Computer Security Principles and Terminology Flashcards
Computer Security definition
measures and controls that ensure confidentiality, integrity, and availability of information processed and stored by a computer, including software, hardware, firmware, information data, and telecommunications
Essential Network and Computer Security Requirements
Confidentiality
Integrity
Availability
Accountability
Authenticity
Confidentiality
The preservation of authorized restrictions on information access and disclosure (protecting personal privacy and proprietary information)
Integrity
Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity
Availability
ensuring timely and reliable access to and use of information
Low Impact
limited adverse effect on the effected (organizations, individuals)
Moderate Impact
Serious adverse effect on the effected
High
Severe or catastrophic adverse effect
Adversary (threat agent)
Individual, group, organization, or government that conducts or has the intent to conduct detrimental activities
Attack
Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself
Countermeasure
A device or technique that has as its objective the impairment of the operational effectiveness of undesirable or adversarial activity, or the prevention of espionage, sabotage, theft, or unauthorized access to or use of sensitive information or information systems
Risk
A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of 1) the adverse impacts that would arise if the circumstance or event occurs; and 2) the likelihood of occurrence
Security Policy
A set of criteria for the provision of security services. It defines and constrains the activities of a data processing facility in order to maintain a condition of security for systems and data
System Resource (Asset)
A major application, general support system, high impact program, physical plant, mission critical system, personnel, equipment, or a logically related group of systems
Threat
Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through a information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service
Vulnerability
Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source
Assets of a Computer System
Hardware
Software
Data
Communication facilities and networks
Categories of vulnerabilities
Corrupted (loss of integrity)
Leaky (loss of confidentiality)
Unavailable or very slow (loss of availability)
Threats
Capable of exploiting vulnerabilities
Represent potential security harm to an asset
Attacks (threats carried out)
Active - attempt to alter system resources or affect their operation
Passive - attempt to learn or make use of system information that does not affect system resources
Insider - initiated by an entity inside the security parameter
Outsider - initiated from outside the perimeter
Countermeasures
prevention, detection, recovery
may introduce new vulnerability, residual vulnerabilities may remain
goal is to minimize residual level of risk to the assets
Unauthorized Disclosure
A circumstance or event whereby an entity gains unauthorized access to data
Unauthorized Disclosure Threat Actions
Exposure: Sensitive data are directly released to an unauthorized
entity.
Interception: An unauthorized entity directly accesses sensitive data traveling between authorized sources and destinations.
Inference: A threat action whereby an unauthorized entity indirectly accesses sensitive data (but not necessarily the data contained in the communication) by reasoning from characteristics or by-products of communications.
Intrusion: An unauthorized entity gains access to sensitive data by circumventing a system’s security protections.
Deception
A circumstance or event that may result in an authorized entity receiving false data and believing it to be true
Deception Threat Action
Masquerade: An unauthorized entity gains access to a system or
performs a malicious act by posing as an authorized entity.
Falsification: False data deceive an authorized entity.
Repudiation: An entity deceives another by falsely denying
responsibility for an act.
Disruption
A circumstance or event that interrupts or prevents the correct operation of system services and functions
Disruption Threat Action
Incapacitation: Prevents or interrupts system operation by disabling
a system component.
Corruption: Undesirably alters system operation by adversely
modifying system functions or data.
Obstruction: A threat action that interrupts delivery of system
services by hindering system operation
Usurpation
A circumstance or event that results in control of system services or functions by an unauthorized entity
Usurpation
Misappropriation: An entity assumes unauthorized logical or
physical control of a system resource.
Misuse: Causes a system component to perform a function or
service that is detrimental to system security
