Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIS3360 > Computer Security Overview > Flashcards

Computer Security Overview Flashcards

1
Q

C.I.A. Triad

A

Confidentiality, Integrity, & Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

preventing unauthorized disclosure of information

A

Data Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources (includes hardware, software, firmware, information/data, and telecommunications).

A

Computer Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

preventing unauthorized collection of personal information

A

Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

preventing unauthorized changes to data and programs

A

Data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Two types of Confidentiality

A

Data & Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Two types of Integrity

A

Data & System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ensuring that the system can perform as intended

A

System integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Ensuring that systems work promptly and service is not denied to authorized users

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Encryption, Access Control, Authentication, Authorization, and Physical Security are methods for achieving what?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

transforming the information so it is useful only to the intended recipient or user

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

rules and policies that limit access to private information

A

Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

determining who the user is (e.g., password, token, fingerprint)

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

determining the level of access (per access control policies)

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

for example, placing sensitive data in a closed room with no communication links, so one would need to be in the room to access the data

A

Physical Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Backups, checksums, and Data correcting codes are methods for achieving what?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

periodic archiving, to support restoration.

A

Backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

computing a numerical value based on the contents of an entire file, to support the detection of alterations

A

Checksums

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

low-level codes for automatically correcting errors, such as for retransmitting packets when communicating.

A

Data correcting codes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Physical protections and Computational redundancies are methods for achieving what?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Backup power supplies and redundant disk storage help achieve what?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

infrastructure meant to keep information available even in the event of physical challenges

A

Physical protections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

computers and storage devices that serve as fallbacks in the case of failures

A

Computational redundancies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

the property of being genuine and being able to be verified and trusted
i.e., that users are who they say they are, and each input arriving at the
system is from a trusted source

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The primary tool of ___ is digital signatures, to support nonrepudiation

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

the property that actions of an entity (person, system) be uniquely traced to that entity
i.e., to trace a security breach to a responsible party

A

Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

activity logs to support nonrepudiation, deterrence, fault isolation, intrusion detection and prevention, and after-action and legal action is an example of…

A

Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

security breach loss could be expected to have a limited adverse effect on organization operations, assets, or individuals

A

Low impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

security breach loss could be expected to have a serious adverse effect on organization operations, assets, or individuals

A

Moderate impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

security breach loss could be expected to have a severe or catastrophic adverse effect on organization operations, assets, or individuals

A

High impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Truly ___systems are not yet achievable

A

secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

___ need to find only a single weakness, but ___ must find all weaknesses

A

Attackers, developers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Users and system managers tend not to see the benefits of ___ until a failure occurs

A

security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

___ is often considered as an add-on after the system is fully designed

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Often considered as an impediment to efficient and user-friendly operation

A

security

36
Q

An entity that attacks, or is a threat to, a system

A

Adversary (threat agent)

37
Q

An assault on system security that derives from an intelligent threat; that is, an intelligent act that is a deliberate attempt (especially in the sense of a method or technique) to evade security services and violate the security policy of a system.

A

Attack

38
Q

An action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that corrective action can be taken

A

Countermeasure

39
Q

An expectation of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a prticular harmful result.

A

Risk

40
Q

A set of rules and practices that specify or regulate how a system or organization provides security services to protect sensitive and critical system resources

A

Security Policy

41
Q

Data contained in an information system; or a service provided by a system; or a system capability, such as processing power or communication bandwidth; or an item of system equipment (i.e., a system component–hardware, firmware, software, or documentation); or a facility that houses system opertations and equipment.

A

System Resource (Asset)

42
Q

A potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm. That is, a ___ is a possible danger that might exploit a vulnerability.

A

Threat

43
Q

A flaw or weakness in a system’s design, implementation, or operation and management that could be exploited to violate the system’s security policy.

A

Vulnerability

44
Q

Hardware, Software, Data, and Communication facilities and networks

A

Assets of a Computer System

45
Q

computer systems, other data processing, data storage, and data communications devices

A

Hardware

46
Q

operating system, system utilities, applications

A

software

47
Q

files, databases, security-related data (e.g. password files)

A

data

48
Q

LAN and WAN links, bridges, routers, etc.

A

Communication facilities and networks

49
Q

a weakness that can be exploited by an attack

A

Vulnerability

50
Q

Corrupted (loss of integrity), Leaky (loss of confidentiality), Unavailable or very slow (loss of availability). These are catagories of…

A

vulnerabilities

51
Q

something or someone that is capable of exploiting a vulnerability; represents a potential security harm to a system resource

A

threat

52
Q

a threat that is carried out by some action by a threat agent; if successful, results in a violation of the system’s security policy

A

attack

53
Q

Active, Passive, inside, and outside are types of…

A

attacks

54
Q

attempt to alter system resources or affect their operation

A

active attack

55
Q

attempt to learn or make use of information from the system without affecting system resources

A

passive attack

56
Q

initiated by an entity (“insider”) inside the security perimeter

A

inside attack

57
Q

initiated from the outside, by an unauthorized or illegitimate user (“outsider”) of the system.

A

Outside attack

58
Q

any means to prevent, detect, or recover from a security attack

A

Countermeasure

59
Q

Despite countermeasures, residual ___ may remain

A

vulnerabilities

60
Q

Countermeasures can themselves introduce new…

A

vulnerabilities

61
Q

The goal of ___ is to minimize the residual level of risk to the assets

A

countermeasures

62
Q

access control, identification and authentication, system and communication protection, and system and information integrity. These are examples of functional security requirements that primarily involve ___ measures.

A

technical

63
Q

awareness and training; audit and accountability; certification, accreditation, and security assessments; contingency planning; maintenance; physical and environmental protection; planning; personnel security; risk assessment; and systems and services acquisition.
These are examples of functional security requirements that primarily involve ___ controls and procedures .

A

management

64
Q

Most functional security requirements most are either primarily ___ or have some ___ component (same word)

A

management

65
Q

i.e., keep it simple

A

economy of mechanism

66
Q

e.g., default is lack of access

A

fail-safe defaults

67
Q

i.e., do not rely on cached answers to grant access

A

complete mediation

68
Q

i.e., publish encryption algorithms, but keep keys secret

A

open design

69
Q

e.g., multifactor user authentication

A

separation of privilege

70
Q

every process/user should have least ___ to perform task

A

privilege

71
Q

i.e., separate user functions as much as possible

A

least common mechanism

72
Q

i.e., security should intrude minimally with user work

A

psychological acceptability

73
Q

i.e., separate systems/processes/files as much as possible

A

isolation

74
Q

i.e., object-oriented concept for protecting data

A

encapsulation

75
Q

i.e., use a modular architecture, to facilitate upgrades/maintenance

A

modularity

76
Q

i.e., provide multiple levels of security

A

layering

77
Q

i.e., programs and UIs should respond in understandable ways

A

least astonishment

78
Q

___ are the reachable and exploitable vulnerabilities in a system

A

Attack surfaces

79
Q

a hierarchical data structure; represents iterative refinement of the steps an attacker could take to achieve a particular security breach

A

attack tree

80
Q

An overall strategy for providing ___ often consists of policy, implementation, assurance, and evaluation.

A

computer security

81
Q

typically, a formal statement of rules and practices specifying how a system or organization provides security services to protect system assets

A

Security policy

82
Q

covers the measures for prevention, detection, response, and recovery

A

Security implementation

83
Q

covers analysis determining the “degree of confidence” that the system’s security measures will work as intended

A

Assurance

84
Q

examining a computer product or system with respect to formal criteria; can include testing and/or formal mathematical analysis. e.g., analysis and testing of a new encryption algorithm

A

Evaluation

85
Q

the assurance that someone cannot deny the validity of something.

A

Non-Repudiation

CIS3360 (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions