Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My CISSP > Domain 3 > Flashcards

Domain 3 Flashcards

1
Q

Security Design

A

Security must be incorporated and addressed from the initial planning and design phases through disposal of the system.

  • Without proper attention to security , an organization’s information technology can become a source of significant risk
  • With careful planning from the earliest stages, however, security becomes an enabler to achieve the organizations mission.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NIST SP 800-160

A

System Security Engineering: Considerations for a Multidisciplinary approach in the engineering of Trustworthy Secure Systems.
SP 800-16 addresses the engineering-driven actions necessary to develop more defensible and survivable systems - including the components that compose and the services that depend on those systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

DevOps

A

The DevOps development methodology is built on the premise that collaboration between developers and the operations team is essential.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Secure DevOps

A

Instead of security operating as a isolated discipline, Secure DevOps aims to integrate security into the development processes from inception.

  • The Secure DevOps approach enables developers to learn more about how that they are developing and can be exploited.
  • Secure DevOps proactively focused on survivability by providing reliable software with reduced attach surface.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Business Alignment

A

Business Alignment mandates that secure design principles are supported thorough the entire organization and incorporates various viewpoints.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Business Alignment Framework

A
  • Zachman Framework

- Sherwood Applied Business Security Architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Zachman Framework

A

The Zachman Framework provides a context for understanding a complex environment by intersecting views and viewpoints.

  • Views: What, how, where, who, and when.
  • Viewpoints: developer, systems, engineer, security, officer, application administrator, and end user.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Sherwood Applied Business Security Architecture. (SABSA)

A

The Sherwood Applied Business Security Architecture. (SABSA) provides a context for understanding a complex environment by intersecting views and life-cycle layers.

  • Views: What, why, how, where, who, and when.
  • Life-cycle Layers: Contextual, conceptual, logical, physical, component, and operational.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Information Security Models

A

Information Security Models focus on interactions and provide structure and rules to be followed to accomplish a specific objective (e.g. confidentiality, integrity, and availability)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Foundational Information Security Models

A

Foundational (lower level) model include State Machine, Non Inference, and Information Flow.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Relationship Information Security Models

A

Relationship (higher level) models include Bell-LaPadula, Biba, Clark -Wilson, Harrison-Ruzzo Ullman (HRU) and Brewer Nash.
Relationship security models address the interaction between subjects and objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

State Machine Model

A

Conceptual model that ensures no matter what activity is taking place within a system, it is always trustworthy/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Non-inference model (multilevel)

A

Whatever happens at one security level does not directly or indirectly affect the security environment of other levels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Information Flow model (multilevel)

A

Information will flow only in ways that do not violate the security policy of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Subjects

A

Subjects are active entities, generally in the form of a person, process, or device that causes information to flow among objects or changes the system state.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Objects

A

Objects are passive entities that contain or receive information or instructions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Bell-Lapadula

A

The goal the Bell-Lapadula model is confidentiality.

  • Simple (read) confidentiality rule: A subject cannot read data at a higher security level (no read up) as secrets may be revealed to them.
  • Star {*} (write) confidentiality rule. A subject cannot write information to a lower security level (no write down) as secrets may be revealed to others.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Biba

A

The goal of the Biba model is integrity.

  • Simple (read) integrity rule: A subject cannot read data at a lower security level (no read down) as they might be misled.
  • Star [*] (write) integrity rule: A subject cannot write information to a higher security level (no write up) as they might mislead others.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Clark-Wilson

A

The goal of the Clark-Wilson model is data integrity.

  • Prevent unauthorized users from making modifications.
  • Prevent authorized users from making improper modifications.
  • Maintain internal and external consistency.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Clark-Wilson (Access Triple)

A

The Clark-Wilson users a three-part relationship (subject/program/object) known as access control triple.
Well formed transactions ensure that a user cannot alter data arbitrarily. Instead, data can be altered only in a specified way in order to preserve its internal consistency (access triple).
- Users cannot access and manipulate objects directly but must access information through a program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Harrison-Ruzzo-Ullman Model (HRU)

A

The goal of Harrison-Ruzzo-Ullman Model (HRU) is integrity.

  • A finite set of operations can be performed on an object to ensure integrity.
  • Enforced by access permissions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Brewer-Nash (Chinese Wall)

A

Brewer-Nash is a context-oriented commercial model designed to defend against conflict of interest.
- Access controls change dynamically depending upon a user’s previous actions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Trusted System

A

A Trusted System has undergone sufficient benchmark testing, verification, and validation (by an independent third party) to ensure that the product meets the user requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Functionality

A

Functionality is verification that a security control exists and that it works correctly at least once.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Assurance

A

Assurance is a degree of confidence that the system will act in a correct and predictable manner in every computing situation (trustworthy computing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Security Evaluation Objectives

A

A security evaluation process assesses products against defined security requirements in a consistent and repeatable manner. Third-party labs rely on standard evaluation criteria.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

TCSEC

A

Developed in 1983, Trusted Computing System Evaluation Criteria (TCSEC) was used to evaluate, classify, and select systems for the DoD based upon confidentiality requirements, Superseded by the Common Criteria.
Original publication as the “Orange Book”. Expanded to 20+ books known as the rainbow series.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

ITSEC

A

Developed in 1991 by a consortium of European nations, IT Security Evaluation Criteria (ITSEC) is used to evaluate the functionality and assurance of a computer system based upon a vendor-defined set of requirements.
Functionality and assurance evaluated independently and separately.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Common Criteria

A

Developed in 1993 by the ISO, the Common Criteria provides a universal structure and language for expressing product and system requirements. the Common Criteria evaluates products against a protection profile and results are published.
- Common Criteria ratings categories are functional and assurance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Protection Profile

A

A protection profile is a specific set of functional and assurance requirements for a category of products. A protection profile can be written by several different groups including vendors, customers, and accreditation agencies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Security Target

A

A security Target is written by a product vendor, developer that explains the specifications of the product including functionality and assurance. requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Target of Evaluation (TOE)

A

The Target of Evaluation (TOE) is the product or system that will be rated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Certification

A

Certification is the process of evaluation, testing, and examining security controls. The evaluation compares the current system’s security posture with specific standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Accreditation

A

Accreditation is the process of an authority (management) granting approval to operate a system for a specified period of time with the understanding of the residual risks identified during the certification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Trusted Computing Base

A

Trusted Computing Base is the combination of all the security mechanisms within a computer including hardware, software, and firmware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

BIOS

A

BIOS (Basic Input Output System) is non-volatile firmware used to perform hardware initialization during the booting process, and to provide run-time services for operating systems and programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

UEFI

A

Unified Extensible Firmware Interface (UEFI) is an open standard interface layer between the firmware and the operating system that requires firmware updates to be digitally signed.

  • Designed as a replacement for traditional PC BIOS.
  • Additional functionality includes support for Secure Boot, network authentication, and universal graphics drivers.
  • Protects against BIOS malware attacks including rootkits.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Secure Boot Attestation

A

Secure Boot Attestation that all boot loader components (e.g. OS Kernel, drivers) attest to their identity (digital signature) and the attestation is compared to the trusted list.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

TPM

A

TPM A trusted platform module (TPM) is a special hardware chip installed on a computer’s motherboard that is responsible for protecting passwords, symmetric and asymmetric keys, hashes, and digital certificates are specific to that system hardware.

  • The chip contains an RSA key used for encryption and authentication.
  • TPMs are compatible with most operating systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

HSM

A

Hardware Security Model (HSM) is a physical device whose function is secure cryptoprocessing.

  • HSM take the form of an adapter cards,m USBs, or appliances.
  • Fast, scalable, and expensive.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

CPU Protection Rings

A

CPU Protection Rings are conceptual boundaries that control how processes are executed. A process is a set of instructions and assigned resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

CPU Protection Rings

A

CPU Protection Rings are conceptual boundaries that control how processes are executed. A process is a set of instructions and assigned resources.

  • Each process has a PID (Process ID) and a level of trust (ring number) assigned to it.
  • The level of trust determines the level of access to system resources, drivers, and data.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

CPU Protection Rings Levels

A
  • Ring 0: OS Kernel and device Drivers.
  • Ring 1 Operating System
  • Ring 2: OS Utilities.
  • Ring 3: Applications.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Set of CPU instructions and assigned resources.

A

Process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Centralized Systems

A

In a centralized computing environment, processing occurs within mainframe or terminal host and clients, (terminals, thin clients) are limited to simple interaction and emulation.

  • Security advantage is controls can be implemented and tightly controlled.
  • Security disadvantage is that configuration errors and unaddressed vulnerabilities can impact all clienteles systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Client | Server Environments

A

In a heterogeneous client-server environment, processing is distributed and there is a inherent trust, which makes every endpoint a potential target and every connection a potential conduit.
Security Considerations:
- Privileged use.
- Outdated operating systems and applications.
- Malware distribution.
- Unauthorized remote access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Distributed Systems

A

In a distributed system environment, there is no central Authority.
Security Considerations:
- Each node is responsible for its own security.
- Distributed ownership and management.
- Local data stores
- Peer-to-Peer (P2P) access.
- Malware Distribution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Large-scale Parallel Systems

A

Large-scale Parallel Systems are disparate systems working in concert. Examples include cluster computing, grid computing, and cloud computing. Security Considerations:

  • Distributed ownership and management.
  • Dependencies (SPOF)
  • Force multiplier effect (dramatic increased efficiency and/or capability.
  • Big data aggregation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Grid Computing

A

Grid Computing is a sharing of CPU and other resources across a network, in a way that all machines function as one large computer. Grid participants can be heterogeneous and multitasking. Security Considerations:

  • Transmission between nodes.
  • Authentication controls.
  • Activity isolation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Industrial Control Systems (ICS)

A

Industrial Control Systems (ICS) are computer-based systems that monitor and control industrial processes that exists in the physical world. ICS are either data-driven or operated remotely.
Well-known industrial control systems include:
- Distributed control systems (DCS).
- Programmable logic controllers (PLC).
- Supervisory control and data acquisition (SCADA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

SCADA

A

SCADA usually refers to centralized systems which monitor and control entire sites, or complexes of systems spread out over large areas (e.g. electrical, grid, oil, and gas pipelines). Security Considerations:

  • Weak Authentication.
  • Use of outdated OS.
  • Inability to patch systems.
  • Unauthorized remote access.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Cloud Computing

A

Cloud Computing is a model for enabling ubiquitous, convenient, on-demand, network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Cloud Competing Service Models

A
  • SaaS
  • PaaS
  • IaaS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Cloud Computing Deployment models

A
  • Private Cloud
  • Community Cloud
  • Public Cloud
  • Hybrid Cloud
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Public Cloud

A

Provisioned for public use. Considerations:

  • Location
  • Multi-tenancy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Community cloud

A

Provisioned for the exclusive use by a well-defined group. Considerations:
- Multi-tenancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Private Cloud

A

Provisioned for exclusive of single organization. Considerations:
- Scalability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Hybrid Cloud

A

The public and private cloud infrastructures communicate over an encrypted connection, using technology that allows for the portability of data and applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Cloud Access Security Brokers

A

Cloud Access Security Brokers (CASBs) are security policy points (software or appliance) placed between ‘the cloud’ and enterprise users.
- Security policies are interjected as cloud-based resources are accessed. for example, authentication, encryption, visibility, and DLP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Security as a Service (SecaaS)

A

Security as a Service (SecaaS) is the delivery of managed security services for public, private, and hybrid cloud environments.

  • SeccaS relieves the burden of relying on the SaaS, PassS, or IaaS vendor for security protection and enforcement.
  • Services include encryption, activity monitoring, DLP, malware detection, filtering, firewall, policy enforcement, email security, intrusion detection, authentication, and more.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Injection Attack

A

Tricking an application into including unintended commands in the data sent to an interpreter (e.g. OS, LDAP, SQL)

  • Flaw: Improper input/output validation.
  • Impact: Can result in unauthorized access, data exfiltration, and data corruption.
  • Mitigation: Use of ‘safe’ API, positive ‘whitelist’ input output validation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Broken Authentication

A

The attacker uses flaws in the authentication or session management Functions to impersonate users> Privileged accounts are frequently targeted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Bluejacking

A

Bluejacking is injecting a unsolicited message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Bluesnarfing

A

Bluesnarfing is unauthorized device pairing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Blueborne

A

Blueborne exploits protocol weakness to take over the device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Embedded Systems Defined

A

An embedded system is an electronic product that contains a microprocessor and software designed to perform a specific task. An embedded system can either be fixed or programmable.
- The devices are designed for functionality and convenience - not security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Embedded System components.

A
  • System on a chip (SOC)
  • Real-time OS (RTOS)
  • APP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Internet of Things (IoT)

A

“The internet of things is the network of physical objects or ‘things’ embedded with electronics, software, sensors, and connectivity to enable it to achieve greater value and service by exchanging data with the manufacturer, operator, and/or other connected devices. Each thing is uniquely identifiable through its embedded computing system but is able to interoperate within the existing Internet infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Fog Computing

A

Architecture that uses collaborative edge computing devices for local resource pooling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Term that describes the use of IT solutions that are managed outside of and without the knowledge of the IT department

A

ShadowIT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Cryptography Use Cases

A
  • Confidentiality (encryption)
  • Integrity (Hashing)
  • Non-repudiation (digital signatures)
  • Authentication (digital certificates)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Plaintext (clear-text)

A

Human readable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Ciphertext

A

Encrypted and/or human unreadable text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Cipher

A

A technique that transforms plaintext into ciphertext and back to clear-text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Algorithm

A

A cryptographic algorithm is a mathematically complex modern cipher.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Stream Cypher

A

Algorithm that works with one bit at a time.

Example: RC4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Block Cypher

A

Algorithm that works with blocks of data.

Examples: DES, 3DES, AES, BLOWFISH, TWOFISH, IDEA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Cryptographic Key / Cryptovariable

A

Secret used with an algorithm.

- The key dictates what parts of the algorithm will be used, in what order, and with what values.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Key Space

A

Number of possible key combinations.

80
Q

Key Stretching

A

The initial key is fed into an algorithm that outputs an enhanced (stronger) key.

81
Q

Symmetric Key

A

Using a single key.

82
Q

Asymmetric Key

A

Using two mathematically related keys (public / private)

83
Q

Substitution Cipher

A

Substitution cipher replaces one character or bit for another character or bit. The key is the shift pattern.

84
Q

Transposition Cipher

A

Transposition Cipher moves characters or bits to another place within the block. The key is the transposition code.

85
Q

Confusion

A

Confusion is the process of changing the values. Complex substitution functions are used to create confusion. Substitution ciphers are enforced through confusion.

86
Q

Diffusion

A

Diffusion is the process of changing the order sending bits through multiple rounds of transposition is used to create diffusion.

87
Q

Lightweight Cryptography.

A

Emerging lightweight cryptographic algorithms are being developed to support low power devices as well as low latency and high resiliency requirements.

88
Q

Strength of a Cryptographic Algorithm

A

Strength of a Cryptographic Algorithm is a combination of the algorithm, the algorithmic process, the length of the key, and the secrecy of the key. If one element is weak, the cryptosystem can potentially be compromised.

89
Q

Workfactor

A

The work factor is the amount of time and effort it would take to penetrate (break) a cryptosystem.

90
Q

Key Management

A

Key management describes the activities involving the handling of cryptographic keys and other related security parameters (e.g. passwords) during their entire life-cycle.

  • A key should only be used for one purpose (e.g. encryption).
  • Keys should be frequently changed to increase work-factor.
  • Provate keys must be securely stored.
91
Q

Key Escrow

A

Key Escrow is a proactive arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, a authorized third party may gain access to those keys.

92
Q

Block Cipher Modes

A
  • Electronic CodeBook (ECB)
  • Cipher Block Chaining (CBC)
  • Counter Mode (CTR)
  • Galois/Counter Mode (GCM)
93
Q

Electronic CodeBook (ECB)

A

With Electronic CodeBook (ECB) mode, each block is independent (doesn’t hide patterns - not suitable for long message).

94
Q

Cipher Block Chaining (CBC)

A

Cipher Block Chaining (CBC) mode, includes an initialization vector (IV) and a compartment mode of the previous ciphertext to leverage randomization.

95
Q

Counter Mode (CTR)

A

Counter Mode (CTR) mode does not have any dependencies. Converts block cipher to a stream cipher using XOR functions.

96
Q

Galois/Counter Mode (GCM)

A

Galois/Counter Mode (GCM) is an efficient mode of operation for symmetric key cryptographic 128-bit blocks. GCM can take advantage of parallel processing.

97
Q

Symmetric Algorithms

A
  • DES
  • 3DES
  • AES
  • Blowfish
  • IDEA
  • Twofish
  • RC4
98
Q

Data Encryption Standard

A

64-bit key size / 16 rounds of substitution and transposition.

  • 1977 established a US Government standard
  • 1998 demonstrated that it could be “broken” in less than 56 hours.
99
Q

Triple DES (3DES)

A

64-bit key size / 48 rounds of substitution and transposition using either 2 or 3 key.

  • 1999 replaced DES as a US Government standard.
  • Considered deprecated.
100
Q

Advanced Encryption Standard (Rijndael)

A

128- or 192- or 256-bit key / 10 or 12 or 14 rounds of substitution and transposition.
- 2002 replaced 3DES as a US Government standard.

101
Q

Asymmetric Ciphers

A
  • RSA
  • ECC-Elliptic Curve Cryptosystem
  • Diffie-Hellman
  • El Gamal
102
Q

RSA

A

Widely implemented.

  • Defacto commercial standard.
  • Works with both encryption and digital signatures.
103
Q

ECC-Elliptic Curve Cryptosystem

A

Similar function to RSA but with smaller key sizes (require less computing power).
- Current US Government standard for Asymmetric encryption.

104
Q

Diffie-Hellman

A

Primarily used for key agreement (key exchange)

  • Allows two parties (in the same DH group) that have no prior knowledge of each other to jointly establish a shared secret key.
  • DHE uses modular arithmetic to computer the shared secret..
  • ECDH uses algebraic curves to generate keys.
105
Q

El Gamal

A

Primarily used for transmitting digital signatures and key exchange.

106
Q

Hashing

A

Hashing produces a visual representation of a data set. The objective of hashing is proving integrity.

  • Validate that a message has not been changed during transmission (message digest).
  • Verify that a forensic clone is intact.
107
Q

Hash Function Characteristics.

A

In order to be considered secure, cryptographic hash functions must meet three criteria:

  • Output must not be reversible (one-way-representation).
  • Variable length input must produce fixed length output.
  • Output must be unique.
108
Q

Hashing Collision

A

If a hash function produces the same value for two different inputs, the result is known as a collision.

109
Q

Message Digest (MDx)

A

MD5 has been shown to be subject to collision attacks and is ‘broken’

110
Q

Secure Hash Algorithm (SHA)

A

Created by the NSA

  • SHA-1 has been shown to be subject to collision attacks
  • Sha-2 family is widely used and includes SHA-256, SHA-384, and SHA-512.
111
Q

RIPEMD

A

RIPEMD was based on MD4; it has been replaced by RIPEMD-160

112
Q

Hashed MAC

A

A hashed message authentication code (HMAC) is a hashed value that includes a symmetric key.

  • An HMAC cannot be reproduced without knowing the key.
  • An HMAC provides integrity and data origin authentication.
  • HMAC is used by cryptographic protocols such as the TLS and IPsec to verify the integrity of transmitted data during secure communications.
113
Q

Digital Signature

A

A digital sinature is a message digest that has been encrypted using a private key.
The goal of a digital signature is integrity and non-repudiation.

114
Q

Non-repudiation

A

Non-repudiation means that the signer cannot deny sending the message. Conversely, the receiver can trust that the message came from the named signer.

115
Q

Digital Signature Algorithms

A
  • RSA

- Digital Signature Algorithms (DSA)

116
Q

Digital Signature Algorithms (DSA)

A

Published by NIST in cooperation with the NSA US Government Digital Signature standard.

