Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 7: Security Operations > Flashcards

Chapter 7: Security Operations Flashcards

1
Q

Operations Security

A

Security is primarily concerned with the protection and control of information processing assets in centralized and distributed environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Operations

A

are primarily concerned with the daily tasks required to keep security services operating reliable and efficiently. Operations security is a quality of other services. Security operations is a service in its own right”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

control Mechanisms

A

Protect information and resources from unauthorized disclosure, modification, and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Types of Control Mechanisms

A

PhysicalAdministrativeTechnical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Administrative Controls

A

Development of policies, standards, and procedures Screening personnel, security awareness training, monitoring system and network activity, and change controlExample: - Procedures indicating how servers should be installed, annual security awareness education for all employees, implementing a change control program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Technical Controls

A

Logical mechanisms that provide password and resource management, identification and authentication, and software configurationsExample: - Anti-virus software, intrusion detection systems, locking down operating systems, encryption, firewalls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Physical Controls

A

Protecting individual systems, the network, employees, and the facility from physical damageExample: - Removing floppy drives from computers, locking chassis’s, security guards monitoring the facility, air conditioning and humidity control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Preventative Access Control

A

Controls to prevent undesirable events from taking place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Detective Access Control

A

Controls used to identify undesirable events that have occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Corrective Access Control

A

Controls Used to Correct effects of undesirable events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Deterrent Access Control

A

Controls used to discourage security violations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Recovery Access Control

A

Controls used to restore resources and capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Compensation Access Control

A

Controls used to provide alternate solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

MTBF

A

mean time to failure how long will a device last

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

MTTR

A

mean time to repair how long for the recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RAID - 0

A

Disk striping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Raid 1

A

mirroring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Raid 5

A

Disk striping with parity: fault tolerance + speed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Clustering

A

2 or more nodes acting as a single or logical entity. can provide load balancing but not always.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Full Backup

A

Archive bit is reset (is is a flag saying hey i got backed up)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Incremental Backup

A

Backs up all files that have been modified since last backupArchive Bit is reset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Differential Backup

A

Backs up all files that have been modified since last full backupArchive Bit is not resetAlways will have to restore 2 tapes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Copy Backup

A

Same as full backup, but Archive Bit is not resetUse before upgrades, or system maintenanceCopy backup before making a system backup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

configuration management

A

a process of identifying and documenting hardware components, software and the associated settings.” including bios settings…etc.everything needs to be documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

System Hardening

A

Removing Unnecessary ServicesInstalling the latest services packs and patchesRenaming default accountsChanging default settingsEnabling security configurations like auditing, firewalls, updates, etcDon’t forget physical security!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Change Management

A

Directive, Administrative Control that should be incorporated into organizational policy. The formal review of all proposed changes–no “on-the-fly” changes Only approved changes will be implementedThe ultimate goal is system stabilityPeriodic reassessment of the environment to evaluate the need for upgrades/modificationsknow the flow of how it works*

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Change management process

A

Request SubmittalRisk/Impact AssessmentApproval or Rejection of ChangeTestingScheduling/User Notification/TrainingImplementationValidationDocumentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Patch Management

A

An essential part of Configuration and Change ManagementMay come as a result of vendor notification or pen testingCve.mitre.org (Common Vulnerability and Exposures) database provides standard conventions for known vulnerabilitiesNvd.nist.gov Enables automation of vulnerability management, security measurement, and compliance. NVD includes databases of security checklists, security related software flaws, incorrect configurations, product names, and impact metrics. www.cert.gov: Online resource concerning common vulnerabilities and attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Trusted Recovery

A

System reboot, emergency system restart, system cold startNo compromise of protection mechanisms or possibility of bypassing themPreparing system for failure and recovering the systemFailure of system cannot be used to breach securityFails - in a secure manner….

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Media Management

A

Production Libraries–Holds software used in production environmentProgrammer Libraries–Holds work in progressSource Code Libraries–Holds source code and should be escrowed (3rd Party Storage)Media Library–Hardware centrally controlled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Media Librarian

A

Librarian to control accessLog who takes what materials out and whenMaterials should be properly labeledMedia must be properly sanitized when necessaryZeroization (Previous DoD standards required seven wipes. Currently, only one is required.)Degaussing (Only good for magnetic media)Coercivity: Amount of energy required to reduce the magnetic field to zeroPhysical destruction (The best means of removing remnants).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Identity Management

A

Controls the lifecycle for all accounts is a system

33
Q

Access Managament

A

Controls the assignment of rights/privileges to those accounts.

34
Q

ID and Access management per ISC2

A

“focus on harmonizing the provisioning of users and managing their access across multiple systems with different native access control systems”.

35
Q

Security Review

A

Conducted by system maintenance or security personnel Goal is determine vulnerabilities within a system. Also known as a vulnerability assessment

36
Q

Security Audit

A

Conducted by 3rd partyDetermines the degree to which required controls are implemented

37
Q

Vulnerability Assesment

A

Physical / Administrative/ LogicalIdentify weaknessesless intrusive

38
Q

PEN Testing

A

Ethical hacking to validate discovered weaknessesRed Teams (Attack)/Blue Teams (Defend)

39
Q

Zero Knowledge attack

A

(Black Box Testing): Team has no knowledge of the target and must start with only information that is publically available. This simulates an external attack

40
Q

Partial Knowledge attack

A

The team has limited knowledge of the organization

41
Q

Full Knowledge attack

A

This simulates an internal attack. The team has full knowledge of network operations

42
Q

Blind PEN

A

attacker have no internal staff know

43
Q

Double Blind

A

attack have no internal structure staff doesn’t know what’s up

44
Q

Targeted

A

Staff works with pen guys on specific things

45
Q

Attack Methodology 1 of 2

A
  1. Reconnaissance WhoIs Database, Company Website, Job Search Engines, Social Networking2. Footprinting Mapping the network (Nmap) ICMP ping sweeps DNS zone transfers3. Fingerprinting Identifying host information Port scanning4. Vulnerability assessment Identifying weaknesses in system configurations Discovering unpatched software
46
Q

Attack Methodology 2 of 2

A
  1. The “attack” Penetration Privilege escalation Run As, SU Root kits Colllection of tools to allow continued access. Includes Back Door softwareCan update the kernel of the operating systemVery difficult to detect Cover tracksTrojaned Programs: The Attacker replaces default utilities with ones that masquerade as system utilities that provide normal services, with the exception of helping identifiy the backdoor softwareLog Scrubbers
47
Q

Why PEN Test???

A

Risk analysisCertificationAccreditationSecurity architecturesPolicy developmentResponsible approach to overall securityBoost company’s position in marketplace

48
Q

Why do PEN test work?

A

Lack of awarenessPolicies not enforced Procedures not followedDisjointed operations between departmentsSystems not patched

49
Q

PEN Test Requiremetn

A

Three basic requirements:Defined goal, which should be clearly documentedLimited timeline outlined with managementApproved by senior management; only management should approve this type of activitySIGNED OFF….

50
Q

PEN Rules of Engagement

A

Specific IP addresses/ranges to be tested Any restricted hostsA list of acceptable testing techniquesTimes when testing is to be conductedPoints of contact for the penetration testing team, the targeted systems, and the networks Measures to prevent law enforcement being called with false alarmsHandling of information collected by penetration testing team

51
Q

3 Types of PEN Test

A

Physical Security –Access into building or department–Wiring closets, locked file cabinets, offices, server -room, sensitive areasRemove materials from buildingAdministrative Security—Help desk giving out sensitive information, data on disposed disksLogical Security–Attacks on systems, networks, communication

52
Q

nmap

A

a port scanner

53
Q

vulnerability scanning

A

ID’ing:Active hosts on network Active and vulnerable services (ports) on hostsApplicationsOperating systemsVulnerabilities associated with discovered OS & applicationsMisconfigured settings

54
Q

dictionary attack

A

goes through dictionary

55
Q

Brute Force

A

try every single pass combo

56
Q

Rainbow Table

A

Trying to find a match to the hash

57
Q

Rogue Infrastructures

A

unathorized dhcp and dns servers

58
Q

War Dialing

A

trying to find modem lines

59
Q

PEN discover serious issue

A

stop and report

60
Q

Log Reviews

A

Periodically check the logs…good to be proactive and taking a look

61
Q

side channel attacks

A

looking where traffic is going

62
Q

traffic padding

A

Generating spurious data in traffic to make traffic analysis more difficultSending out decoy attacksThe amount and nature of traffic may be maskedAttempt to keep traffic constant so no information can be gained

63
Q

IDS

A

Software is used to monitor a network segment or an individual computerUsed to detect attacks and other malicious activityDynamic in naturePASSIVE SYSTEM***** a glorified snifferhas analysis engine

64
Q

Network Based IDS

A

Monitors traffic on a network segmentComputer or network appliance with NIC in promiscuous modeSensors communicate with a central management consolesniffer with analysis engine

65
Q

Host Based IDS

A

Small agent programs that reside on individual computerDetects suspicious activity on one system, not a network segment

66
Q

where put IDS

A

in the DMZ

67
Q

Difference between IDS and Sniffer

A

the anlysis engine with works like this you hunk:Pattern Matching-Rule-Based Intrusion Detection-Signature-Based Intrusion Detection-Knowledge-Based Intrusion DetectionProfile Comparison-Statistical-Based Intrusion Detection-Anomaly-Based Intrusion Detection-Behavior-Based Intrusion Detection

68
Q

Sig Based IDS Systems

A

Signature-based—MOST COMMONIDS has a database of signatures, which are patterns of previously identified attacksCannot identify new attacks Database needs continual updates

69
Q

Behaviors IDS system

A

Behavior-basedCompares audit files, logs, and network behavior, and develops and maintains profiles of normal behaviorBetter defense against new attacksCreates many false positives

70
Q

IDS response options

A

Passive:Page or e-mail administratorLog eventActiveSend reset packets to the attacker’s connectionsChange a firewall or router ACL to block an IP address or rangeReconfigure router or firewall to block protocol being used for attack

71
Q

IDS Portspan

A

make switch act like hub for IDS captures

72
Q

Permiscous mode

A

IDS Needs an interface that gets everything…

73
Q

Insertion Attack

A

disguising malicious code

74
Q

honeypot

A

a distractorPseudo Flaw: Loophole purposely added to operating system or application to trap intruders Sacrificial lamb system on the networkAdministrators hope that intruders will attack this system instead of their production systemsIt is enticing because many ports are open and services are runninghoneynet- a collection of honeyposts

75
Q

Enticement vs Entrapment

A

make it look vunerable keep attacker buys

76
Q

padded cell

A

and area of isolation like java…a sandbox

77
Q

Phishing

A

Social engineering crazy email to entice user.

78
Q

spoofing

A

emails that look authentic

79
Q

whitelist

A

all traffic is denied except…what is on list.

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions