Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > lesson 1-4 > Flashcards

lesson 1-4 Flashcards

1
Q

Control objective

A

A control objective is a statement of desired result or purpose to be achieved by implementing a control or set of controls (What am I trying to achieve? Or what am I trying to accomplish?)
Ex: Control Objective: Protect Hosts from Malware Infiltration
AV software
Host firewall
Restricted email attachments
URL filtering
Sandboxing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

vulnerability

A

a weakness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

threat

A

potential danger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

threat actor

A

an adversary with malicious intent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

exploit

A

a threat actor is successful at taking advantage of a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Proportionality

A

Control baselines should be proportionate to the criticality and sensitivity classifications of the asset being protected (Principle of Proportionality)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

controls

A

Controls are tactics, mechanisms, or strategies that proactively minimize risk in one or more of the following ways:
* Reduce or eliminate a vulnerability
*Reduce or eliminate the likelihood that a *threat actor will be able to exploit a vulnerability.
Reduce or eliminate the impact of an exploit
Has to perform at least one to be considered a control. It can use more than one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Defense-in-depth

A

(layered security) is the design and implementation of multiple overlapping layers of diverse controls
Controls should not be subject to a cascade (domino) effect and should maintain independence
The diversity of types of controls and associated vendors should be considered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Cost Benefit analysis

A

the process of comparing the estimated costs and benefits to determine whether it makes sense to proceed from a business perspective.
*If the cost of the control is significantly lower than the losses without the control, the cost of the control is generally justified
*If the cost of the control is significantly higher than the losses without the control, the cost may not be justified
*When the cost and benefits are about the same, a return on investment (ROI) analysis is needed to determine whether the cost is justified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Tailoring

A

customizing baseline recommendations to align with organizational requirements. (like buying a suit off the rack, its ok but you want it to fit better so you tailor it)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Scoping

A

elimination of unnecessary baseline recommendations that are not applicable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Compensating

A

is substituting a recommended baseline control with a similar control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Supplementing

A

augmenting or adding to the baseline recommendations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Functionality-

A

is what a control does

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Effectiveness

A

is how well a control works, effectiveness reflects the control’s consistent, complete, reliable, and timely operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Assurance

A

is a measure of confidence that the intended security controls are effective in their application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Countermeasures

A

are controls implemented to address a specific threat.
Countermeasures are generally reactive.
Countermeasures may be more effective but less broadly efficient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

NIST Frameworks

A

Cybersecurity Framework (CSF)
Privacy Framework
Risk Management Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ISO 27014:2020

A

Information security, cybersecurity, and privacy protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Technical (control category)

A

mechanisms are implemented using hardware, software, and/or firmware components. Can be native or supplemental. (Ex. firewalls, cryptography, authentication systems)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Managerial- (control category)

A

relate to risk management, governance, oversight, strategic alignment, and decision-making ( ex. Risk assessments, project management)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Operational (control category)

A

are aligned with a process that is primarily implemented and executed by people (ex. Change management, training, testing)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Physical (control category)

A

are designed to address physical interactions. Generally related to buildings and equipment. ( ex. Gates, locks, security guards)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Deterrent (control classification)

A

discourage a threat agent from acting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Preventative (control classification)

A

stops a threat agent from being successful.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Detective (control classification)

A

identify and report a threat agent or action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Corrective (control classification)

A

minimize the impact of a threat agent or modify or fix a situation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Compensating controls

A

*Are controls implemented in lieu of a recommended control that provides equivalent or comparable protection
*Compensating controls can be supplemental in cases where the implemented control does not provide sufficient protection. For example in the case of a zero-day vulnerability.
*can be short-term or temporary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Directive controls

A

are often used to increase the effectiveness of other controls
* Proactive actions taken to cause or encourage a desirable event or outcome to occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Confidentiality

A

is the assurance that information is not disclosed to unauthorized persons, processes, or devices. Confidentiality covers data in storage, during processing, and in transit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Integrity:

A

is the principle that systems are trustworthy, and work as intended, and the data is complete and accurate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Availability

A

is the principle that information systems and supporting infrastructure are operating and accessible when needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Authentication

A

is the process of verifying identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Authorization

A

is the process of approving access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Accounting-

A

is the process of tracing actions to the source. Who did what

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Non-Repudiation

A

is the process of securing the validity and origin of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Privacy

A

the right of an individual to control the use of their personal information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

OECD PRIVACY PRINCIPLES

A
  1. Collection Limitation
  2. Data Quality
  3. Purpose Specification
  4. Use Limitation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Collection Limitation

A

Collection of personal data should be obtained by lawful and fair means and where appropriate, with the knowledge or consent of the data subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Data Quality

A

Personal data should be relevant to the purpose collected and should be accurate, complete, and kept up-to-date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Purpose Specification

A

The purposes for which personal data is collected should be specified no later than at the time of data collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Use Limitation

A

Personal data should not be disclosed or otherwise used for purposes other than specified except with the consent of the data subject; or by authority of law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Zero trust

A

Is a security framework requiring all subjects, assets, and workflows to be authenticated, authorized, and continuously validated before being granted or keeping access to applications and data.
*The goal is to prevent unauthorized access to data and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

CORE PRINCIPLES OF ZERO TRUST (NIST SP 800-207)

A
  1. Continuous verification- always verify access, all the time, for all resources
  2. Access limitation- Access to individual enterprise resources is granted on a per-session basis.
  3. Limit the “Blast Radius”- Minimize impact if the internal or external resources are breached. Segmentation, least privilege
  4. Authomate- we can’t do this manually, automate contest collection response. Credentials, workloads, endpoints, SIEMS, threat intelligence.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

control plane

A

The control plane is used by infrastructure components to maintain and configure assets, access control, and communication security. In a ZT environment, requests for access are made through the control plane.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

data plane

A

The data plane is used for communication (moving data) between software components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Policy Decision Point (PDP)

A

The PDP functions as a gatekeeper. The PDP has two logical components
Policy Engine
Policy Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Policy Engine (PE)

A

The PE is responsible for the ultimate decision to grant access to a resource for a given subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Policy Administrator (PA)

A

The PA generates any specific session-specific authentication and authentication token, or credential used to access an enterprise resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Policy Enforcement Point (PEP)

A

The PEP is responsible for enabling, monitoring, and eventually terminating connections between a subject and an enterprise resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Physical Security

A

the protection of people, property, and physical assets from actions and events that could cause damage, loss, or unauthorized activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Crime Prevention Through Environmental Design (CPTED)

A

the proper design and effective use of the physical environment can lead to a reduction in the incidence and fear of crime and increase safety.
* relies on psychological and sociological responses.
*People protect territory they feel is their own, and people have a certain respect for the territory of others
*Intruders do not want to be seen
*Limiting access discourages intruders and or marks them as intruders.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Fail-safe

A

implies that in an emergency or fault situation, controls will default to open (unlocked)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Fail-secure

A

implies that in an emergency, controls will default to close (locked).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Passive Infrared

A

Senses change in heat signatures

56
Q

Photometric-

A

Senses change in light

57
Q

Acoustical

A

Senses change in noise

58
Q

Microwave

A

Senses movement within an invisible field of energy (between the transmitter and receiver)

59
Q

Ultrasonic

A

proximity sensor that measures the distance of a target by emitting ultrasonic sound waves and converting the reflected sound into an electrical signal.

60
Q

Pick Resistant locks

A

have an extra set of tumblers. These locks are resistant to lock bumping. These locks are complex and difficult to reproduce keys

61
Q

access control vestibules

A

Barriers such as wall fences, gates, and bollards define the perimeter and can be used to control and divert traffic flow.

62
Q

ENVIRONMENTAL BASELINES

A
  1. Temperature- The acceptable temp for an area containing computing devices is between 18-27 degrees C (64.4-80.6 F). Circulation must take into account temp.
  2. Humidity- High humidity can cause corrosion and low humidity can cause excessive static electricity. Relative humidity between 50-70% is acceptable,
  3. Power-Continuous clean (filtered) power, consistent voltage
  4. FIre- Fire detection and suppression capabilities
63
Q

ESD (Electronic Discharge)

A

releases static electricity when two objects touch. This can damage or destroy electronic components. ESD can be minimized by using antistatic grounding workbenches, mats, bags, and wristbands. Electrical storms can increase the ESD risk.

64
Q

EMI (Electromagnetic Interference RFI (Radio frequency Interference) -

A

Equipment and copper cables are sensitive to EMI. Equipment should have limited exposure to magnets, fluorescent lights, electric motors, space heaters, and wireless access points. The copper cable should be shielded.

65
Q

Brownout-

A

A prolonged period of low-voltage

66
Q

Sag

A

Moment of low voltage

67
Q

surge

A

Prolonged period of high voltage

68
Q

spike

A

Moment of high voltage

69
Q

blackout

A

Prolonged period without power

70
Q

Honeynet

A

is multiple linked honeypots that simulate a network environment.

71
Q

Honeypot

A

A honeypot is a decoy system (e.g., a web server). High interaction honeypot is running the application that it says it is. Low interaction Honeypot is not running those services; it just appears they are.

72
Q

Honeyfiles

A

a decoy file located on a network file share. Honeyfiles are designed to detect access and exfiltration attempts.

73
Q

Honeytoken

A

is a beacon embedded into a document, databases, images, directory, and folders. They are used to identify the attacker.
* used to track malicious actors revealing critical information about their identity and the methods they use to exploit a system

74
Q

Spam Traps/ honey traps

A

(fake email address) are used to identify and block spammers. Legitimate mail is unlikely to be sent to a fake address, so when an email is received, it is most likely spam.

75
Q

DNS Sinkhole-

A

is a DNS server that responds with false results. They can be used to redirect malicious traffic so that it can be captured and analyzed by security analysts. Sinkholes are most often used to seize control of botnets by interrupting the DNS names of the botnet that is used by the malware.

76
Q

CONFIGURATION MANAGEMENT

A

A set of practices designed to ensure that configuration items (CI) servers, routers, and software, are deployed in a consistent state and stay that way through their lifetime.
The goal of configuration management is to minimize risk

77
Q

Configuration Item (CI)

A

Is an aggregation of information system components and treated as a single entity throughout the configuration process

78
Q

Baseline Configuration (BC)

A

is a set of specifications for a CI, that has been reviewed and agreed upon and can be changed only through change control procedures. The baseline config. Is used as a basis for future builds and releases.

79
Q

AUTOMATED PROVISIONING

A

The ability to deploy IT or OT systems and services using predefined, automated procedures without requiring human intervention.
*Automation is used to ensure consistency in provisioning in support of configuration management.

80
Q

Demand-generated resource allocation-

A

the automatic provisioning and de-provisioning of resources based on demand

81
Q

Idempotence

A

is a principle that every time an automated configuration script is run, the same result is produced.

82
Q

Immutable System

A

principle that resources should not be changed, only created and destroyed. Utilizes automation to replace rather than fix

83
Q

Infrastructure As Code

A

using code as configurations and automate provisioning of infrastructure. Supports the principle of Idempotence.

84
Q

change management

A

Change Management is to drastically minimize the risk and impact a change can have on business operations

85
Q

Rollback Strategies

A

Recovery to the previous state (Backout plan)

86
Q

Standard Change

A

is one that occurs frequently, is low risk, and has a pre-established procedure with documented tasks for completion (patch management)

87
Q

Normal Change

A

is one that’s not standard but not an emergency. Can be approved by a change control board or committee.

88
Q

Major Change

A

may have significant financial implications and or be high risk. Such a change often requires multiple levels of management approval.

89
Q

Emergency

A

is one that must be assessed and implemented (without prior authorization) as quickly as possible to resolve a major incident.

90
Q

KPI (key performance indicator)

A

are business metrics used to measure performance in relation to strategic goals and objectives
1. Successful Changes- The number of changes that have been completed successfully compared to the number of completed changes. The Higher the percentage the better
2. Backlog of Changes- The number of changes that are not yet completed. While this absolute number depends on the size of the organization, it should not grow over time
3. Emergency Changes- The number of completed emergency changes. While this number depends on the size of the company, it should not trend upward.

91
Q

Cryptography

A

the conversion of communication into a form that can only be read by the intended recipient.

92
Q

Encryption

A

this is a process of encoding information. The use case of encryption is confidentiality.

93
Q

Hashing

A

is a one-way function that turns a file or string of text into a unique digest of the message. The use case for hashing is integrity.

94
Q

Digital Signatures

A

is a hash value encrypted using the sender’s private key. The use case is sender authenticity and nonrepudiation(the sender can’t deny they sent the message)

95
Q

Digital Certificates

A

is a digital object that is tied to a cryptographic key pair. The use case for a digital certificate is authentication

96
Q

Ciphertext

A

is encrypted or human-unreadable text

97
Q

Algorithm

A

a mathematically complex modern cipher. Need to have a computer to solve it.

98
Q

KEY

A

is a secret value used with an algorithm. The Key dictates what parts of the algorithm will be used, is what order, and with what values.

99
Q

Trusted Platform Module (TPM)

A

is a hardware chip used for storing cryptographic keys and related information

100
Q

Hardware Security Module (HSM)

A

is a hardened tamper-resistant hardware devices that secure cryptographic keys and related information

101
Q

Secure Enclave

A

a separate processor & microkernel used for storing and processing cryptographic keys and related information in mobile devices

102
Q

Deprecated

A

means that the use of algorithm and key length is allowed, but the user must accept some risk due to inherent weaknesses.

103
Q

Broken

A

means that the algorithm and or key length is exploitable.

104
Q

SYMMETRIC ENCRYPTION

A

Uses the same key to encrypt and decrypt. The key may be referred to as a single key, shared key, secret key, or session key.

105
Q

SYMMETRIC ALGORITHMS

A
  1. DES- 64-bit key size, 16 rounds of substitution and transposition
    In 1998 demonstrated that it could be broken in less than 56 hours
  2. 3DES- 64-bit key size, 48 rounds of substitution and transposition using either 2 or 3 keys.
    In 1999 replaced the DES as a US Gov. standard
    Considered to be deprecated(it’s weak and has a lot of risk)
  3. AES | Rijndael - 128 or 192 or 256 bit key w/10 or 12 or 14 rounds of substitution and transposition.
    In 2002 it replaced 3DES as the US standard
  4. RC4- stream cipher, Key sizes 40-2048 bits
    4 variants: SPRITZ, RC4A, VMPC, RC4A+
106
Q

ASYMMETRIC ENCRYPTION

A

Uses two mathematically related keys to encrypt and decrypt. The keys are referred to as public and private keys. The public key is freely distributed, The private key must be secured.

107
Q

ASYMMETRIC ALGORITHMS

A
  1. RSA- widely implemented de facto commercial standard. Words with both encryptions and digital signatures.
  2. Elliptic Curve Cryptosystem ECC- similar function to RSA but with smaller keys so it takes less computing power. Current US Gov. standard
  3. Diffie-Hellman- Primarily used for key agreement (key exchange) Allows two parties( in the same DH group) that have no prior knowledge of each other to jointly establish a shared secret key.
  4. El Gamal- Primarily used for transmitting digital signatures and key exchange
108
Q

Key management

A

describes the activities involving the handling of cryptographic keys during their entire lifecycle.

109
Q

KMPS

A

a Key management practices statement is a document that describes in detail the organizational structure, responsible roles and rules for key management.

110
Q

HASHING

A

The objective of hashing is to prove integrity. Hashing produces a visual representation of a data set that can be used for comparative purposes. The output is known as a message digest, fingerprint, or hash value.

111
Q

one-way representation

A

Output must not be reversible. one of the 3 hashing criteria

112
Q

collision attack

A

is a cryptographic attack where two different inputs produce the same hash value, compromising the integrity of the hash function.
different output for the same input

113
Q

Message Digest (MD) - hash function

A

MD4 was developed by Ron Rivest in 1990 and has been broken.
MD5 (current use) is subject to collision attacks and is considered broken, however, it can be used for non-cryptographic purposes.

114
Q

Secure Hash Algorithm (SHA) - hash function

A

Was developed by the NSA
SHA-1 is subject to collision attacks
Secure versions include the SHA -2 and SHA-3 families

115
Q

RIPEMD- hash function

A

RIPEMD-160 is a cryptographic hash function based upon the Merkle-Damgard construction. It is used in the Bitcoin standard.

116
Q

Salting-

A

salts are random values appended to the input to negate the value or rainbow tables
Rainbow tables are publicly available tables of precomputed hashes.

117
Q

digital signature

A

is a message digest that has been encrypted using the sender’s private key
The objective of a digital signature is to prove integrity and non-repudiation. Non-repudiation means that the singer cannot deny sending the message

118
Q

RSA- hashing algorithm

A

Widely implemented and the commercial standard. Works with both encryption and digital signatures

119
Q

Digital Signature Algorithm (DSA)

A

Published by NIST is a cooperation with the NSA. US Gov. digital signature standard.

120
Q

Digital Certificates

A

used to generate a private key and to bind a public key to its owner. Digital certificates are issued by commercial entities. Alternately they can be self-generated

121
Q

X.509 standard

A

The X.509 standard is a widely used framework for defining the format of public key certificates. defines the distribution procedures.

122
Q

web of trust

A

certificates that can be signed and validated by other users

123
Q

certificate authorities (CA)

A

Digital certificates are issued by commercial trusted parties like the CA

124
Q

A Registration Authority (RA)

A

offloads some of the work from the CA. The RA can accept and process registration requests and distribute certificates.

125
Q

Root certificate

A

verifies the identity of a root certificate authority in a chain of trust

126
Q

Trusted/Intermediate

A

Verifies root and intermediate certificate authorities.

127
Q

Certificate Revocation List (CRL)

A

maintained list of certificates that have been revoked

128
Q

Online Certificate Status Protocol (OCSP)

A

A process designed to query the status of a certificate in real time.

129
Q

Blockchain

A

is a distributed, decentralized, public ledger. Blocks are linked using cryptography
Each block contains a cryptographic hash of the previous block, a timestamp, and transaction data.

130
Q

HOMOMORPHIC ENCRYPTION

A

Allows for encrypted data to be processed. Uses complex mathematical operations to allow a variety of computations (or operations) on encrypted data.
*Partially Homomorphic encryption (PHE)- one operation can be performed an unlimited number of times on the ciphertext
*Somewhat Homomorphic encryption (SHE)- Supports limited operations up to a certain complexity, but there operations can only be performed a set number of times.

131
Q

Quantum cryptography

A

applies principles of quantum mechanics to encrypt messages.

132
Q

Post-quantum cryptography

A

develop cryptographic systems that are secure against both quantum and classical computers and can interoperate with existing communications, protocols and networks.

133
Q

Steganography

A

Is the science of hiding information
Consists of a message and a cover image. The massage is the secret data, cover image is the carrier that hides the message

134
Q

Steganalysis

A

is the study of detecting messages hidden using Steganography

135
Q

DIGITAL COVER IMAGES

A
  1. Text- Hiding information in text files (every nth letter)
  2. Image- Hiding information in image files (BMP, JPEG, GIF, PNG)
  3. Audio- Hiding information in audio files (MP3, AU, WAV)
  4. Video- Hiding information in video files (MPEG, MP4)
136
Q

concealment

A

The objective of Steganography

137
Q

digital watermark

A

is a hidden message that is used to prove or claim ownership (generally intellectual property or artistic work)

Security+ 701 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions