New Knowledge Points Flashcards
Diameter vs Radius
Diameter is largely used in the 3/4G space, RADIUS is used elsewhere. Was intended to replacement for RADIUS, but the use cases changed and both now have different uses. Also provides centralized AAA (Authentication, Authorization, and Accounting) management for users who connect and use a network service.
Due diligence vs Due care
Due diligence is planning. Due care is doing the right thing.
Due diligence is first, then due care.
Duo Care - prudent person rule - asking “Would a prudent person do in the same situation?”
ISC2 Code of Ethics Canons
ISC2 Code of Ethics Canons:
1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
2. Act honorably, honestly, justly, responsibly, and legally.
3. Provide diligent and competent service to principles.
4. Advance and protect the profession.
PATRIOT Act of 2001
Expands law enforcement electronic monitoring capabilities. Allows search and seizure without immediate disclosure.
Penetration test phases -NIST defines
Planning
Information gathering and discovery
Attack
Reporting
Hash Functions: RIPEMD
RIPEMD: Developed outside of defense to ensure no government backdoors. 128, 256, 320 bit hashes. Not widely used. No longer secure.
SRAM (Static RAM)
SRAM (Static RAM): Fast and expensive. Uses latches to store bits (Flip-Flops). Does not need refreshing to keep data, keeps data until power is lost. This can be embedded on the CPU.
HIPAA
HIPAA is the Health Insurance Portability and Accountability Act.
Regression testing
Finding defects after a major code change has occurred. Looks for software regressions, as degraded or lost features, including old bugs that have come back.
MTD > RTO + WRT
The time to rebuild the system and configure it for reinsertion into production must be less than or equal to the MTD.
Clipper chip
The Clipper chip was a chipset that was developed and promoted by the United States National Security Agency (NSA) as an encryption device that secured “voice and data messages” with a built-in backdoor. It used SkipJack, a block cipher.
On which layer of the Open Systems Interconnect (OSI) model do we establish the connection between 2 applications?
Layer 5: Session Layer: Establishes connection between 2 applications: Setup > Maintenance > Tear Down.
The purpose of production acceptance testing
Compatibility/production testing: Does the software interface as expected with other applications or systems? Does the software perform as expected in our production environment vs. the development environment
Wi-Fi Protected Access 2 (WPA2) provides users with a higher level of assurance that their data will remain protected by using which protocol?
Extensible Authentication Protocol (EAP)
Static testing
Passively testing the code, it is not running. This is walkthroughs, syntax checking, and code reviews. Looks at the raw source code itself, looking for evidence of known insecure practices, functions, libraries, or other characteristics having been used in the source code.
Real Evidence
Real Evidence is tangible and physical objects, in IT Security it is things like hard disks, USB drives and not the data on them.
Polyinstantiation
Polyinstantiation (Alternative Facts) – Two (or more) instances of the same file depending on who accesses it. The real information may be available to subjects with Top Secret clearance, but different information will be available to staff with Secret or lower clearance.
Type of the trust domain
One-way trust, Two-way trust, Trusted domain, Transitive trust and Intransitive trust are all trust domains, there is no reflective trust.
Exigent circumstances
Exigent circumstances apply if there is an immediate threat to human life or of evidence destruction. This will later be decided by a court if it was justified. Only applies to law enforcement and those operating under the “color of law” – Title 18. U.S.C. Section 242 – Deprivation of Rights Under the Color of Law.
For access control management, which of these is considered something you have?
A. Fingerprint.
B. Cookie on computer.
C. PIN.
D. MAC address.
B. Cookie on computer.
Explain: Things in your possession, not things you know (knowledge factor) or something you are (biometrics).
Digital forensics should always be done on bit-level copies of the original, never the original. Is it True or false?
True
Fail-open and fail-closed
In the context of the physical world, the terms fail-open
is a synonym for fail-safe, and fail-closed is a synonym for fail-secure
Unstructured audits
Unstructured audits: Internal auditors to improve our security and find flaws, often done before an external audit.
Which of these is NOT covered by the Wassenaar Arrangement?
Rockets.
Encryption algorithms.
SQL Databases.
Munitions.
SQL Databases.
Typosquatting
Typosquatting is a form of cybercrime that involves hackers registering domains with deliberately misspelled names of well-known websites.
Key stretching
Key stretching – Adding 1-2 seconds to password verification. If an attacker is brute forcing password and need millions of attempts it will become an unfeasible attack. Brute Force attacks uses the entire key space (every possible key), with enough time any plaintext can be decrypted. Effective against all key based ciphers except the one-time pad, it would eventually decrypt it, but it would also generate so many false positives the data would be useless.
Clipping levels
Clipping levels are thresholds of acceptable user errors and suspicious activities. If this threshold is exceeded, it must be logged and the administrator must decide if any malicious activity is taking place or if the user needs some training.
What kind of proof does the Civil Law (Tort Law) require?
Civil Law (Tort Law): Individuals, groups or organizations are the victims and proof must be ”the majority of proof” / “More likely than not”. Financial fines to “Compensate the victim(s)”.
The evidence we collect must be accurate, complete, authentic, convincing, and admissible.
Drill for security awareness training
Drills (exercises): Walkthroughs of the plan; main focus is to train staff, and improve employee response
Servers pull cold air in from the cold aisles and push out in the warm aisles. The cold aisles would be at the front of the rack and the hot aisles at the rear of the rack. Servers have intake in the front and exhaust in the back and switches are often reserved.
Crypto-shredding
Crypto-shredding is a data destruction technique that consists in destroying the keys that allow the data to be decrypted, thus making the data undecipherable. It can be used to destruct data in the cloud server. It uses the symmetric algorithm key.
In the context of security incident response, which of the following is the MOST important consideration when determining the severity of an incident?
A) The number of affected systems
B) The financial impact on the organization
C) The level of media attention
D) The potential harm to the organization’s reputation
B) The financial impact on the organization
S/MIME
The Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol has emerged as a de facto standard for encrypted email. S/MIME uses the RSA encryption algorithm and has received the backing of major industry players, including RSA Security.
ASLR
Address space layout randomization
- isa memory-protection process for operating systems (OSes) that guards against buffer-overflow attacks by randomizing the location where system executables are loaded into memory.
TEMPEST
The TEMPEST program creates technology that is not susceptible to Van Eck phreaking attacks because it reduces or suppresses natural electromagnetic emanations
