Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sys-601 > My Questions > Flashcards

My Questions Flashcards

1
Q

Protect Documents that can be used in evidence from being altered

A

Legal Hold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Authentication Header (AH)

A

provides a mechanism for authentication only. Because AH does not perform
encryption, it is faster than ESP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Encapsulation Security Payload ESP

A

provides data confidentiality (encryption) and authentication (data integrity, data
origin authentication, and replay protection). ESP can be used with confidentiality only,
authentication only, or both confidentiality and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Data owner

A

Usually a member of senior management. Can delegate some day-to-day duties.
Cannot delegate total responsibility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Controller

A

Manages the purposes and means by which
personal data is processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data processor

A

Processes data on behalf of the data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data custodian/steward

A

Responsible for data accuracy, privacy, and security
– Associates sensitivity labels to the data
– Ensures compliance with any applicable laws and standards
– Manages the access rights to the data
– Implements security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Data protection officer (DPO)

A

Responsible for the organization’s data privacy
– Sets policies, implements processes and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Incident Response Lifecycle

A
  • Preparation
  • Detection & Analysis
  • Containment, Eradication and Recovery
  • Post Incident Activity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cyber Kill Chain

A
  1. Recon
  2. Weaponisation
  3. Delivery
  4. Exploitation
  5. Installation
  6. Command & Control
  7. Action on Objectives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Diamond Model

A

This is an analysis framework
1. Adversary Develops Capability
2. Adversary Uses Infrastructure
3. Infrastructure Connects To Victim
4. Capability Exploits Victim and deployed via Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Managerial Control

A

Address security design and implementation through policies and SOP’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Operational Control

A

Implemented by People e.g. security guards and awareness programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Technical Control

A

Implemented using systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Physical Security

A

Deter - Deny - Detect - Delay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

DER Cert Format

A

Distinguished Encoding Rules
- Binary Format
- Common Format used in Java Certs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

PEM Cert Format

A

Privacy Enhanced Mail
- Base 64 encoded DER (ASCII)
- Format Provided by CA’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PKCS#12 Cert Format

A

Public Key Cryptography Standard #12
- Personal Information Exchange (PFX) syntax standard
- Often used in transfer of public and private key pairs
- p12 or pfx file ecxtension

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CER Cert Format

A

Certificate
- Encoded as binary DER or ASCII PEM
- Common format for windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

PKCS#7 Cert Format

A
  • p7b file
  • ASCII format
  • Private keys not included in p7b file
  • Used in Windows and Java Tomcat
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Policy

A

Formal Statement produced & supported by management. The why

22
Q

Standard

A

Mandatory course of action or rules giving formal policies support or direction. The what

23
Q

Procedure

A

Step by the step instructions. The how

24
Q

Guidelines

A

Recommendation of what to do when standards do not exist. The when

25
Q

Symmetric Algorithms

A

AES -DES - 3DES
RC4
Blowfish - Twofish

26
Q

Asymmetric Algorithms

A

RSA
DSA - Digital Signature Algorithm
Diffie-Hellman Ephemeral (DHE)
ECDHE - Elliptic Curve DHE
Elliptic Curve Cryptography (ECC)
Pretty Good Privacy (PGP)
GNU Privacy Gaurd (GPG)

27
Q

Key Stretching

A

Bcrypt

28
Q

CBC

A

Cipher Block Chaining
- Depends on block before and therefore slow. Uses IV for randomisation

29
Q

GCM

A

Galois Counter Mode
- provides authentication/integrity and hashes

30
Q

ECB

A

Electronic Code Book
- simplest Cipher Each block is encrypted with the same key

31
Q

CTR

A

Counter
- Block cipher mode / acts like a stream cipher. Encrypts successive values of a “counter” - XOR

32
Q

FERPA

A

Family Educational Rights and Privacy Act - requires that educational institutions implement security and privacy controls for student educational records

33
Q

GLBA

A

Gramm-Leach-Bliley Act - focused on services of banks,
lenders, and insurance severely limited services they could provide and the information they could
share with each other

34
Q

FISMA

A

Federal Information Security Management Act (FISMA) Required formal infosec operations for
federal gov’t. Requires that government agencies include the activities of contractors in their
security management programs.

35
Q

HIPPA

A

Health Insurance Portability and Accountability Act

36
Q

COPPA

A

Children’s Online Privacy Protection Act was designed to protect children under age 13

37
Q

ECPA

A

Electronic Communications Privacy Act (ECPA) prohibits a third party from intercepting or disclosing
communications without authorization

38
Q

ISO 27001

A

Standards for an Information Security Management System (ISMS)

39
Q

ISO 27002

A

Code of Practice for information security controls

40
Q

ISO 27701

A

Privacy
Information Management System (PIMS).

41
Q

ISO 31000

A

Risk Management Framework

42
Q

SSAE

A

Statements on Standards for Attestation Engagements (SSAE) SSAE 18 is an audit standard to
enhance the quality and usefulness of System and Organization Control (SOC) reports.

43
Q

CAC

A

Common Access Card

44
Q

PIV

A

personal identity verification

45
Q

CRL

A

Certificate revocation list (CRL) Contains information about any certificates that have been revoked
by a subordinate CA due to compromises to the certificate or PKI hierarchy

46
Q

OCSP

A

Online Certificate Status Protocol Offers a faster way to check a certificate’s status compared to downloading a CRL. With OCSP, the consumer of a certificate can submit a request to the issuing CA to obtain the status of a specific certificate.

47
Q

CSR

A

Certificate signing request cords identifying information for a person or device that owns a
private key as well as information on the corresponding public key.

48
Q

Stapling

A

method used with OCSP, which allows a web server to provide information on the validity
of its own certificate.

49
Q

Pinning

A

method designed to mitigate the use of fraudulent certificates. Once a public key or certificate has been seen for a specific host, that key or certificate is pinned to the host

50
Q

Tracks the movement of evidence through its collection, safeguarding, and analysis
lifecycle.

A

Chain of Custody

Sys-601 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions