Chapter 5 Flashcards
What is ingress monitoring
surveillance and assessment of all inbound communications traffic and access attempts
What is Egress monitoring
monitoring of all outbound network traffic, used to regulate data leaving the organization’s IT environment.
Give an example of some devices that perform ingress monitoring
Firewalls
Gateways
Remote authentication servers
IDS/IPS tools
SIEM solutions
Anti-malware solutions
Egress monitoring should be combined with DLP and deployed to what attack vectors for Data leak
Email (content and attachments)
Copy to portable media
File Transfer Protocol (FTP)
Posting to web pages/websites
Applications/application programming interfaces (APIs)
What is an encryption system
is the set of hardware, software, algorithms, control parameters and operational methods that provide a set of encryption service
Explain configuration management
a process and discipline used to ensure that the only changes made to a system are those that have been authorized and validated
what are the components of configuration management
Identification
Baseline
Change Control
Verification and audit
Define the identification of CM
Baseline identification of a system and all its components, interfaces and documentation.
define the baseline component of CM
A security baseline is a minimum level of protection that can be used as a reference point. Baselines provide a way to ensure that updates to technology and architectures are subjected to the minimum understood and acceptable level of security requirements.
define the Change Control component of CM
An update process for requesting changes to a baseline, by means of making changes to one or more components in that baseline. A review and approval process for all changes. This includes updates and patches.
Define the Verification and Audit of CM
A regression and validation process, which may involve testing and analysis, to verify that nothing in the system was broken by a newly applied set of changes. An audit process can validate that the currently in-use baseline matches the sum total of its initial baseline plus all approved changes applied in sequence.
What is the first step to security baselining
Take inventory of the assets you have and their compliance
What is the second step to security baselining
The baseline is a total inventory of all the system’s components, hardware, software, data, administrative controls, documentation and user instructions
Third step to security baselining
Ensure updating is in place with controls to validate backwards compatibility and forwards compatiiblity of updates. Also perform security review of assets to determine if things once considered secure are still, in fact, secure.
Final step to security mgmt
Patch management mostly applies to software and hardware devices that are subject to regular modification. Orgs should test the patch before rolling it out across the organization.
