Cloud Data Security Flashcards
1
Q
What are the common stages of the data lifecycle?
A
- Create
- Store
- Use
- Share
- Archive
- Destroy
2
Q
Data created by the user should be ______ before uploading to the cloud or if created within the cloud.
A
Encrypted
3
Q
Packet capture, on-path attacks, and insider threats are all prevented by _____.
A
encryption on data created remotely
4
Q
______ helps to analyze networks, manage network traffic, and identify network performance issues. It also allows IT teams to detect intrusion attempts, security issues, network misuse, packet loss, and network congestion.
A
Packet capture
5
Q
An ________ is when an attacker sits in the middle between two stations and intercepts, and in some cases, changes the information being sent interactively across the network.
A
On-path attack
6
Q
What is a means to secure network traffic?
A
Using TLS (Transport Layer Security) through an HTPPS connection.
7
Q
- Provisioning access rights
- Securing storage locations
- Protect data thru encryption at rest
Are all security controls that are vital during _____ phase?
A
Store
8
Q
What is the set of features an application provides so that a user may supply input to and receive output from the program.
A
An application interface
9
Q
What are mechanisms that enable two software components to communicate with each other using a set of definitions and protocols?
A
APIs
10
Q
What contains information on how developers are to structure the communication (requests and responses) between two applications?
A
API documentation
11
Q
The application sending the request is called the _____, and the application sending the response is called the _____.
A
Client, server
12
Q
What is the most popular and flexible APIs found on the web today, where the client sends requests to the server as data, and the server uses this client input to start internal functions and returns output data back to the client.
A
REST APIs
13
Q
Data must be protected when it is:
A
Stored, in transit, and at rest.
14
Q
- Strong protections in virtualization and shared service implementation
- Ensure data on virtualized host can’t be read/detected by other VHs on same device
- Implement personnel/admin controls so workers can’t access raw cust data
A
How CSPs ensure they provide secure environments for data use
15
Q
- Encryption
- IRM
- Tagging and permissions models
- Jurisdiction/legal restrictions (via export or import controls)
- Egress monitoring
A
Key controls for the Share phase
16
Q
Export restriction that covers State Department prohibitions on defense-related exports:
A
International Traffic in Arms Regulations (ITAR)
17
Q
Export restriction that covers Dept of Commerce prohibitions on dual-use (commercial and military) items:
A
Export Admin Regulations (EAR)
18
Q
Import restriction on cryptosystems or encrypted material:
A
Cryptography
19
Q
Import restriction where 41 member countries agreed to mutually inform each other about conventional military shipments to non-member countries:
A
The Wassenaar Arrangement
20
Q
What are the security considerations for the Archive phase?
A
Cryptography and key management
21
Q
Cryptography methodology that uses an algebraic elliptical curve that results in smaller keys that can provide the same level of security as the larger ones:
A
Elliptical Curve Cryptography
22
Q
What areas of physical security are important to consider in Archive phase?
A
Location, format, staff, and procedure.
23
Q
What is storage specifically designed to be used for extended periods of time?
A
Long-term storage.
24
Q
Amazon Glacier, Azure Archive Storage, and Google Coldline and Archive
A
3 examples of long-term storage
25
What is storage for data that exists only as long as an instance does?
Ephemeral storage
26
What is storage you have direct access to?
Raw storage
27
What are some examples of raw storage?
Hard drive, SSD. You have direct access to underlying storage rather than a storage service.
28
What is the type of storage that's represented as a drive attached to the user's virtual machine?
Volume storage
29
A type of volume storage where data is stored/displayed as files and folders:
File storage - file level storage - file based storage
30
A blank volume that the customer/user can put anything into.
Block storage.
31
Volume storage can be offered in any cloud service model but is often associated with _____.
IaaS
32
Object based storage includes:
Production content and metadata for object stored
33
Object storage can be in any service model but is usually associated with _____.
IaaS
34
In the cloud, the database is usually ________, accessed by users utilizing _______.
Back-end storage in the data center
Online apps or APIs through a browser
35
- Traditional relational databases
- Nonrelational databases (key-value databases)
- Document oriented databases
Are types of databases CSPs may provide
36
Databases are most often configured to work with ______.
Paas and Saas
37
Security methods for databases are:
- Minimizing datasets
- Anonymization/
pseudonymization
38
- Exposure and malicious access
- Risks to data integrity
- Exposure of data
- DDoS
Long term storage threats
39
Same as long term + risk to IR and forensics b/c the devices may be automatically destroyed when systems are terminated unless intentionally preserved.
Ephemeral storage threats
40
Leaving fragments of data available to next user are _____ threats.
Raw storage
41
What is a security exploit that aims to gather information from or influence the program execution of a system by measuring or exploiting indirect effects of the system or its hardware -- rather than targeting the program or its code directly.
Side channel attack
42
Encryption is used to protect data ________.
At rest, in transit, and in use.
43
Encryption is used w/in the customer's enterprise environment to ______, and within the datacenter to ______.
Protect data
Keep tenants from accessing each other's data.
44
What are strings of bits that allow for encryption/decryption to occur?
Encryption keys
45
Encryption keys must be at ______ as the data they protect.
Same level of control or higher
46
What type of encryption is where the encryption key is stored in the database itself?
Transparent encryption
47
What is a device that can safely create, store, and manage encryption keys and is used in servers, data transmission, and log files?
HSM = Hardware security module
48
This is used to hold keys in a secure way so they can be recovered by authorized parties.
Key escrow
49
What are two reasons a key escrow might be used?
Incident response
Legal holds
50
T/F: Keys should be stored in the CP's data center.
False - somewhere other
51
What are 3rd party providers that handle IAM and key management services?
CASB - Cloud Access Security Broker
52
T/F: The cost of using a CASB is higher than maintaining keys within the org.
False - much lower
53
What are the commonly used CASBs?
Zscaler, Netskope, and McAfee's Enterprise CASB tool.
54
What is a common issue with keys in the cloud?
Inadvertent exposure of private keys in public repositories.
55
Malicious actors can scan _________ looking for private keys that may have been uploaded w/ other materials when coding projects are submitted.
GitHub and other code repositories
56
Certificates rely on a _______.
Public and private key
57
Certificates may be _______
Self-generated or generated by a CA (Certificate Authority)
58
What uses an algorithm to transform a given string of characters into another value?
Hashing
59
T/F: Hash output is smaller than input provided.
True
60
What are two uses of hashes?
- Checking if a file has changed
- Storing and retrieving data quickly
61
T/F: You can decrypt a hash value.
False
62
T/F: Hashes are one-way functions that have keys.
F - they don't have keys
63
What allows you to determine what the input was for a given hash?
Rainbow table
64
What is the technique to make data less meaningful, detailed, or readable?
Obfuscation
65
What is the replacement of date or part of the data w/ randomized info?
Randomization
66
When is randomization useful?
When you want to remove the real data but maintain its attributes.
67
Removing identifiable data is _____.
Anonymization
68
What involves using a one-way cryptographic function to create a digest of the original data?
Hashing
69
What is using different entries from within the same dataset to represent the data?
Shuffling
70
What is hiding the data with useless characters?
Masking
71
What is deleting raw data before it is represented?
Nulls
72
What is replacing sensitive data with a replacement value called a token?
Tokenization
73
Obscuring can be done in ______ or _____ configurations.
Dynamic or static
74
New dataset is created as a copy from the original data.
Static obscuring
75
Data is obscured as it's accessed.
Dynamic obscuring
76
Tokenization is the process of having two distinct databases:
One w/ live, actual sensitive data and one with nonrepresentational tokens mapped to each piece of that data.
77
PCI DSS allows _______ instead of _______ for sensitive cardholder data.
Tokenization, encryption
78
DLP tools are also sometimes called:
Egress monitoring tools
79
DLP identifies controlled data using:
Tagging, pattern matching, etc.
80
- Search for numeric strings to detect SSN
- Use categorization/labels/metadata
- Use keyword searches
DLP functions
81
The monitoring task can be implemented:
At points of network egress or on all hosts that process data within the production environment.
82
Downsides of DLP:
- High processing overhead
- Complicated config and usage due to insufficient data center access
83
What are Amazon, Azure, and Google monitoring services called?
CloudWatch, Azure Monitor, GCP Operations Suite
84
What are the basic elements of any log you capture:
Identity, IP address, geolocation, time stamps
85
ID what you log, what events are most important, which should be alerted, where logs are stored/analyzed, how long you will retain, and how you will secure when designing _____
data security models and architecture
86
What are the best practices for logging and analysis for Amazon, Azure, and Google?
Well-Architected Tools, Well-Architected Framework, Cloud Architecture Framework
87
- Centralize collection of log data
- Enhance analysis capabilities
- Dashboarding
- Automated response
SIEM goals
88
SIEMs are only useful when:
Someone actually looks at what they produce.
89
Data should always be stored in
more than one location
90
– Local: replicas within a single datacenter
– Zone: replicas to multiple datacenters within a region
– Global: region level resiliency (replicas to backup region)
Cloud storage for IaaS levels of storage redundancy
91
Is useful to gain visibility and ensure that adequate security controls are implemented
data flow diagram
92
* Decreased development time and faster deployment of new system features.
* Visibility into data movement, critical for regulatory compliance, where data security is often mandated in law.
These are benefits of a _____.
data flow diagram
93
T/F: Creating the DFD can be both a risk assessment activity and a crucial compliance activity.
True
94
Ephemeral, raw, long term, volume, and object storage are associated with:
IaaS
95
Disk, databases, binary large object (blob) are associated with
PaaS
96
Information storage and management, content and file storage, content delivery network (CDN) are associated with
SaaS
97
- Raw Storage. Physical media, allows a VM access a storage LUN
- Volume storage. Attached as IaaS Instance (EC)
- Object storage. S3 storage bucket, Azure storage
IaaS
98
– Structured. Relational databases
– Unstructured. Big data
PaaS
99
– Information Storage and Mgmt. Data entered via the web interface
– Content/File Storage. File based content
– Ephemeral Storage. It used for any temporary data such as cache, buffers, session data, swap volume, etc.
– Content Delivery Network (CDN) Geo distributed content for (better UX)
SaaS
100
– Unauthorized access threatens
– Improper modification threatens
– Loss of connectivity threatens
C
I
A
101
— Jurisdictional issues
— Denial of service
— Data corruption/destruction
— Theft or media loss
— Malware and ransomware
— Improper disposal
threats to storage
102
Primarily a cost and operational concern. Ease of use can lead to unofficial use, unapproved deployment, and unexpected costs
unauthorized provisioning - shadow IT
103
Privacy legislation bars data transfer to countries without adequate privacy protections, like _____
Germany
104
Defenses for data corruption/destruction are least privilege, _____, and offsite data backups
RBAC
105
Who retains responsibility for preventing the loss of physical media through appropriate physical security controls?
CSP
106
Who is responsible for hardware disposal?
CSP
107
- Back up your computer
- Store backups separately
- File auto versioning
ransomware countermeasures
108
- Update and patch computers
- Use caution with web links
- Use caution with email attachments
- Verify email senders
- Preventative software programs
- User awareness training
ransomware prevention
109
Relies on the use of a single shared secret key. Lacks support for scalability, easy key
distribution, and nonrepudiation
symmetric
110
Public private key pairs for communication between parties. Supports scalability, easy
key distribution, and nonrepudiation
asymmetric
111
_____keys are shared among communicating parties. _____ keys are kept secret.
Public / Private
112
To encrypt a message:
To decrypt a message:
use the recipient’s public key / use your own private key
113
To sign a message:
To validate a signature:
use your own private key / use the sender’s public key
114
bridge, hierarchical, hybrid, and mesh.
trust models used with public key infrastructure ( PKI)
115
Many CSPs offer FIPS compliant virtualized _____ to securely generate, store, and control access to cryptographic keys.
HSMs
116
Organizations that use multiple cloud providers or need to retain physical control over key management may need to implement a _____
bring-your-own-key (BYOK) strategy
117
Provides encryption of data as it is written to storage, utilizing keys that are controlled by the CSP.
storage-level encryption
118
Provides encryption of data written to volumes connected to specific VM instances, utilizing keys controlled by the customer.
Volume-level encryption
119
Encryption of objects as they are written to storage, in which case the CSP likely controls the keys and could potentially access the data.
object-level encryption
120
Implemented in client apps, such as word processing apps like Microsoft
Word or collaboration apps like SharePoint
file level encryption
121
Implemented in an application typically using object storage. Data entered by user typically encrypted before storage
Application level encryption
122
Transparent data encryption (database files, logs, backups), column level or row level encryption, or data masking
Database level encryption
123
The process of removing all relevant data so that it is impossible to identify original subject or person. If done effectively, then GDPR is no longer relevant for the data.
Anonymization
124
De identification procedure using pseudonyms (aliases) to represent other data. Can result in less stringent requirements than would otherwise apply under the GDPR.
Pseudonymization
125
A one way function that scrambles plain text to produce a unique message digest. Conversion of a string of characters into a shorter fixed length value. No way to reverse if properly designed
hashing
126
Verification of digital signatures
Generation of pseudo random numbers
Integrity services
uses of hashing
127
1. They must allow input of any length.
2. Provide fixed length output.
3. Make it relatively easy to compute the hash function for any input.
4. Provide one way functionality.
5. Must be collision free.
5 requirements of good hash functions
128
A system designed to identify, inventory, and control the use of data that an
organization deems sensitive. Spans several categories of controls including detective, preventative, and corrective.
DLP
129
Is a way to protect sensitive information and prevent its inadvertent disclosure. Can identify, monitor, and automatically protect sensitive information in documents monitors for and alerts on for potential breaches, policy violations like oversharing
DLP
130
Are used to verify the identity of a communication party and can also be used for asymmetric encryption by providing a trusted public key. Often used to encrypt a shared session key or other symmetric key for secure transmission.
Certificates
131
This is an encrypted hash of a message, encrypted with the sender’s private key. In a signed email scenario, it provides three key benefits:
Authentication. This positively identifies the sender of the email. Ownership of a digital signature secret key is bound to a specific user
Non repudiation. The sender cannot later deny sending the message. This is sometimes required with online transactions
Integrity. Provides assurances that the message has not been modified or
corrupted. Recipients know that the message was not altered in transit
digital signature
132
Include cryptographic protocol design, key servers, user procedures, and other relevant protocols.
Key Management Design Considerations
133
Create digital certificates and own the policies.
Certification Authorities
134
A trust anchor in a PKI environment from which the whole chain of trust is derived.
the root certificate
135
A Domain Validated (DV) certificate is an X.509 certificate that
proves the ownership of a domain name.
136
Extended validation certificates provide _____ in identifying the entity that is using the certificate.
a higher level of trust
137
Usually maintained in an offline state.
Issues certs to new subordinate CAs.
root ca
138
Also called a Policy CA or Intermediate CA. Issues certs to new issuing CAs. Have the ability to revoke certificates.
Subordinate CA
139
Certificates for clients, servers, devices, websites, etc. issued from here
issuing ca
140
If the issuing CA is breached, its certificate can be
revoked and a new one issued.
141
Contains information about any certificates that have been revoked by a subordinate CA due to compromises to the certificate or PKI hierarchy.
Certificate revocation list (CRL)
142
T/F: CAs are required to publish CRLs, but it’s up to certificate consumers if they check these lists and how they respond if a certificate has been revoked.
True
143
Two potential options for tracking revocation:
ask for the CRL or if available, OCSP endpoint/service.
144
Endpoint to query for CRL or OCSP is on the _____
certificate
145
Offers a faster way to check a certificate’s status compared to downloading a CRL in which the consumer of a certificate can submit a request to obtain the status of a specific certificate.
OCSP - online certificate status protocol
146
Records identifying information for a person or device that owns a private key as well as information on the corresponding public key. It is the message that's sent to the CA in order to get a digital certificate created.
Certificate signing request (CSR)
147
the Fully Qualified Domain Name (FQDN) of the entity (e.g web server)
CN (common name)
148
Metadata, or data that describes data, is a critical part of discovery in structured data
Semantics, or the meaning of data, is described in the schema or data model and explains relationships expressed in data.
discovery methods for structured data
149
How does unstructured data discovery occur?
through content analysis, like:
Pattern matching, which compares data to known formats like
credit card numbers.
Lexical analysis: attempts to find data meaning and context to
discover sensitive info that may not conform to a specific pattern
Hashing: attempts to identify known data by calculating a hash of
files and comparing it to a known set of sensitive file hashes
150
JSON, XML, HTML, email messages, NoSQL
semi-structured data - may contain meta data to help organize
151
T/F: Network-based DLP may not analyze all traffic between on premises endpoints and cloud.
True
152
T/F: An optimal DLP approach will discover data in on-premises and in cloud repositories, as well as in transit
True
153
T/F: Tools must be able to scan unstructured data within structured data sources, such as relational databases.
True
154
T/F: If a single data classification label has to be placed on a large data source the most sensitive classification found will apply
True
155
T/F: Both unstructured and structured in same repository will increase tool cost and complexity and may present classification challenges
True
156
Exceptionally grave damage
Serious damage
Damage
No damage
top secret/confidential/proprietary
secret/private
confidential/sensitive
unclassified/public
157
Who regulates PHI?
HIPAA
HITRUST
158
Brings understanding that enables implementation of security controls and classification polices. Usually precedes classification and labeling
mapping
159
Enforce data rights, provisioning access, and implementing access control model. Often implemented to control access to data designed to be shared but not freely distributed. Can be used to block specific actions, like print, copy/paste, download, and sharing. Provide file expiration so that documents can no longer be viewed after a specified time
IRM programs
160
persistence
dynamic policy control
expiration
continuous audit trail
interoperability
IRM objectives
161
- Centralized service for identity proofing and certificate issuance, store of revoked certificates, and for unauthorized identify information access.
- Enables enforcement from anywhere.
- Secrets storage: These solutions require local storage for encryption keys, tokens, or digital certificates used to validate users and access authorizations.
- Local storage requires protection primarily for data integrity to prevent tampering
IRM
162
Provides inventor exclusive use of their invention for a period of time, generally 20 years.
patent
163
Retention happens b/w _____.
archive and destroy
164
- Data Encryption
- Data Monitoring
- eDiscovery and Retrieval
- Backup and DR Options
- Data Format
- Media Type
key elements of data archiving
165
To maintain data governance, it is required that all data access and movements be _____
tracked and logged.
166
T/F: Accountability, traceability, auditability should be maintained in data archiving
True
167
Directly promotes good user behavior and compliance with the organization’s security policy.
auditing
168
Help ensure that management programs are effective and being followed. Commonly associated with account management practices to prevent violations with least privilege or need to know principles. Can also be performed to oversee many programs and processes
security audits and reviews
169
T/F: Because the cloud customer has nearly full control over their compute environment in IaaS, including system and network capabilities, virtually all logs and data events should be exposed and available for capture.
True - same level of detail on app level in PaaS
170
T/F: In SaaS, customer responsibility is limited to access control, shared responsibility for data recovery, and feature configuration
True
171
Sufficient user ID attribution should be accessible, or it may be impossible to determine who performed a specific action at a specific time.
identity attribution
172
What should logs be able to answer?
“Who did (source address and user identity)
what, (event type, severity, flag, and description)
when, (date, time, interaction identifier)
and from where?” Application identifier (name, version, etc.), application address, Service, Geolocation, Window/for/page (URL and HTTP method), and Code location
(script or module name)
173
Provides evidence integrity through convincing proof evidence was not tampered with in a way that damages its reliability.
chain of custody
174
Documents key elements of evidence movement and handling, including :
- Each person who handled the evidence
- Date and time of movement/transfer
- Purpose evidence movement/transfer
chain of custody
175
Inclusion of sufficient evidence in log files
Digital Signatures
methods to provide non-repudiation
