Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COSC362 > Lecture 2: Course overview (key definitions) > Flashcards

Lecture 2: Course overview (key definitions) Flashcards

1
Q

Give the definition of cyber security provided from the NIST computer security handbook.

A

The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources (include hardware, software, firmware, information/data, and telecommunications).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is NIST?

A

The National Institute of Standards and Technology is a physical sciences laboratory and non-regulatory agency of the United States Department of Commerce. Its mission is to promote American innovation and industrial competitiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the difference between computer security and cyber security?

A

computer security: concerned with the security of a single computer

cyber security: concerned with the security
of multiple computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define “a threat”

A

A threat represents a potential security harm to an asset

system resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define “an attack”

A

An attack a threat that is carried out and, if successful,

leads to an undesirable violation of security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define “the threat agent”

A

The threat agent carrying out the attack is referred to as an attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define “a countermeasure”

A

A countermeasure is any means taken to deal with a security attack (e.g. prevention, detection/recovery).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define “a residual level of risk to the assets”

A

A residual level of risk to the assets is represented by

vulnerabilities possibly exploited by threat agents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What assets (system resources) do we need to protect?

A

Hardware
Software
Data
Communication facilities and networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How are those assets threatened?

A

A leaky, corrupted and/or unavailable computer system or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define the hardware asset

A

computer systems and other data processing,

data storage, and data communications devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define the software asset

A

operating system, system utilities, and applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define the data asset

A

files and databases, as well as security-related

data (e.g. password files)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define the communication facilities and networks asset

A

local and wide area network communication links, bridges, routers, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is meant by a computer system or network having the vulnerability of being leaky?

A

meaning that it gives access to information
through the network while it should not (see
Confidentiality)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is meant by a computer system or network having the vulnerability of being corrupted?

A 
meaning that it does the wrong thing or gives
wrong answers (see Integrity).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is meant by a computer system or network having the vulnerability of being unavailable?

A

meaning that it becomes impossible to use it or

impractical (see Availability)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the two types of passive attacks?

A

1) Eavesdropping (interception)

2) Traffic analysis (inference)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the characteristics of a passive attack?

A

1) DO NOT alter information and resources in the system

2) may be hard to detect but easy to prevent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define the passive attack of eavesdropping (interception)

A

the attacker directly accesses
sensitive data traveling between authorised source
and destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define the passive attack of traffic analysis (inference)

A

the attacker gains information from observing the amount of traffic between source and destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the three types of active attacks?

A

1) Masquerade
2) Modification of messages (falsification)
3) Distributed denial of service (misappropriation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the three types of active attacks?

A

1) Masquerade
2) Modification of messages (falsification)
3) Distributed denial of service (misappropriation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the characteristics of an active attack?

A

1) DO alter information and/or resources in the system

2) may be hard to prevent but easy to detect (and recover)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Define the active attack of modification of messages (falsification)

A

the attacker changes messages during transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define the active attack of modification of messages (falsification)

A

the attacker changes messages during transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define the active attack of distributed denial of service (misappropriation):

A

the attacker prevents legitimate users from accessing

resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the two types of inside attacks?

A

1) Exposure

2) Falsification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the characteristics of an inside attack?

A

1) initiated by an entity INSIDE the security perimeter

2) authorization to access system resources but use of them in a malicious way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define the inside attack of exposure

A

the attacker intentionally releases sensitive information to an outsider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Define the inside attack of falsification

A

the attacker alters or replaces valid data or introduces false data into a file or database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the two types of outside attacks?

A

1) Obstruction

2) Intrusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the characteristics of an outside attack?

A

initiated from OUTSIDE the perimeter, by an unauthorised or illegitimate user of the system

34
Q

Define the outside attack of obstruction

A

the attacker disables communication links or

alters communication control information

35
Q

Define the outside attack of intrusion

A

the attacker gains unauthorised access to
sensitive data by overcoming the access control
protections

36
Q

What is information security management required to do?

A
  1. Identify threats
  2. Classify all threats according to likelihood and severity
  3. Apply security controls based on cost benefit analysis
37
Q

What do countermeasures to vulnerabilities and threats comprise?

A
  1. Computer security technical measures (e.g. access control, authentication, system protection)
  2. Management measures (e.g. awareness and training)
  3. Both (e.g. configuration management)
38
Q

Give the information security definition from the ISO security architecture.

[security, vulnerability, threat]

A

The term security is used in the sense of minimizing the vulnerabilities of assets and resources. An asset is anything of value.

A vulnerability is any weakness that could be exploited to violate a system or the information it contains.

A threat is a potential violation of security.

39
Q

What is the CIA triad?

A

Traditional definitions are based on 3 information security goals: confidentiality, integrity, availability

40
Q

Define confidentiality

A

preventing unauthorised disclosure of

information (POODLE attack)

41
Q

Define integrity

A 
preventing unauthorised (accidental or deliberate)
modification or destruction of information (SQLI
attack)
42
Q

Define availability

A

ensuring resources are accessible when required

by an authorised user (DoS attack)

43
Q

What does the OSI Security Architecture X.800 define?

A 
security threats (attacks), security services and
security mechanisms and how they are related.
44
Q

Define security service

A

a processing or communication service to give a specific kind of protection to system resources

45
Q

Define security mechanism

A

a method of implementing one or more security services

46
Q

What does a security service, provided by a layer of communicating open systems, ensure?

A

adequate security of the systems or of data

transfers as defined by ITU-T X.800

47
Q

What are the 8 security services?

A

1) peer entity authentication
2) data origin authentication
3) access control
4) data confidentiality
5) traffic flow confidentiality
6) data integrity
7) non-repudiation
8) availability

48
Q

What does the security service of peer entity authentication provide?

A

confirmation of the claimed identify of an entity

49
Q

What does the security service of data origin authentication provide?

A

confirmation of the claimed source (origin) of a data unit (message)

50
Q

What does the security service of access control provide?

A

protection against unauthorization use of resources. Access control service is usually provided in combination with authentication and authorisation services

51
Q

What does the security service of data confidentiality protect?

A

data against unauthorised disclosure

52
Q

What does the security service of traffic flow confidentiality protect?

A

disclosure of data which can be derived from knowledge of traffic flows

53
Q

What does the security service of data integrity detect?

A

any modification, insertion, deletion or replay of data in a message or a stream of messages

54
Q

What does the security service of non-repudiation protect against?

A

any attempt by the creator of a message to falsely deny creating the data or its contents

55
Q

What does the security service of availability protect?

A

a system against denial of service

56
Q

In terms of non-repudiation, what does X.800 talk about?

A

non-repudiation of origin to protect against denial by the sender of a message, and non-repudiation of receipt to protect against denial by the recipient of a message

57
Q

What are the 8 security mechanisms?

A

1) Encipherment
2) Digital signature
3) Access control
4) Data integrity
5) Authentication exchange
6) Traffic padding
7) Routing control
8) Notarization

58
Q

What is the security mechanism of enchipherment?

A

the transformation of data in order to hide its information content –> relates to public-key and symmetric-key encryption

59
Q

What is the security mechanism of digital signature?

A

cryptographic algorithms which transform data using a signing key

–> essential property is that signed data can only be
created with the signing key
–> relates to standard signature schemes

60
Q

What are the security mechanisms of access control?

A

include access control lists, passwords, or tokens, which may be used to indicate access rights

61
Q

What are the security mechanisms of data integrity?

A

“corruption detection techniques“ which can be used with ”sequence information“

–> Message Authentication Codes (MACs)

62
Q

What is the security mechanisms of authentication exchange?

A

protocols which exchange information to ensure identity of protocol participants

–> e.g. TLS

63
Q

What is the security mechanisms of traffic padding?

A

spurious traffic generated to protect against traffic analysis.

typically used in combination with encipherment

64
Q

What is the security mechanisms of routing control?

A

the use of specific secure routes

65
Q

What is the security mechanisms of notarization?

A

uses a trusted third party to assure the source or receipt of data.

The trusted third party is sometimes called a notary

66
Q

What security mechanism(s) relate to the security service of peer entity authentication?

A

1) Encipherment
2) Digital signature
3) Padding

67
Q

What security mechanism(s) relate to the security service of data origin authentication?

A

1) Encipherment

2) Digital signature

68
Q

What security mechanism(s) relate to the security service of access control ?

A

1) Encipherment

69
Q

What security mechanism(s) relate to the security service of Data Confidentiality?

A

1) Encipherment

2) Routing control

70
Q

What security mechanism(s) relate to the security service of Traffic Flow Confidentiality?

A

1) Encipherment
2) Padding
3) Routing control

71
Q

What security mechanism(s) relate to the security service of Data Integrity?

A

1) Encipherment
2) Digital signature
3) Data Integrity

72
Q

What security mechanism(s) relate to the security service of Non-repudiation?

A

1) Digital signature
2) Data Integrity
3) Notarization

73
Q

What security mechanism(s) relate to the security service of Availability?

A

1) Data Integrity

2) Auth. exchange

74
Q

What security service(s) relate to the security mechanism of Encipherment?

A

1) Peer entity authentication
2) Data origin authentication
3) Data Confidentiality
4) Traffic Flow Confidentiality
5) Data Integrity

75
Q

What security service(s) relate to the security mechanism of Digital Signature?

A

1) Peer entity authentication
2) Data origin authentication
3) Data Integrity
4) Non-repudiation

76
Q

What security service(s) relate to the security mechanism of Access control?

A

1) Access control

77
Q

What security service(s) relate to the security mechanism of Data Integrity?

A

1) Data Integrity
2) Non-repudiation
3) Availability

78
Q

What security service(s) relate to the security mechanism of Auth. exchange?

A

1) Peer entity authentication

2) Availability

79
Q

What security service(s) relate to the security mechanism of Padding?

A

1) Traffic Flow Confidentiality

80
Q

What security service(s) relate to the security mechanism of Routing control?

A

1) Data Confidentiality

2) Traffic Flow Confidentiality

81
Q

What security service(s) relate to the security mechanism of Notarization?

A

1) Non-repudiation

COSC362 (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions