Final Review Flashcards
CIA
Confidentiality - preventing unauthorized access to sensitive information
Integritiy - assurance that data is not altered/destroyed unauthorized
Availability - continuous operation of computing systems (DOS prevention)
Exploit
Any attack that takes advantage of vulnerabilities in applications, networks, or hardware
T/F New exploits tend to be variations of common past exploits
True
Cracker
A person/entity that attempts to gain unauthorized access to a computer system, network, or data with malicious intent
Hacker
White hat - ethical cybersecurity
Black hat - cybercriminals
Gray hat - between the lines
DLP
Data Loss Prevention - software designed to detect to detect data leaks or breaches
IDS/IPS
Intrusion Detection / Prevention System
Located behind the firewall on protected network.
Detect and log abnormal traffic based on programmed signatures (data pattern).
Response capability based on signature = IPS.
Web Content Filtering
Originally intended to stop people from getting to specific websites / limit inappropriate content getting to children, now is often used to block malware
Hacker Goals
Reconnaissance - scanning, fingerprinting, enumerating
Exploit - steal/use/destroy info, stop/slow access, extortion
Hacker Motivation
Profit
Revenge
Challenge
Vandalism
Causes of Threats
Technology weakness
Configuration weakness
Policy weakness
Human error
PHP
O - Personal Home Pages
N - Php: Hypertext Preprocessor
PHP Key Benefits
Familiarity, Simplicity, Flexibility, Open Source
PHP Tag
<?php … ?>
or
<? … ?>
T/F You can have as many php blocks as you need spread throughout your HTML
True
phpinfo( )
A built-in function that outputs information about PHP’s configuration
print vs echo
print can return an error code (int), echo returns void
PHP Identifiers
Can begin with letter or underscore, be any length, consist of ASCII characters 127-255, case sensitive characters
PHP Variables
preceeded by a $
What is <?=$x?>
If short tags are enabled in php.ini, it is the short form of
<?php echo $x; ?>
Are there problems with Short Tags?
Unexpected behaviors, SQL injection vulnerabilities, Loose comparisons issues
T/F You can reassign variables dynamically?
True (risky)
How to Get/Set a variable’s type?
.gettype( ) and .settype( )
What are Variable Variables?
Allow you to use the value of one variable as the name of another. Defined by a variable name preceded by another $
eg. $varname = “student_num”;
$$varname = 121131;
// means $student_num = 121131;
PHP String Concatenation
. instead of +
Primary Functions of Cryptography
Confidentiality - Cannot be read by others
Authentication - Mathematically prove the source of the data
Integrity - Assurance the data has not been altered
Nonrepudiation - verify the identity of the sender
Encryption vs Hashing
Encryption - two way
Hashing - one way
Symmetric Algorithms
Same key, requires sender & receiver to agree on a key, AKA secret key, single-key, or one-key algorithms
Asymmetric Encryption
Different keys. Encrypt with private, decrypt with public. Recommended minimum length is now 2048-bit
Digital Signatures
Utilize hash functions to create and verify digital signatures. Provides non repudiation and authentication. Issue is that computation is done by the computer, not the person.
Digital Certificates
Electronic document attached to a public key by a trusted third party which provides proof that the public key belongs to a legitimate owner and has not been compromised. Consist of cert. owner’s public key, unique info, and digital signatures of an endorser (trusted third party)
Nonrepudiation
Practice of using a trusted, third-party entity to verify the authenticity of a party who sends a message
TLS
Transport Layer Security
Uses cryptography to enable encryption of data between two parties and digital certificates to enable authentication of the parties involved in a secure transaction.
Hashing
Method used to verify data integrity. Uses variable-length input that is converted to a fixed-length output string. Ex. digital signatures and secure storing of passwords
Zero-Day Exploit
Technique used to attack systems that have a vulnerability that is unknown to the public, or “zero days” old
Hardening
Process of modifying an OS’s default configuration to make it more secure to outside threats.
Remove unnecessary programs / services, apply patches to eliminate known vulnerabilities
Change Management Process
Document existing state
Determine impact of change
Seek approval for change
Test the change
Document the changes
Review proposed changes
Schedule change and notify affected users
Deploy the change
Test and Report Success
Close the change ticket
Obfuscation
The obscuring of intended meaning in communication, making the message confusing, willfully ambiguous, or harder to understand. Intentional or unintentional.
