browser client and the server
Stateful protocol
A cookie that is only sent to the server with an encrypted request over the secure HTTPS protocol
Secure cookie
A header that can inform the browser how to function while communicating with the website
HTTP Response Header
A software-based application that runs on an endpoint computer and can detect that an attack has occurred
Host Intrusion Detection Systems (HIDS)
Robust tools that monitor endpoint events and take immediate action
Endpoint detection and response (EDR)
Software that monitors endpoint activity to immediately block a malicious attack by following specific rules
Host Intrusion Detection Systems
Patch updates for application and utility software
Third-party updates
The automatic download and installation of patches as they become available
Auto-update
Turning off any service that is not being used and closing any unnecessary TCP ports to enhance security
Disabling unnecessary ports and services
A database that contains low-level settings used by the Windows OS and for those applications that elect to use it
Registry
Requiring pre approval for an application to run or not run
Application whitelisting and blacklisting
Approving in advance only specific applications to run on the OS so that any item not approved is either restricted or denied
Whitelisting
Creating a list of unapproved software so that any item not on the list can run
Blacklisting
A “container” in which an application can be run so that it does not impact the underlying OS
Sandbox
The process that holds a suspicious document, most commonly used with email attachments
Quarantine
