Domain 3. Security Architecture and Engineering Flashcards
CPU Register
A register is a temporary storage location located on the Central Processing Unit (CPU). It is used to store instruction sets. When a CPU executes an instruction set, it loads it from the register.
Known-Plaintext Attack
A known-plaintext attack is an attack model for cryptanalysis where the attacker has samples of both the plaintext and its encrypted version.
Secure defaults
Concept that products should have default settings that are intentionally secure.
This principle demands product and solution teams consider the security implications of weak “default” settings in their product or solution (e.g., passwords, algorithms, or controls) and instead utilize responsible default security settings, even if those increase the complexity of implementation or use.
A Salt is BEST defined as what?
A random value that is added to existing data before being hashed
Scytale, Vigenere, Caesar are types of what?
Ancient Ciphers
El Gamal
El Gamal is an asymmetric public-key algorithm. It was derived from Diffie-Hellman principles but was expanded to support an entire public-key cryptosystem. The main drawback of El Gamal is performance. It also doubles the length of any message it encrypts.
One-Time Pad
The only cryptography known to be impossible to crack.
One-Time pad requirements:
Keys must be genuinely random values
Keys can only be used one time
Keys must be exchanged securely
The sender and receiver must keep the keys secure
The key must be the same length as the message.
Vernam Cipher
Another name for One-time Pad
The only cryptography known to be impossible to crack.
One-Time pad requirements:
Keys must be genuinely random values
Keys can only be used one time
Keys must be exchanged securely
The sender and receiver must keep the keys secure
The key must be the same length as the message.
PGP - Symmetric or Asymmetric?
Symmetric
Third-Party Audit vs. External Audit
External Audits are any audit performed by an outside auditing firm.
Third-Party Audit is an audit conducted on behalf of another firm.
Abuse Case Testing
Subset of misuse case testing. Tests for intentional mis-use (as opposed to unintentional/accidental). Abuse case testing is a test to determine if a website, its hardware, software, and their interactions with one another have security vulnerabilities which could be used by attackers.
Misuse Case Testing
When we test for a case of misuse, we are testing to ensure a common user misuse doesn’t exploit a vulnerability.
What is Jack the Ripper
Psyche! Not a thing in CyberSecurity. JOHN the ripper is a password cracking tool. JACK the Ripper was a serial killer.
Infection Monkey
Open Source Breach Attack Simulation program.
Hydra
Password Cracking Tool
Birthday Attack
Attacker attempts to substitute one message for another message that generates the exact same hash and/or signature.
birthday attack exploits a mathematical principle on probability. This is known as the mathematical birthday paradox. For example, consider the scenario where a teacher with 30 students asks for everybody’s birthday. The odds are small if the teacher picked a specific day (say, 5th of October) that at least one student was born on that particular day, it’s around 8%. However, the probability that at least one student has the same birthday as any other student is about 70%.
Open System
Open Systems use agreed-upon insdustry standards.
Much easier to integrate multi-vendor solutions when industry standards are used.
i.e API, motherboard PCI connectors,
Closed System
Closed systems and proprietary systems use proprietary hardware or software.
Confinement (In context of running processes)
Another term for Sandboxing.
Confinement is used to restrict a process from interfering with the memory locations and resources of another process.
Multithreading
Allows multiple instruction sets to run in parallel under a single process
A thread is an individual instruction set that must be worked on by the CPU. Threads can execute in parallel with other threads that are part of the same parent process. This is known as multithreading. Threads are dynamically built and destroyed by the parent process. A process is a program loaded in memory. Most modern applications take advantage of multithreading.
Class A Combustible
Common combustibles, wood, paper.
Suppress with water, soda acid
Class B Combustible
Liquids - oil, gas, fuel
Suppress with COs, halon, or other gas option, soda acid.
Class C Combustible
Electrical
Suppress with CO2, halon, alternate gas option
Class D Combustible
Metals such as magnesium.
Suppress with dry powder
Class K Combustible
Cooking media - fats, grease, etc
Suppress with Alkaline mix.
Work Level
Metric that defines the strength of encryption. Very strong encryption will have a high work level
Common Criteria - Use and EAL levels
For Sure My Mother - So Sweet Forever
Common standard for evaluating technology products. Has 7 levels
EAL1-Functionally tested
EAL2-Structurally testeed
EAL3-Methodically tested, checked
EAL4-Methodically designed, tested, reviewed
EAL5-Semiformally designed and tested
EAL6-Semiformally verified designed, and tested
EAL7-Formally verified design, and tested
TCP SYN Scan
AKA Half Open scanning
Scanner sends a SYN packet and waits for a SYN ACK packet - but the scanner doesn’t then respond with an ACK packet.
Most common cause of a false positive in regards to water-based fire suppression
People
TOC/TOU Attack
Time of check, time of use attack.
Sometimes called a “race condition”, occurs when an attacker exploits the gap in time that exists between the processing of different instructions in an ordered set to circumvent security controls.
Multi processing
When CPUs are used in parallel, it is called multiprocessing. Multiprocessing is the parallel execution of instructions. If a computer has more than one CPU, they can be used in parallel to execute instructions. For example, a database server can use up to eight processors at the same time to improve performance for data queries.
FM-200
Replacement for Halon as a fire suppressant.
uses HFC-227ea, leaves no residue, and does not require costly cleanup. FM-200 systems replace halon, which was banned in the US in 1994 as an environmental hazard.
CPU Architecture - Ring 0
Kernel
CPU Architecture - Ring 1
Operating System
CPU Architecture - Ring 2
Drivers
CPU Architecture - Ring 3
Applications
ASLR - Address Space Layout Randomization
A Memory protection methodology that randomizes memory locations.
Common Access Cards
Smart cards used by the U.S. government are known as common access cards (CACs).
SCADA
Supervisory Control and Data Acquisition:
Controls multiple process, and can span large geographical areas.
ICS
Industrial Control System
DCS - Distributed System Controller
Distributed Control System:
Network of PLCs
Generally, DCS is process-specific and does not span large geographical areas.
Often integrated into other scada systems.
PLC
Programmable Logic Controller:
PLCs are often networked and controlled by a supervisory computer.
ALU - Arithmetic Logic Unit
Component of the CPU - “Brain” of the CPU.
The arithmetic logic unit (ALU) is a series of physical circuits that perform bitwise operations on binary numbers. The circuits are built using logic gates made from transistors.
How many stages in a fire?
4
Incipient - triggers air ionization but has no smoke
Smoke - displays smoke
Flame - visible flames
Heat - heat buildup and burning of surrounding objects
How many OS process states are there?
5:
Ready
Running
Waiting
Supervisory
Stopped
Preferable Humidity range for Electronics
20%-80% (OSG)
40%-60% (Learnzapp)
Trusted Computing Base
The trusted computing base is the total combination of protection mechanisms for a computer system, including hardware, software, and firmware.
The combination of hardware, software, and controls that form a trusted base that enforces your security policy.
Tape Jukebox AKA Tape Library
A device that contains multiple backup tapes and rotates them automatically
RAID 0
Striping
RAID 1
Mirroring
RAID 10
Mirror of stripes
RAID 5
Striping with parity
RAID 6
Striping with double parity
Secondary Memory
Secondary memory, also called secondary storage, includes non-volatile storage such as a floppy disk, hard drive, or CD-ROM.
CISSP Certified Information Systems Security Professional Official Study Guide, 9th Edition. Pg 365-366.
Primary Memory
(Also called Primary Storage in some questions I’ve taken)
Primary memory is the RAM the computer uses to keep necessary information readily available to CPU.
CISSP Certified Information Systems Security Professional Official Study Guide, 9th Edition. Pg 366.
Reference Monitor
The reference monitor is an abstract machine that is used to implement security. The reference monitor’s job is to validate access to objects by authorized subjects. The reference monitor operates at the boundary between the trusted and untrusted realm. The reference monitor has three properties:
Cannot be bypassed and controls all access
Cannot be altered and is protected from modification or change
Can be verified and tested to be correct
Security Kernel
reference monitor is a concept in which an abstract machine mediates all access to objects by subjects. The security kernel is the hardware, firmware, and software of a TCB that implements this concept.
CISSP Certified Information Systems Security Professional Official Study Guide, 9th Edition. Pg 324-325.
S/MIME
Secure Multipurpose Internet Mail Extensions (S/MIME) is used to encrypt and digitally sign email. S/MIME uses the RSA encryption algorithm and has been incorporated into many commercial products.
Multilevel Processing
A multilevel approach allows for the processing of data at different security levels. Information is allowed to flow between different access levels, provided the user has the proper clearance. Multilevel models are a category in the information-flow model.
PASTA
7 stages
Process for Attack Simulation and Threat Analysis:
Seven stage threat modeling methodology. This is a risk-centric approach that aims at selecting countermeasures in relation to the value of the assets to be protected.
SD3+C
Microsoft Security Development Cycle
Secure by Design
Secure by Default
Secure in Deployment and Communication
STRIDE
Threat Categorization scheme developed by microsoft.
Tape Librarian
The tape librarian generally has access to media storage facilities. They are responsible for check-in and check-out processes, keeping the storage facility locked, and sanitizing media when it’s returned for reuse.
Zero-knowledge proof
A zero-knowledge proof allows one party to demonstrate knowledge of a secret without actually disclosing that secret to the other party. It is a method commonly applied in cryptography to validate passwords and keys (for example, validating an asymmetric private key through the use of a public key).
TEMPEST
United States government standard for limiting electric or electromagnetic radiation emanations from electronic equipment
Heartbeat Sensor
Mechanism attached to analog alarm system to periodically check in with the security/alarm company.
