CompTIA Security+ Flashcards
study
Confidentiality
Ensures that unauthorized individuals are not able to gain access to sensitive information.
Integrity
ensures that there are no unauthorized modifications to information or systems, either intentionally or unintentionally.
Availability
ensures that information and systems are ready to meet the needs of legitimate users at the time those users request them.
Nonrepudiation
while not part of the CIA triad, is also an important goal of some cybersecurity controls. ________ means that someone who performed some action, such as sending a message, cannot later deny having taken that action.
Security incidents
occur when an organization experiences a breach of the confidentiality, integrity, and/or availability of information or information systems.
Disclosure
is the exposure of sensitive information to unauthorized individuals, otherwise known as data loss.
Alteration
is the unauthorized modification of information and is a violation of the principle of integrity.
Denial
is the disruption of an authorized user’s legitimate access to information.
Financial risk
is, as the name implies, the risk of monetary damage to the organization as the result of a data breach.
Reputational risk
occurs when the negative publicity surrounding a security breach causes the loss of goodwill among customers, employees, suppliers, and other stakeholders.
Strategic risk
is the risk that an organization will become less effective in meeting its major goals and objectives as a result of the breach.
Operational risk
is risk to the organization’s ability to carry out its day-to-day functions.
Compliance risk
occurs when a security breach causes an organization to run afoul of legal or regulatory requirements. F
Gap Analysis
the cybersecurity professional reviews the control objectives for a particular organization, system, or service and then examines the controls designed to achieve those objectives. If there are any cases where the controls do not meet the control objective, that is an example of a ___.
Technical controls
enforce confidentiality, integrity, and availability in the digital space. Examples of ________ security controls include firewall rules, access control lists, intrusion prevention systems, and encryption.
Operational controls
include the processes that we put in place to manage technology in a secure manner. These include user access reviews, log monitoring, and vulnerability management.
Managerial controls
are procedural mechanisms that focus on the mechanics of the risk management process. Examples of administrative ______ controls include periodic risk assessments, security planning exercises, and the incorporation of security into the organization’s change management, service acquisition, and project management practices.
Physical controls
are security controls that impact the ______ world. Examples of _______ security controls include fences, perimeter lighting, locks, fire suppression systems, and burglar alarms.
Preventive controls
intend to stop a security issue before it occurs. Firewalls and encryption are examples of _______ controls.
Deterrent controls
seek to prevent an attacker from attempting to violate security policies. Vicious guard dogs and barbed wire fences are examples of ________ controls.
Detective controls
identify security events that have already occurred. Intrusion detection systems are ________ controls.
Corrective controls
remediate security issues that have already occurred. Restoring backups after a ransomware attack is an example of a ______ control.
Compensating controls
are controls designed to mitigate the risk associated with exceptions made to a security policy.
Directive controls
inform employees and others what they should do to achieve security objectives. Policies and procedures are examples of _______ controls.
Data at rest
is stored data that resides on hard drives, tapes, in the cloud, or on other storage media. This data is prone to theft by insiders or external attackers who gain access to systems and are able to browse through their contents.
Data in transit
is data that is in motion/_____ over a network. When data travels on an untrusted network, it is open to eavesdropping attacks by anyone with access to those networks.
Data in use
is data that is actively in use by a computer system. This includes the data stored in memory while processing takes place. An attacker with control of the system may be able to read the contents of memory and steal sensitive information.
Encryption
technology uses mathematical algorithms to protect information from prying eyes, both while it is in transit over a network and while it resides on systems.
Data Loss Prevention (DLP)
systems help organizations enforce information handling policies and procedures to prevent data loss and theft.
DLP systems work in two different environments:
NAME?
Agent-based DLP
-uses software agents installed on systems that search those systems for the presence of sensitive information. These searches often turn up Social Security numbers, credit card numbers, and other sensitive information in the most unlikely places!
Agentless (network-based) DLP
systems are dedicated devices that sit on the network and monitor outbound network traffic, watching for any transmissions that contain unencrypted sensitive information. They can then block those transmissions, preventing the unsecured loss of sensitive information.
DLP systems also have two mechanisms of action:
NAME?
Pattern matching
where they watch for the telltale signs of sensitive information.
Watermarking
where systems or administrators apply electronic tags to sensitive documents and then the DLP system can monitor systems and networks for unencrypted content containing those tags
Hashing
uses a _____ function to transform a value in our dataset to a corresponding hash value. If we apply a strong _____ function to a data element, we may replace the value in our file with the ______ value
Tokenization
replaces sensitive values with a unique identifier using a lookup table. For example, we might replace a widely known value, such as a student ID, with a randomly generated 10-digit number.
Masking
partially redacts sensitive information by replacing some or all sensitive fields with blank characters.
Access restrictions
are security measures that limit the ability of individuals or systems to access sensitive information or resources.
Two common types of access restrictions:
NAME?
Geographic restrictions
limit access to resources based on the physical location of the user or system.
Permission restrictions
limit access to resources based on the user’s role or level of authorization.
Segmentation
places sensitive systems on separate networks where they may communicate with each other but have strict restrictions on their ability to communicate with systems on other networks.
Isolation
goes a step further and completely cuts a system off from access to or from outside networks.
