Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CC > Domain 1: Security Principles > Flashcards

Domain 1: Security Principles Flashcards

1
Q

What is Information Security

A

Protecting paper documents, voice information, data, and the knowledge people have

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is IT Security

A

Protecting hardware, software, and data (computers, servers, networks, firmware, data being processed, stored, and communicated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Cyber Security

A

Everything from IT security that is accessible from the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does CIA stand for

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Confidentiality

A

Keeping our data and systems safe by ensuring no one unauthorised can access it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Integrity

A

Protecting data and systems against modification by making sure the data has not been altered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Availability

A

Ensuring authorised people can access they data they need when they need to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What do we use to ensure Confidentiality

A

Disk Encryption, secure transport encryption, clean desk policies, no shoulder surfing, screen locks, strong passwords, mfa, access control, need-to-know, least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What threatens Confidentiality

A

attacks on encryption, social engineering, key loggers, cameras, backdoors in IOT devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What do we use to ensure Integrity

A

Cryptography, check sums, message digests/hash (md5, sha1, or sha2), digital signatures, access control, non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What threatens Integrity

A

alterations of data, code injections, attacks on encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What do we use to ensure Integrity

A

IPS/IDS, patch management, redundancy in power (ups/generator), disks (RAID), traffic paths (network design), HVAC, staff, high availability design, replication of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What threatens availability

A

malicious attacks (DDOS, physical, system compromise, staff), application failures, component failure (hardware)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the opposite of CIA

A

DAD - Discolsure (opposite of confidentiality): someone not authroised getting access
Alteration (oppostive of integrity): data has been changed without authorisation
Destruction (opposite of availability): your data or system are not accessible or destroyed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is IAAA

A

Identification, authentication, authorisation, accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is identification

A

your username, id number, employee number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is authentication and what are the types

A

proving you are an identity
type 1: something you know - passwords, pass phrase, pin
Type 2: something you have - ID, passport, smart card, token, cookie, phone
Type 3: something you are - biometrics, finger print, iris scan, palm vein scan, facial geometry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the minimum password requirements

A

specify minmum length, upper and lower case,, numbers, symbols, not contain usernames or easy to guess words or phrases, expiration date, not reused, limit reuse via policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is key stretching

A

adding a few seconds to password verification to make brute force an unfeasible attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Brute Force Attack

A

using the entire key space to continually guess a password until it is excepted.

21
Q

How to protect against Brute Force

A

Key stetching, limit number of incorrect guesses (clipping) - lock account when limit is reached

22
Q

what is totp

A

a type 2 authentication (something you have) which generates a a shared secret every short time period

23
Q

What is flase rejection rate (type 1 error)

A

an authorised user is rejected. Can occur when biometric settings are too strict (99%+)

24
Q

what is flase accept rate (type 2 error)

A

an unauthroised user is granted access

25
Q

What are the two types of biometric identifiers

A

Physiological characteristics:
finger print, palm veins, facial rec, dna, palm print, hand geo, iris, retina.
Behavioral characteristic:
typing rythm, walk/gait, signature, voice

26
Q

what are some issus with biometrics

A

privacy:
biometrics can show diseases, pregnacy, diabetes, neurological diseases
breaches:
pictures of your face and fingers can be used to get through biometrics scans
recordings of your voice and copies of your signatures
Non recreation:
stolen passwords can be regenerated, biometrics can’t

27
Q

What is least privilege

A

the minimum necessary access needed for users to access only exactly what they need

28
Q

what is need to know

A

even if you have access, if you do not need ti know, then don’t access the data

29
Q

What is DAC

A

discretionary access control - used when availability is most importat. access to an object is controlled by the object owner. Uses an ACL based on identity

30
Q

what is MAC

A

mandatory access control - used when confidentiality is most importat. access to an object is determiend by labels and clearance.

31
Q

what is a label

A

objects have labels assigned to them to allow subjects with the right clearance to access them

32
Q

what is clearance

A

subjects have clearance assigned to them based on their current and future tustworthiness

33
Q

what is rbac

A

role based access control - used when integrity is most important. access control mechanicsm defined around roles. A role is assigned permissions, and subjects in that roles are addedd tot he group. Can enforce seperation of duties and prevent privilege creep

34
Q

what is abac

A

attribute based access control - access to objects is granted based on subjects, objexts, and environmental conditions. attributes could be subject (name, role, id, clearance), Objects (name, owner, date of creation), environment (location, time of access, threat level)

35
Q

what is context based access control

A

access to an object is controlled based on parameter such as location time, sequence of responses, access history. E.g. captcha, mac address filtering

36
Q

content based access control

A

access provided based on attributes or content of an object. the value and attributes of the content being accesses determine the control requirements. e.g. showing or hiding menus in applications

37
Q

what is accountability (or auditing)

A

tracing an action to a subjects identity. Proves who did an action (non-repudation) usings logs

38
Q

what type of user account has zero accountability?

A

shared/group accounts

39
Q

what is non repudiation

A

when a user can’t deny having performed a certain action

40
Q

what is a subject

A

users and programs. a subject is something that manipulates an object

41
Q

what is an object

A

passive data (physcial and data). an object is manipulated by a subject

42
Q

whats privacy

A

the state of being free from observation or being disturbed by other people and freedom from unauthorised intrusion

43
Q

who do we calculate risk, total risk and residual risk

A

risk = threat * vulnerability (or likelyhood) * impact
total risk = threat * vuln * asset value
Residual risk = total risk - countermeasures

44
Q

what is a threat

A

a potentially harmful incident

45
Q

what is a vulnerability

A

a weakness that can allow the threat to do harm

46
Q

what is due diligence

A

doing the research of a countermeasure before implementation

47
Q

due care

A

implementation of the countermeasure

48
Q
A

CC (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions