Foundations of Cybersecurity Flashcards
Compliance
The process of adhering to internal standards and external regulations and enables organizations to avoid fines and security breaches.
Security frameworks
Guidelines used for building plans to help mitigate risks and threats to data and privacy.
Security controls
Safeguards designed to reduce specific security risks. They are used with security frameworks to establish a strong security posture.
Security posture
An organization’s ability to manage its defense of critical assets and data and react to change. A strong security posture leads to lower risk for the organization.
Threat actor
Aka, a malicious attacker. Any person or group who presents a security risk.
Internal threat
A current or former employee, an external vendor, or a trusted partner who poses a security risk. At times, this threat is accidental.
Network security
The practice of keeping an organization’s network infrastructure secure from unauthorized access. This includes data, services, systems, and devices that are stored in an organization’s network.
Cloud security
The process of ensuring that assets stored in the cloud are properly configured, or set up correctly, and access to those assets is limited to authorized users.
Programming
A process that can be used to create a specific set of instructions for a computer to execute tasks.
Cybersecurity (or security)
The practice of ensuring confidentiality, integrity, and availability of information by protecting networks, devices, people, and data from unauthorized access or criminal exploitation.
Personally identifiable information (PII)
Any information used to infer an individual’s identity.
Sensitive personally identifiable information (SPII)
A specific type of PII that falls under stricter handling guidelines. E.g. SS # or credit card information.
Technical skills
Skills that require knowledge of specific tools, procedures, and policies.
Threat
Any circumstance or event that can negatively impact assets.
Transferable skills
Skills from other areas that can apply to different careers.
Phishing
The use of digital communications to trick people into revealing sensitive data or deploying malicious software.
What are the most common types of phishing attacks?
Business Email Compromise (BEC), Spear phishing, Whaling, Vishing, and Smishing
Business Email Compromise (BEC)
A threat actor sends an email message that seems to be from a known source to make a seemingly legitimate request for information, in order to obtain a financial advantage.
Spear phishing
A malicious email attack that targets a specific user or group of users. The email seems to originate from a trusted source.
Whaling
A form of spear phishing. Threat actors target company executives to gain access to sensitive data.
Vishing
The exploitation of electronic voice communication to obtain sensitive information or to impersonate a known source.
Smishing
The use of text messages to trick users, in order to obtain sensitive information or to impersonate a known source.
Malware
Software designed to harm devices or networks.
What are the most common types of malware?
Viruses, Worms, Ransomware, and Spyware
Viruses
Malicious code written to interfere with computer operations and cause damage to data and software.
Worms
Malware that can duplicate and spread itself across systems on its own.
Ransomware
A malicious attack where threat actors encrypt an organization’s data and demand payment to restore access.
Spyware
Malware that’s used to gather and sell information without consent. This type of malware can be used to access devices. This allows threat actors to collect personal data, such as private emails, texts, voice and image recordings, and locations.
Social engineering
A manipulation technique that exploits human error to gain private information, access, or valuables.
Phishing, Smishing, Vishing, Spear phishing, Whaling, Social media phishing, Business Email Compromise (BEC), Watering hole attack, USB (Universal Serial Bus) baiting, and Physical social engineering.
What are the most common types of social engineering attacks?
What does CISSP stand for?
Certified Information Systems Security Professional
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communications and Network Security
- Identity and Access Management
- Security Assessment and Testing
- Security Operations
- Software Development Security
What are the eight CISSP security domains?
Password attack
An attempt to access password-secured devices, systems, networks, or data.
What are the two common forms of password attacks?
Brute force and Rainbow table
Physical attack
A security incident that affects not only digital but also physical environments where the incident is deployed.
What are some of the most common examples of physical attacks?
Malicious USB cable, Malicious flash drive, and Card cloning and skimming
Adversarial artificial intelligence
A technique that manipulates
artificial intelligence and machine learning technology to conduct attacks more efficiently.
Supply-chain attack
An attack that targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed.
Cryptographic attack
An attack that affects secure forms of communication between a sender and intended recipient.
What are some forms of cryptographic attacks?
Birthday, Collision, and Downgrade
