Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Computer & Network Security > Midterm > Flashcards

Midterm Flashcards

1
Q

Access Control Policies

A
  • Discretionary Access Control
  • Mandatory Access Control
  • Role based (RBAC)
  • Attribute based (ABAC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Example of DAC

A

Unix file mode (read, write, execute)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Subject

A

an entity capable of accessing objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Object

A

a resource to which access is controlled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

MAC

A

Access is granted based on comparing subject security clearances to security labels on objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

DAC

A

Allows user to access a resource as well as by own volition enable another entity to access the same resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Access Control Matrix

A

Objects vs Subjects (each box contains permissions like own, read, write, etc…)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

RBAC

A

Access is granted based on what roles users have inside the system and what permissions those roles carry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ABAC

A

Controls access based on user attributes, resource to be accessed, and environmental conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Permitted Set

A

Limiting superset of a thread’s effective capabilities (capabilities a thread MAY assume)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Inheritable Set

A

Set of capabilities preserved across an execve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Effective Set

A

This is the set of capabilities used by the kernel to perform permission checks for the thread.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Weird machine

A

Computational artifact where additional code execution can happen outside the specification of the program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Three malware propagation techniques

A
  1. Infection of an existing executable or interpreted content by viruses
  2. exploit of software vulnerabilities either locally or over a network by worms or drive-by-downloads
  3. social engineering attacks that convince users to bypass security mechanisms to install trojans or respond to phishing attacks.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Virus

A

Malware that tries to replicate itself into other executable code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Worms

A

Independent program that propagates itself onto hosts through a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Trojan Horse

A

A program that appears to have a useful function, but has a hidden malicious function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Bots

A

malware that subverts the computational and network resources of the infected system for the use of the attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Spyware

A

General monitoring of a system to gain useful knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Rootkits

A

Set of programs installed on a system to maintain covert access to system with root privileges, while hiding evidence of its presence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Non executable memory

A

Marks memory regions as non-executable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Return to LibC Attack

A

Inserting an existing binary’s address into the return address (don’t need to inject own code)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Reverse engineering

A

Reverse engineering is the process of extracting the knowledge or design blueprints
from anything man-made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

White box analysis

A

Looking at source code for vulnerability or algorithm details

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Grey box analysis

A

Looking at low-level implementation with inferred abstractions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Black box analysis

A

Using only input and output relations, make conclusion about how system behaves

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Static analysis

A

Looking at the code without executing program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Dynamic analysis

A

Looking at what code does by stepping through its execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Static analysis example

A

Sign analysis to check for division by zero (among others)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Dynamic analysis example

A

Assertions to check for conditions that halt execution if not met

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Economy of Mechanism

A

Security mechanisms should be as simple as possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Fail-safe defaults

A

Base access decisions based on permission rather than exclusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Complete mediation

A

Every access to every object must be checked for authority

34
Q

Open Design

A

The design should not be a secret

35
Q

Separation of Privilege

A

Divide a program into parts that are given necessary privileges only when needed

36
Q

Least privilege

A

Give user least privileges necessary to do the job

37
Q

Least Common Mechanism

A

Minimize the amount of mechanism common to more than one user and depended on by all users

38
Q

Psychological Acceptability

A

It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly.

39
Q

Least Astonishment

A

Users should not be astonished at the way a feature behaves

40
Q

Security Implementation Strategy

A
  1. Identify
  2. Prevent
  3. Detect
  4. Respond
  5. Recover
41
Q

Why were setuid and setgid deemed necessary?

A

To allow users to execute files with temporarily elevated rights.

42
Q

How to find set-uid programs

A

$ find /usr/bin /usr/lib -perm /4000 -user root

43
Q

How is Malware classified?

A

1) Propagation method

2) Payload type

44
Q

Why was Slammer’s propagation so fast?

A

It used UDP (no handshakes)

45
Q

Anomaly-based Intrusion Detection

A

Detects both network and computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous

46
Q

Signature-based Intrusion Detection

A

Scans files for known malware “signatures” (most anti-virus today)

47
Q

Advantages of Anomaly-based Intrusion Detection

A

Good for unknown attacks

48
Q

Advantages of Signature-Based Intrusion Detection

A
  • Few false positives

- Model construction

49
Q

Disadvantages of Anomaly-based Intrusion Detection

A
  • Higher false positives

- Model construction

50
Q

Disadvantages of Signature-Based Intrusion Detection

A
  • Hard to defend against unknown attacks

- Polymorphic attacks

51
Q

Intrusion Detection Approaches

A
  • Host-based
  • Network-based
  • Hybrid
52
Q

Host-based IDS

A
  • OS Audits
  • Program execution monitoring
  • Memory evaluation
53
Q

Network-based IDS

A
  • Deploy strategic network sensors
  • Inspect network traffic
  • Monitor user activities
54
Q

Confidentiality

A

Preserving authorized restrictions on information access and disclosure

55
Q

Integrity

A

Guard against improper data modification

56
Q

Availability

A

Ensuring timely, reliable access to information

57
Q

Bug

A

A flaw in code

58
Q

Vulnerability

A

Exploitable bug

59
Q

Exposure

A

Bug that reveals info that can then be used to penetrate system

60
Q

Threat

A

Potential security harm

61
Q

Exploit

A

A threat that uses a vulnerability/exposure to violate system security

62
Q

Security Implementation: Identify

A

Develop institutional understanding to manage cybersecurity risk to systems, assets, data, etc…

63
Q

What data is stored in the iNode?

A

All data about a file except name and and actual data (owner, permissions, size, date, etc…)

64
Q

Common characteristic of memory corruption exploits

A

Inserting crafted address into EIP

65
Q

Main bug allowing memory corruption exploits

A

No range checking on inputs

66
Q

Stack Guard

A

Inserts canaries to verify integrity

67
Q

Data Execution Prevention (DEP)

A

Kernel enforces that no data can be executed as code

68
Q

ASLR stands for

A

Address Space Layout Randomization

69
Q

What does ASLR do?

A

Randomly re-arranges address space positions of key process data regions

70
Q

ASLR Entropy

A

19 bits

71
Q

How to execute a return-to-libc

A
  1. Overwrite return addr to “system()”
  2. Overwrite next 4-bytes with “exit()”
  3. Overwrite next 4-bytes with “/bin/sh”
72
Q

4 authentication methods:

A

Something a user:

1) Knows
2) Has
3) Is
4) Does

73
Q

2-Step Verification is an example of

A

Have

74
Q

In Linux, user account data is stored in

A

/etc/passwd

75
Q

In Linux, hashed passwords are stored in

A

/etc/shadow

76
Q

2^10

A

1024

77
Q

2^20

A

1M

78
Q

2^30

A

1B

79
Q

Rainbow Table

A

Precomputes H(Dictionary) to speed up comparisons

80
Q

How to defeat rainbow table attack

A

Use a salt

81
Q

What’s in the shadow file

A

UserID :: Password(alg, salt, hash) :: other shit

Computer & Network Security (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions