Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + Cards - Jason Dion > Fundamentals of Security > Flashcards

Fundamentals of Security Flashcards

1
Q

Information Systems Security

A

Protecting the systems (e.g., computers, servers, network devices) that hold and
process critical data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information Security

A

Protecting data and information from unauthorized access, modification, disruption, disclosure, and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Name the 3 parts of the CIA Triad

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define Confidentiality

A

Ensures information is accessible only to authorized personnel (e.g.,
encryption)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define Integrity

A

Ensures data remains accurate and unaltered (e.g., checksums)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Availability

A

Ensures information and resources are accessible when needed (e.g.,
redundancy measures)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define Non-Repudiation

A

Guarantees that an action or event cannot be denied by the involved parties
(e.g., digital signatures)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the CIANA Pentagon?

A

An extension of the CIA triad with the addition of non-repudiation and
authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the Triple A’s of Security?

A

Authentication, Authorization, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define Authentication

A

Verifying the identity of a user or system (e.g., password checks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define Authorization

A

Determining actions or resources an authenticated user can access (e.g.,
permissions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define Accounting

A

Tracking user activities and resource usage for audit or billing purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Name the 4 Security Control Categories

A

■ Technical
■ Managerial
■ Operational
■ Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Name the 6 Security Control Types

A

■ Preventative
■ Deterrent
■ Detective
■ Corrective
■ Compensating
■ Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the Zero Trust Model?

A

Operates on the principle that no one should be trusted by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What 2 things do we use to achieve zero trust?

A

The control plane and the data plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Control Plane

A
  • Adaptive identity
  • threat scope reduction
  • policy-driven access control
  • secured zones
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Data Plane

A
  • Subject/system
  • policy engine
  • policy administrator
  • establishing policy enforcement points
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a threat?

A

Anything that could cause harm, loss, damage, or compromise to our information technology systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A threat can come from the following 4 things

A

● Natural disasters
● Cyber-attacks
● Data integrity breaches
● Disclosure of confidential information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a vulnerability?

A

Any weakness in the system design or implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A vulnerability can come from internal factors like the following

A

● Software bugs
● Misconfigured software
● Improperly protected network devices
● Missing security patches
● Lack of physical security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Where threats and vulnerabilities intersect, that is where the risk to your enterprise systems and networks lies

A

■ If you have a threat, but there is no matching vulnerability to it, then you have no risk
■ The same holds true that if you have a vulnerability but there’s no threat against it, there would be no risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Risk Managment?

A

Finding different ways to minimize the likelihood of an outcome and achieve the
desired outcome

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does Confidentiality refer to and what does it ensure?

A

■ Refers to the protection of information from unauthorized access and disclosure
■ Ensure that private or sensitive information is not available or disclosed to
unauthorized individuals, entities, or processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Confidentiality is important for 3 main reasons

A

■ To protect personal privacy
■ To maintain a business advantage
■ To achieve regulatory compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

To ensure confidentiality, we use five basic methods

A
  • Encryption
  • Access Controls
  • Data Masking
  • Physical Security Measures
  • Training and Awareness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is Encryption?

A

Process of converting data into a code to prevent unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How are Access Controls good for Confidentiality?

A

By setting up strong user permissions, you ensure that only authorized personnel can access certain types data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Data Masking?

A

Method that involves obscuring specific data within a database to make it inaccessible for unauthorized users while retaining the real data’s authenticity and use for authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are Physical Security Measures?

A

Ensure confidentiality for both physical types of data, such as paper records stored in a filing cabinet, and for digital information contained on servers and workstations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is Training and Awareness?

A

Conduct regular training on the security awareness best practices that
employees can use to protect their organization’s sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What does Integrity help ensure and verify?

A

■ Helps ensure that information and data remain accurate and unchanged from its original state unless intentionally modified by an authorized individual
■ Verifies the accuracy and trustworthiness of data over the entire lifecycle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Integrity is important for three main reasons

A

■ To ensure data accuracy
■ To maintain trust
■ To ensure system operability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

To help us maintain the integrity of our data, systems, and networks, we usually utilize five methods

A
  • Hashing
  • Digital Signatures
  • Checksums
  • Access Controls
  • Regular Audits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is Hashing?

A

Process of converting data into a fixed-size value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What do digital signatures ensure?

A

Ensure both integrity and authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are Checksums?

A

Method to verify the integrity of data during transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Why are Access Controls good for Integrity?

A

Ensure that only authorized individuals can modify data and this reduces
the risk of unintentional or malicious alterations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Why are regular audits good for Integrity?

A

Involve systematically reviewing logs and operations to ensure that only authorized changes have been made, and any discrepancies are immediately addressed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does Availability ensure?

A

Ensure that information, systems, and resources are accessible and operational when needed by authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

As cybersecurity professionals, we value availability since it can help us with the following

A

■ Ensuring Business Continuity
■ Maintaining Customer Trust
■ Upholding an Organization’s Reputation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

To overcome the challenges associated with maintaining availability, the best strategy is to use redundancy in your systems and network designs. What are 4 different types of redundancy?

A
  • Server Redundancy
  • Data Redundancy
  • Network Redundancy
  • Power Redundancy
44
Q

What is Redundancy?

A

Duplication of critical components or functions of a system with the intention of enhancing its reliability

45
Q

What is Server Redundancy?

A

Involves using multiple servers in a load balanced or failover configuration
so that if one is overloaded or fails, the other servers can take over the
load to continue supporting your end users

46
Q

What is Data Redundancy?

A

Involves storing data in multiple places

47
Q

What is Network Redundancy?

A

Ensures that if one network path fails, the data can travel through
another route

48
Q

What is Power Redundancy?

A

Involves using backup power sources, like generators and UPS systems

49
Q

What is Non-repudiation?

A

■ Focused on providing undeniable proof in the world of digital transactions
■ Security measure that ensures individuals or entities involved in a
communication or transaction cannot deny their participation or the authenticity
of their actions

50
Q

What are Digital Signatures?

A

■ Considered to be unique to each user who is operating within the digital domain
■ Created by first hashing a particular message or communication that you want to
digitally sign, and then it encrypts that hash digest with the user’s private key using asymmetric encryption

51
Q

Non-repudiation is important for three main reasons

A

■ To confirm the authenticity of digital transactions
■ To ensure the integrity of critical communications
■ To provide accountability in digital processes

52
Q

What is Authentication?

A

Security measure that ensures individuals or entities are who they claim to be during a communication or transaction

53
Q

What are 5 commonly used authentication methods?

A
  • Something you know (Knowledge Factor)
  • Something you have (Possession Factor)
  • Something you are (Inherence Factor)
  • Something you do (Action Factor)
  • Somewhere you are (Location Factor)
54
Q

Something you know (Knowledge Factor)

A

Relies on information that a user can recall

55
Q

Something you have (Possession Factor)

A

Relies on the user presenting a physical item to authenticate themselves

56
Q

Something you are (Inherence Factor)

A

Relies on the user providing a unique physical or behavioral characteristic of the person to validate that they are who they claim to be

57
Q

Something you do (Action Factor)

A

Relies on the user conducting a unique action to prove who they are

58
Q

Somewhere you are (Location Factor)

A

Relies on the user being in a certain geographic location before access is
granted

59
Q

What is Multi-Factor Authentication System (MFA)

A

Security process that requires users to provide multiple methods of identification
to verify their identity

60
Q

Authentication is critical to understand because of the following

A

■ To prevent unauthorized access
■ To protect user data and privacy
■ To ensure that resources are accessed by valid users only

61
Q

What is Authorization?

A

Pertains to the permissions and privileges granted to users or entities after they have been authenticated

62
Q

Authorization mechanisms are important to help us with the following

A

■ To protect sensitive data
■ To maintain the system integrity in our organizations
■ To create a more streamlined user experience

63
Q

What is Accounting?

A

Security measure that ensures all user activities during a communication or transaction are properly tracked and recorded

64
Q

Your organization should use a robust accounting system so that you can create the following 5 important tasks

A
  • Create an audit trail
  • Maintain regulatory compliance
  • Conduct forensic analysis
  • Perform resource optimization
  • Achieve user accountability
65
Q

What does Creating an audit trail do?

A

Provides a chronological record of all user activities that can be used to
trace changes, unauthorized access, or anomalies back to a source or
point in time

66
Q

What does Maintaining regulatory compliance do?

A

Maintains a comprehensive record of all users’ activities

67
Q

What does Conducting forensic analysis do?

A

Uses detailed accounting and event logs that can help cybersecurity
experts understand what happened, how it happened, and how to prevent similar incidents from occurring again

68
Q

What does Performing resource optimization do?

A

Organizations can optimize system performance and minimize costs by
tracking resource utilization and allocation decisions

69
Q

What does Achieving user accountability do?

A

Thorough accounting system ensures users’ actions are monitored and logged , deterring potential misuse and promoting adherence to the organization’s policies

70
Q

To perform accounting, we usually use different technologies like the following 3

A
  • Syslog Servers
  • Network Analysis Tools
  • Security Information and Event Management (SIEM) Systems
71
Q

For accounting purposes, what are Syslog Servers used for?

A

Used to aggregate logs from various network devices and systems so that system administrators can analyze them to detect patterns or anomalies in the organization’s systems

72
Q

For accounting purposes, what are Network Analysis Tools used for?

A

Used to capture and analyze network traffic so that network
administrators can gain detailed insights into all the data moving within a
network

73
Q

For accounting purposes, what are Security Information and Event Management (SIEM) Systems used for?

A

Provides us with a real-time analysis of security alerts generated by
various hardware and software infrastructure in an organization

74
Q

What are 4 broad categories of Security Controls?

A
  • Technical Controls
  • Managerial Controls
  • Operational Controls
  • Physical Controls
75
Q

What are Technical Controls?

A

Technologies, hardware, and software mechanisms that are implemented
to manage and reduce risks

76
Q

What are Managerial Controls?

A

● Sometimes also referred to as administrative controls
● Involve the strategic planning and governance side of security

77
Q

What are Operational Controls?

A

● Procedures and measures that are designed to protect data on a
day-to-day basis
● Are mainly governed by internal processes and human actions

78
Q

What are Physical Controls?

A

Tangible, real-world measures taken to protect assets

79
Q

What are 6 Basic Types of Security Controls?

A
  • Preventive Controls
  • Deterrent Controls
  • Detective Controls
  • Corrective Controls
  • Compensating Controls
  • Directive Controls
80
Q

What are Preventive Controls?

A

Proactive measures implemented to thwart potential security threats or
breaches

81
Q

What are Deterrent Controls?

A

Discourage potential attackers by making the effort seem less appealing
or more challenging

82
Q

What are Detective Controls?

A

Monitor and alert organizations to malicious activities as they occur or shortly thereafter

83
Q

What are Corrective Controls?

A

Mitigate any potential damage and restore our systems to their normal
state

84
Q

What are Compensating Controls?

A

Alternative measures that are implemented when primary security
controls are not feasible or effective

85
Q

What are Directive Controls?

A

● Guide, inform, or mandate actions
● Often rooted in policy or documentation and set the standards for
behavior within an organization

86
Q

What is Gap Analysis?

A

Process of evaluating the differences between an organization’s current performance and its desired performance. Conducting a gap analysis can be a valuable tool for organizations looking to improve their operations, processes, performance, or overall security posture

87
Q

There are 4 main steps involved in conducting a gap analysis

A

■ Define the scope of the analysis
■ Gather data on the current state of the organization
■ Analyze the data to identify any areas where the organization’s current
performance falls short of its desired performance
■ Develop a plan to bridge the gap

88
Q

2 Basic Types of Gap Analysis

A

■ Technical Gap Analysis
■ Business Gap Analysis

89
Q

What is a Technical Gap Analysis?

A

● Involves evaluating an organization’s current technical infrastructure
● identifying any areas where it falls short of the technical capabilities
required to fully utilize their security solutions

90
Q

What is a Business Gap Analysis?

A

● Involves evaluating an organization’s current business processes
● Identifying any areas where they fall short of the capabilities required to
fully utilize cloud-based solutions

91
Q

What are Plan of Action and Milestones (POA&M) for gap analyses?

A

● Outlines the specific measures to address each vulnerability
● Allocate resources
● Set up timelines for each remediation task that is needed

92
Q

What does Zero Trust demand?

A

verification for every device, user, and transaction within the
network, regardless of its origin

93
Q

To create a zero trust architecture, we need to use two different planes

A
  • Control Plane
  • Data Plane
94
Q

What does the Control Plane refer to?

A

Refers to the overarching framework and set of components responsible
for defining, managing, and enforcing the policies related to user and
system access within an organization

95
Q

Which 4 key elements does the Control Plane Encompass?

A
  • Adaptive Identity
  • Threat Scope Reduction
  • Policy-Driven Access Control
  • Secured Zones
96
Q

What is Adaptive Identity?

A

Relies on real-time validation that takes into account the
user’s behavior, device, location, and more

97
Q

What is Threat Scope Reduction?

A

■ Limits the users’ access to only what they need for their
work tasks because this reduces the network’s potential
attack surface
■ Focused on minimizing the “blast radius” that could occur
in the event of a breach

98
Q

What is Policy-Driven Access Control?

A

Entails developing, managing, and enforcing user access
policies based on their roles and responsibilities

99
Q

What are Secured Zones?

A

Isolated environments within a network that are designed to house sensitive data

100
Q

Control Plane uses a ——– and a ——– to make
decisions about access

A

Policy Engine and Policy Administrator

101
Q

What does a Policy Engine do?

A

Cross-references the access request with its predefined
policies

102
Q

What is a Policy Administrator used for?

A

Used to establish and manage the access policies

103
Q

What does a data plane consist of?

A

Subject/System and Policy Enforcement Point

104
Q

What does a Subject/System refer to in terms of a data plane?

A

Refers to the individual or entity attempting to gain access

105
Q

What does a Policy Enforcement Point refer to in terms of a data plane?

A

Where the decision to grant or deny access is actually executed

Security + Cards - Jason Dion (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions