Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

- > Domain 7: Security Operations > Flashcards

Domain 7: Security Operations Flashcards

1
Q

Process at an incident scene

A

Ensure you identify the scene, protect the environment, identify evidence and potential sources of evidence, collect evidence (hash) and minimise the degree of contamination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Locard’s Exchange Principle

A

Perpetrator of a crime will bring something into the crime scene and leave with something from it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Sufficient: Evidence

A

Persuasive enough to convince one of its validity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Reliable: Evidence

A

Consistent with fact, evidence has not been tampered with or modified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Relevant: Evidence

A

Relationship to the findings must be reasonable and sensible, proof of crime, documentation of events, proof of acts and methods used, motive proof, identification of acts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Permissible: Evidence

A

Lawful obtaining of evidence, avoid: unlawful search and seizure, secret recording, privacy violations, forced confessions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Techniques to Identify Evidence

A

Labeling, recording serial number. Evidence must be preserved and identifiable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Evidence lifecycle

A
  1. Discovery
  2. Protection
  3. Recording
  4. Collection and identification
  5. Analysis
  6. Storage, preservation, transportation
  7. Present in court
  8. Return to owner

Witnesses that evidence is trustworthy, description of procedures, normal business methods collections, error precaution and correction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Best Evidence

A

Primary evidence is used at the trial because it is the most reliable. Original documents are used to document things such as contracts. This means NO COPIES. Further, oral evidence is not the best evidence, however, it can be used for interpretation of documents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Secondary Evidence

A

Not as strong as best evidence, a copy is not permitted if the original is available. Further examples include, oral evidence like Witness testimony.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Direct Evidence

A

Can prove fact by itself and does not need any type of backup. Testimony from a witness - one of their five senses. Oral evidence is a type of secondary evidence so the case can’t simply stand on it alone. But it is Direct Evidence and does not need other evidence to substantiate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Conclusive Evidence

A

Irrefutable and cannot be contradicted. Requires no other corroboration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Circumstantial Evidence

A

Used to help assume another fact, however, cannot stand on its own to directly prove a fact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Corroborative Evidence

A

Supports or substantiates other evidence presented in a case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Hearsay Evidence

A

Something a witness hears another one say. Also business records are hearsay and all that’s printed or displayed. One exception to business records: audit trails and business records are not considered hearsay when the documents are created in the normal course of business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Interviewing

A

Gather facts and determine the substance of the case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Interrogation

A

Evidence retrieval method, ultimately obtain a confession

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The process - Due Care

A
  • Prepare questions and topics, put witness at ease, summarise information - interview/interrogation plan
  • Have one person as lead and 1-2 others involved aswell
  • Never interrogate or interview alone
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Opinion Rule

A

Requires witnesses to testify only about the facts of the case, cannot be used as evidence in the case

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Expert Witnesses

A

Used to educate the jury, can be used as evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Six Principles of Digital Evidence

A
  1. Ensure you apply all of the general forensic and procedural principles
  2. Upon seizing digital evidence, ensure evidence is not changed
  3. When it is necessary for a person to access original digital evidence, that person should be trained for the purpose
  4. All activity relating to the seizure, access, storage, or transfer of digital evidence must be fully documented, preserved and available for review
  5. An individual is responsible for all actions taken to the digital evidence while it is in their possession
  6. Any agency seizing, accessing, storing, or transferring digital evidence is responsible for compliance with these principles.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Media Analysis

A

Involves the identification and extraction of information from storage media, such as hard disks and RAM. This may include recovery of deleted files or static analysis of forensic images of storage media.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Network Analysis

A

Analysis of network activity, such as network logs, packet captures. Focus is on collecting and correlating information from these disparate sources and produce as comprehensive a picture of network activity as possible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Hardware/Embedded Device Analysis

A

Review the contents of hardware and embedded devices, such as phones and laptops.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Admissible Evidence

A
  1. Evidence must be relevant to determining a fact
  2. The fact that the evidence seeks to determine must be material (that is, related) to the case
  3. The evidence must be competent, meaning it must have been obtained legally. Evidence that results from an illegal search would be inadmissible because it is not competent.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Five rules of Evidence

A
  1. Be authentic; evidence tied back to scene
  2. Be accurate; maintain authenticity and veracity
  3. Be complete; all evidence collected, for and against view
  4. Be convincing; clear and easy to understand for jury
  5. Be admissible; be able to be used in court
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Forensic Disk Controller

A

Intercepting and modifying or discarding commands sent to the storage device. This includes:

  • Write blocking, intercepting write commands sent to the device and prevents them from modifying data on the device
  • Return data requested by a read operation
  • Returning access-significant information from device
  • Reporting errors from device to forensic host
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

MOM: Investigation

A

Means, opportunity and motive. Determine suspects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Victimology

A

Why certain people are victims of crime and how lifestyle affects the changes that a certain person will fall victim to a crime investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Types of Investigation

A
  • Operational
  • Criminal
  • Civil
  • eDiscovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Slack space

A

Slack space on a disk should be inspected for hidden data and should be included in a disk image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Common Law

A

Used in USA, UK, Australia and Canada (judges)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Civil Law

A

Europe, South America

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Islamite and other Religious Laws

A

Middle East, Africa and Indonesia

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

USA’s 3 Branches of Law

A
  1. Legislative: writing laws (statutory laws)
  2. Executive: enforces laws (administrative laws)
  3. Judicial: interprets laws (makes common laws out of court decisions)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

3 Categories of Laws

A
  1. Criminal Law
  2. Civil Law
  3. Administrative/Regulatory Laws
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Criminal Law

A

Individuals that violate Government laws. Punishment is typically imprisonment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Civil Law

A

Wrongs against individual or organisation that result in a damage or loss. Punishment can include financial penalties. AKA tort law where jury decides liability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Administrative/Regulatory Laws

A

How the industries, organisations and officers have to act. Wrongs can be penalised with imprisonment or financial penalties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Uniform Computer Information Transactions Act (UCITA)

A

Federal law which provides common framework for conduct of computer related business transactions. Provides basis for software licensing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Types of computer crime

A
  1. Unauthorised intrusion
  2. Unauthorised alteration or destruction
  3. Malicious code
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Enticement

A

is the legal action of luring an intruder, like in a honeypot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Entrapment

A

Is the illegal act of inducing a crime, the individual had no intent of committing the crime at first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Federal Sentencing Guidelines

A

Provides judges and courts procedures on the prevention, detection and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Purpose of Security Incident and Event Management (SIEM)

A

Automating much of the routine work of log review. Provide real-time analysis of events occurring on systems throughout an organisation but don’t necessarily scan outgoing traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Intrusion

A

Occurs when an attacker is able to bypass or thwart security mechanisms and gain access to an organisation’s resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Intrusion Detection

A

Monitors recorded information and real-time events to detect abnormal activity indicating a potential incident or intrusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

IDS

A

Intrusion detection system automates inspection of logs and real-time system events to detect intrusion attempts and system failures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

IPS

A

Intrusion prevention system includes all the capabilities of an IDS but can also take additional steps to stop or prevent intrusions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

DLP

A

Data Loss Prevention systems attempt to detect and block data exfiltration attempts. These systems have the capability of scanning data looking for keywords and data patterns.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Network Based DLP

A

Scans all outgoing data looking for specific data. Administrators would place it on the edge of the network to scan all data leaving the organisation. The system will scan, block and alert if a file was leaving the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Endpoint Based DLP

A

Can scan files stored on a system as well as files sent to external devices, such as printers. For example, an organisation endpoint-based DLP can prevent users from copying sensitive data to USB flash drives or sending sensitive data to a printer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

3 States of Information

A
  1. Data at Rest (storage)
  2. Data in Transit (moving through network)
  3. Data being processed (must be decrypted) / in use / end-point
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Configuration item (CI)

A

Component whose state is recorded. Version: recorded state of the CI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Configuration

A

Collection of component CI’s that make another CI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Building

A

Assembling a version of a CI using component CI’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Build list

A

Set of versions of component CI’s used to build a CI software library

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

CI Software Library

A

Controlled area only accessible for approved users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Artifacts

A

Configuration Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Recovery Procedures

A

System should restart in secure mode, startup should occur in maintenance mode that permits access only by privileged users from privileged terminals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Fault-tolerant

A

Systems continue to function despite failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Fail safe system

A

Program execution is terminated and system protected from compromise when hardware or software failure occurs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Fail Closed/secure

A

Most conservative from a security perspective. Denies all further access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Fail Open

A

Permits all access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Fail Hard

A

Such as BSOD, where human intervention to see why it failed is required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Fail soft or resilient system

A

Reboot, selected, non-critical processing is terminated when failure occurs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Failover

A

Switches to hot backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Fail Safe

A

Doors UNLOCK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Fail Secure

A

Doors LOCK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Trusted Path

A

Protected data between users and a security component. Channel established with strict standards to allow necessary communication to occur without exposing the TCB to security vulnerabilities. A trusted path also protects system users (sometimes known as subjects) from compromise as a result of a TCB interchange. This is the only way to cross security boundary appropriately.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Events

A

Anything that happens. Can be documented, verified and analysed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Incident

A

Event or series of events that adversely impact the ability of the organisation to do business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Security Incident

A

This could be a suspected attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Security Intrusion

A

Evidence attacker attempted or gained access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Lifecycle of incident

A
  1. Detection
  2. Response
  3. Mitigation
  4. Reporting
  5. Recovery
  6. Remediation
  7. Lessons Learned

It is all about response capability (policy, procedures a team) –> incident response and handling (triage, investigation, containment, and analysis of and tracking) –> Recovery (recovery/repair), –> debriefing/feedback (external communications) –> Mitigation: limit the effect or scope of an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

RCA

A

Tree/Boolean - Fault Tree Analysis, such as:

  • 5Ways
  • Failure Mode and Effects Analysis
  • Pareto Analysis
  • Fault Tree Analysis
  • Cause Mapping
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

HIDS: Firewalls

A

Host Based IDS, monitors activity on a single computer, including process calls and information recorded in firewall logs. Can examine events in more detail than NIDS. Benefits of HIDS include that it can detect anomalised on the host system that NIDS cannot detect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

NIDS: Firewalls

A

Network based IDS, monitors and evaluates network activity to detect attacks or event anomalies. It cannot monitor the content of encrypted traffic but can monitor other packet details.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Full: Backup Type

A

All files, archieve bit and modify bit are cleared. Advantage: only previous day needed for full restore, disadvantage: time consuming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Incremental: Backup Type

A

Only backups modified files, archieve bit cleared. Advantage: least time and space, Disadvantage: first restore full then all incremental backups, thus less reliable because it depends on more components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Differential: Backup Type

A

Backups only modified files, doesn’t clear archive bit. Advantage: full and only last difference needed, intermediate time between full and diff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Redundant Servers

A

Applies RAID 1 mirroring concept to servers. On error servers can do a fail-over. This AKA server fault tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Server clustering

A

Group of independent servers which are managed as a single system. All servers are online and take part in processing service requests. Individual computing devices on a cluster vs. a grid system - cluster devices all share the same OS and application software but grid devices can have different OSs while still working on same problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Tape Rotation Schemes

A

Grandfather/Father/Son, Tower of Hanoi, Six Cartridge Weekly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

RAIT

A

Robotic mechanisms to transfer tapes between storage and drive mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Mutual Aid Agreement: DRP

A

Arrangement with another similar corporation to take over processes. Advantage: cheap, disadvantage, must be exact same, is there enough capability, only for short term, and what if disaster affects both corporations. Is not enforceable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Subscription Service

A

Third party, commercial services provide alternate backups and processing facilities. Most common of implementaitons.

88
Q

Redundant Site

A

Mirrored site, potential 0 downtime

89
Q

Hot Site - Internal/External

A

Fully configured computer facility. All applications are installed, up-to-date mirror of the production system. For extremely urgent critical transaction processing. Advantage: 24/7 availability and exclusive use are assured. Disadvantage: Very costly

90
Q

Warm Site

A

Cross between hot and cold site. The computer facility is available but the applications may not be installed or need to be configured. External connections and other data elements that take log time to order are present. Advantages: less costly, however, disadvantages include: more time to setup (could be 12 hours).

91
Q

Cold Site

A

Least ready but most commonly used. Has no hardware installed only power and HVAC. Advantage: cheap, however, disadvantages include: very lengthy time of restoration.

92
Q

Service Bureau

A

Contract with a service bureau to fully provide alternate backup processing services. Advantage: quick response and availability.

93
Q

Multiple Centres (AKA Dual Sites)

A

Processing is spread over several computer centres. Can be managed by same corporation (in-house) or with another organisation (reciprocal agreement). Advantage: costs, multiple sites will share resources and support. Disadvantage: a major disaster could affect both sites; multiple configurations have to be administrered.

94
Q

Other data centre backup alternatives

A
  1. Rolling/mobile sites: mobile homes or HVAC trucks. Could be considered a cold site.
  2. In-house or external: Supply of hardware replacements. Stock of hardware either onsite or with a vendor. May be acceptable for warm site but not for hot site.
95
Q

Prefabricated Buildings

A

A very cold site

96
Q

RTO

A

Recovery Time Objectives. Refers to business processes, not hardware.

Hot Site RTO: In minutes or hours
Warm Site RTO: 1-2 days
Mobile Site RTO: 3-5 Days
Cold Site: RTO 1-2 weeks

97
Q

RAID 0: Striped

A

One large disk out of several physical disk. Improved performance but no fault tolerance

98
Q

RAID 1: Mirrored

A

Mirrored drives. Fault tolerance from disk errors and single disk failure. Expensive, and offers redundancy only, with no improvement to speed.

99
Q

RAID 2

A

Not used commercially. Hammering code parity/error

100
Q

RAID 3

A

Striped on a byte level with extra parity drive - improved performance and fault tolerance, but parity drive is a single point of failure and write intensive. 3 or more drives

101
Q

RAID 4

A

Same as RAID 3 but striped on a block level. 3 or more drives

102
Q

RAID 5

A

Striped on block level, parity distributed over all drives - requires all drives but one to be present to operate hot swappable. Interleave parity

103
Q

RAID 6

A

Dual Parity, parity distributed overall drives. Requires all drives but two to be present to operate hot-swappable drives.

104
Q

RAID 7

A

Same as RAID 5 but all drives act as one single virtual disk

105
Q

Tape: Storage Media

A

Sequential, slow read, fast write (200GB an hour), historically cheaper than disk (now changing), robotic libraries

106
Q

Disk: Storage Media

A

Fast read/write, less robust than tape

107
Q

Optical Drive

A

CD/DVD. Inexpensive

108
Q

MTTF

A

Mean Time to Failure

109
Q

MTTR

A

Mean Time to Repair

110
Q

MTBF

A

Mean Time between Failures (Useful Life) = MTTF + MTTR

111
Q

JBOD

A

Most basic type of storage

112
Q

Electronic Vaulting

A

Transfer of backup data to an offsite storage location via communication lines

113
Q

Remote Journaling

A

Parallel processing of transactions to an alternative site via communication lines

114
Q

Database Shadowing

A

Live processing of remote journaling and creating duplicates of the database sets to multiple servers

115
Q

Object Reise

A

Use after initial use

116
Q

Data Remanence

A

Remaining data after erasure. Format magnetic media 7 times (orange book)

117
Q

Clearing

A

Overwriting media to be reused

118
Q

Purging

A

Degaussing or overwriting to be removed

119
Q

Destruction

A

Completely destroy preferably by burning

120
Q

End Goal: DRP

A

Restore normal business operations.

121
Q

Statement of Actions

A

Actions that have to be taken before, during and after a disruptive event that causes a singificant loss

122
Q

Information Goal

A

Provide organised way for decision making, reduce confusion and deal with the crisis. Planning and development must occur before the disaster

123
Q

Disaster

A

Any event, natural or manmade, that can disrupt normal IT operations. A disaster is not over until all operations have been returned to their normal location and function. It will be officially over when the data has been verified at the primary site, as accurate

124
Q

Recovery Team: DRP Teams

A

Mandated to implement recovery after the declaration of the disaster

125
Q

Salvage Team

A

Goes back to the primary site to bring normal processing environmental conditions. Clean, repair, salvage. Can declare when primary site is available again.

126
Q

Normal Operations Resume Plan

A

Has all procedures on how the company will return processing from the alternate site

127
Q

Other recovery issues

A

Interfacing with other groups: everyone outside the corporation.
Employee relations: responsibility towards employees and families
Fraud and crime: like vandalism, looting and people grabbing the opportunity

128
Q

DRP Key Points

A
  • Make sure to get communications up first, then most critical business functions
  • Documenting the plan
  • Activation and recovery procedures
  • Plan management
  • HR involvement
  • Costs
  • Required documentation
  • Internal/external communications
  • Detailed Plans by team members
129
Q

Desk Check: DRP Test

A

Deskcheck simply reviews the plans contents on paper

130
Q

Table-top Exercise

A

Members of the DRP team gather in a large conference room and role-play a disaster scenario

131
Q

Simulation Tests

A

More comprehensive and may impact one or more noncritical business units of the organisation, all support personnel meet in a practice room

132
Q

Parallel Tests

A

Involve relocating personnel to the alternate site and commencing operations there. Critical systems are run at an alternate site, main site open also

133
Q

Full-interruption tests

A

Involve relocating personnel to the alternate site and shutting down operations at the primary site

134
Q

BCP

A

Plan for emergency response, backup operations and post disaster recovery maintained by an activity as a part of its security program that will ensure the availability of critical resources and facilitate the continuity of operations in an emergency situation.

135
Q

BCP Process

A
  1. Scope and Plan Initiation: consider amount of work required, resources required, management practice
  2. BIA: helps to understand impact of disruptive processes
  3. BCP Development: Use BIA to develop BCP (strategy development phase bridges the gap between the BIA and the continuity planning phases of BCP development). Also includes testing of BCP.
  4. Plan approval and implementation: Management approval, and creating awareness
136
Q

BCP Testing Frequency

A

Should be atleast once a year

137
Q

DRP vs BCP

A

DRP has a heavy IT focus, allows the execution of the BCP, needs planning and testing

138
Q

BCP Development

A

Is about defining the continuity strategy. Computing strategy to preserve the elements of hardware/software/communication lines/applications/data

139
Q

Facilities

A

Use of main buildings or remote facilities

140
Q

People

A

Operators, management, technical support persons

141
Q

Supplies and equipment

A

Paper, HVAC

142
Q

BCP Committee: Roles and Responsibilities

A
  • Senior Staff (ultimate responsibility, due care/diligence)
  • Various business units (identify and prioritise time critical systems)
  • Information Systems
  • Security Administrator
  • People who will carry out the plan (execute)
  • Representatives from all departments
143
Q

CCTV

A

Enables you to compare the audit trails and access logs with a visual recording. Attacks include: replay attacks. Recording = detective control

144
Q

Glare Protection: Lighting

A

Against blinding by lights

145
Q

Continuous Lighting

A

Evenly distributed lighting

146
Q

Standby Lighting

A

Timers

147
Q

Responsive Areas Illumination

A

IDS detects activities and turns on lighting

148
Q

NIST guidance on lighting

A

For critical areas the area should be illuminated 8 feet in height with 2 foot candle power

149
Q

Fences: Guidance

A

Small mesh and high gauge is most secure.
3-4 feet deters casual trespasser
6-7 feet too hard to climb easily
8 feet + wires deters intruders, and difficult to climb
However, no one STOPS a determined intruder

150
Q

Local Alarms

A

Audible alarm for at least 4000 feet far

151
Q

Central Stations

A

Less than 10 minutes travel time for a private security firm

152
Q

Proprietary Systems

A

Owned and operated by the customer. System provides many of the features in-house

153
Q

Auxiliary Station Systems

A

On alarm ring out to lcoal fire or police

154
Q

Line supervision check

A

If no tampering is done with the alarm wires

155
Q

Power supplies

A

Alarm systems needs separate circuitry and backup power

156
Q

Electromechanical: Physical Perimeter Detection

A

Detect a break or change in a circuit magenets pulled lose, wire door, pressure pads

157
Q

Photoelectric

A

Light beams interrupted (such as in store entrance)

158
Q

Passive Infrared

A

Detects changes in temperature

159
Q

Acoustical Detection

A

Microphones, vibrations sensors

160
Q

Wave Pattern Motion Detecters

A

Detects motions

161
Q

Proximity or Capcitance Detector

A

Magnetic field detects presence around an object

162
Q

Warded lock

A

Hanging lock with a key

163
Q

Tumbler lock

A

Cylinder slot

164
Q

Combination lock

A

3 digits with wheels

165
Q

Cipher Lock

A

Electrical lock

166
Q

Device Lock

A

Bolt down hardware

167
Q

Preset Lock

A

Ordinary door lock

168
Q

Programmable Lock

A

Combination or electrical lock

169
Q

Raking

A

Circumvent a pin tumbler lock

170
Q

Audit Trails

A

Ensure to collect date and time stamps, successful or not attempt, where the access was granted, who granted access, and who modified access privileges at supervisor level

171
Q

Photo ID Card

A

Dumb digital coded ID cards, such as swipe cards and smartcards

172
Q

Wireless Proximity CArds

A

User activated, system sensing. These can be passive or field powered.

173
Q

Passive, Field Powered and Transponders

A

Passive: no battery, uses power of the field
Field Powered: active electronics, transmitter but gets power form the surrounding field from the reader.
Transponders; Both card and receiver holds power, transmitter and electronics

174
Q

Trusted Recovery

A

Ensures that the security is not breached when a system crash or failure occurs. only required for B3 and A1 level systems.

175
Q

Failure Preperation

A

Backup critical information thus enabling data recovery.

176
Q

System recovery after a system crash

A
  1. Rebooting system in single user mode or recovery console, so no user access is enabled
  2. Recovering all file systems that were active during failure
  3. Restoring missing or damaged files
  4. Recovering the required security characteristic, such as file security labels
  5. Checking security-critical files such as system password file
177
Q

Manual: Reocvery Type

A

System admin intervention is required to return the system to a secure state

178
Q

Automatic: Recovery type

A

Recovery to a secure state is automatic when resolving a single failure (though system administrators are needed to resolve additional failures)

179
Q

Automatic without Undo Loss: Recovery Type

A

Higher level of recovery defining prevention against the undue loss of protected objects

180
Q

Function: Recovery Type

A

System can restore functional processes automatically

181
Q

System Reboot: Types of System Failure

A

System shuts itself down in a controlled manner after detecting inconsistent data structures or runs out of resources

182
Q

Emergency Restart: Types of System Failure

A

when a system restarts after a failure happens in an uncontrolled manner. E.g. when a low privileged user tries to access restricted memory segments

183
Q

System Cold Start: Types of System Failure

A

When an unexpected kernel or media failure happens and the regular recovery procedure cannot recover the system in a more consistent state.

184
Q

Hackers and crackers: Types of Attackers

A

Want to verify their skills as intruders

185
Q

Entitlement

A

Refers to the amount of privileges granted to users, typically when first provisioning an account. A user entitlement audit can detect when employees have excessive privileges.

186
Q

Aggregation

A

Privilege creep, accumulate privilege

187
Q

Hypervisor

A

Software component that manages the virtual components. The hypervisor adds an additional attack surface, so its important to ensure it is deployed in a secure state and kept up-to-date with patches, controls access to physical resources

188
Q

Exigent circumstances

A

Allows officials to seize evidence before it is destroyed. Police is called in.

189
Q

Data haven

A

Is a country or location has no laws or poorly enforced laws

190
Q

Chain of custody

A

Collection, analysis and preservation of data. Forensics uses bit-level copy of the disk

191
Q

Darknet

A

Unused network space that may detect unauthorised activity

192
Q

Pseduo Flaw

A

False vulnerability in a system that may attract an attacker

193
Q

Fair information practices

A

Openness, collection limitation, purpose specification, use limitation, data quality, individual participation, security safeguards, and accountability.

194
Q

Noise and perturbation

A

Inserting bogus information to hope to mislead an attacker

195
Q

First step of change process

A

Management approval. When a question is about processes, there must always be management’s approval as first step

196
Q

Prototyping

A

Customer view taken into account

197
Q

SQL - SUDIGR

A

6 basic SQL commands: Select, Update, Delete, Insert, Grant, Revoke

198
Q

Bind Variables

A

Placeholders for literal values in SQL query being sent to the database on a server. Bind variables in SQL used to enhance performance of a database

199
Q

Gantt and PERT Charts

A

Project management and monitor progress and planning of projects

200
Q

Piggybacking

A

Looking over someone’s shoulder to see how someone gets access

201
Q

Datacentre Secure Feautres

A

Walls from floor to ceiling, concrete floor slab of 150 pounds per square foot, no windows, and air conditioning should have own emergency power off

202
Q

Electronic Access Control (EAC)

A

Proximity readers, programmable locks or biometric systems

203
Q

CPTED Crime Prevention Through Environmental Design

A

Natural access control: guidance of people by doors, fences bollards lighting. Secure zones defined.

  • Natural surveillance: cameras and guards
  • Territorial Reinforcements: walls, fences, flags
  • Hardening: focus on locks, cameras, guards
204
Q

Facility site

A

Core of building (thus with 6 stores, on 3rd floor)

205
Q

Hacktivists

A

Combination of hacker and activist, often combine political motivations with the thrill of hacking

206
Q

Thrill attacks

A

Attacks launched only for the fun of it. Pride, bragging rights

207
Q

Script kiddies

A

Attackers who lack the ability to devise their own attacks will often download programs that do their work for them, such as website defacements

208
Q

Business attacks

A

Focus on illegally obtaining an organisation’s confidential information

209
Q

Financial attacks

A

Carried out to unlawfully obtain money or services

210
Q

Terrorist Attacks

A

Purpose of a terrorist attack is to disrupt normal life and instill fear

211
Q

Military or inteliigence attack

A

Designed to extract secret information

212
Q

Grudge attacks

A

Attacks that are carried out to damage an organisation or a person.

213
Q

Sabotage

A

Criminal act of destruction or disruption committed against an organisation by an employee.

214
Q

Espionage

A

Malicious act of gathering proprietary, secret, private, sensitive, or confidential information about an organisation. Countermeasures include: strict access control measures to all nonpublic data, thoroughly screen new employee candidates, and efficiently track all employee activities.

215
Q

Integrity breaches

A

Unauthorised modification of information, violations are not limited to intentional attacks. Human error, oversight, or ineptitude accounts for many instances

216
Q

Confidentiality breaches

A

Theft of sensitive information

- (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions