Lesson 7: Configuring SOHO Network Security Flashcards
Three principles of security control and management. Also known as the information security triad. Also referred to in reverse order as the AIC triad.
CIA triad
- Confidentiality
- Integrity
- Availability
Protection of computer systems and digital information resources from unauthorized access, attack, theft, or data damage.
cybersecurity
Person or entity responsible for an event that has been identified as a security incident or as a risk
threat actor
Likelihood and impact (or consequence) of a threat actor exercising a vulnerability.
Risk
Weakness that could be triggered accidentally or exploited intentionally to cause a security breach
vulnerability
System whose configuration is different from its secure baseline.
non-compliant system
System where one or more required security controls (antivirus or firewall, for example) is missing or misconfigured.
unprotected system
Specific method by which malware code infects a target host, often via some vulnerability in a software process.
exploit
Vulnerability in software that is unpatched by the developer or an attack that exploits such a vulnerability.
zero-day
EOL
End of Life
Security framework and tools to facilitate use of personally-owned devices to access corporate networks and data. A provisioning model that allows employees to use personal mobile devices to access corporate systems and data.
BYOD
BYOD
Bring your own device
Using persuasion, manipulation, or intimidation to make the victim violate a security policy.
Social engineering
Social engineering attack where an attacker pretends to be someone they are not.
Impersonation
Social engineering tactic where a team will communicate, whether directly or indirectly, a lie or half-truth in order to get someone to believe a falsehood
pretexting
The social technique of discovering things about an organization (or person) based on what it throws away
Dumpster diving
Social engineering tactic to obtain someone’s password or PIN by observing him or her as he or she types it in
shoulder surfing
Social engineering technique to gain access to a building by following someone who is unaware of their presence
Tailgating
Allowing a threat actor to enter a site or controlled location without authorization
Piggybacking
Email-based social engineering attack, in which the attacker sends email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim.
Phising
Email-based or web-based form of phishing which targets specific individuals. When the attacker has some information that makes the target more likely to be fooled by the attack
Spear phishing
An email-based or web-based form of phishing which targets senior executives or wealthy individuals. An attack directed specifically against upper levels of management in the organization (CEOs and other “big catches”).
Whaling
Social engineering attack where the threat actor extracts information while speaking over the phone or leveraging IP-based voice messaging services (VoIP). Conducted through a voice channel (telephone or VoIP, for instance).
Vishing
Wireless access point that deceives users into believing that it is a legitimate network access point. Similar to phishing but instead of an email, the attacker uses a rogue wireless access point to try to harvest credentials
Evil twin
Potential for an entity to exercise a vulnerability (that is, to breach security)
threat
Type of threat actor who is assigned privileges on the system that cause an intentional or unintentional incident. This typically means an employee, but an also arise from contractors and business partners
insider threat actor
Phase in an attack or penetration test in which the attacker or tester gathers information about the target before attacking it. An information-gathering threat in which the attacker attempts to learn about the configuration of the network and security systems
Footprinting
Attack technique where the threat actor disguises their identity or impersonates another user or resource. Type of attack where the threat actor can masquerade as a trusted user or computer.
spoofing
Attack where the threat actor makes an independent connection between two victims and is able to read and possibly modify traffic. Specific type of spoofing where the threat actor can covertly intercept traffic between two hosts or networks
on-path attack
Any type of physical, application, or network attack that affects the availability of a managed resource. This attack causes a service at a given host to fail or to become unavailable to legitimate users.
denial of service (DoS) attack
An attack that uses multiple compromised hosts (a botnet) to overwhelm a service with request or response traffic.
distributed DoS (DDoS)
Group of hosts or devices that have been infected by a control program called a bot that enables attackers to exploit the hosts to mount attacks.
botnet
Any attack where the attacker tries to gain unauthorized access to and use of passwords.
plaintext password
Type of password attack that compares encrypted passwords against a predetermined list of possible password values.
Dictionary
Type of password attack where an attacker uses an application to exhaustively try every possible alphanumeric combination to crack encrypted passwords.
Brute force
A web application can use two methods of running code (2)
Server-side code and Client-side code
Server-side code is run on the HTTP/HTTPS web server to process the request and build the response before it is sent to the client
Client-side code runs within the web browser software on the client machine to modify the web page before it is displayed to the user or to modify requests made to the server.
Malicious script hosted on the attacker’s site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site, circumventing the browser’s security model of trusted zones.
XSS (cross-site scripting) attack
Attack that injects a database query into the input data directed at a server by accessing the client side of the application
SQL injection
SQL
Structured Query Language
What does sql do?
read and write information from a database
SQL statements perform operations such as selecting data (SELECT), inserting data (INSERT), deleting data (DELETE), and updating data (UPDATE)
Function that converts an arbitrary length string input to a fixed length string output.
hash
What are Two of the most used cryptographic hash algorithms? (2)
- Secure Hash Algorithm (SHA)
- Message Digest (MD5)
MD5 is the older algorithm and is gradually being phased out of use.
