CSF Flashcards
What is Information Assurance?
Cybersecurity has replaced the term IA
Information Assurance (IA) is defined by the techniques and methods we use to protect and defend automated information and information systems through risk management techniques in order to provide reasonable stratums of availability, integrity, authentication, confidentiality, and non-repudiation.
What is the Army Information Assurance Program? (AIAP)
The Army Information Assurance Program (AIAP) is a unified approach to protect unclassified, sensitive, or classified information stored, processed, accessed, or transmitted by Army ISs, and is established to consolidate and focus Army efforts in securing that information, including its associated systems and resources, to increase the level of trust of this information and the originating source. The AIAP will secure Army ISs through IA requirements, and does not extend access privileges to Special Access Programs (SAPs), classified, or compartmentalized data; neither does it circumvent need-to-know requirements of the data or information transmitted.
What are the three focus elements of Defense in Depth? (DiD)
The elements of the Defense in Depth (DiD) strategy focus on three areas: people, operations, and defense of the environment (the latter of which encompasses the computing environment, networks, the enclave boundaries, and supporting infrastructure).
What is a Threat?
Threats are any potential violation of security. a threat is the capabilities, intentions, and attack methods of adversaries to exploit, damage, or alter information or an information system.
(Threat Methods) Masquerading, forging or spoofing
In order to gain an illegitimate advantage, such as the ability to by-passing an access control list (ACL) or to maliciously redirect network traffic, a person or application may masquerade as another. This is done by falsifying data. Common types of these attacks include: IP spoofing, E-mail spoofing, website spoofing, and MAC spoofing.
(Threat Methods) Playback or replay
form of network attack where a valid transmission, often including authentication data, is fraudulently replayed by an attacker with the hopes of authenticating to a system by using the legitimate user’s credentials.
(Threat Methods) Bypassing security controls
Normal security controls include basic user authentication to complex firewalls on the network. Identification can be faked and a firewall may be bypassed. Backdoors, Trojan-horses, and even rootkits are often used to bypass security controls.
(Threat Methods) Authorization violations or misuse of authority
Insiders are a major area of concern to network security. According to the 2008 Computer Crime & Security Survey “insider abuse of networks was the second-most frequently occurring (incident), at 44 percent.”
(Threat Methods) Eavesdropping
Eavesdropping can occur on a network, telephone, or even within a social gathering. An unauthorized sniffer running on a network can eavesdrop and gather data. Telephone bugs have been used for years to eavesdrop on conversations. People gained valuable information by listening to conversations while in social gatherings
(Threat Methods) Network Attacks
The main intent of many network attacks is to cause a Denial of Service (DoS). Common DoS attacks include: SYN floods, ICMP floods, smurf attacks, teardrop attacks, and the land attack.
(Threat Methods) Traffic analysis / network scanning
“Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more can be inferred from the traffic.”
(Threat Methods) War dialing
War dialing is a specialized technique which utilizes a modem to detect potential access points into a network, usually a computer or fax machine, from a predetermined list of phone numbers. The Wardialer makes calls to these numbers making note of any that are answered by a modem or fax machine. These listed modems and fax machines provide the hacker with the possibility of bypassing the firewall in an attempt to accessing the network.
(Threat Methods) War driving
War driving is the process of searching for wireless local area networks by driving through an area with a portable computer or similar device. By conducting war driving, a user may be able to gain unauthorized access to a network. The reasons for gaining this access may be malicious from a platform for launching attacks to simply gaining access to the internet free of charge.
(Threat Methods) Malware (aka Malicious code)
“Malware is short for malicious software and is typically used as a catch-all term to refer to any software designed to cause damage to a single computer, server, or computer network, whether it’s a virus, spyware, et al.” As such, malware can take many different forms: viruses, worms, rootkits, trojan-horses, spyware, and certain types of adware. Generally malware is designed to corrupt, alter, destroy, distribute information or cause disruption of the network or system.
(Threat Methods) Backdoors
A backdoor is a means or method to covertly bypass normal authentication in order to establish remote access to a system. A backdoor can be a specialized program, such as Back Orifice, or the unauthorized modification of a legitimate program. A recent example includes the Sony rootkit backdoor in late 2005, which installed itself on a windows system when a Sony music CD was played.