117
Q

Public Key Infrastructure

A

Public Key Infrastructure consists of programs, data formats, procedures, communication protocols, security policies, and public key cryptographic mechanisms working together in a comprehensive manner to enable secure communication.

118
Q

x509

A
  • Public Key Infrastructure x506 (PKIX) is the working group formed by the IETF to develop standards and models (known as x.509).
  • Public Key Cryptography Standards (PKCS) is a set of voluntary standards created by RSA and other industry leaders.
119
Q

Digital Certificates

A

Digital Certificates are the mechanisms to generate a private key and to associate a public key with a collection of components sufficient to authenticate the claimed owner.

  • The x509 standards defines the certificate format and fields for public key.
  • The x509 standard defines the distribution procedures.
  • The current version of x509 for certificates is v3.
120
Q

Self-Signed Certificate

A

A Self-Signed certificate is signed by the person creating it.

  • The advantage is that there is no additional expense.
  • The disadvantages is that a self-signed certificate can easily be impersonated, will present the user with a warning message and cannot be revoked.
  • Use cases include a internal development server.
121
Q

Trust Models (Chain of Trust)

A

A Trust Model defines how users trust other users, organizations, CAs and RAs within the PKI.

  • Web of Trust.
  • Third party (single Authority) Trust.
  • Hierarchical Model.
122
Q

Web of Trust

A

No central authority. Each user creates and signs their own certificate. Users sign each others public key indicating “trust”

123
Q

Third party (single Authority) Trust.

A

A central third-party Certificate Authority (CA) signs a key and authenticates the owner.

124
Q

Hierarchical Trust Model.

A

Extension of third party in which root CAs issues certificate to lower level “intermediate” CAs who can then issue certificates. Trust is inherited.

125
Q

Trusted Certificate Life-Cycle.

A
  • CSR - Certificate Signing Requrest (CSR).
  • Certificate is issued
  • Certificate is published
  • Certificate is received
  • Certificate is Installed
  • Certificate renewed, suspended, revoked or expired.
  • Key is destroyed.
126
Q

Certificate Revocation List (CRL)

A

CA maintain list of certificates that have been revoked.

  • Pull Model - CRL is downloaded by the user or organization.
  • Push model - CRL is automatically sent out by the CA at regular intervals.
127
Q

Online Certificate Status Protocol (OCSP)

A

Process designed to query the status of certificate in real-time.
- OCSP stapling is a time stamped (cached) OCSP response.

128
Q

Cyptanalysis

A

The process of finding a cryptographic weakness (vulnerability)

129
Q

Known Ciphertext

A

A sample of ciphertext is available without the plaintext associated with it.

130
Q

Known Plaintext

A

A sample of ciphertext and the corresponding known plaintext is available.

131
Q

Chosen Plaintext

A

Can choose the plaintext to get encrypted and obtain the corresponding ciphertext

132
Q

Chosen Ciphertext

A

Can select the ciphertext and obtain the corresponding plaintext.

133
Q

Cryptographic Key Attacks

A
  • Brute Force
  • Dictionary
  • Frequency
  • Replay
134
Q

Brute Force Attack

A

Every possible key is tested (Online, Offline)

135
Q

Dictionary Attack

A

List of known keys tested.

136
Q

Frequency Attack

A

Looking for patterns to reveal the key.

137
Q

Replay Attack

A

Attacker tries to reuse a cryptographic transmission.

138
Q

Birthday Attack

A

Exploits the mathematics behind the birthday problem probability theory to cause collision.

139
Q

Pass-the-hash Attack

A

Using captured hashed credentials from one machine to successfully gain control of another machine.

140
Q

Rainbow Tables

A

Rainbow Tables are publicly available tables of pre-computed hashes.

141
Q

Salting

A

Salts are values appended to the input to negate the value of rainbow tables.

142
Q

Downgrade Attack

A

A Downgrade Attack is an attack on a system or communications protocol that forces degradation to a lower-quality crypto mode (if available) designed for backward compatibility

143
Q

Weak Implementations

A

Attackers take advantage of miscommunications, weak keys, broken, or deprecated versions.

144
Q

Physical Security Controls

A

Physical security principles of deter, detect, and delay* supported by a response plan are designed to frustrate and disrupt an adversary’s attack timeline.

  • Deter: Stop or displace an attack.
  • Detect: Verify an attack, initiate a response.
  • Delay: Prevent the attack from reaching the asset (including measures to minimize the consequence of an attack)
145
Q

Layered Defense (Defense-in-depth)

A

The premise of a layered defense model is that it an intruder can bypass one layer of controls, the next layer of controls should provide additional deterrence or detection capabilities. Layers defense is both physical and psychological.

146
Q

Physical Security zones

A

The principles of deter, detect, and delay* extend to the following security zones.

  • Beyond the perimeter
  • Perimeter
  • Within site
  • Building
  • Asset
147
Q

Fail-Safe

A

Fail-Safe implies that in an emergency situation, controls will default to open.

148
Q

Fail-Secure

A

Fail-Secure implies that in an emergency situation, controls will default to locked.

149
Q

CPTED

A

The basic premise of Crime Prevention through Environmental Design (CPTED) is that the proper design and effective use of the physical environment can lead to a reduction in the incidence ad fear of crime.

150
Q

Lighting

A

Lighting can be continuous, motion triggered, random, timed, or standby.
Lighting should be tamper proof and have a backup power supply.

151
Q

Physical Signs

A

Signs for personnel safety and intruder deterrence.

152
Q

Physical Barrier

A

fences, walls, gates, barricades, and bollards define perimeter.

153
Q

Security Guards

A

Security personnel may be stationed at checkpoints, and patrol the area, manage surveillance, and respond to breaches and/or suspicious activity.

154
Q

Conventional Lock

A

Key Controlled cylinder -susceptible to “bumping”.

155
Q

Pick Resistant Lock

A

Conventional locks that have complex and difficult to reproduce keys.

156
Q

Cipher Lock

A

Uses a programmable key pad.

157
Q

Electronic (digital) Lock

A

Cipher lock with centralized control and auditing capabilities.

158
Q

Biometric Lock

A

Biometric recognition - may also require a key code.

159
Q

Entrance / Exit Access Controls

A
  • ID Card / badge
  • Smart Card
  • Biometric
  • Access logs
  • Audit Logs
  • Mantrap
160
Q

ID Card / badge

A

Identification card with or without picture (non electronic)

161
Q

Smart Card

A

Card with integrated circuitry used in conjunction with a card reader.

162
Q

Biometric

A

Use of bio-metric technology to identify and authenticate a person.

163
Q

Access Logs

A

Requirement to document access (sign-in/out)

164
Q

Audit Logs

A

Logs generated by smart and biometric systems.

165
Q

Mantrap

A

Two-tier barrier. Entry door on one side and an exit door on the opposite side. One door of a mantra cannot be unlocked and opened until the opposite door has been closed and locked.

166
Q

Surveillance

A

Surveillance technologies such as closed-circuit TV (CCTV) and camera detect suspicious, abnormal, or unwanted behavior.
A surveillance system can:
- Identify the presence of an intruder
- Trigger an alarm or an alert
- Provide enough detail to determine the type of incident response.
- Provide Evidence.

167
Q

Physical Intrusion Detection Systems types

A
  • Proximity: Measure magnetic field.
  • Motion: Detect physical disturbance.
  • Photometric: Changes in light.
  • Passive Infrared: Changes in Heat.
  • Acoustical: Changes in noise
  • Contact: - Electrical circuit si broken,
168
Q

Data Center Considerations

A
  • Located in the center of a facility with no external windows or doors.
  • Located on floors other that the basement, first floor, and top floor.
  • Full walls extending from floor to ceiling.
  • Partitioned ceiling.
169
Q

Airgap Isolation

A

Airgap Isolation refers computers or networks that are physically isolated from the internet or to any other computers that are connected to the internet.

170
Q

Isolated Networks

A

A physically isolated network is completely disconnected from any other network, period.

171
Q

Clean Room

A

Clean Room network/computer is located in a secured room or facility.

172
Q

Data Center Temperature.

A

Data Centers (inclusive of server rooms and networking closets) need to be kept cool.

  • Recommended temperature for an area containing computing devices is between 70-74 degrees Fahrenheit.
  • Damaging temperatures: Computers >175F, Magnetic Storage >100F, Paper products >350F
173
Q

Data Center Humidity

A

Data Center humidity can cause corrosion and low humidity can cause excessive static electricity.

  • Relative humidity between 45-60% is acceptable for areas that are processing data.
  • Electronic discharge (ESD) is the release of static electricity when two objects touch. ESD can damage or destroy electronic components.
174
Q

EMI and RFI

A

Equipment copper cable are sensitive to electromagnetic interference (EMI) and radio frequency interference (RFI).
Equipment should have limited exposure to magnets, fluorescent lights, electric motors space heaters, and wireless access points.

175
Q

Electromagnetic Interference (EMI)

A

Electromagnetic Interference (EMI) is due to electromagnetic conduction or radiation. Almost any type of electrical device can cause EMI

176
Q

Radio Frequency Interference (RFI)

A

Radio Frequency Interference (RFI) is due to AM/FM and cellular tower transmissions.

177
Q

Data Emanation

A

Data Emanation (or signal emanation) is the electromagnetic (EM) field generated by a coax or copper cable or network devices, which can be manipulated to eavesdrop on conversations or to steal data.

178
Q

Faraday Cage

A

A Faraday Cage is shield is an enclosure used to block electromagnetic (EM) fields (incoming and outgoing).
Faraday bags are after used in digital forensics to prevent remote wiping and alteration of criminal digital evidence.

179
Q

Blackout

A

Prolonged period without power

- Mitigating Control: Battery backup (UPS), Alternate power supply (generator), Supplier diversity,

180
Q

Brownout

A

Prolonged period of low voltage.

- Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)

181
Q

Sag

A

Moment of low voltage.

- Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)

182
Q

Surge

A

Prolonged period of high voltage.

- Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)

183
Q

Spike

A

Moment of high voltage.

- Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)

184
Q

Power Supply Failure

A

Failure of internal power supply or fan.

- Mitigation control: Redundant power supply.

185
Q

Fire protection elements

A
  • Fire Prevention: is the first line of defense.
  • Fire Detection: Is to realize that there is a fire while it is still small and controllable.
  • Fire Suppression: Is the containment and actually dealing with the fire.
186
Q

Fire Type “A”

A

Ordinary combustibles: wood, paper, rubber, fabrics, and many plastics.
Type of Extinguisher: Water, Dry Powder, Halon.

187
Q

Fire Type “B”

A

Flammable Liquids and Gases: gasoline, oils, paint, lacquer, and tar.
Type of Extinguisher: carbon Dioxide, Dry Powder, Halon

188
Q

Fire Type “C”

A

Fires involving Live electrical Equipment.

Type of Extinguisher: carbon Dioxide, Dry Powder, Halon

189
Q

Fire Type “D”

A

Combustible Metals or Combustible Metal Alloys.

Type of Extinguisher: Special Agents.

190
Q

Fire Type “K”

A

Fires in Cooking appliances that involve Combustible Cooking Media: Vegetable or Animal Oils, and Fats.

191
Q

Water-based Fire Suppression Systems

A

Sprinkler system effective on Class A (ordinary combustible) fires.

192
Q

Dry-Pipe

A

Sprinkler system effective on Class A (Ordinary combustible) fires Pipes do not have water in them until system is activated. Automatic Shut-off.

193
Q

Halon

A

Pressurized Halon gas that removes oxygen from the air with no residue (Banned by the Montreal Protocol of 1987)

194
Q

FM-200

A

Colorless, orderless gaseous halo-carbon with no residue. Safe for Humans.

195
Q

Argonite

A

Mixture of argon and nitrogen gas. Although non-toxic, it can be dangerous for humans.

196
Q

CO2

A

Pressurized gas - manual discharge required. Extremely dangerous to humans.

My CISSP (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions