Information Security Flashcards
What is the CIA triad?
Confidentiality
Integrity
Availability
What does data Confidentiality mean?
This can refer to data confidentiality: private or confidential information is not made available or disclosed to unauthorized individuals
Privacy - individuals control or influence what information related to them is collected and stored and by whom. And who that information may be shared with.
Example: Student records kept private. FERPA
What is Integrity?
Assures that information and programs are changed only in a specified and authorized manner.
Assures that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.
Example: Incorrect data in a database could have negative impact.
What is availability?
Assures that systems work promptly and service is not denied to authorized users.
Example: School website is up and available to users when they need it.
What is Authenticity?
Verifying that users are who they say they are and that each input arriving at the system is from a trusted source.
What is Accountability?
The security goal that generates the requirement for actions of that entity to be traced uniquely to that entity.
What does it mean for something to have low breach impact?
The loss could be expected to have limited adverse effect on an organization’s operations, assets, or individuals.
What does it mean for something to have medium or moderate breach impact?
The loss could be expected to have a serious adverse effect on organizational operations, assets, or individuals.
What does it mean for something to have high breach impact?
The loss could be expected to have a severe or catastrophic adverse effect on organizational operations, assets, or individuals.
What are some computer security challenges?
- Solutions are often complex
- require constant monitoring
- is often an afterthought
- little perceived benefit
- constant battle between perpetrators and the security specialist
What is a security attack?
Any action that compromises the security of information owned by an organization.
What is a security mechanism?
A process (or a device incorporating such a process) that is designed to detect, prevent, or recover from a security attack.
What is a security service?
A processing or communication service that enhances the security of the data processing systems and the information transfers of an organization.
Intended to counter security attacks, and they make use of one or more security mechanisms to provide the service.
What is the difference between a threat and an attack?
Threat - A possible danger that might exploit a vulnerability
Attack- An assault on system security that derives from an intelligent threat; that is, an intelligent act that is a deliberate attempt to evade security services or policies.
What are two different types of security attacks?
Passive - gathering information from the system but not physically affecting the resources themselves
Active- attempt to alter system resources or affect their operation.
What is Nonrepudiation?
When someone can’t deny the authenticity of something.
What is ISOC?
Internet Society - professional membership society responsible for internet infrastructure standards including the IETF
