Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Cryptography and Mitigation (Ch. 10,11) > Flashcards

Cryptography and Mitigation (Ch. 10,11) Flashcards

1
Q

PKI

A

_ public key infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Symmetric vs asymmetric encryption

A

_ same key to encrypt and decrypt vs different keys
_ asymmetric requires PKI for certificates
_ asymmetric is much more resource intensive (so mainly only used to exchange symmetric keys)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Stream cipher

A

_ encrypts one bit or one byte at a time
_ more efficient with unknown or variable length data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Block cipher

A

_ encrypts data in blocks
_ more efficient with known-length data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ECC

A

_ elliptic curve cryptography
_ minimal overhead
_ useful in mobile devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

steganography

A

_ hides data within other files
_ e.g. embed data within whitespace of an image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Digital signature for email

A

_ has of email encrypted with private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Benefits of a digital signature

A

_ authentication
_ non-repudiation
_ integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

MD5

A

_ message digest 5
_ hashing algorithm producing 128-bit hash
_ has vulnerabilities, so now used as a checksum
_ susceptible to has collisions, making it unsuitable as a cryptographic hash (e.g. for hashing passwords)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SHA

A

_ secure hashing algorithm
_ can be used to verify integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SHA-2

A

_ created by NSA
_ SHA-256 creates 256-bit hashes
_ SHA-512 creates 512-bit hashes
_ SHA-224 truncates SHA-256
_ SHA-384 truncates SHA-512

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SHA-3

A

_ created in a non-Nsa public competition
_ alternative to SHA-2 (making same sizes available)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

HMAC

A

_ hash-based message authentication code
_ fixed-length string requiring a shared secret to create and validate
_ encrypts MD5 hash
_ provides both integrity and authenticity
_ used in IPsec and TLS
_ (if hash is transmitted with message, attacker could revise hash for a revised message, but not with HMAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

sha256sum

A

_ calculates SHA-256 of a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Password spraying attack

A

_ a kind of brute force attack
_ loops over many accounts for each attempted password
_ increases time between attempts on any given account, helping to avoid password lockout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Pass the hash attack

A

_ attacker first somehow acquires a hash for a password
_ attacker then uses that hash in authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Birthday attack

A

_ named for the mathematical “birthday paradox”
_ in any group of 23 people, there is a 50% chance 2 of them were born on the same day of their birth year
_ attack guesses the hash (which has collisions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Rainbow table attack

A

_ attempts to discover a password from a hash
_ rainbow table is a DB of hashes for passwords (e.g. hashes for every possible 9-digit password)
_ hashes are time-consuming to produce, but rainbow tables can be so huge that they save time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Key stretching

A

_ applies cryptographic stretching to a salted password to make the effort of guessing hashes much more time consuming
_ Bcrypt, PBKDF2, and Argon2 also key stretch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Bcrypt

A

_ salts password prior to encrypting
_ repeats process up to 60 times to make computationally expensive
_ 60-character string

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

pepper

A

_ a second random salt number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

PBKDF2

A

_ 64+ bit salt with HMAC
_ can (but need not) repeat process many times to make computationally expensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

AES

A

_ advanced encryption standard
_ symmetric key algorithm
_ encrypts into 128-bit blocks
_ key sizes 128, 192, or 256 bits
_ fast, efficient, strong

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

3DES

A

_ “triple DES” (Data Encryption Standard)
_ improves on DES
_ encrypts in 3 passes with 3 different keys
_ more resource intensive than AES
_ used when hardware doesn’t support AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Key exchange

A

_ asymmetric keys are used to secretly exchange a symmetric key
_ the symmetric key is then used for encryption and decryption because it’s much more efficient

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Digital certificate

A

_ means by which public keys are shared
_ includes a public key
_ describes owner of the certificate
_ serial number
_ certificate authority issuer
_ validity dates
_ valid usage (encryption, authentication, etc.)
_ CN
_ sent to clients in response to an HTTPS request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

CA

A

_ certificate authority
_ issues and manages digital certificates
_ provides trust in certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Ephemeral key

A

_ lasts only the duration of a session

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

RSA key lengths

A

_ 1024, 2048, 4096 bits
_ 1024 no longer considered secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

tokenization

A

_ obfuscation technique that replaces sensitive data with non-sensitive placeholders (i.e. tokens)
_ tokens have to be looked up within a database to retrieve what they represent
_ reduces exposure when one of the datasets is compromised

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

masking

A

_ showing asterisks instead of a typed value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Encryption with private key

A

_ for making digital signatures
_ not used to encrypt web traffic; that’s done with an ephemeral symmetric key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

DSA

A

_ digital signature algorithm
_ encrypted hash of a message, using sender’s private key
_ authenticates the sender
_ sender can’t repudiate that they sent the message
_ ensures message integrity, as the hash was included
_ encrypting the message would do the same but take far more resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

S/MIME

A

_ secure/multipurpose internet mail extensions
_ used for digitally signing and encrypting/decrypting email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

HTTPS TLS handshake

A

_ client requests an HTTPS session (but TLS is not restricted to HTTP)
_ server responds with certificate containing its public key
_ client creates a symmetric key
_ client encrypts symmetric key with server’s public key
_ client sends encrypted symmetric key to server
_ server decrypts symmetric key with server’s private key
_ data is thereafter encrypted with the symmetric key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Downgrade attack

A

_ forces system to downgrade its security
_ attacker then exploits the lesser security
_ e.g. if SSL is enabled and client says it doesn’t support TLS, server might allow SSL
_ e.g. if server supports a weak cipher suite, client might force it to downgrade to that

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

blockchain

A

_ distributed, decentralized public ledger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Blockchain block

A

Contains:
_ info about the transaction
_ info about the parties involved (digital signatures rather than names)
_ a hash that uniquely identifies the block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Blockchain block creation process

A

_ transaction occurs
_ networked computers verify transaction
_ transaction is recorded in a block
_ block is assigned a hash
_ block is added to the blockchain (referencing the prior block’s hash)

40
Q

entropy

A

_ randomness of a cryptographic algorithm
_ greater randomness provides greater security

41
Q

Plaintext attack

A

_ attacker has plaintext and its associated ciphertext
_ can then determine the encryption method
_ can then decrypt any ciphertext

42
Q

Chosen-plaintext attack

A

_ attacker has part of the text associated with some ciphertext
_ can be used to find the encryption method

43
Q

Root certificate

A

_ certificate that identifies the CA
_ goes in Os or browser’s root certificate store
_ browsers often ship with root certificates
_ can be used to sign certificates of other CAs to convey trust to those CAs, making CAs hierarchical
_ leaf node CAS of this hierarchy are used in apps and services
_ may be kept offline to prevent compromise, enabling it to re-issue certs for compromised certs

44
Q

Certificate chain/path

A

_ chain of all certs from root to any given cert

45
Q

CSR

A

_ certificate signing request
_ includes purpose of certificate, a public key, and info about the owner of the public key
_ CA receives CSR, validates owner’s identity, and issues a certificate containing the public key
_ validation process depends on declared purpose

46
Q

RA

A

_ registration authority
_ assists with registration process
_ doesn’t issue certificates
_ used by large organizations

47
Q

Reasons to revoke a cert

A

_ private key compromise
_ CA compromise
_ change of affiliation
_ superseded by another cert
_ cease of operation
_ certificate hold
_ certificate holder’s request

48
Q

CRL

A

_ certificate revocation list
_ publicly available
_ often downloaded and cached, so it might not be up-to-date

49
Q

OCSP

A

_ online certificate status protocol
_ API for determining whether a cert has been revoked
_ signs the response (+ timestamp) so that response can be reused by others with trust (aka “stapling”)

50
Q

Validating a cert

A

_ check whether expired
_ check whether issued by a trusted CA (i.e. whether it’s in the certificate authorities store)
_ check whether revoked (requiring that the client request the CRL from the CA or use OCSP)
_ if the site provides a “stapled” OCSP response, the client can verify this response and need not perform the above checks, reducing traffic to the OCSP and CA

51
Q

Certificate pinning

A

_ HTTPS response includes a header listing hashes derived from public keys that the site uses
_ each hash also has a max-age telling the client when to expire the hash
_ when clients reconnect to a website, they recalculate the hashes and compare with the returned values
_ matching hashes indicate a return to an already-verified website

52
Q

Key escrow

A

_ process of placing coy of a key in a safe environment for recovery purposes

53
Q

KMS

A

_ key management system
_ manages entire life cycle of cryptographic keys (generation, storage, distro, rotation, retirement/revocation/destruction)

54
Q

Common cert types

A

_ machine/computer - identifies the device within a domain
_ user - for encryption or authentication
_ email - encryption and signing
_ code signing - signing software and scripts
_ self-signed - privately used certs, not CA-backed
_ root - root cert of a CA
_ wildcard - starts with an asterisk, applying to all subdomains of a given domain
_ subject alternative name (SAN) - applies to different domains owned by the same org
_ domain validation - asserts an org owns a domain

55
Q

Cert filename extensions

A

_ there are many cert file formats
_ e.g. .crt, .cer, .pem, .p7b, .p7c, .p7s, .pfx, .p12
_ file may have a format different from that indicated by its extension

56
Q

CER

A

_ ASCII format cert

57
Q

DER

A

_ binary format cert

58
Q

PEM

A

_ privacy-enhanced email (cert format)
_ certs can be used for purposes other than email
_ very common format

59
Q

P7B

A

_ cert format often used to share public keys

60
Q

P12 and PFX

A

_ cert formats used to hold private keys

61
Q

Perfect forward secrecy

A

_ generates a new random public key for each session
_ generates key non-deterministically (given same input, generates a different public key)
_ keys therefore are not reused
_ past compromised keys can’t be used in a later attack

62
Q

Backout plan

A

_ steps to follow if a change goes wrong
_ restores system to a previous operational state ASAP

63
Q

wiping

A

_ erases data from disks by overwriting various patterns multiple times
_ does not apply to SSDs, which require a special erase process; SSDs are usually therefore destroyed

64
Q

degaussing

A

_ a powerful magnet renders data on tapes and disk drives unreadable
_ not effective on SSDs

65
Q

COD

A

_ certification of (device or drive) destruction

66
Q

Incident response plan

A

_ formal plan of how to respond to an incident
_ defines incident types (distinguishing events from incidents)
_ response team
_ roles and responsibilities
_ communication plan

67
Q

Incident communication plan

A

_ first responders should know who to contact under what conditions
_ further internal communication plans with others
_ reporting requirements with external entities
_ constraints on external communication
_ plan for communicating with the customer

68
Q

SOC

A

_ security operations center

69
Q

Incident response process

A

_ preparation before an incident, including establishing procedure to prevent incidents
_ detection processes and operations
_ analysis to determine whether an event is an incident
_ containment of incident (e.g. isolating or unplugging system)
_ eradication of the components of the attack (and forensic analysis)
_ recovery, returning systems to normal
_ lessons learned

70
Q

Order of volatility

A

Order in which to collect evidence. Most to least volatile:
_ cache
_ RAM
_ swap file or pagefile
_ disk
_ attached devices (e.g. USB drives)
_ network

71
Q

dd

A

_ data duplicator command
_ good for taking snapshots for forensic examination

72
Q

Legal hold

A

_ legal obligation to maintain different types of data as evidence

73
Q

eDiscovery

A

_ identification and collection of electronically stored data (for legal purposes)

74
Q

Chain of custody

A

_ process that assures that evidence has been properly controlled and handled
_ in security, this is form that gets filled out indicating every person who was in possession of the asset
_ control is the effort to ensure that the written chain of custody remains valid

75
Q

TTP

A

_ tactics, techniques, and procedures of an attack

76
Q

SOAR

A

_ security orchestration, automation, and response
_ tools that respond to low-level security events automatically
_ e.g. responding to phishing emails
_ e.g. opening attachments in a sandbox to observe behavior
_ uses playbooks and runbooks

77
Q

playbook

A

_ general guidelines
_ e.g. what to check to detect a phishing email

78
Q

runbook

A

_ technical details for implementing playbook
_ uses the tools of the organization
_ either auto-handles the event or tasks an admin

79
Q

Security governance

A

_ responsibilities and processes established by an organization to manage its security efforts
_ provides framework for making decisions
_ sets strategic direction and goals
_ indicates how to manage risk

80
Q

AUP

A

_ acceptable use policy
_ of computer system or network

81
Q

Information security policy

A

_ protects data and information systems
_ rules for managing, protecting, distributing information
_ e.g. password complexity, handling of sensitive data

82
Q

Security guidelines

A

_ best practices (optional)
_ unlike policies, standards, and procedures, which are mandatory

83
Q

Data governance

A

_ processes an organization uses to manage, process, and protect data
_ helps ensure or improve quality of data

84
Q

Data roles

A

_ data owner - responsible for the data, including classifying it
_ data steward - entity to whom owner delegates management of the data
_ data custodian - does routine daily tasks like backup
_ data controller - org that collects info from employees for payroll processing
_ data processor - third-party org that works with data on behalf of the data controller

85
Q

EOSL

A

_ end of service life
_ end of vendor support

86
Q

Right-to-audit clause

A

_ clause in cloud contracts giving customers right to hire an auditor to review cloud provider’s records and systems

87
Q

SLA

A

_ service level agreement
_ stipulates performance expectation
_ e.g. uptime/downtime levels
_ may include a monetary penalty for failure to meet

88
Q

MOU

A

_ memorandum of understanding
_ aka memorandum of agreement (MOA)
_ expresses understanding between parties to work together toward a goal
_ less formal than an SLA and no monetary penalties

89
Q

BPA

A

_ business partners agreement
_ written agreement detailing relationship between business partners and obligations

90
Q

MSA

A

_ master services agreement
_ structured agreement for vendors used repeatedly
_ agreement applies across projects
_ a work order (WO) or statement of work (SOW) is written per project

91
Q

Rules of engagement

A

_ what one is and is not allowed to do in security testing

92
Q

GLBA

A

_ Gramma-Leach Bliley Act
_ aka Financial Services Modernization Act
_ requires financial institutions to provide consumers with privacy notices

93
Q

GDPR

A

_ general data projection regulation
_ an EU directive mandating privacy for EU individuals
_ applies globally

94
Q

PCI DSS

A

_ payment card industry data security standard
_ contractual relationship between banks that issue credit cards and merchants
_ provides strict requirements for handling cardholder data

95
Q

Due diligence

A

_ actions taken to ensure organization is aware of all legal requirements

96
Q

Due care

A

_ continuous effort to ensure organization adhere to legal requirements and identifies non-compliance in a timely manner

97
Q

CBT

A

_ computer based training

Security+ 701 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions