Intro to Security Terms Flashcards
What are the goals of Information Security?
Those fundamental goals are confidentiality, integrity (data integrity), and availability—also referred to as CIA.
What is Confidentiality?
One of the goals of information security is to ensure confidentiality such that only required persons can gain access to information and are able to read the information.
What are Access Control/Permissions?
Most network administrators will secure information on the company network by implementing permissions on the files and folders. This is known as building an access control list (ACL) on the files because you are controlling who can access the files.
What is Encryption?
Encrypting the information puts the information in an unreadable format until an authorized person decrypts the information, which places it in a readable format.
You can encrypt the file at two levels—either encrypt the file in storage or encrypt the file while the file is in transit from one location to another. The benefit of encrypting the file in storage is that if the hackers can get physical access to the system, they can normally bypass the permissions set by the system. If you encrypt the data in storage and a hacker somehow circumvents the permissions, you will have ensured that the data is unreadable.
When you encrypt the information in transit, you are typically encrypting the communication channel between two systems, that is, all data that runs through the communication channel. By encrypting the information in transit, you have ensured that someone who taps into the communication cannot read the information they have tapped into.
What is Steganography?
Steganography is a method of hiding information, such as a text file, in a graphic file. The information is placed in the graphic file using a program, and a password is placed on the file. After sending the graphic to the intended receiver, the intended receiver would use the steganography application to read the text information out of the file.
What is Integrity?
The concept of data integrity is to ensure that when data is sent from a source to a destination, the information received at the destination has not been altered in transit. Data integrity also means that if you store a file on the drive and open it later, you can be certain that the data has not been altered while in storage.
What is Hashing?
To ensure data integrity when communicating over a network, the sending system runs the data through a mathematical algorithm, known as a hashing algorithm, which then generates an answer (known as the hash value). This hash value is then sent with the data. On the receiving end of the transmission, the destination system runs the data through the same mathematical algorithm to generate an answer (hash value). Once the destination system has its own calculated hash value, it then compares that to the hash value sent with the message—if they are the same, then it is assumed the data has not been altered.
Data integrity is not only about the integrity of the data in transit, but also about the data in storage. In highly secure environments, you may want to ensure that after a user stores a file, the file cannot be altered until the user opens the file again. To verify the integrity of the file, you can use a file integrity program that calculates hash values on the file when the file is saved and then compares the stored hash value with the calculated hash value when the file is opened again. If the file has changed since the last time the user worked with the file, the hash values will be different, and notification that the file has been changed will be sent to the user.
Data integrity is used in many scenarios today; a few of those scenarios follow:
Downloading files: When you download a program from the Internet, most vendors tell you the hash value of the file you are downloading so that you can do your own integrity check on the file after downloading it. Performing an integrity check on the downloaded file will ensure that the file was not altered during the download.
Law enforcement: When law enforcement agencies perform an investigation on a suspect’s computer, they need to generate a hash value on the data before they even look at it so that they can prove later in court that they did not plant the information. If the evidence comes into question, the hash values of the data before and after the investigation are compared—if they are the same, then the data was not altered.
Another point to make about data integrity is that implementing solutions such as permissions can help protect the data integrity of information, because if you control who is allowed to modify the data, you can then protect it from unauthorized changes.
What are some Other Integrity Concepts?
Digital signature: A digital signature is created on a message in order to prove the integrity of the sender of the message. Because the signature is created using a person’s private key and only that person has access to their private key, it proves the sender is who they say they are.
Certificate: A digital certificate is an electronic file used to transport keys used to encrypt or digitally sign messages.
Nonrepudiation: Nonrepudiation is the concept of ensuring that someone cannot dispute that they sent a message or made a change, which adds to the integrity of the system. You can use digital signatures or auditing as a method to implement nonrepudiation.
What is Availability?
Availability is the last fundamental goal of information security, and it is the concept of ensuring that the information is available when the user wants it. This is an overlooked aspect of information security.
The following are popular solutions you can implement to help maintain availability:
Permissions: Implementing permissions on a resource is a way to help ensure availability because if you limit who can delete the data, then chances are high it will still be available when needed.
Backups: Ensure you perform regular backups of critical information so that if the data becomes corrupt or unavailable, you can restore it from backup.
Fault tolerance: You can implement data redundancy solutions to ensure the data is available so that if one of the hard drives fails, the other drives have a copy of the information.
Clustering: To ensure availability of services such as e-mail or database servers, you can use a high-availability solution such as clustering. Clustering allows you to have multiple servers acting as one unit so if one server fails, the other server takes over the workload. For example, you can have your e-mail server installed on both servers (called nodes), with one server acting as the active node (currently online) and the other server acting as the passive node (not online). When the active node fails, the passive node will become the active node so that users still have access to e-mail.
Patching: To aid in the availability of the system, you should ensure you keep the system up to date with patching. Patching a system by applying service packs and security hot fixes helps reduce vulnerabilities in the system and reduces the chances of attack.
What is Accountability?
Accountability is ensuring that employees are accountable for their actions—if they delete a file, you will ensure they take responsibility for deleting the file.
You implement accountability in the organization by implementing auditing and logging features on the systems, routers, firewalls, and in the applications. The concept here is if you log the activity and are able to identify who caused a certain event to occur, then you can hold that person accountable for their actions. The following are some popular methods to implement accountability within the organization:
Log files: Most network services either implement logging by default or can be configured to log activity to log files. Be sure to enable logging for all core services on the network so that if an incident arises, you can review the logged data.
Audit files: Most operating systems have a security auditing feature that allows you to review the security-related events that occur on a system. In Windows, this is the security log in Event Viewer. Be sure to review the security audit logs on a regular basis.
Firewalls and proxy servers: Most firewalls and proxy servers can log outbound user activity, such as web sites that are visited and applications used for outbound communication. Be sure to review the firewall and proxy server logs on a regular basis to hold the users accountable for their actions.
Application logging: It is becoming more important for applications to log activity within the application. For example, if someone deletes a customer record or a purchase from the purchasing system, you want to know about it. Find out what levels of logging are available in all your critical applications, and let users know you are logging activity. This will help keep them accountable for their actions within the business software. For example, Microsoft SQL Server has features that allow the database developers to implement logging and auditing in the database application.
What is Identification and Authentication?
Identification happens before authentication and is the process of having users identify themselves to the system. The most popular method companies use to identify individual users is to give each a unique username. The users type their username into the system in order to identify themselves.
After the user inputs the identifying information (the username) and the password for that account, the information is then sent to an authentication system that is responsible for verifying that the username and password are valid. If the username and password are correct, the user is granted access to the system, but if the information is incorrect, an error is displayed and access is denied.
Users can identify themselves and authenticate to the system in a number of ways. The following lists a few popular methods used for identification and authentication purposes:
Username: The most popular method of identifying users on the network is to give them each a unique username. For the users to identify themselves, they will type the username into a logon screen. To be authenticated, they would type the password associated with that username.
Smartcard: The smartcard can be used to identify the unique owner of that specific smartcard. Once the smartcard is inserted into the system, the user will need to type a PIN associated with the smartcard in order to authenticate to the system.
Token: A security token is a small device that is typically used to identify an individual and is used in the authentication process. Of the different types of tokens, the most popular is a device that displays a random number on it for 30 to 60 seconds. The random number, username, and password are used to log on.
Biometrics: Biometrics is the concept of using part of your physical self to authenticate to the system. For example, you can scan a fingerprint or a retina to authenticate to a system. You typically use biometrics in highly secure environments because it is difficult for anyone else to obtain your physical characteristics.
What is Authorization?
Once the user has been authenticated, they are given access to different resources; this is known as authorization. You have many ways to authorize individuals for different resources. One of the most popular methods of authorization is to give the user permissions to a file or folder. The following are some examples of authorization:
Permissions You may authorize individuals to access a file by giving them permission to the file or giving a group that the individual is a member of permission to the file.
Router ACLs: Another example of implementing authorization is by configuring access control lists (ACLs) on a router. These ACLs determine whether the router is allowed to accept certain traffic and route it to a different network.
Proxy servers: Another popular example of authorization is allowing or denying access to different web content at the proxy server. The proxy server is a server on the network that all traffic headed out to the Internet passes through. The proxy server can control what web sites can be visited or even what types of Internet applications can be used by the internal users.
Facility: A final example of authorization is to control access to different areas of the building. For example, Bob’s smartcard may give him access to the area of the building that he works in, but the card does not open doors to other areas of the building—he is not authorized to access those areas.
What is Physical Security?
The first type of security to be familiar with is physical security. Physical security is the concept of being able to control who has physical access to the assets within the organization. For example, most companies will control access to the servers by placing the servers in a locked room known as the server room.
Physical security also deals with controlling who can gain entry to the premises of the business by placing a fence around the perimeter of the facility and maybe using guards at the entry gate.
What is Communication Security?
Communication security is an often overlooked aspect of security because companies seem to put a lot of focus on physical security and also on setting permissions on files and folders. Setting permissions on files and folders will help secure the asset only as it is stored on the server—what about when someone accesses the file from across the network? If a user who has permission to the file accesses the file from across the network, the file is downloaded to the client computer. While the file is being downloaded to the client computer, it is possible for untrusted parties to tap into that communication and see the information.
Communication security deals with protecting the information that is traveling between the source and destination by encrypting the communication.
What is Computer Security?
Computer security is one of the most popular types of security—it deals with securing the computer systems by implementing a number of best practices such as authentication, access control, data redundancy, malware protection, and system-hardening techniques. The point to understand about computer security is that you are securing the system and not the communication between the systems.
