Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 3 - Security Architecture and Engineering > Flashcards

Domain 3 - Security Architecture and Engineering Flashcards

1
Q

Zero Trust Security

A

○ Addresses limitations of legacy network perimeter-based security model
○ Treats user identity as the control plane
Assumes compromise/ breach in verifying every request, no entity is trusted by default, verify identity, manage device, manage apps, protect data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Secure defaults (secure design principles)

A

default configuration reflects a restrictive and conservative enforcement of security policy, taken from NIST 800-160

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Fail securely (secure design principles)

A

default configuration reflects a restrictive and conservative enforcement of security policy, taken from NIST 800-160

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Trust but verify (secure design principles)

A

depends on initial authentication process to gain access to the internal “secured” environment then relied on generic access control methods, taken from NIST 800-160, given way to zero trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Privacy by design (secure design principle)

A

making privacy and integral part of every system, tech, policy, and design process
§ Proactive and not reactive approach
§ Privacy as the default setting
§ Privacy embedded into design, not added later
§ Privacy should be positive-sum approach, not zero-sum, needs of everybody are met
§ End to end full lifecycle data protection
§ Visibility and transparency, i.e. privacy policy explaining what company does with data
Keep privacy user-centric, i.e. in GDPR the customer can request data and tell them to “forget” them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Security-aaS

A

cloud provider concept in which security is provided to an org through and online entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

internet of things (IoT)

A

class of devices connected to internet in order to provide automation, remote control, or AI processing in home or business, plugs, thermostats, speakers, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SIEM

A

sec information and event management, collects data from many sources, provides real time monitoring, traffic analysis of potential attacks, often use AI, ML and threat intel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SOAR

A

sec orchestration automation and response, threat specific playbooks, response may be fully automated or single click, domain 8, delivered with SIEM typically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Microservices

A

fine grained services with a discrete function, more modern version of SOA to cloud computing, run on Docker/ kubernetes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SOA (service oriented architecture)

A

creation of discrete services that may be accessed by users in black box fashion (don’t know whats going on under the hood)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

code level vulnerabilities

A

should be identified early in development lifecycle via static code analysis and dynamic testing to identify deficiencies before release

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

containerization

A

lightweight, granular, portable way to package apps for multiple platforms, reduces overhead of server virtualization by enabling containerized apps to run on a shared OS kernel, containers don’t have their own OS, sharing OS of host, test focuses on devops security (container level) and application level security (Authentication and Authorization)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

API

A

set of exposed interfaces allow for program interaction between services, REST uses HTTPS for web comms to offer API end points, all comms between client and server should be encrypted and access limited with API keys, storage/ dist/ transmission of access keys should be done in secure fashion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Embedded Systems

A

tech component of an IOT device, full computer system embedded inside a larger system, ie printers/ drones/ semi autonomous vehicles, consider authentication practices to ensure they meet security best practices (avoid implied trust)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

high performance computing

A

alternative to client/ server computing model for intensive operations with large data sets, for problems that require large-scale parallel processing, SETI project where individuals can volunteer their compute time i.e. grid computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

grid computing

A

employs a centralized controller that makes computing assignments to grid members, secure the grid controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

edge computing

A

some compute operations require processing activities to occur locally not in the cloud, common in IOT scenarios like agricultural, science/ space, military, ie watering plants in a field by sensing moisture, kiosk in a drug store, consider encryption, spoofing protection and authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

fog computing

A

places gateway devices in the field to collect and correlate data centrally at the edge, version of edge computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Serverless (Function as a service FaaS)

A

different that PaaS, more granular, less decisions around service tier and scale, azure functions and AWS Lambda

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

IaaS

A

CSP: networking, storage, servers, virtualization

You: OS, middleware, runtime, data, apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

PaaS

A

CSP: networking, storage, servers, virtualization, OS, middleware, runtime

You: data, apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SaaS

A

CSP: networking, storage, servers, virtualization, OS, middleware, runtime, data, apps

You: n/a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Public cloud

A

everything runs on CSPs hardware, advantages include scalability, agility, pay as you go, no maintenance, low skills

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Private cloud

A

cloud environment in your own datacenter, legacy support (can support older versions vs public which will typically always be latest versions), control, compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Hybrid (cloud model)

A

combines public and private allowing every app to run in the right location, connect the 2 clouds with VPN, flexible in legacy, compliance, and scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

CASB

A

cloud access security broker, security policy enforcement solution, ie ensuring specific users only use the applications we have in place, prevent sensitive information from being shared externally, solves problem of shadow IT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Post quantum cryptography

A

development of new kinds of cryptographic approaches that can be implemented using todays conventional computers, but will be resistant to quantum computing attacks of the future

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Symmetric encryption (shared key)

A

bulk encryption, fast, holds up well to quantum, uses 1 shared secret key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Grovers algorithm

A

quantum computer speeds up attacks to halve the key length, 256 bit key is as strong against quantum as 128 bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Shors algorithm

A

quantum can easily break all commonly used PK alogorithms, RSA is vulnerable, Elliptic curve is vulnerable, Lattice offers some resistance against quantum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

lattice

A

makes up most publications on post-quantum cryptography, QUANTUM RESISTANT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Stream cipher

A

symmetric key, one character at a time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Block cipher

A

crypto key and algo are applied to a block of data at once as a group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Substitution cipher

A

replace each character with a different character

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

transposition

A

rearrange the letters of a plaintext message to form ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Initialization vector (IV)

A

random bit string (nonce) that is XORed with the message to reduce predictability and repeatability, same length as the block size or as large as the encryption key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Caesar, vigenere, one-time pad

A

similar STREAM ciphers, difference is key length, caeser=1, vigenere=longer key like a word/ sentence, one-time pad=same length as the message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

one time pad

A

key must be generated randomely, as long as message to be encrypted, pads be protected against disclosure, pad must be used one-time then discarded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

zero knowledge proof

A

communication concept, specific type of info is exchanged but no real data is transferred, ie digital signature and digital certificate, enables one to prove knowledge of a fact without revealing the fact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

split knowledge

A

information/ priv required to perform an operation is divided among multiple users, ensures no single person has sufficient priv to compromise security, role seperation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

work function

A

aka work factor, measure strength of crypto system by measuring cost/ time to decrypt, work function rating typically represents the amount of time to complete a brute-force attack against a crypto system, TIME AND EFFORT TO BREAK A PROTECTIVE MEASURE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

key security

A

crypto keys provide security to crypto system, modern systems utilize keys of at least 128 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

symmetric encryption

A

shared secret key, faster, lacks support for scalability/ easy key distro/ nonrepudiation

AES > block > 128
Blowfish > 64
DES > block > 64 > weak
3DES > block > 64 > moderate
RC4 > stream cipher

RC5 > RSA block mode cipher > 32/63/128 > VERY strong

Skipjack > 64
Twofish > 128

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Asymmetric

A

PKI for communication between parties, supports scalability, easy key distribution, and nonrepudiation, public and private key pairs, stronger than symmetric, encrypt with recipients public key, digital signature signed with own private key

RSA > key transport > 512 > strong
Diffie Hellman > key exchange > moderate
El Gamal > key exchange > very strong
ECC > elliptic curve > very strong

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Electronic Codebook Mode (ECB)

A

DES/3DES mode
simplest and least secure, 64-bit blocks, easy to break

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Cipher block chaining (CBC)

A

DES/3DES mode
each block of unencrypted text is XORed w/ block of ciphertext immediately preceding. Decryption process simply decrypts ciphertext and reverse the XOR operation,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Cipher feedback (CFB)

A

streaming version of CBC, works on data in real time, uses chaining so errors propogate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Output feedback (OFB)

A

operates similar to CFB but XORs plaintext with a seed value, no chaining function so errors do not propogate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Counter (CTR)

A

incrementing value instead of a seed, errors do not propogate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

XOR Cipher

A

exclusiveOR, flipping bits in a simple systemic fashion, when values match = 1, when values don’t match = 0.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Key clustering

A

weakness where plaintext message generates identical ciphertext message using same algo but different keys, similar to hash collision, same reason why MD5 is no longer used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Hash functions

A

allow input of any length, provide fixed length output, easy to compute hash function, must be irreversible, must be collision free. MD5 not used anymore, sha-256 is the standard

HMAC - variable hash value length > very strong
MD5 > 128 > weak
SHA1 > 160 > weak
SHA2 > 256 > strong > current standard
SHA3 > 384 > strong
SHA5 > 512 > strong

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Salt

A

random data added before hashing, reduces effectiveness of rainbow table attacks`

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Digital signature standard (DSS)

A

uses SHA-1, SHA-2 (must use SHA-256 these days), and SHA-# message digest functions, works with Digital signature algo (DSA), Rivest, Shamir, Adleman (RSA) algo, and Eliptic Curve DSA (ECDSA) algo, FIPS-186-4 (digital signature standard)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

PKI

A

Certificate authorities (CAs) generate digital certificates containing public keys of system users, Users then distribute certificates to people with whom they want to communicate, recipients verify a certificate using CAs public key, used for web/ network/ email security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Email encryption

A

standards for encrypted messages include S/MIME and Pretty Good Privacy (PGP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Web encryption

A

standard is HTTP over TLS (HTTPS), this has replaced SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Network encryption

A

Ipsec is standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

IPsec

A

secure communication over IP, transport mode or tunnel mode, establish direct communication between computers or over VPN, windows OS can Ipsec between computers, uses 2 protocols - Authentication header (AH) and encapsulating security payload (ESP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Meet in the middle attack

A

exploits protocols using 2 rounds of encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Man in the middle attack

A

fools both parties into communicating with the attacker instead of directly with each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Birthday attack

A

attempts to find collisions in hash functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Replay attack

A

attempt to reuse authentication requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Digital rights management (DRM)

A

allows content owners to enforce restrictions, common in entertainment ie music/ movies/ books, occasionally found in enterprise to protect sensitive info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Rivest, Shamir, and Adleman (RSA)

A

most famous public key crypto system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

El Gamal

A

Public key cryptosystem, Based on Diffie-Hellman key exchange, less common than RSA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Elliptic Curve

A

public key cryptosystem, provides more security than other algos with same length key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Security Model

A

formalize security policy, implemented by enforcing integrity, confidentiality, or other controls, lay out broad guidelines (not specific), up to the developer to decide how models will be integrated into specific designs, map abstract statements into sec policy, determines what subjects can access system and what objects they will have access to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Simple security property (sec model)

A

describes rules for read, subject cannot read data at a higher classification level (no read up)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Star * security property (sec model)

A

describes rules for write

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Invocation property (sec model)

A

rules around invocation (calls), such as to subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

State machine (sec model)

A

system that is always secure no matter what state its in, based on finite state machine (FSM), “state” is a snapshot of a system at a moment in time, all state transitions must be evaluated, if each transition results in a secure state then the system is a “secure state machine”,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Information flow model

A

focuses on flow of information, Biba and Bell-Lapadula

75
Q

Bell-LaPadula (sec model)

A

prevent info flow from high security to low security level, no read up no write down, CONFIDENTIALITY, government (DoD), uses mandatory access control (MAC) to enforce DoD multilevel sec policy, simple security property and star * sec property, no read up no write down, lattice based

76
Q

Biba (sec model)

A

focuses on flow from low to high security level, INTEGRITY, no read down no write up, simple integrity property (no read down), star * integrity property (no write down), lattice based, invocation property prohibits subject from invoking subject at a higher integrity level

77
Q

Non-interference (sec model)

A

how actions of a subject at a higher security level affect the system or actions of a subject at a lower security level, ensures that actions of different objects/ subjects arent seen by/ interfere with other objects/ subjects on the same system

78
Q

Lattice (sec model)

A

based on interaction between objects (resources, computers, and applications) and subjects (individuals, groups, organizations), used to define levels of security that an object may have and that a subject may have access to

79
Q

Clark Wilson (sec model)

A

access control triple, INTEGRITY, uses security LABELS to grant access, constrained data item (CDI), unconstrained data item (UDI), integrity verification procedure (IVP), Transformation procedures (TPs), access control triplet!!

80
Q

Goguen-Meseguer (sec model

A

THE non-interference model, INTEGRITY

81
Q

Sutherland (sec model)

A

preventing interference (Information flow and SMM)

82
Q

Brewer and Nash (sec model)

A

Chinese wall, CONFIDENTIALITY, prevent conflict of interest problems

83
Q

Take Grant (sec model)

A

employs a directed graph, CONFIDENTIALITY, 4 operations (take, grant, create, and revoke)

84
Q

Constrained data item (CD)

A

Clark Wilson model, any data item whose integrity is protected by the sec model

85
Q

Unconstrained data item (UDI)

A

Clark Wilson model, any data item that is not controlled by the sec model

86
Q

Integrity verification procedure (IVP)

A

Clark Wilson model, scans data items and confirms integrity

87
Q

Transformation procedures (TPs)

A

Clark Wilson model, procedures that are allowed to modify a constrained data item (CDI)

88
Q

Access control triplet

A

authenticated principal (subjects/ users) > programs (transformational procedures) > data items (Objects/ UDIs/ CDIs), refers to relationship between users, programs and a set of data items, used in Clark Wilson model

89
Q

Graham-Denning (sec model)

A

protections rules where each object has an owner and a controller, focused on secure creation and deletion of both subjects and objects, 8 primary protection rules that define the boundaries of certain secure actions, securely create object/ subject, securely delete object/ subject, securely provide the read/ grant/ delete/ transfer access right

90
Q

Dedicated mode (sec modes)

A

clearance that permits access to ALL info, approval for ALL info, valid need-to-know for ALL info

91
Q

Multilevel mode (sec modes)

A

can process info at different levels even when all system users do not have required sec clearance

92
Q

System high mode (sec modes)

A

each user must have valid clearance, access approval for ALL info, and valid need-to-know for SOME info on a system. Offers most GRANULAR control over resources and users of these models

93
Q

Compartmented mode (sec modes)

A

one step further than system high, each user must have valid clearance, access approval for ALL INFO processed by a system, but requires valid need to know for ALL INFO they will have access to on the system

94
Q

Trusted Computing Base (TCB)

A

combo of hardware, software, and controls that work together to form a “trusted base” that enforces sec policy, subset of the complete information system, portion that can be trusted to adhere/enforce sec policy, separated by a security perimeter from the untrusted parts of the system, creates secure channels to communicate w/ rest of system

95
Q

Reference monitor

A

logical part of TCB that confirms whether subject has right to use a resource prior to granting access, ENFORCES ACCESS CONTROL

96
Q

security kernel

A

collection of TCB components that implement the functionality of the reference monitor, IMPLEMENTS ACCESS CONTROL

97
Q

Common Criteria (ISO-IEC 15408)

A

enable objective evaluation to validate a product/ system satisfies a defined set of sec requirements, gold standard, has replaced BOTH TCSEC and ITSEC
1. description of assets
2 identification of threats
3 analysis and rating of threats
4 determination of sec operations
5 selection of sec functional requirements
levels 1 through 7 vary from minimal/no protection up to verified security design

98
Q

Community protection profile (cPP)

A

flavor of common criteria (ISO-IEC 15408), black box

99
Q

Evaluation assurance level (EAL)

A

flavor of common criteria (ISO-IEC 15408), white box, see chart below!! White box

100
Q

Trusted Computer System Evaluation Criteria (TCSEC)

A

set of criteria for evaluation computer sec within products and systems, REPLACED BY COMMON CRITERIA

101
Q

Information Technology Security Evaluation Criteria (ITSEC)

A

represents initial attempt to create sec evaluation criteria in Europe. ITSEC uses 2 scales to rate functionality and assurance, REPLACED BY COMMON CRITERIA

102
Q

Covert Channel

A

method to pass info over a path that is not normally used for comms, since its not used it may not be protected by sec controls, i.e. steganography, 2 types: covert timing and covert storage

103
Q

Trusted Platform Module (TPM)

A

chip that lives on motherboard, storage/ management of keys used for disk encryption, provides OS with access to keys but prevents drive removal and data access

104
Q

Mandatory Access Control (MAC)

A

enforces access policy determined by the system not the object owner, relies on classification labels that are representative of sec domains and realms, every object/ subject has one or more labels, labels are predefined and system determines access based on labels

105
Q

Hierarchical environment (MAC type)

A

classification labels are assigned in an ordered structure from low to medium to high security, type of MAC

106
Q

Compartmentalized environment (MAC type)

A

requires security clearances over compartments/ domains instead of objects, type of MAC

107
Q

Hybrid Environment (MAC type)

A

contains levels with compartments that are isolated from the rest of the sec domain, combines both hierarchical and compartmentalized environments so that sec levels have sub compartments, type of MAC

108
Q

Discretionary Access Control (DAC)

A

permits owner of an object to control/ define its accessibility, because the owner has full control by default, at the discretion of the owner

109
Q

Non-Discretionary access control (NDAC)

A

enables enforcement of system-wide restrictions that override object specific access control

110
Q

Role based access control (RBAC)

A

well-defined collection of named job roles to endow each one with specific permissions, ensures users in each role have access to get their jobs done, i.e. global admin/ security reader/ normal user

111
Q

Certification

A

technical evaluation of each part of a comp system to assess its alignment with sec standards

112
Q

Accreditation

A

formal acceptance of certified configuration from a designated authority

113
Q

Open system

A

designed using industry standards, easy to integrate with other open systems

114
Q

Closed system

A

proprietary hardware and software, specifications are not normally published, harder to integrate with other systems

115
Q

Confinement

A

restricts process to reading from and writing to certain memory locations

116
Q

Bounds

A

are the limits of memory a process cannot exceed when reading or writing

117
Q

Isolation

A

mode a process runs in when it is confined through the use of memory bounds

118
Q

MFA

A

something you know (pin or password), something you have (trusted device), something you are (biometric)

119
Q

Authentication (AuthN)

A

process of proving that you are who you say you are, IDENTITY

120
Q

Authorization (AuthZ)

A

act of granting an authenticated party permission to do something, ACCESS

121
Q

Multitasking

A

simultaneous execution of more than one application on a comp and is managed by the OS

122
Q

Multithreading

A

permits multiple concurrent tasks to be performed within a single process

123
Q

Multiprocessing

A

use of more than one processor to increase compute power

124
Q

Multiprogramming

A

similar to multitasking, takes place on mainframe systems and requires specific programming, MULTITASKING FOR MAINFRAME

125
Q

Single vs Multi state processors

A

operate at only one security level at a time vs multiple sec levels

126
Q

User mode (processor operating)

A

apps operate in a limited instruction set environment known as user mode, normal end user operations

127
Q

Privileged mode (processor operating)

A

controlled ops are performed in privileged mode aka system mode, kernel mode, supervisory mode

128
Q

Read only memory (ROM)

A

contents burned in at factory, read only

129
Q

RAM

A

static RAM (SRAM) uses flip flops, dynamic RAM (DRAM) uses capacitors

130
Q

PROM

A

programmable chip similar to ROM, subtypes: erasable (EPROM) for overwriting with unclassified data, Ultraviolet (EPROM) uses UV light to erase, Electronically erasable PROM (EEPROM) uses electrical voltage to erase

131
Q

Flash memory

A

derivative of EEPROM, nonvolatile, can be electronically erased and rewritten

132
Q

Primary storage

A

same as memory

133
Q

Secondary storage

A

consists of magnetic, flash, and optical media that must first be read into primary memory before the CPU can use the data, 3 SECURITY ISSUES: removable media can be used to steal data ie USB drives, access controls and encryption must be applied to protect data, data can remain after deletion/ formatting

134
Q

Random access storage

A

devices can be read at any point

135
Q

Sequential access storage

A

require scanning through all the data physically stored before the desired location

136
Q

Firmware

A

software stored on a ROM chip containing basic instructions to start computer, provide OS instructions in peripherals like printers/ keyboards etc

137
Q

Process isolation

A

ensures that individual processes can only access their own data

138
Q

Layering

A

creates different realms of security within a process and limits comms between them

139
Q

Abstraction

A

creates a black box interface for programmers to use without requiring knowledge of algo/ devices inner workings

140
Q

Data hiding

A

prevents info from being read at a different sec level, hardware segmentation enforces this with physical controls

141
Q

Security policy

A

inform design/ development/ implementation/ testing/ maintenance of systems,

142
Q

cloud computing

A

processing/ storage are performed over a network connection instaed of locally (Azure, AWS, GCP)

143
Q

Hypervisors

A

Virtual machine management/ creator/ operator, Type 1 = 1 bare metal, type 2 = runs on a standard OS and the hypervisor is an app ie virtualbox/ vmware workstation

144
Q

CASB

A

cloud access sec broker, sec policy enforcement, prevents shadow IT, installed on-prem or in the cloud, ensure only secure apps are used in your environment, ensure data is not stored in unauthorized repos (only approved storage locations)

145
Q

Security-aaS

A

security is provided to an org by an online entity

146
Q

Smart devices

A

mobile devices offering app installs, may use on-device or cloud AI processing

147
Q

IoT

A

class of devices connected to internet to provide automation, remote control, or AI processing in a home/ business ie smart switches/ thermostats/ alexa/ cars

148
Q

Mobile device security

A

encryption, remote wiping (can be selective for business data), screen locking, GPS, app control, apps and functions NEED TO BE SECURED, concepts include key management/ cred management/ authentication/ geotagging/ encryption/ app whitelisting/ transitive trust and authentication

149
Q

BYOD

A

policy that allows employees to use their personal mobile devices to access business info/ resources, may improve morale but INCREASES SEC RISKS, MDM platforms like intune offer solutions

150
Q

Embedded system

A

designed around a limited set of specific functions, in relation to the larger product of which it’s a component, ie motion sensors/ lighting system/ wifi routers/ cash registers

151
Q

Static environments

A

apps/ Oss/ hardware sets/ networks that are configured for a specific need, capability, or function and then set to remain UNALTERED

152
Q

Least privilege

A

ensures a minimum number of processes are authorized to run in supervisory/ system mode, also applies to role based access where people are given what they need to do their jobs and not more

153
Q

Separation of privilege

A

separating privs that any one entity can perform, aka role separation

154
Q

accountability

A

ensures that an audit trail exists

155
Q

Buffer Overflow

A

occurs when programmer fails to check size of input data prior to writing data into a specific memory location, overwrites the bounds of memory for which it has been granted access, programmers can also leave backdoors and privileged programs on system after deployment, some systems are susceptible to time-of-check-to-time-of-use (TOTTOU) attacks where state change presents opportunity for attacker to compromise system

156
Q

time-of-check-to-time-of-use (TOTTOU) attacks

A

where state change presents opportunity for attacker to compromise system

157
Q

Order of sec controls

A

as each one fails they move to the next Deterrence > denial > detection > delay > determine (what is occuring) > decide (whether to aprehend, collect evidence)

158
Q

Administrative controls

A

(site management/ personnel controls/ awareness training/ emergency response and procedures/facility selection and management/ policy)

159
Q

Logical/ Technical Controls

A

(access control/ IDS/ alarms/ CCTV/ fire detection)

160
Q

Physical controls

A

for physical security, fences/lights/locks/mantraps/dogs/guards, VERY IMPORTANT, no amount of admin or logical/technical controls can provide adequate security without control over physical environment!!

161
Q

Fence heights

A

deter casual trespasser (3-4 feet), too hard to climb easily (6-7 feet), will deter intruders (8 feet+ with barbed wire)

162
Q

Temp (physical security)

A

humidity (40-60%, any higher causes corrosion any lower causes static), temps for computers 60-75 F damaged at 175F, storage devices damaged at 100F

163
Q

Electrical impacts (physical security)-

A

blackout=prolonged loss of power, brownout=prolonged low voltage, fault=short loss of power, surge=prolonged high voltage, spike=temporary high voltage, sag=temporary low voltage

164
Q

Lights (physical security)

A

8 feet high with 2 feet candle power

165
Q

Fire suppression

A

Class A (ASH)=common combustibles ie wood/paper=extinguish with water or soda acid, Class B (BOIL)=burning alcohol/oil/other petroleum=extinguish with gas or soda acid NOT water, Class C (CONDUCTIVE)=electrical=extinguish with any type of gas, Class D (DILYTHIUM)=burning metals=extinguished with dry powder, Class K (KITCHEN)=oil or grease=extinguish with wet chemicals

166
Q

Fire detection

A

smoke, heat, or flame sensing

167
Q

Fire damage

A

smoke damages storage devices, heat damages electronics, suppression mediums can cause short circuits

168
Q

Water based fire suppression

A

preaction systems= BEST FOR COMPUTER SYSTEMS closed sprinkler heads, pipe is charged with compressed air instead of water / wet pipe systems=filled with water, dry pipe systems= compressed air until water is needed (useful for parking garages etc where water freezes) / Deluge systems=sprinkler heads are open and larger than dry pipe heads, empty at normal air pressure and water is held back by deluge valve / NOT FOR ELECTRICAL FIRES

169
Q

Gas discharge systems

A

more effective than water but shouldn’t be used near people because it removes O2 from the air, Halon is effective but bad for environment and toxic at over 900F, Halon replacements = FM-200, CEA-410, NAF-S-III, FE-13, ARGON, Inergen, Aero-K

170
Q

Electromagnetic interference

A

common mode noise=difference in power between hot and ground wires of a power source operating electrical equipment, traverse mode noise=difference in power between hot and neutral wires of a power source operating electrical equipment,

171
Q

Radio frequency interference (RFI)

A

generated by electrical applicances/ light sources/ cables/ circuits/ etc.

172
Q

Static voltages

A

40 - destroys sensitive circuits
1000 scrambles monitors
1500 destroys hard drive data
2000 abrupt shutdown
4000 printer jam
17000 - permanent circuit damage

173
Q

Locks

A

○ Electronic combo locks - aka cipher lock, something you KNOW
○ Key card systems - something you HAVE
○ Biometric systems - something you ARE
Conventional locks - easily picked/ bumped, keys easily duplicated, least secure, pick and bump resistant exist

174
Q

site selection

A

visibility, accessibility, effects of natural disasters

175
Q

facility design

A

understand level of security needed and plan for it before construction begins

176
Q

secure work area

A

should NOT be equal access to all locations, high value assets require restricted access, should be located at CENTER OF PROTECTION, centralized server rooms don’t need to be human compatible

177
Q

Threats to physical access controls

A

propping doors, bypassing locks or access controls, masquerading is using someone elses ID, guard or monitoring system MUST be present, piggybacking/ tailgating is following someone through secure gateway/ doorway

178
Q

Visitors

A

assign an escort, monitor activities and access, badges

179
Q

evidence logs

A

used to retain logs, drive images, VM snapshots, PROTECTIONS INCLUDE: locked cabinets/ safes, dedicated isolated storage facilities, offline storage, access restrictions and activity tracking, hash management and encryption

180
Q

`audit trails/ access logs

A

useful for managing physical access control, may need to be created manually by security guards or automatically by smartcards etc, monitor with CCTV, important to reconstruct the events of an intrusion/ attack

181
Q

clean power

A

most electronic equipment requires clean power, UPS self charging battery that can supply consistent clean power to sensitive equipment, can supply power for minutes or hours depending on size, then generators after that

182
Q

open relay (SMTP)

A

does not authenticate users before relaying their message, if internet exposed they are typically quickly exploited

183
Q

motion detector

A

capacitance=electromagnetic field

184
Q

X.509

A

governs digital certificates and PKI, defines processes used by CAs, international telecommunications union (ITU) standard

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions