Domain 1 : General Security Concepts Flashcards
What is a firewall?
Firewalls are a common technical control used to protect computer networks from unauthorized access. They monitor incoming and outgoing network traffic, filter and block potential threats, and reduce the risk of unauthorized intrusion.
Security Controls
Security control is designed to give a system or data asset the properties of
confidentiality, integrity, availability, and non-repudiation
Technical Controls
the control is implemented as a system (hardware, software, or firmware. - Technical controls mitigate risk and are implemented by the security team.
Data Encryption
Data encryption is a technical control that converts sensitive information into a coded form, making it unreadable to unauthorized individuals. It reduces the risk of data breaches by ensuring that even if data is intercepted, it remains secure and inaccessible without the decryption key
Managerial controls
—the control gives oversight of the information system. Examples
could include risk identification or a tool allowing the evaluation and selection of
other security controls.
Performance Reviews
Performance reviews are a managerial control that involves regular assessments of employee performance. By providing feedback, setting goals, and identifying areas for improvement, performance reviews help align employee activities with organizational objectives and ensure that employees are performing effectively.
Risk Assessment
Risk assessments are a managerial control that involves the systematic identification, evaluation, and mitigation of potential risks within an organization. They help with identifying vulnerabilities, assessing the likelihood and impact of risks, and developing strategies to minimize or mitigate them. By conducting regular risk assessments, management can proactively identify and address potential threats, reducing the organization’s overall risk exposure.
Code of Conduct
A code of conduct is a set of guidelines and ethical standards established by management to govern employee behavior. It serves as a managerial control by defining acceptable behavior, promoting ethical conduct, and reducing the risk of misconduct within the organization.
Operational Controls
the control is implemented primarily by people. For example,
security guards and training programs are operational contro
Incident response procedures
Incident response procedures are operational controls that outline the steps to be followed in the event of a security incident or breach. These procedures provide a structured approach to detecting, responding to, and recovering from security incidents. By having well-defined incident response procedures in place, organizations can minimize the impact of security breaches, mitigate further risks, and restore normal operations more effectively.
Security Awareness Training
Security awareness training is an operational control that educates employees about security threats, best practices, and organizational policies.
User Access Management
User access management is an operational control that involves the management and control of user access privileges to systems, applications, and data. It includes processes for user provisioning, access requests, access revocation, and periodic access reviews.
Physical Controls
controls such as alarms, gateways, locks, lighting, and security
cameras that deter and detect access to premises and hardware are often
placed in a separate category to technical controls.
Access control vestibule
An access control vestibule is a small, enclosed area with two doors that creates a buffer zone between the outside environment and the secured area. It typically requires individuals to pass through multiple authentication steps (such as presenting an access card or undergoing biometric verification) before they can proceed into the secured area.
Mantraps
Mantraps are enclosed areas that allow only one person at a time to pass through. They typically consist of two interlocking doors or gates. The first door must close and lock before the second door opens, ensuring that only authorized individuals can proceed through the controlled area.
Tamper-evident seals
: Tamper-evident seals are used to secure containers, equipment, or sensitive areas. These seals are designed to show visible signs of tampering or unauthorized access, such as a broken seal or a change in color, indicating that someone has attempted to gain access or tamper with the secured item.
What are the security control types
Preventive
Detective
Directive
Deterrent
Compensating
Preventive control
These controls are designed to prevent problems or risks from occurring in the first place. They focus on eliminating or minimizing potential threats before they can cause harm. Examples of preventative controls include firewall installations to prevent unauthorized access to computer networks by using access control lists, employee training programs to educate staff about safety procedures and prevent workplace accidents, and quality control checks in the manufacturing process to prevent defects.
Deterrent Controls
Deterrent controls aim to discourage individuals from engaging in undesirable behaviors or activities. They create a perception of risk or negative consequences to deter potential offenders. Examples of deterrent controls include surveillance cameras in public areas to deter criminal activity, warning signs indicating the presence of a security system to discourage burglars, and strong passwords and multi-factor authentication to discourage unauthorized access to online accounts
Detective control
Detective controls are implemented to identify and detect problems or risks that have already occurred. They help uncover issues and anomalies promptly to initiate corrective actions. Examples of detective controls include regular financial audits to identify accounting irregularities or fraud and Security Information and Event Management (SIEM) systems that aggregate and correlate log data from multiple sources, providing a comprehensive view of network activities and enabling the detection of suspicious patterns or behaviors.
Corrective controls
Corrective controls are put in place to address problems or risks after they have been identified. They aim to rectify the situation, mitigate the impact, and restore normalcy. Examples of corrective controls include implementing a backup and recovery system to restore data after a system failure and implementing fixes or patches to address software vulnerabilities
Compensating Controls
Compensating controls are alternative measures implemented when primary controls are not feasible or sufficient. They help offset the limitations or deficiencies of other controls.
Directive Controls
Directive controls involve providing specific instructions or guidelines to ensure compliance with policies, procedures, or regulations. They establish a clear framework for employees to follow
Authentication Header(IPSEC Packet)
This feature consists of either SHA-1 or MD5 hashing algorithms, which provide data integrity to ensure the packet has not been tampered with in transit
Encapsulated Security Payload (ESP)
Encapsulated Security Payload (ESP): ESP is the part of the IPSec packet in which the data is stored and encrypted using symmetric encryption via DES, 3DES, or AES. It comprises several key elements:
Header: ESP adds an additional header to the IP packet. The header contains information necessary for the proper processing of the packet during transmission and reception.
Payload data: This is the actual data that is being transmitted and can be any type of network traffic, such as email, web browsing, or file transfers.
ESP trailer (optional): This is an optional component that may be added to the end of the payload data for padding or integrity checks.
Always on VPN
This mode is applied during the creation of a site-to-site VPN, the purpose of which is to build a point-to-point connection between two sites in possession of their own VPNs
How does MIB work?
Management Information Base, also known as MIB, is a hierarchical database that contains configuration and other vital management information of SNMP devices in the form of data objects. An SNMP management system uses these database files to interpret the messages sent by the managed devices.
DKIM
DKIM, or DomainKeys Identified Mail, is an email authentication method that uses a digital signature to let the receiver of an email know that the message was sent and authorized by the owner of a domain.
Virtualization
Virtualization allows multiple virtual machines (VMs) to run on a single physical server,
Always on mode tunneling
This mode is applied during the creation of a site-to-site VPN, the purpose of which is to build a point-to-point connection between two sites in possession of their own VPNs. The session is set to always on to ensure the connection is available all the time. While a site-to-site VPN is active, both the AH and the ESP are encrypted.
Tunnel mode
This mode is used during the creation of an IPSec tunnel with an internal network using client/server-to-server communication. During transport mode, only the ESP is encrypted.
Regression Testing
a type of testing in the software development cycle that runs after every change to ensure that the change introduces no unintended breaks.
MAC access control
MAC is a stringent access strategy that employs classification levels to regulate access to information based on the sensitivity of the data and the user’s clearance level. The classification levels (Top Secret, Secret, Confidential, and Restricted) serve to prevent unauthorized access, protecting national interests from varying degrees of potential damage. The classification is not solely about the potential impact on national interests but also applies to organizations for which data sensitivity and confidentiality are paramount.
RBAC
RBAC restricts system access to authorized users. It is often employed within departments where specific roles require access to resources, helping to minimize the risk of unauthorized access to sensitive information. For example, there may be only two people within the finance department who are allowed to sign checks. Similarly, in the IT department, only two people may be allowed to administer the email server, as others may not have the skills.
DAC access control
DAC is an access control model in which the owner of the object (typically a file or directory) determines who is allowed to access assinged via ACL list
ABAC
ABAC restricts access based on user attributes, allowing organizations to grant permissions on a granular level.
OTP(Onet time password)
An OTP is a short-lived password that is sent to your phone as an additional factor of authentication.
Knowledge based authentication
KBA is based on knowledge factors such as security questions, which are considered soft because they rely on information only the user should know. For example, when being authenticated by your bank, you may be asked to list the last three transactions on your account.
Password Complexity
Often referred to as “strong passwords,” complex passwords contain elements from at least three out of four groups: lowercase letters, uppercase letters, numbers, and special characters not commonly used in programming.
Password Expiry
: Password expiry is a security measure that requires users to change their passwords after a set period to reduce the risk of unauthorized access.
Password Vaulting
This refers to the process by which administrative and privileged accounts are removed from the Active Directory environment and stored in password vaults (normally a software solution). When a request for PAM has been authorized, the ticket is released for the approved period.
IAM
Identity and Access Management (IAM), and examining the role of password managers in generating and securely storing complex passwords. The concept of passwordless access using SSH keys in Linux environments was also introduced to enhance security while eliminating traditional passwords.
Cyber Kill Chain
Stages of the Cyber Kill Chain
Reconnaissance
Calling employees, sending emails, social engineering, dumpster diving
Weaponization
Create malware payload
Delivery
Delivery medium, such as USB, email, web page
Exploitation
Executing code via a vulnerability
Installation
Installing malware on the asset
Command and Control
Infected system sends back information to the attacker
Action on Objectives
Hands-on keyboard—attack complete
