Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IT & Data Assurance I (IST293) > Module 4: Endpoint & Application Development Security > Flashcards

Module 4: Endpoint & Application Development Security Flashcards

1
Q

Define Key Risk Indicator (KRI)

A

A metric of the upper & lower bounds of specific indicators of normal network activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define Indicator of Compromise (IOC)

A

Shows that a malicious activity is occurring but it still in the early stages of an attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define Predictive Analysis

A

Discovering an attack before it occurs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What do Key Risk Indicators (KRIs) include?

A

1) Total network logs per second
2) Number of failed remote logins
3) Network bandwidth
4) Outbound email traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does Indicator of Compromise (IOC) show?

A

That a malicious activity is occurring but is still in the early stages of an attack

Aids in predicitve anaysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Open Source.

A

Refers to anything that could be freely used w/o restriction, such as open source film or open source curriculum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Open Source Intelligence (OSINT)?

A

Open source threat intelligence information that is freely available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are 4 services that CISCP provides?

A

1) Analyst-to-analyst technical exchanges
2) CISCP analytical products
3) Cross industry orchestration
4) Digital malware analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are analyst-to-analysst technical exchanges?

A

A CISCP service:

Partners can share & receive information on threat actor tactics, techniques, & procedures (TTPs) & emerging trends

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are CISCP analytical products?

A

A CISCP service:

A portal can be accessed through which partners can receive analysis of products & threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is cross industry orchestration?

A

A CISCP service:

Partners can share lessons learned & their expertise w/ peers across common sectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is digital malware analysis?

A

A CISCP service:

Suspected malware can be submitted to be analyzed & then used to generate malware analysis reports to mitigate threats & attack vectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are 2 concerns around public information sharing centers?

A

1) Privacy
2) Speed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does Automated Indicator Sharing (AIS) do?

A

Enables the exchange of cyberthreat indicators b/t parties through computer-to-computer communication, not email communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are 4 CISCP privacy protections?

A

1) Cybersecurity Information Sharing Act (CISA)
2) Freedom of Information Act (FOIA)
3) Traffic-Light Protocol (TPL)
4) Protected Critical Infrastructure Information Act (PCII)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Cybersecurity Information Sharing Act (CISA)?

A

Federal law passed in 2015 that provides authority for cybersecurity information sharing b/w the private sector, state, & local governments, & the federal government

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Freedom of Information Act (FOIA)?

A

Passed in 1967 & provides the public the right to request access to records from any federal agency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Traffic-Light Protocol (TLP)?

A

Set of designations used to ensure that sensitive information is shared only w/ the appropriate audience

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Protected Critical Infrastructure Informatoin Act (PCII)?

A

2002 act that protects private sector infrastructure information that is voluntarily shared w/ the government for the purposes of homeland security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Structured Threat Information Expression (STIX)?

A

A language & format used to exchange cyberthreat intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Trusted Automated Exchange of Intelligence Information (TAXII)?

A

An application protocol for exchanging cyberthreat intelligence over HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define Closed Source?

A

Opposite of open source; proprietary, meaning it is owned by an entity that has an exclusive right to it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are private information sharing centers?

A

Organizations participating in closed source information that restrict both access to data & participation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are 4 sources of threat intelligence?

A

1) Vulnerability database
2) Threat maps
3) File and code repositories
4) Dark web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 3 tasks that securing endpoint computers primarily involves?

A

1) Confirming that the computer has started securely
2) Protecting the computer from attacks
3) Hardening it for even greater protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is BIOS?

A

A chip integrated into the computer’s motherboard; when computer was powered on, the BIOS software would “awaken” & perform a legacy BIOS boot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is Unified Extensible Firmware Interface (UEFI)?

A

An improved firmware interface was developed to replace the BIOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the 4 enhancements of UEFI over BIOS?

A

1) Ability to access hard drives that are larger than 2 TB
2) Support for an unlimited number of primary hard drive partitions
3) Faster booting
4) Support for networking functionality in the UEFI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the chain of trust?

A

Each element relies on the confirmation of the previous element to know that the entire process is secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the Hardware Root of Trust?

A

The strongest starting point in the chain of trust is hardware, which cannot be modified like software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the 5 Boot Security Modes?

A

1) Legacy BIOS Boot
2) UEFI Native Mode
3) Secure Boot
4) Trusted Boot
5) Measured Boot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Description/Advantages/Disadvantages of Legacy BIOS Boot.

A

Description:
Uses BIOS for boot functions

Advantages:
Compatible w/ older systems

Disadvantages:
No security features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Description/Advantages/Disadvantages of UEFI Native Mode.

A

Description:
Uses UEFI standards for boot functions

Advantages:
Security boot modules can be patched or updated as needed

Disadvantages:
No validation or protection of the boot process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Description/Advantages/Disadvantages of Secure Boot.

A

Description:
Each firmware & software executable at boot time must be verified as having prior approval

Advantages:
All system firmware, bootloaders, kernels, & other boot-time executables are validated

Disadvantages:
Custom hardware, firmware, & software may not pass w/o first being submitted to system vendors like Microsoft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Description/Advantages/Disadvantages of Trusted Boot.

A

Description:
Windows OS checks the integrity of every component of boot process before loading it

Advantages:
Takes over where Secure Boot leaves off by validating the Windows 10 software before loading it

Disadvantages:
Requires using Microsoft OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Description/Advantages/Disadvantages of Measured Boot.

A

Description:
Computer’s firmware logs the boot process so the OS can send it to a trusted server to assess the security

Advantages:
Provides highest degree of security

Disadvantages:
Could slow down the boot process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are 4 ways endpoints are protected?

A

1) Antivirus Software
2) Antimalware
3) Web Browser Protections
4) Monitoring & Response Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How does Antivirus Software protect endpoints?

A
  • Can examine a computer for file-based virus infections & monitor computer activity (such as scanning new documents that might contain a virus)
  • Log files created by AV products can provide beneficial info regarding attacks
  • Many AV products use signature-based monitoring, called static analysis
  • A newer approach to AV is heuristic monitoring, called dynamic analysis
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How does Antimalware protect endpoints?

A
  • Suite of software intended to provide protections against multiple types of malware
  • Antimalware spam protection is often performed using a technique called Bayesian filtering
     Filters by analyzing every word in each email & determines how frequently a word occurs in a spam pile versus a nonspam pile
  • Another component of an antimalware suite is antispyware, which helps prevent computers from becoming infected by spyware
     Uses pop-up blocker, which allow the user to select the level of blocking, ranging from blocking all pop-ups to allowing specific pop-ups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

How Do Web Browsers protect endpoints (2)?

A

1) Secure Cookies
2) HTTP Headers

  • Secure cookies are sent to a web server w/ an encrypted request over the secure HTTPS protocol
  • This prevents an unauthorized person from intercepting a cookie that is being transmitted between the browser & the web server
  • HTTP Response Header are headers that tell the browser how to behave while communicating w/ the website
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is stateless protocol vs stateful protocol?

A

Stateless - “Forgets” what occurs when the session is interrupted or ends

Stateful - “Remembers” everything that occurs b/t the browser client & the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are 3 ways the stateless protocol can mimic stateful protocol?

A

1) Using a URL extension so the state is sent as part of the URL as a response

2) Using “hidden from fields” in which the state is sent to the client as part of the response & returned to the server as a part of a form’s hidden data

3) Storing user-specific information in a file on the user’s local computer & then retrieve is later in a file called a cookie

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are the 3 types of Monitoring & Response Systems?

A

1) Host Intrusion Detection Systems (HIDS)
2) Host Intrusion Prevention Systems (HIPS)
3) Endpoint Detection & Response (EDR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is Host Intrusion Detection Systems (HIDS)?

A

Software-based application than runs on an endpoint computer & can detect an attack has occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is Host Intrusion Prevention Systems (HIPS)?

A

Monitor endpoint activity to immediately block a malicious attack by following specific rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is Endpoint Detection & Response (EDR)?

A

Tools are considered more robust than HIDS & HIPs:

  • An EDR can aggregate data from multiple endpoint computers to a centralized database
  • EDR tools can perform more sophisticated analytics that identify patterns & detect anomalies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the 4 types of HTTP Response Headers?

A

1) HTTP Strict Transport Security (HSTS)
2) Content Security Policy (CSP)
3) Cross Site Scripting Protection (X-XSS)
4) X-Frame-Options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Description/Protection of HTTP Strict Transport Security (HSTS).

A

Description:
Forces browser to communicate over more secure HTTPS instead of HTTP

Protection:
Encrypts transmissions to prevent unauthorized user from intercepting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Description/Protection of Content Security Policy (CSP).

A

Description:
Restricts the resources a user is allowed to load within the website

Protection:
Protects against injection attacks

50
Q

Description/Protection of Cross Site Scripting Protection (X-XSS).

A

Description:
Prohibits a page from loading if it detects a cross-site scripting attack

Protection:
Prevents XSS attacks

51
Q

Description/Protection of X-Frame-Options.

A

Description:
Prevents attackers from “overlaying” their content on the webpage

Protection:
Foils a threat actor’s attempt to trick a user into providing personal information

52
Q

What are 3 ways HIDs typically monitor installed agents/types of endpoint computer functions?

A

1) System calls
2) File system access
3) Host input/output

53
Q

What does Hardening Endpoints involve (2)?

A

1) Patch management
2) OS Protections

54
Q

Patch management involves what 2 types of patch management tools to administer patches?

A

1) Patch distribution
2) Patch reception

55
Q

What are 3 advantages of automated patch update service?

A

1) Downloading patches from a local server instead of using the vendor’s online update service can save bandwidth & time because each computer does not have to connect to an external server

2) Administrators can approve or decline updates for client systems, force updates to install by a specific date, & obtain reports on what updates each computer needs

3) Administrators can approve updates for “detection” only; this allows them to see which computers require the update w/o installing it

56
Q

What 3 options does patch reception in Microsoft Windows 10 include?

A

1) Forced updates
2) No selective updates
3) More efficient distribution

57
Q

What are 3 security configurations a typical OS should include?

A

1) Disabling unncessary ports & services
2) Disabling default accounts/passwords
3) Employing least functionality

58
Q

What are 6 OS types?

A

1) Network OS
2) Server OS
3) Workstation OS
4) Appliance OS
5) Kiosk OS
6) Mobile OS

59
Q

Uses & Example of Network OS.

A

Uses:
Software that runs on a network device like a firewall, router, or switch

Examples:
Cisco Internetwork Operating System (IOS), Juniper JUNOS, MikroTik RouterOS

60
Q

Uses & Example of Server OS.

A

Uses:
OS that runs on a network server to provide resources to network users

Examples:
Microsoft Windows Server, Apple macOS Server, Red Hat Linux

61
Q

Uses & Example of Workstation OS.

A

Uses:
Software that manages hardware & software on a client computer

Examples:
Microsoft Windows, Apple macOS, Ubuntu Linux

62
Q

Uses & Example of Appliance OS.

A

Uses:
OS in firmware that is designed to manage a specific device like a digital video recorder or video game console

Examples:
Linpus Linux

63
Q

Uses & Example of Kiosk OS.

A

Uses:
System & user interface software for an interactive kiosk

Examples:
Microsoft Windows, Google Chrome OS, Apple iOS, Instant WebKiosk, KioWare (Android)

64
Q

Uses & Example of Mobile OS.

A

Uses:
OS for mobile phones, smartphones, tablets, & other handheld devices

Examples:
Google Android, Apple iOS, Apple iPadOS

65
Q

Confinement Tools - 3 tools that can be used to restrict malware.

A

1) Application whitelisting/blacklisting
2) Sandbox
3) Quarantine

66
Q

What are 3 attacks based on application vulnerabilities?

A

1) Executable files attack
2) System tampering
3) Process spawning control

67
Q

Description/Defense of Executable files attack.

A

Description:
Trick the vulnerable application into modifying or creating executable files on the system

Defense:
Prevent the application from creating or modifying executable files for its proper function

68
Q

Description/Defense of System tampering.

A

Description:
Uses the vulnerable application to modify special sensitive areas of the OS (Microsoft Windows registry keys, system startup files, etc.) & take advantage of those modifications

Defense:
Do not allow applications to modify special areas of the OS

69
Q

Description/Defense of Process spawning control.

A

Description:
Trick the vulnerable application into spawning executable files on the system

Defense:
Take away the process spawning ability from the application

70
Q

What does a directory traversal attack take advantage of?

A

Vulnerability in the web application program or the web server software so that a user can move from the root directory to other restricted directories

71
Q

What is a command injection?

A

The ability to move could allow an unauthorized user to view confidential files or enter commands to execute on a service

72
Q

What are poor memory management vulnerabilities?

A

Other dangerous weaknesses in an application can create vulnerabilities in computer memory or buffer areas that can be easily exploited

73
Q

What results in poor memory management vulnerabilities (4)?

A

1) Buffer overflow
2) Integer overflow
3) Pointer/object dereference
4) DLL injection attacks

74
Q

What are 2 levels of application development concepts?

A

1) General concepts that apply to all application development
2) General concepts that apply to rigorous security-based approach

75
Q

What are the 4 stages an application requires completing during development?

A

1) Development
2) Testing
3) Staging
4) Production

76
Q

What happens in the Development Stage of an application?

A

The requirements for the application are established, & it is confirmed that the application meets the intended business needs before the actual coding begins

77
Q

What happens in the Testing Stage of an application?

A

Thoroughly tests the application for any errors that could result in a security vulnerability

78
Q

What happens in the Staging Stage of an application?

A

Tests to verify that the code functions as intended

79
Q

What happens in the Production Stage of an application?

A

The application is released to be used in its actual setting

80
Q

What is Software Diversity?

A

A software development technique in which 2 or more functionally identical variants of a program are developed from the same specification but by different programmers or programming teams

81
Q

What are the 3 intents that Software Diversity provide?

A

1) Error detection
2) Increased reliability
3) Additional documentation

82
Q

What is Provisioning?

A

The enterprise-wide configuration, deployment, & management of multiple types of IT system resources

83
Q

What is Deprovisioning?

A

Application development is removing a resource that is no longer needed

84
Q

What is Integrity Measurement?

A

An “attestation mechanism” designed to be able to convince a remote party that an application is running only a set of known & approved executables

85
Q

What is an application development lifecycle model?

A

A conceptual model that describes the stages involved in creating an application & are usually one of the following 2:

1) Waterfall model
2) Agile model

86
Q

What is the design of the waterfall model?

A

Uses a sequential design process; as each stage is fully completed, the developers move on to the next stage

87
Q

What is the design of the agile model?

A

Designed to overcome the disadvantages of the waterfall model; takes an incremental approach

88
Q

What is SecDevOps?

A

The process of integrating secure development best practices & methodologies into application software development & deployment processes using the agile model

89
Q

What terms is SecDevOps often promoted to?

A

1) Elasticity
2) Scalability

90
Q

What is the cornerstone of SecDevOps?

A

Automation

91
Q

What 5 things does automation enable r/t SecDevOps?

A

1) Continuous monitoring
2) Continuous validation
3) Continous integration
4) Continuous delivery
5) Continuous deployment

92
Q

What is Continuous Monitoring?

A

Examining processes in real time instead of at the end of a stage

93
Q

What is Continuous Validation?

A

Ongoing approvals of the code

94
Q

What s Continuous Integration?

A

Ensuring that security features are incorporated at each stage

95
Q

What is Continuous Delivery?

A

Moving the code to each stage as it is completed

96
Q

What is Continuous Deployment?

A

Continuous code implementation

97
Q

What are immutable systems?

A

Once a value or configuration is employed as a part of an application, it is not modified; if changes are necessary, a new system must be created

98
Q

What is infrastructure as code?

A

Managing a hardware & software infrastructure using the same principles as developing computer code

99
Q

What is baselining?

A

Creating a starting point for comparison purposes in order to apply targets & goals to measure success

100
Q

What coding techniques are used to create secure applications & limit data exposure or disclosing sensitive data to attackers (2)?

A

1) Determining how encryption will be implemented
2) Ensuring that memory management is handled correctly so as not to introduce memory vulnerabilities

101
Q

What are 3 secure software development lifecycle sources?

A

1) OWASP (Open Web Application Security Project)
2) SANS (SysAdmin, Audit, Network & Security Institute)
3) CIS (Center of Internet Security)

102
Q

Description/Materials Available of OWASP.

A

Description:
A group that monitors web attacks

Materials Available:
Maturity models, development guides, testing guides, code review guides, & application security verification standards

103
Q

Description/Materials Available of SANS (SysAdmin, Audit, Network, & Security Institute).

A

Description:
A company that specializes in cybersecurity & secure web application development

Materials Available:
White papers, research reports, & best practices guidelines

104
Q

Description/Materials Available of Center for Internet Security (CIS).

A

Description:
Not-for-profit organization that compiles CIS security controls

Materials Available:
Training, assessment tools, & consulting services

105
Q

What is one of the most important steps in SecDevOps?

A

Testing!

106
Q

When should testing be done r/t SecDevOps?

A

During the implementation & verification phases of a software development process

107
Q

What 2 codes analysis are involved with testing SecDevOps?

A

1) Static Code Analysis
2) Dynamic Code Analysis

108
Q

What is static code analysis?

A

Tests ran before the source code is even compiled & may be accompanied by manual peer reviews

109
Q

What is dynamic code analysis?

A

Security testing performed after the source code is complied

110
Q

What is Fuzzing?

A

Used by dynamic code analysis tools & provides random input to a program in an attempt to trigger exceptions

111
Q

What are the 8 secure coding techniques?

A

1) Proper input validation
2) Normalization
3) Stored procedure
4) Code signing
5) Obfuscation/camouflaged code
6) Dead code
7) Server-side execution & validation or Client-side execution & validation
8) Code reuse of third-party libraries & SDKs

112
Q

Description/Security Advantage of Proper Input Validation.

A

Description:
Accounting for errors such as incorrect user input (entering a file name for a file that does not exist)

Security Advantage:
Can prevent Cross-site scription (XSS) and Cross-site forgery (CSRF)

113
Q

Description/Security Advantage of Normalization.

A

Description:
Organizing data within a database to minimize redundancy

Security Advantage:
Reduces footprint of data exposed to attackers

114
Q

Description/Security Advantage of Stored Procedure.

A

Description:
A subroutine available to applications that access a relational database

Security Advantage:
Eliminates the need to write a subroutine that could have vulnerabilities

115
Q

Description/Security Advantage of Code Signing.

A

Description:
Digitally signing applications

Security Advantage:
Confirms the software author and guarantees the code has not been altered or corrupted

116
Q

Description/Security Advantage of Obfuscation/Camouflaged Code.

A

Description:
Writing an application in such a way that its inner functionality is difficult for an outsider to understand

Security Advantage:
Helps prevent an attacker from understanding a program’s function

117
Q

Description/Security Advantage of Dead Code.

A

Description:
A section of an application that executes but performs no meaningful function

Security Advantage:
Provides an unnecessary attack vector for attackers

118
Q

Description/Security Advantage of Server-Side Execution & Validation or Client-Side Execution & Validation.

A

Description:
Input validation generally uses the server to perform validation but can also have the client perform validation by the user’s web browser

Security Advantage:
Adds another validation to the process

119
Q

Description/Security Advantage of Code Reuse of Third-Party Libraries and SDKs.

A

Description:
Code reuse is using existing software in a new application; a software development kit (SDK) is a set of tools used to write applications

Security Advantage:
Existing libraries that have already been vetted as secure eliminate the need to write new code

120
Q

What does Windows 10 Tamper Protection do?

A

Windows 10 Tamper Protection security feature prevents Windows security settings from being changed or disabled by a threat actor who modifies the registry

IT & Data Assurance I (IST293) (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions