Definitions Flashcards
Data steward
The data steward is primarily responsible for data quality. Ensuring the data is collected and stored in a format containing values that comply with applicable laws and regulations.
Data custodian
The data custodian handles all data and manages the system on which the data assets are stored.
Data Owner
The owner is responsible for labeling the asset and ensuring that it is protected with appropriate controls.
Data Processor
The data processor is the entity engaged by the data controller to assist with technical collection, storage, or analysis tasks.
Cross-Site Scripting (XSS)
When an attacker uses a web application to ‘send malicious code’ to a different end user.
Occurs when web apps contain ‘reflected input’.
‘Client Side Vulnerability’.
Cross-Site Request Forgery (XSRF or CSRF)
‘Exploits trust’ that a user has in a website to ‘execute code’ onto the users computer.
What’s the difference between XSS and XSRF
Cross-site scripting (or XSS) allows an attacker to execute arbitrary JavaScript within the browser of a victim user. Cross-site request forgery (or CSRF) allows an attacker to induce a victim user to perform actions that they do not intend to.
Dynamic-Link Library (DLL) Injection attack
When malware tries to inject code into the memory process space of a library using a ‘vulnerable/compromised DLL.’
Lightweight Directory Access Pool (LDAP) Injection attack
Exploits the weaknesses in LDAP implementations.
Occurs when users ‘input is not properly filtered’.
‘Unauthorized quire’s’.
Extensible Markup Language (XML) Injection attack
When users enter values that query XML (known as XPath) with values that take advantage of exploits.
Similar to SQL, but does not have the same ‘access control’ so exploits can return entire documents.
List the Events of the Cyber Kill Chain
Reconnaissance
Intrusion
Exploitation
Privilege Escalation
Lateral Movement
Obfuscation
Denial of Service
Exfilitration
RIEPLODE
Address Resolution Protocol (ARP) poisoning
To sniff all traffic on a switched network. ARP poisoning occurs when an attacker, with access to the network, redirects an IP address to the MAC address of an unintended computer.
List Layers of the OSI Model
- Physical
- Data Link
- Network
- Transport
- Session
- Presentation
- Application
PLEASE DO NOT THROW SAUSAGE PIZZA AWAY
List the Incident Management Framework
- Detection
- Response
- Mitigation
- Reporting
- Recovery
- Remediation
- Lessons Learned
DRMRRRL
A Directory Traversal Attack
Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files.
What’s the difference between Entropy and Ephemeral
Entropy is used to produce random numbers, which in turn are used to produce security keys to protect data. It is a measure of cryptographic unpredictability. A lack of can leave a crypto-system vulnerable and unable to encrypt data securely.
An Ephemeral key is an asymmetric cryptographic key used to create a one-time password when the user wants to authenticate. i.e DUO or Google Authenticator.
What’s the difference between a honey-net and a honey-pot?
Honey-pots: singular Honey-net: plural
Honey-nets contain one or more honeypots
List the Order of Volatility, from most volatile to least.
- CPU Cache, Registers
- Routing Table, ARP Cache, Process Table, Kernel Statistics
- System memory, RAM
- Temporary Files
- Data on Hard Disks
- Remote Logs
- Backups
List examples of Technical Controls
Firewall Rules, Access Control Lists, Intrusion Prevention Systems, and Encryption
List examples of Operational Controls
User Access Reviews, Log Monitoring, and Vulnerability Management
List examples of Managerial Controls
Risk/Threat Assessments, Security Planning Exercises, Incorporation of security into the orgs change management, Service Acquisition, and Project Management Practices
What is a Supply Chain attack?
An attack that occurs before software or hardware is delivered to an organization.
What port does HTTPS run on?
TCP 443
What port does HTTP run on?
TCP 80
