Messer Practice Exam 2 Flashcards
A security administrator has performed an audit of the organizations web servers, and the results have identified banner information leakage, web services running from a privileged account, and inconsistencies with SSL certificates. Which of the following would be the BEST way to resolve these issues?
Server Hardening - Many applications and services include secure configuration guides that can assist in hardening the system. These hardening steps will make the system as secure as possible while simultaneously allowing the application to run efficiently. All of the identified issues were the result of server configurations.
A shipping company stores information in small regional warehouses around the country. The company keeps an IPS online at each warehouse to watch for suspicious traffic patterns. Which of the following would BEST describe the security control used at the warehouse?
If preventative is not an option, default to the best available option. In this case it was Detective, because an IPS can detect and record any intrusion attempt.
What is a “Compensating” security control?
It can’t prevent an attack, but it can compensate when an attack occurs.
For example, a compensating control would be the re-imaging process or a server restored from backup if an attack had been identified.
Who is a “Data Owner”?
The data owner is accountable for specific data, and is often a senior officer of the organization.
Example: The Vice President of Sales is the Data Owner of the sales data.
Who is a “Data Protection Officer”?
The Data Protection Officer (DPO) is responsible for the organization’s data privacy. The DPO commonly sets processes and procedures for maintaining the privacy of data.
Who is a “Data Steward/Custodian”?
The Data Steward/Custodian manages access rights to the data.
Example: The IT team of a Company would be the Data Steward/Custodian.
Who is a “Data Processor”?
The Data Processor is often a third-party that processess data on behalf of the data controller.
Who is a “Data Controller”?
A Data Controller is responsible for data collection responsibilities.
These responsibilities include: collecting individuals’ consent, storing the data, managing consent-revoking, and enabling the right to access. They ensure all data processed within their organization is compliant with the GDPR.
Example: Lets look at the payroll process within an organization. There’s probably a payroll department within your company, and they’re considered to be the Data Controller. Because they’re the ones that define how much people get paid, and when they get paid. BUT it is very common for a company to work with a third party to actually process the payroll, and that would be a third-party payroll company. They’re considered to be the data processor.
What does “GDPR” stand for?
General Data Protection Regulation
What does “IaaS” provide?
It’s a type of cloud service that provides the basic hardware required to install an OS and application.
What is a “Watering Hole Attack”?
A watering hole attack requires users to visit a central website or LOCATION.
What is “SIAM”?
Service Integration and Management (SIAM) allows the integration of many different service providers into a single management system. This simplifies the application management and deployment process when using separate cloud providers.
What is “SDN”?
Software-Defined Networking (SND) separates the control plane of networking devices from the data plane. This allows for more automation and dynamic changes to the infrastructure.
Example: Network virtualization
What is “Federation”?
Federation provides a way to authenticate and authorize between two different roganizations.
What is “Accounting” in cybersecurity?
Accounting will document information regarding a user’s session, such as login time, data sent and received, files transferred, and logout time.
What is a “Ping Scan”?
A Pig Scan is a type of network scan that can identify devices connected to the network. It is not a penetration test.
What is “Orchestration”?
The process of automating the configuration, maintenance, and operation of an application instance.
What is “Wireshark”?
Wireshark is a protocol analyzer, and it can provide information about every frame that traverses the network. It can show the exploitation process and details about the payloads used during an attack attempt.
What is “Nessus”?
Nessus is a vulnerability scanner that can help identify potential exploit vectors, but its not useful for showing active exploitation attempts.
What is “DNSSEC”?
Domain Name System Secure Extensions (DNSSEC) are used on DNS servers to validate DNS responses using public key cryptography.
What is “RBAC”?
Role-Based Access Control (RBAC) restricts access based on a person’s role within an organization.
What is “MAC”?
Mandatory Access Control (MAC) is when the operating system provides the limits on how much access someone will have to a particular object.
This is generally based on Clearance Levels!
What is “DAC”?
Discretionary Access Control (DAC). The person who creates the object get to set the controls for it.
Example: If you create an excel sheet, you get to determine exactly who has access.
What is “ABAC”?
Attribute-Based Access Control (ABAC) allows us to create very complex relationships between the applications we’re using and the data that is used by those applications.
Example: ABAC authorization may consider your IP Address, the time of day, your geographic locations, etc. to determine access.
What is “RuBAC”?
Rule-Based Access Control (RuBAC) manages access to areas, devices, or databases.
We often seen them used in firewalls.
What is a “Jump Server”?
A Jump Server is a highly secured device commonly used to access secure areas of ANOTHER network.
A technician would first connect to the Jump Server using SSH or a VPN tunnel, and then “jump” from the Jump Server to other devices on the inside of the protected network.
What is a “HSM”?
A Hardware Security Module (HSM) is a secure method of cryptographic key backup and hardware-based cryptographic offloading.
What is “NAC”?
Network Access Control (NAC) is a broad term describing access control based on a heath check or posture assessment.
NAC will deny access to devices that don’t meet the minimum security requirements.
What is “RTO”?
Recovery Time Objective (RTO) defines the minimum time to get up and running to a particular service level.
Example: System restored within 24 hours.
What is “RPO”?
Recovery Point Objective (RPO) defines how much data loss would be acceptable during a recovery.
Example: We accept the lose of up to 48 hours of data.
What is “MTTR”?
Mean Time to Repair (MTTR) is the time required to repair a product or system after a failure.
What is “MTBF”?
Mean Time Between Failures (MTBF) is the average time expected between outages.
Usually and estimation based on the internal device components and their expected operational lifetime.
What is a “WAF”?
Web Application Firewall (WAF) is used to protect exploits against web-based applications.
What is a “Proxy”?
A proxy is used to make network or application requests on behalf of another person or device.
What is “RADIUS”?
Remote Authentication Dial-In User Service (RADIUS) is a common method of centralizing authentication for users.
Instead of having separate local accounts on different devices, users can authenticate with account information that is maintained in a centralized database.
What is the downfall of MS-CHAP?
The vulnerabilities related to the use of DES (Data Encryption Standard) make it relatively easy to brute force the hash used.
What is “PAP”?
Password Authentication Protocol
What is “IPsec”?
It is commonly used as an encrypted tunnel between sites or endpoints.
A recent security audit has discovered email addresses and passwords located in a packet capture. What does this audit identify?
It identifies “Insecure Protocols”. An insecure protocol will transmit information “in the clear,” or without any type of encryption or protection.
What security issue is associated with WPS?
Wi-Fi Protected Setup (WPS) is vulnerable to brute-force attacks because its PIN only has 11,000 possible iterations.
What is “Threat Transfer”?
Assign or move the risk to a third-party.
Example: Cyber Liability Insurance
