Chapter 9 Flashcards
Trademark:
a word, words, or a symbol legally registered as representing a company or a product,
Copyright:
represented by the © symbol, protects original works of authorship
Patent:
signifies ownership of an invention for a limited time.
Digital products:
they don’t make their money from physical assets
What is in the CIA triad?
Confidentiality
Integrity
Availability
Confidentiality:
ensuring that private information stays that way
Snooping (also called Sniffing):
occurs when the attacker captures network traffic and then looks for key pieces of information
Protocol Analyzer:
lets administrators capture network traffic and analyze its contents.
What are five attacks on confidentiality?
Snooping
Eavesdropping
Wiretapping
Social engineering
Dumpster diving
Eavesdropping:
a low-tech attack method in which the attacker simply listens to a conversation to gain key information
Wiretapping:
occurs when the attacker places a bug to tap into the physical wire on which the communication traveled.
Social Engineering:
occurs when an attacker attempts to acquire information about you or your network and system by social means
Phishing:
is a form of social engineering in which someone uses email to ask you for a piece of information that they are missing by making it look as if it is a legitimate request
Spear phishing:
the attacker uses information that the target would be less likely to question because it appears to be coming from a trusted source.
Whaling:
phishing for “big” users
Shoulder surfing:
involves nothing more than watching someone when they enter their sensitive data
Screen filter:
directs the light from the display at a restricted angle so that anyone who isn’t viewing it straight on won’t be able to read it clearly
Dumpster diving:
people can go through the dumpster and steal information
Integrity:
means that the data is accurate and consistent and from the indicated source
What are the 4 threats to data integrity?
Man-in-the-middle attacks
Replay Attacks
Impersonation
Unauthorized Information Alteration
Man-in-the-middle Attack:
Someone secretly places something between a server and the client, and neither party is aware of it.
Replay Attack:
the attacker captures information from a sender with the intent of using it later
Impersonation:
pretending to be someone or something that you are not
Unauthorized information alteration:
is an attack that can also come from internal sources
Availability:
means that the data is accessible when the user needs it
What are the two concerns of availability?
Denying Service
Hardware Issues
Denial of Service (DoS):
flooding a server with a multitude of illegitimate connection request
Service outage:
any time a service is denied
Zombies or Bots:
infected systems being commanded across the Internet
Power outage:
a cause of service denial
Uninterruptible power supply (UPS):
A battery backup that a server plugs into
Physically securing your area prevents two types of problems:
Hardware Damage
Hardware Theft
Kensington security slot (K-slot):
a type of lock that fits into a laptop slot and is attached to a wall or furniture to keep it secure.
Malware:
software designed to do harm to your computer
Exploits:
take advantage of flaws in the OS or an application
Worms:
used to transmit malware
Trojan Horses:
are applications that mask their true intent
Adware:
used to display unwanted advertisements
Spyware:
used to report on your computer and possibly steal data
Ransomware:
used to extract payments from the infected user
Rootkits:
conceal themselves on the host OS, allowing for full-control access of the computer at a later date
Backdoors:
open ports or other routes into your system
Keyloggers:
record every keystroke and then use that data for identity theft
Vulnerability:
exists when flaws in the programming create the potential for misuse, an attacker is aware of the flaw, and a tool or technique that the attacker can use to exploit that vulnerability for malicious purposes is readily available.
Exploit:
when criminals use a vulnerability to attack a system
Service pack:
a collection of critical updates
Virus:
a computer code that inserts itself into an executable file
Payload:
malware carried by a worm
Spam:
a flood of unsolicited messages that you receive electronically
Spambot:
spammers program this to send as much emails as possible
What is the framework for access control?
Authentication
Authorization
Accounting
Auditing
Nonrepuditaion
Authentication:
happens when the system being logged into validates that the user has proper credentials.
