Final Exam Flashcards
What is CIA?
Confidentiality, Integrity, Availability. How do we keep something secret, how do we control modification, and how can we make sure that it can be accessed
What is authentication? What are the four ways of validating?
What you know, what you are, where you are, something you have. It is the process of identifying someone’s identity
What are the three kinds of access models and what do they do?
Discretionary, mandatory, and role based. An individual sets the access control, the system sets access control and the individual can’t make edits, controls are based off of roles, not individuals
What are examples of symmetric crypto?
AES, 3DES
How many keys are used in Symmetric crypto?
1
How many keys are used in asymmetric crypto?
2
What are examples of asymmetric crypto?
Sha, md5
Why can’t you unhash?
Because you run crypto with additional text so that everything gets mixed up
What are some mitigation strategies that should be employed?
Whitelist applications. Find trusted applications that need to be used and block all others. Patch applications within two days of finding risks. Patch the operating system within two days of finding risks, and minimize the number of users
What are the PII Principals? (7)
Notice Purpose Consent Security Disclosure Access Accountability
What are the top Owasp threats
Injections, Broken authentication, cross-site scripting
How can you protect your wifi
Use WPA2 instead of WEP
What is the internet of things?
Connection of physical things to the internet. RFID, security cameras, etc.
How can we create a risk assessment for heartbleed?
Use Dread and Fair
How did the NSA use testing to find heartbleed in 2013?
s
What are some problems with wireless?
There are no physical protections, you dont know if you are being watched, you can blutooth snarf from up to a mile away, can air bridge gapped networks, mobile devices can be multi homed, lots of easy to use attacks
How can you protect tokens?
Expiration times, limited types of uses, limited number of uses, sign/encrypt, use standard formats
Is open source more secure?
Depends, there are more eyes looking at the code but the code is open. They are usually more security minded but there is less funding for security
What is DREAD?
Damage potential Reproducability Exploitability Affected users Discoverability
How does the FAIR model calculate risk?
(Threat event frequency * Threat capability * Control strength) * Estimated probable loss
What is stride?
Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege
What does stride use to compare to?
Data flows, data stores, processors, interactors
What is GRC?
Governance, risk management, compliance
Biometric characteristics
Uniqueness, permanence, collectability, performance, acceptibility, circumvention
What is the minimal response plan?
Detect analyze contain or eradicate provide workarounds prevent re-infection log events preserve evidence conduct a post-mortem apply lessons learned
What is IPS/IDS
Intrusion detection and protection. They are mostly meant to detect problems rather than actually fix them
Token protections
expiration time limited usages sign/ encrypt rng use saml
Tokens
handle - reference or artifact
assertion - directly validated
bearer - used by any client (bonds)
proof - specific client
