Definitions Flashcards
Logical Assets
Assets that exist as data or intellectual property
Physical Assets
those assets which are tangible objects and materials.
Information Security
2 definitions
Protecting information and information systems from unauthorized access, use, disclosure disruption, modification, or destruction.
Protect data and systems from those who seek to misuse them, intentionally or unintentionally, or those who shouldn’t have access at all.
PCI DSS (Payment card industry data security standards are what?
Applies to companies that process credit card payments
FISMA (Federal Information Security Management Act)
Defines security standards for many federal agencies in the USA
Confidentiality
Our ability to protect our data from those who are not authorized to use it.
Integrity
The ability to prevent people from changing your data in an unauthorized or undesirable manner.
Availability
Refers to the ability to access our data when we need it
Parkerian Hexad?
a more thorough model for assessing information security than CIA.
Possession / Control
refers to the physical disposition of the media on which the data is stored.
Authenticity
Allows you to say whether you’ve attributed the data in question to it’s proper owner or creator
Utility
How useful is the data to you?
Interception Attack:
allows unauthorized users to access your data, applications or environments. Primarily attacks against confidentiality.
Data at Rest
stored data that isn’t in the process of being moved from one place to another
Data in Motion
data in the process of being moved from one place to another
Data in Use
data an application or individual is actively accessing or modifying.
Modification Attacks
involves tampering with an asset
Fabrication Attacks
Involves generating data, processes, communications, or other similar material with a system.
Threats
something that has the potential to cause harm
Vulnerability
Weakness, or holes that threats can exploit to cause you harm
Risk
is the likelihood that something bad will happen
Impact
used by some organizations like the NSA.
Takes into account the value of the asset being threatened and uses it to calculate the risk.
What are controls?
Measures put into place to mitigate risks.
What are physical controls?
Protect the physical environment in which your systems sit or where your data is stored.
What are logical controls?
Protect the systems, networks, and environs that process, transmit, and store data
What are administrative controls?
Based on rules, laws, policies, procedures, guidelines,and other items that are “paper” in nature.
Dictate how the users of your environment should behave?
