Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 8 > Flashcards

Chapter 8 Flashcards

1
Q

entity that makes a request to access a resource

A

subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

entity a subject wants access to

A

resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

concept that if A trusts B and B trusts C, then A can also trust C

A

transitive trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

system that is designed to work well with a narrow range of other systems; standards are often proprietary and not normally disclosed

A

closed system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

systems that are designed using agreed-upon industry standards

A

open systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

defined set of interactions allowed between computing elements

A

API - Application Programming Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

11 secure design principles

A
  1. secure defaults
  2. fail securely
  3. keep it simple
  4. zero trust
  5. privacy by design
  6. trust but verify
  7. threat modeling
  8. defense in depth
  9. least privilege
  10. separation of duties
  11. shared responsibility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

should you assume that A. default settings are the most secure or B. default settings are for easy installation and need to be hardened?

A

B

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

process where programmer codes in mechanisms to anticipate and defend against errors in order to avoid the termination of execution

A

exception handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

the inclusion of code that will attempt to handle errors when they arise before they can cause harm or interrupt execution

A

error handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

logical block statement that is used to place code that could result in an error on the “try” branch

an example of an exception handling mechanism

A

try..catch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

3 mechanisms for avoiding or preventing errors related to user input

A

input sanitation
input validation
input filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

allow a system to continue to operate after a component fails

A

fail-soft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

human protection prioritization; when a failure occurs the product will revert to a state that protects the health and safety of people

A

fail-safe or fail-open

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

a system that prioritizes the physical security of assets of the safety of people

A

fail-secure or fail-close

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

the more complex a system, the more difficult it is to secure

A

KISS - Keep it Simple

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

eliminating redundancy in software by not repeating the same code in multiple places

A

DRY - Don’t Repeat Yourself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

code should use the least necessary resources possible

A

Computing Minimalism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

use the least powerful programming language that is suitable

A

Rule of Least Power

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

software quality/security does not necessarily increase with an increase in capabilities and functions

A

New Jersey Style (Worse is Better)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

don’t add capabilities until they are actually necessary

A

YAGNI - You Aren’t Gonna Need It

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

nothing inside the organization is automatically trusted; every access request should be authenticated, authorized, and encrypted

A

zero trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

dividing up an internal network into numerous subzones using firewalls, subnets, or VLANS

A

microsegmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

guideline to integrate privacy protections into products during the early design phase

A

Privacy by Design (PbD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

7 principles of PbD

A
  1. Proactive not reactive, preventative not remedial
  2. Privacy as the default
  3. Privacy embedded into design
  4. Full functionality
  5. End-to-end security
  6. visibility and transparency
  7. respect for user privacy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

depends on an initial authentication process to gain access to the internal secure environment

A

trust but verify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

allowing a process to read from and write to only certain memory locations and resources

A

confinement/sandboxing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

limits set on the memory addresses and resources a process can access

A

bounds

29
Q

the degree of confidence in satisfaction of security needs; how reliable the security mechanisms are

A

assurance

30
Q

a system in which all protection mechanisms work together to process sensitive data while maintaining a stable and secure computing environment

A

trusted system

31
Q

an object that is associated with a resource and describes its security attributes

A

token

32
Q

a list that maintains a row of security attributes for each controlled object

A

capabilities list

33
Q

a type of attribute storage that is a permanent part of the object to which its attached

A

security label

34
Q

combination of hardware, software, and controls that work together to form a trusted base

A

trusted computing base (TCB)

35
Q

an imaginary boundary that separates the TCB from the rest of the system

A

security perimeter

36
Q

part of the TCB that validates access to every resource

A

reference monitor

37
Q

collection of components in the TCB that work together to implement reference monitor functions

A

security kernel

38
Q

a system that is always secure no matter what state its in

A

state machine model

39
Q

a snapshot of a system at a specific moment in time

A

state

40
Q

this security model focuses on controlling the flow of information; designed to prevent unauthorized, insecure, or restricted information flow between different levels of security

A

information flow model

41
Q

this security model is concerned with how the actions of a subject at a higher security level affect the system state at a lower security level

A

noninterference model

42
Q

this security model employs a directed graph to dictate how rights can be passed from on subject to another

A

take-grant model

43
Q

4 rules of the take-grant model

A

take rule: allows a subject to take rights over an object
grant rule: allows a subject to grant rights to an object
create rule: allows a subject to create new rights
remove rule: allows a subject to remove rights it has

44
Q

a table of subjects and objects that indicates the actions or functions that each subject can perform on each object

A

access control matrix

45
Q

this security model was developed by the DoD based on multilevel security policies

A

Bell-LaPadula model

46
Q

This security model has two properties: simple integrity property and star integrity property

A

Biba model

47
Q

Integrity property that states a subject cannot read an object at a lower integrity level

A

Simple Integrity Property

48
Q

integrity property that states that a subject cannot modify an object at a higher integrity level

A

star integrity property

49
Q

this model only provides integrity

A

Biba

50
Q

this model defines each data item and allows modifications through only a limited or controlled intermediary program or interface

A

Clark-Wilson model

51
Q

any data item whose integrity is protected by the security model

A

constrained data item (CDI)

52
Q

an data item that is not controlled by the security model

A

unconstrained data item (UDI)

53
Q

a procedure that scans data items and confirms their identity

A

integrity verification procedure (IVP)

54
Q

the only procedures that are allowed to modify a CDI

A

transformation procedures (TPs)

55
Q

this model permits access controls to change based on a user’s previous activity; involves conflicts of interest defined by conflict classes

A

Brewer and Nash model

56
Q

this integrity model is a noninterference model, and is based on predetermining the set or domain of objects that a subject can access

A

Gogen-Meseguer Model

57
Q

this integrity model is based on the idea of defining a set of system states, initial states, and state transitions.

A

Sutherland Model

58
Q

this model is focused on the secure creation and deletion of both subjects and objects.

A

Graham-Denning model

59
Q

this model focuses on the assignment of object access rights to subjects as well as the resilience of those rights

A

Harrison-Ruzzo-Ullman model (HRU)

60
Q

This product evaluation model defines various levels of testing and confirmation of systems’ security capabilities

A

Common Criteria (CC)

61
Q

The Common Criteria process is based on two key elements:

A

protection profiles and security targets

62
Q

official approval to use secured equipment for operational objectives

A

ATO - Authorization to Operate

63
Q

the 4 authorization decisions an AO can issue

A

ATO Authorization to Operate
Common control Authorization
Authorization to Use
Denial of Authorization

64
Q

this security capability is used to prevent an active process from interacting with an area of memory that was not specifically assigned or allocated to it

A

Memory Protection

65
Q

this exploitation can allow for the reading of private kernel memory contents by a nonprivileged process

A

Meltdown

66
Q

this exploitation can enable to wholesale theft of memory contents from other running applications

A

Spectre

67
Q

hosting one or more operating systems within the memory of a single host computer

A

virtualization

68
Q

the ability of a system to suffer a fault but continue to operate; achieved through redundancy (RAID), and failover clusters

A

Fault Tolerance

CISSP (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions