Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cissp > CISSP Domain 3 > Flashcards

CISSP Domain 3 Flashcards

1
Q

What are technique of ensuring CIA for processes?

A

1.Confinement: Process to be assigned only required resources (memory, run time)
2. Bound: Process is authorised to interactions user, Kernel
3. Isolation : Enforcement of bound and implementation of confinement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is trust and Assurance?

A

Trust: Presence of security mechanism
Assurance: Degree of confidence in satisfaction of security needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is security model?

A

Map abstract statements into security policy for designers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is TCB and it’s components?

A

Enforcement of security policy through:

  1. Security perimeter: Seperate trusted to in untrusted
  2. Reference monitor: Restrict the access it’s a theoretical concepts
  3. Security kernel: Implements the above RM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is State machine model?

A

Takes snapshot of a system at given time
It should always be in “secure state”
When the state changes it’s called transition state and it should happen in secure transition state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is information flow model ?

A

Multilevel security
Dictates information flow from subject to object to prevent unauthorised, restricted, insecure often between different security level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are elements of Evaluation criteria?

A

Protection profile ( and Security Target ()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Non Interference

A

Actions of subject at a higher level should not take advantage of the lower level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Take grant model

A

Access rights can be passed on from an object to a different object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Access control matrix

A

Capability list and access control matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Bella padula

A

Protect confidentiality
simple security property ( no read up) and star security property (no write down)
Discretionary security property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Biba model

A

Integrity

No read down ( simple integrity rule)
No write up ( star integrity rule)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Clark Wilson model

A

Provide integrity
Access triplet ( subject, program and object)

Subjects cannot access objects directly but only through TP

CDI - constrained data item to protect integrity using security model
UDI - not restricted
Transformation Procedure - Will use TP for subject to access object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Brewer and nash model

A

Provides confidentiality
Chinese wall model or to avoid conflict of interest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Goguen - Meseguer model

A

Integrity
Foundation of non Interference model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Sutherland model

A

Prevention of interference+ integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Graham Denning model

A

Creation and deletion of both subjects and objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Harrison -Ruzo -Ulman model

A

Assignment of object access rights and resilience of assigned rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Secure design principles

A

Secure default
Fail securely: physical - digital
Fail open( people, availability)
Fail safe ( people, CI)
Fail closed and secure( assets, CI)
KISS
Zero trust : Microsegmentation, assume there is data breach, trust but verify,
privacy by design- (proactive, default setting, positive sum, data protection, visibility and transparency, user centric)

, trust but verify - now zero trust)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Shared Responsibility

A

Organization do not operate in isolation in an interconnected World you can have internal and external suppliers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Process and execution types

A

Brain of computer

  1. Ready : to be executed after fetching info from memory
  2. Running: Execution
  3. Waiting: Has 2 but need to fetch other data from memory in order to complete execution
  4. Supervisory
  5. Stopped

Problem state based on low prevlige access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CPU and processing types

A

Brain of computer
1. Multitasking: Multiple tasks a single core
2. Multi processing: Multiple process and multiple thread executed by processor
3. Multicore : Many core cpu
4. Multi threading: Many thread executed for a single process
5. Multi programming: similar to multitasking

Fetch execute decode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Protection mechanism of OS

A

Ring 0 kernel
Ring 1 os components
Ring 2 drivers and protocol
Ring 3 i/o devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is goal of memory protection and and how can it be achieved (2 methods)?

A

A computing device is likely running multiple applications and services simultaneously, each occupying a segment of memory. The goal of memory protection is to prevent one application or service from impacting another. There are two primary memory protection methods:

Process isolation: OS provides separate memory spaces for each processes instructions and data, and prevents one process from impacting another

Hardware segmentation: forces separation via physical hardward controls rather than logical processes; in this type of segmentation, the operating system maps processes to dedicated memory locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Virtualization and types

A

technology used to host one or more operating systems within the memory of a single host, or to run applications that are not compatible with the host OS. The goal is to protect the hypervisor and ensure that compromising one VM doesn’t affect others on that host

Type 1 hypervisor: Hypervisor directly installe on bare metal server hardware mainly used for servers

Type 2: application are managed through hypervisor
Hardware
Hypervisor
OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

ROM

A

ROM : only reads
It’s volatile in nature and contents are burned into chips can’t be changed

PROM : Users burn in the content into chips

EEPROM and UVPROM: contents can be erased

Flash memory: USB kind of EEPROM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

RAM and types

A

Can be read and written

Real memory
Secondary memory: ssd
Cache memory: Repetitive tasks
Virtual memory: secondary memory to expand memory space -Page file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Memory addressing

A

Ways by which cpu accesses memory

Register addressing
Immediate addressing
Direct addressing
Indirect addressing
Base+offset addressing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data storage devices

A

Primary vs secondary
Volatile vs non volatile
Random vs sequential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Emnation security and how to reduce it

A

Related to emanating signals, voltage

Tempest technology can reduce it

Faraday cage
Control Zoning
White noise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Firmware

A

Mini OS which does very limited function of OS. ROM or EEPROM chip

BIOS and UEFI ( same as BIOS but additional support)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Phlashing and boot attestation or secure boot, measured boot

A

Malicious code embedded into bios

Protection of local os

Optional feature of UEFI which does hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

TPM

A

cryptographic chip that is sometimes included with a client computer or server. A TPM enhances the capabilities of a computer by offering hardware-based cryptographic operations. Many security products and encryption solutions require a TPM

TPM is both a specification for a cryptoprocessor chip on a motherboard and the general name for implementation of the specification

A TPM is an example of ahardware security module (HSM)

An HSM is a cryptoprocessor used to manage and store digital encryption keys, accelerate crypto operations, support faster digital signatures, and improve authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Client and server based systems

A

Client based: Applet (Adobe in chrome)
Server based :
Data Flow Control: movement of data between processes, between devices, across a network, or over a communications channel

Management of data flow seeks to minimize latency/delays, keep traffic confidential (i.e. using encryption), not overload traffic (i.e. load balancer), and can be provided by network devices/applications & services

While attackers may initially target client computers, servers are often the goal

Mitigation: regular patching, deploying hardened server OS images for builds, and use host-based firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

DCE

A

collection of individual systems that work together to support a resource or provide a service

DCEs are designed to support communication and coordination among their members in order to achieve a common function, goal, or operation

Most DCEs have duplicate or concurrent components, are asynchronous, and allow for fail-soft or independent failure of components

DCE is AKA concurrent computing, parallel computing, and distributed computing

DCE solutions are implemented as client-server, three-tier, multi-tier, and peer-to-peer

Securing distributed systems:

in distributed systems, integrity is sometimes a concern because data and software are spread across various systems, often in different locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Microservices

A

A component of web application and derivative of SOA instead of developer building all the services of software they can integrate using micro services which can be called upon using API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Containers Vs virtualization

A

Instead of using tht complete OS it will create and use only whatever is required

AKA OS virtualization is based on the concept of eliminating the duplication of OS elements in a virtual machine; instead each application is placed into a container that includes only the actual resources needed to support the enclosed application, and the common or shared OS elements are then part of the hypervisor

Containerization is able to provide 10 to 100 x more application density per physical server compared to traditional virtualization

Vendors often have security benchmarks and hardening guidelines to follow to enhance container security

Securing containers:

container challenges include the lack of isolation compared to a traditional infrastructure of physical servers and VMs

scan container images to reveal software with vulnerabilities

secure your registries: use access controls to limit who can publish images, or even access the registry; require images to be signed

harden container deployment including the OS of the underlying host, using firewalls, and VPC rules, and use limited access accounts

reduce the attack surface by minimizing the number of components in each container, and update and scan them frequently

Virtualization: System, host os , Hypervisor, guest OS, bin lib , apps

Containers: System, host os, bin abd lib, App..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Serverless architecture

A

Serverless architecture(AKAfunction as a service (FaaS)): a cloud computing concept where code is managed by the customer and the platform (i.e. supporting hardware and software) or servers are managed by the CSP

Applications developed on serverless architecture are similar to microservices, and each function is created to operate independently and automonomously

A serverless model, as in other CSP models, is a shared security model,and your organization and the CSP share security responsibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Embedded systems

A

form of computing component added to an existing mechanical or electrical system for the purpose of providing automation, remote control, and/or monitoring; usually including a limited set of specific functions

Example: microcontroller

40
Q

Hpc and it’s there main elements

A

High-performance computing (HPC)systems: platforms designed to perform complex calculations/data manipulation at extremely high speeds (e.g. super computers or MPP); often used by large orgs, universities, or gov agencies

An HPC solution is composed of three main elements:

compute resources

network capabilities

storage capacity

HPCs often implement real-time OS (RTOS)

HPC systems are often rented, leased or shared, which can limit the effectiveness of firewalls and invalidate air gap solutions

Securing HPC systems:

deploy head nodes and route all outside traffic through them, isolating parts of a system

“fingerprint” HPC systems to undersatnd use, and detect anomalous behavior

41
Q

Edge and fog computing

A

philosophy of network design where data and compute resources are located as close as possible, at or near the network edge, to optimize bandwidth use while minimizing latency

Securing edge computing:

this technology creates additional network edges that result in increased levels of complexity

visibility, control, and correlation requires a Zero Trust access-based approach to address security on the LAN edge, WAN edge and cloud edge, as well as network management

IoT devices collect data and transfer data to Central location for processing

42
Q

VM escape and VM sprawl

A

occurs when software within a guest OS is able to breach the isolation protection provided by the hypervisor

Org deployed numerous vm without IT management

43
Q

Explain 3 types of key exchange

A

Three main methods are used to exchange secret keys:

offline distribution

public key encryption, and

the Diffie-Hellman key exchange algorithm

44
Q

Key escrow

A

Key escrow: process or entity that can recover lost or corrupted cryptographic keys

multiparty key recovery: when two or more entities are required to reconstruct or recover a key

m of n control: you designate a group of (n) people as recovery agents, but only need subset (m) of them for key recovery

split custody: enables two or more people to share access to a key (e.g. for example, two people each hold half the password to the key)

Key rotation: rotate keys (retire old keys, implement new) to reduce the risks of a compromised key having access

45
Q

Ciphertext only attack

A

attack where you only have the encrypted ciphertext message at your disposal (not the plaintext)

If you have enough ciphertext samples, the idea is that you can decrypt the target ciphertext based on the ciphertext samples
One technique proves helpful against simple ciphers is frequency analysis (counting the number of times each letter appears in the ciphertext)

46
Q

Known plaintext

A

this attack, the attacker has a copy of the encrypted message along with the plaintext message used to generate the ciphertext (the copy); this knowledge greatly assists the attacker in breaking weaker codes

47
Q

Frequency analysis

A

attack where the characteristics of a language are used to defeat substitution ciphers

For example in English, the letter “E” is the most common, so the most common letter in an encrypted cyphertext could be a substitution for “E”

Other examples might include letters that appear twice in sequence, as well as the most common words used in a language

48
Q

Chosen ciphertext and differential analysis

A

chosen ciphertext attack, the attacker has access to one or more ciphertexts and their plaintexts; i.e. the attacker has the ability to decrypt chosen portions of the ciphertext message, and use the decrypted portion to discover the key

type of chosen plaintext attack, is a general form of cryptanalysis applicable primarily to block ciphers, but also to stream ciphers and cryptographic hash functions; in the broadest sense, it is the study of how differences in information input can affect the resultant difference at the output advanced methods such as differential cryptanalysis are types of chosen plaintext attacks;
as an example, an attacker may try to get the receiver to decrypt modified ciphertext, looking for that modification to cause a predictable change to the plaintext

49
Q

Large scale parallel data system and types

A

Computation system designed toBreaking large tasks into smaller ones by OS

Symmetric multiprocessing: common OS shared by processors
Asymmetric multiprocessing: processor operating independently of each other, dedicated data bus and memory

50
Q

Grid computing

A

Members of grid can join and leave grid where multiple processors group till work on a specific processing goal

51
Q

P2P

A

Distributed Application solutions that share tasks among peers

52
Q

ICS and it’s components

A

DCS: Need to gather data and implement control over a single location is essential - state driven and process focussed, interconnect several PLC
PLC : Single purpose or focused purpose to manage computers
SCADA (HMI): to manage large scale physical area to monitor wide range of PLC’s and DCS

53
Q

Distributed systems

A

Collection of systems to provide a service

Think DOS attack

54
Q

Blockchain

A

Collection of ledgers of records, transactions, timestamp working in distributed environment and each time there is change in records the ledger is updated and hashed in all the distributed systems

55
Q

Static system

A

No updates once built-in like ATM, gaming console

56
Q

Infrastructure as code

A

Hardware management to be treated the same as software code with proper version control, testing etc

57
Q

Immutable architecture

A

Pet versus cattle

58
Q

Elasticity and scalability in cloud computing

A

H/w characteristics:Expansion or contraction of resources to meet needs

S/W characteristics: Handle more tasks or workload

59
Q

VDI and types

A

Reduce security risk by hosting desktop and workstation OS

Persistent: customisable for user
Non persistent: if user makes changes it rolls back to default state

60
Q

MDM and UEM

A

To centrally manage mobile devices

To control mobile, IoT

61
Q

Context aware authentication

A

Geo-tagging, unrecognisable browser like logging into Google from cafe

62
Q

Geo location, geo tagging , geo fencing

A

Location services, automatically implementation of features

63
Q

Rooting in mobile devices

A

Break drm and to operate mobile device in full prevlige

64
Q

Mobile key management

A

Good key selection is based on rng’s

Best option is micro sd hsm or tpm

65
Q

Byod, cyod, coms, co-pe

A

Co-pe : User can use for work and activities

Cyod: list of approved devices and policy to be implemented

Coms: company purchase and support their security policy

66
Q

Covert channe andl types

A

Method of data transfer not designed for

Passing info on the path that’s not normally used for communication hence can’t be protected

Timing channel: modifying resources timing

Storage channel: Writing data to an area where another process can read it

67
Q

Rootkits

A

Embeds within OS or gain full control over a system with a combination of lateral movement and remain undetected

68
Q

Data didling , salami attack and incremental attacks

A

Modify transaction or make minor changes or delete files incrementally or slicing each time

69
Q

Secure facility

A

Risk analysis
Critical path analysis: critical process and operations

Secure facility plan: outlines the security needs of your organization and emphasizes methods or mechanisms to employ to provide security, developed through risk assessment and critical path analysis
critical path analysis (CPA): a systematic effort to identify relationships between mission-critical applications, processes, and operations and all the necessary supporting components
During CPA, evaluate potential technology convergence: the tendency for various technologies, solutions, utilities, and systems to evolve and merge over time, which can result in a single point of failure
A secure facility plan is based on a layered defense model

70
Q

Industrial camouflage

A

Make it look like a food retail

71
Q

CPTED

A

Crime Prevention Through Environmental Design (CPTED): a well-established school of thought on “secure architecture”

core principle of CPTED is that the design of the physical environment can be managed/manipulated, and crafted with intention in order to create behavioral effects or changes in people present in those areas that result in reduction of crime as well as a reduction of the fear of crime

CPTED stresses three main principles:

Natural surveillance
Natural actress control
Natural territorial reinforcement

72
Q

Power problem types

A

Commercial power problem types:

fault: momentary loss of power

blackout: complete loss of power

sag: momentary low voltage

brownout: prolonged low voltage

spike: momentary high voltage

surge: prolonged high voltage

inrush: initial surge of power associated with connecting to a power source

73
Q

Fire stages:

A

Stage 1: incipient stage: at this stage, there is only air ionization and no smoke
Stage 2: smoke stage: smoke is visible from the point of ignition
Stage 3: flame stage: this is when a flame can be seen with the naked eye
Stage 4: heat stage: at stage 4, there is an intense heat buildup and everything in the area burns

74
Q

Fire extinguisher class

A

Fire extinguisher classes:
Class A: common combustibles
Class B: liquids
Class C: electrical
Class D: metal
Class K: cooking material (oil/grease)

75
Q

4 main types of suppression system

A

Four main types of suppression:
wet pipe system: (AKA closed head system): is always filled with water. water discharges immediately when suppression is triggered
dry pipe system: contains compressed inert gas
preaction system: a variation of the dry pipe system that uses a two-stage detection and release mechanism
deluge system: uses larger pipes and delivers larger volume of water

76
Q

Zero trust components which needs to be protected

A

Verify identity
Manage devices
Manage apps
Protect data

77
Q

SOAR

A

Centralised alert and response automation with threat specific playbooks (Response automation) whereas SIEM monitoring automation

78
Q

MTTF, MTTR and MTBF

A

MTTF is time taken for the equipment to fail

MTTR time taken to repair after fault occurs

MTBF time taken to fail after subsequent failure

79
Q

Proximity devices

A
  • Passive proximity device
  • Field powered proximity device: EM
  • Transponder : press of a button it opens
80
Q

Intrusion alarm

A

Deterrent
Repellent
Notification alarm

81
Q

Power considerations

A

Surge protectors
Power conditioner
Ups - Double conversion and line interactive - voltage regulators and surge protectors
Generator
Battery backup

82
Q

Properties of Reference monitors concept

A

Isolation
Verifiable
Completness

83
Q

2 methods of process isolation

A

Memory segmentation

Time division multiplexing

84
Q

Difference between siem and soar

A

Siem is notification vs soar is response analysis

85
Q

Grid computing vs fog computing

A

Centralised Vs gateway devices to collect data

86
Q

CASB

A

Security policy enforcement

Shadow IT prevention

87
Q

Key clustering

A

2 keys using same algorithm to give same result

Same as collision

88
Q

Meet in middle

A

Attacker needs 2 rounds of encryption

89
Q

3 key major PK cryptography

A

RSA - Factoring

El Gamal - less common than RSA

Elliptic curve - Discrete Algorithm provides more security than other algorithms when both are used with keys of the same length

90
Q

Functional order of security controls

A

Deter

Deny

Detect

Delay

Determine

Decide

91
Q

3 ways Cipher text coverts plaintext ?

A

Ciphers convert messages from plaintext to ciphertext on a bit basis (that is, a single digit of a binary code), character basis (that is, a single character of an ASCII message), or block basis (that is, a fixed-length segment of a message, usually expressed in number of bits).

92
Q

Does digital signature provide confidentiality? If yes or no how does it provide ?

A

No it does not it only provide AIN and if you want to provide confidentiality then message has to be encrypted using receiver public key

93
Q

In PKI why & how can CA protect their own private keys ?

A

Certificate authorities must carefully protect their own private keys to preserve their trust relationships. To do this, they often use an offline CA to protect their root certificate, the top- level certificate for their entire PKI. This offline CA is disconnected from networks and pow- ered down until it is needed. The offline CA uses the root certificate to create subordinate intermediate CAs that serve as the online CAs used to issue certificates on a routine basis.

.

94
Q

What is certificate chaining?

A

In the CA trust model, the use of a series of intermediate CAs is known as certificate chaining. To validate a certificate, the browser verifies the identity of the intermediate CA(s) first and then traces the path of trust back to a known root CA, verifying the identity of each link in the chain of trust

95
Q

What is difference between allow listing and deny listing in firewall etc. ?

A

Application allow listing (previously known as whitelisting ) is a security option that pro- hibits unauthorized software from being able to execute. Allow listing is also known as deny by default or implicit deny .

This is a significant departure from the typical device-security stance, which is to allow by default and deny by exception (also known as deny listing or block listing, previ- ously known as blacklisting)

Cissp (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions