Sec Two Flashcards
1
Q
What is a use case?
A
A goal that an organization wants to achieve
2
Q
What is confidentiality?
A
ensuring data is only viewable by authorized users
3
Q
What is steganography
A
hiding data inside other data, such as hiding messages inside a picture
4
Q
What is integrity?
A
ensuring that data has not been modified, tampered with, or corrupted through unauthorized or unintended changes
5
Q
What is non-repudiation?
A
prevents entities from denying they took an action
6
Q
What is availability?
A
Ensuring data and services are available when needed
7
Q
What is risk?
A
the possibility of a threat exploiting a vulnerability and resulting in loss
8
Q
What is a threat?
A
any circumstance or event that has the potential to compromise CIA
9
Q
What is a vulnerability?
A
a weakness in hardware, software, configuration, or users operating the system
10
Q
What is risk mitigation?
A
Reduces risk by reducing the chances that a threat will exploit a vulnerability or reducing impact of the risk
11
Q
What are security controls
A
things that reduce risk, such as antivirus software
12
Q
What are the 3 primary security control types
A
technical (implemented w/ tech)
administrative (implemented w/ admin or management methods)
physical (controls you can physically touch)
13
Q
What are preventive controls
A
controls that attempt to prevent security incidents
14
Q
What are detective controls?
A
controls that attempt to detect when a vulnerability has been exploited
15
Q
What are corrective controls
A
controls that attempt to reverse the impact of an incident after it has occurred
16
Q
What are deterrent controls
A
controls that attempt to prevent incidents by discouraging threats
17
Q
what are compensating controls
A
alternative controls used when it isn’t feasible to use a primary control
18
Q
what is authentication
A
allows entities to prove their identity by using credentials known to another entity
19
Q
what is identification
A
occurs when a user claims or professes an identity with username, email, PIV, biometrics, etc
20
Q
What are the five factors of authentication?
A
something you know (username/password)
something you have (smart card, token)
something you are (fingerprint, retina scan)
somewhere you are (geolocation, MAC address)
something you do (gestures)
21
Q
What are the open source standards used for one-time passwords?
A
HOTP - creates OTP that doesn’t expire
TOTP - creates OTP that expires after 30 seconds
22
Q
What are FAR, FRR, and CER in regards to biometrics?
A
FAR - false acceptance rate (false positive match)
FRR - false rejection rate (false negative match)
CER - crossover error rate (the point on a sensitivity vs. rate graph where FAR and FRR cross - indicates quality of biometric system)
23
Q
What is kerberos?
A
network authentication protocol using tickets issued by KDC or TGT server
24
Q
What is LDAP?
A
specifies formats and methods to query directories such as Active Directory. LDAPS encrypts transmissions with SSL or TLS
25
What is SAML?
an XML based standard used to exchange authentication and authorization info between parties
26
what is a federated identity?
links a user's credentials from different networks or OSs, but treats it as one identity
27
what is shibboleth?
open source federated identity solution
28
what is OAuth and OpenID Connect?
commonly used authentication solutions allowing users to log on to many web sites with another account
29
What are the general account management best practices?
- Least privilege
- No account sharing
- Admin should have 2 accounts (one non-admin account)
- Account disablement policy for users that leave
- routinely delete accounts that are no longer needed
30
What are common access control models?
role-BAC (RBAC) - grants access based on user roles such as jobs, functions, or assigned tasks
- rule-BAC (RBAC) - grants access based on approved instructions such as rules triggered in response to detected attack
- discretionary (DAC) - every object has an owner, that owner can determine everyone else's access - major flaw is susceptibility to trojan horses
- Mandatory access control (MAC) - uses sensitivity labels to identify objects and users, users with matching labels can access
- attribute-based (ABAC) evaluates attributes and grants access based on the value of the attributes. often used in software-defined networks
31
Which protocols are used for voice and video?
Real time transport protocol (RTP) and secure real time transport protocol (SRTP) - SRTP provides encryption, message authentication, and integrity
32
What protocol is commonly used to transfer files over networks?
File transfer protocol (FTP)
33
What are the encryption protocols used to encrypt data-in-transit?
File Transfer Protocol Secure (FTPS - uses TLS)
Secure File Transfer Protocol (SFTP - uses SSH)
Secure Shell (SSH)
Secure Socket Layer (SSL - Deprecated)
Transport Layer Security (TLS)
34
What port does SMTP use to send mail?
TCP 25
35
What port does POP3 use to receive mail?
TCP 110
36
What port does IMAP4 use?
TCP 143
37
What port does Secure POP use?
995 (legacy) or with STARTTLS on port 110
38
What port does IMAP use TLS?
port 993 (Legacy) or with STARTTLS on port 143
39
What port does HTTP use?
80
40
what port does HTTPS use?
443
41
What port does LDAP use?
TCP 389
42
What port does LDAP secure use?
TCP 636
43
What port does RDP use?
TCP 3389
44
What do admins typically use to remote into systems?
SSH or RDP
45
What does network time protocol (NTP) do?
provides time synchronization services
46
What does DNS zone A records contain?
IPv4 addresses
47
What do DNS zone AAAA records contain?
IPv6 addresses
48
How is DNS Zone data updated?
zone transfers and secure zone transfers
49
What port does DNS use?
TCP 53 for zone transfers and UDP 53 for DNS Client queries
50
What is the purpose of DNSSEC?
provides validatin for DNS responses and helps prevent DNS poisoning attacks
51
What are the command line commands for querying DNS?
nslookup (windows) and dig (Linux)
52
what does the axfr switch do?
download all zone data from DNS server, unless it is blocked
53
What do switches do?
map MAC addresses to physical ports
54
What are two examples of port security?
limiting number of MAC addresses per port, and disabling unused ports
55
what is an aggregation switch?
connects multiple switches together in a network
56
What do routers do?
connect networks and direct traffic based on the destination IP address
use rules within access control lists (ACLs) to allow or block traffic
57
What is implicit deny?
indicates that unless something is explicitly allowed, it is denied. it is the last rule in an ACL
58
What do network-based firewalls do?
filter traffic in and out of a network
| placed on border of network
59
What is a stateless firewall?
controls traffic between networks using rules within an ACL
60
What is a stateful firewall?
filters traffic based on the state of a packet within a session
61
What is a web application firewall?
protects a web server against web application attacks. Typically placed in the DMZ and alerts admins of suspicious activity
62
What is a demilitarized zone (DMZ)?
provides a layer of protection for servers that are accessible from the internet
typically sits between two different firewalls
63
What is an intranet?
an internal network used to communicate and share content with each other
64
what is an extranet?
part of a network that can be accessed by authorized entities from outside the network
65
What is NAT?
translates public IP addresses to private IP addresses and vice versa
66
What is an airgap?
a metaphor for physical isolation, indicating a system or network is completely isolated from another system or network
67
What are forward proxy servers?
forward requests for services from a client
can cache and record users' internet activity
68
What is a transparent vs nontransparent proxy server?
transparent accepts and forwards requests without modifying them
nontransparent can modify or filter requests, such as filtering based on the URL
69
What is a reverse proxy server?
proxy server which accepts traffic from the internet and forwards it to one or more internal servers, then returns the result to the requester
70
What is a UTM?
unified threat management. a security appliance which includes multiple layers of protection, such as URL filters, content inspection, malware inspection, and DDoS mitigator
71
What is a mail gateway?
gateway placed between an email server and the internet. examines and analyzes all traffic and can block unsolicited email. may include data loss prevention (DLP) and encryption capabilities
72
What is loop protection?
protects against switching loop problems, such as when a user connects two switch ports together with a cable.
73
what protocol protects against loops?
Spanning Tree Protocol (STP)
74
what are flood guards?
prevent MAC flood attacks on switches
75
What are VLANs
logically separated computers or logically grouped computers regardless of their physical location. can be created with layer 3 switches
76
What network device has antispoofing capabilities?
router using rules within ACLs
77
What is SNMPv3?
used to monitor and configure network devices and uses notification messages known as traps. Uses strong authentication mechanisms and uses UDP ports 161 and 162
78
Which network device can Linux iptables be configured to replaces?
firewall
79
What are IDSs and IDPs?
intrusion detection systems and intrusion prevention systems
| inspect traffic using the same functionality as a protocol analyzer
80
What's the difference between HIDS and NIDS?
HIDS can detect attacks on local systems and protect local resources on the host. Can also detect some malware not detected by traditional antivirus
NIDS detects attacks on the network
81
How do signature-based IDS/IPS work?
uses a signatures to detect known attacks or vulnerabilities
82
How do heuristic-based or behavioural IDSs work?
require a baseline and detect attacks based on anomalies or when traffic is outside of expected boundaries compared to the baseline
83
What's the difference between an IPS and an active IDS?
IPS is placed inline with traffic while an active IDS is out of band
84
What is a SSL/TLS accelerator?
dedicated hardware device that handles TLS traffic, allowing other devices to offload TLS traffic
85
What is an SSL decryptor?
allows an organization to inspect traffic, even when traffic is using SSL or TLS
86
What is a software defined network?
(SDN) uses virtualization tech to route traffic instead of using hardware routers or switches. separates the data and control planes
87
What are honeypots/honeynets?
servers that appear to have valuable data in an attempt to divert attackers from live networks. honeynet is a group of honeypots that looks like a full network
can also be used to observe current attack methodologies
88
What is an 802.1x server?
provides strong port security using port-based authentication. prevents rogue devices from connecting to a network by ensuring only authorized clients can connect
89
What's difference between fat AP and thin AP?
fat AP has everything needed to connect wireless clients to wireless network.
thin AP is controller-based. multiple thin APs are typically configured and managed by one controller
90
What is a weakness of MAC filtering?
attackers can easily discover authorized MACs and spoof an authorized MAC address
91
how do directional antennas differ from omnidirectional antennas?
they have narrower beams and longer ranges
92
What is an ad hoc wireless network?
network set up between two or more devices connected together without an AP
93
what encryption protocol does WPA use?
TKIP (temporal key integrity protocol)
94
what encryption protocol does WPA2 use?
counter mode cipher block chaining message authentication code protocol (CCMP) which is based on AES
95
what protocol do 802.1x servers use?
one of the extensible authentication protocol (EAP) versions such as Protected EAP (PEAP), EAP Tunneled TLS (EAP-TTLS), EAP-TLS, or EAP-Flexible Authentication via Secure Tunneling (EAP-FAST)
96
Which EAP version is most secure?
EAP-TLS - requires a certificate on the server and each of the wireless clients
PEAP and EAP-TTLS only require certificate on the server
PEAP is often implemented with MS-CHAPv2
LEAP is proprietary to Cisco and does not require a certificate. EAP-FAST replaces LEAP
97
What is a captive portal?
forces wireless clients to complete a process such as acknowledging a policy or paying for access before being granted access to the network
98
What is a dissociation attack?
effectively removes a wireless client from a wireless network, forcing it to reauthenticate
99
What is WPS?
allows users to set up a WAP to allow access by pressing a button or entering a short PIN. WPS PINs can be discovered within hours and are not secure. The PIN can then be used to discover the passphrase
100
What is a rogue AP?
an AP placed within a network without official authorization.
101
what is an evil twin?
a rogue AP with the same SSID as a legitimate access point
102
What is a jamming attack?
floods a wireless frequency with noise, blocking wireless traffic
103
what is an IV attack?
initialization vector attack. Attempts to discover the IV and uses it to discover the passphrase. WPA2 isn't susceptible to an IV attack
104
What is an NFC attack?
near field communication attack. uses an NFC reader to read data from mobile devices
105
What is bluejacking?
the practice of sending unsolicited messages to a phone
106
What is bluesnarfing?
the unauthorized access to, or theft of information from, a bluetooth device
107
What is a wireless replay attack?
an attacker captures data sent between two entities, modifies it, and then impersonates one of the parties by replaying the data. WPA2 using CCMP and AES prevents wireless replay attacks
108
What is RFID attack?
radio frequency identification attack. includes eavesdropping, replay, and DoS
109
What is a vpn?
provides secure access to private networks via a public network, such as the internet.
110
What are VPN concentrators?
dedicated devices that provide secure remote access to remote users
111
what is IPsec?
a common tunneling protocol used with VPNs. Secures traffic within a tunnel. provides authentication with an Authentication Header (AH). Encapsulating security payload (ESP) encrypts traffic and provides CIA
112
What are differences between IPsec tunnel mode and transport mode?
tunnel mode encrypts the entire IP packet used in the internal network.
Transport mode only encrypts the payload and is commonly used in private networks, but not with VPNs
113
What are differences between full tunnel and split tunnel?
full tunnel encrypts all traffic after a user has connected to a VPN.
Split tunnel encrypts only traffic destined for the VPNs private network
114
what are site-to-site VPNS
provide secure access between two networks. Can be on-demand or always-on VPNs
115
What is NAC?
network access control. inspects clients for specific health conditions such as up to date antivirus, and can redirect unhealthy clients to a remediation or quarantine network
116
what are differences between permanent NAC agent and dissolvable NAC agent?
permanent is installed on client and stays on clinet
dissolvable is downloaded and run, then deleted when the session ends. commonly used for BYOD devices
117
when is remote access authentication used?
when a user accesses a private network from a remote location, such as with a VPN
118
What is PAP?
password authentication protocol. uses password or PIN for authentication. weakest authentication protocol because it sends passwords as cleartext
119
what is CHAP?
challenge handshake authentication protocol. mroe secure than PAP and uses a handshake process when authenticating clients
120
What is MS-CHAP and MS-CHAPv2?
microsoft versions of CHAP. CHAPv2 provides mutual authentication
121
What is RADIUS?
provides central authentication for multiple remote access services. relies on the use of shared secrets and only encrypts the PW during authentication procses. uses UDP
122
What is TACACS+?
used by some Cisco systems as an alternative to RADSIUS. uses TCP, encrypts the entire authentication process, and supports multiple challenges and responses
123
What is Diameter?
an improvement over RADIUS. uses TCP, encrypts the entire authentication process, and supports many additional capabilities
124
What are AAA protocols?
protocols when provide authentication, authorization, and accounting. examples include RADIUS, TACACS+, and Diameter
125
What is least functionality?
core system design principle stating that systems should only be deployed with the applications, services, and protocols needed to function
126
What is a trusted OS?
one which meets a set of predetermined requirements such as those defined in the Common Criteria
127
What is a master image?
a secure starting point for systems, created with a template or other baseline
128
What is patch management?
procedures which ensure OS's and applications are kept up to date with current patches to ensure protection against known vulnerabilities
129
What is sandboxing?
creating virtual machines or using chroot(on linux) to test security controls and patches in an isolated environment
130
What is EMI?
electromagentic interference. comes from sources such as motors, power lines, and flourescent lights, and can be prevented with shielding
131
What is EMP?
electromagnetic pulse. a short burst of electromagnetic energy
132
What is FDE?
full disk encryption. encrypts an entire disk
133
What is SED?
self-encrypting drive. includes hardware and software necessary to automatically encrypt a drive
134
What is a TPM?
Trusted Platform Module. A chip included in many laptops and mobile devices that provides full disk encryption, a secure boot process, and supports remote attestation. Have an encryption key burned into them that provides hardware root of trust
135
What is an HSM?
hardware security module. kind of like a removable TPM. generates and stores RSA encryption keys and can be integrated with servers to provide hardware based encryption
136
What is a CASB?
cloud access security broker. A software tool or service deployed between an organization's network and cloud provider. Monitors all network traffic and can enforce security policies acting as Security as a Service
137
What is COPE?
corporate-owned, personally enabled. Refers to mobile devices owned by the organization but used by an employee for personal use
138
What is CYOD?
choose your own device. employer provides a list of acceptable devices and allows employees with one of those devices to connect to the network
139
What is VDI in regards to mobile devices?
virtual desktop infrastructure. provides a virtual desktop that users can access from their mobile devices
140
What is MDM?
mobile device management. Tools which help ensure that devices meet minimum security requirements. Can monitor devices, enforce security policies, and block network access if req's/policies are not met. Can restrict apps on devices, segment nad encrypt data, enforce strong authentication methods, and implement securtiy methods such as screen lock and remote wipe
141
What is a SCADA?
supervisory control and data acquisition system. controls an industrial control system (ICS) typically used in large facilities like power plants or water treatment facilities. Should be in isolated networks without access to the internet, and sometimes are protected by NIPS
142
What is an RTOS?
real-time operating system. OS which reacts to input within a specific time
143
how is data encrypted within a database?
individual columns, entire database, individual files, entire disks, and removable media
144
what are the primary methods of protecting the confidentiality of data?
encryption and strong access controls
145
which command is used on Linux to change permissions?
chmod
146
What is data exfiltration?
unauthorized transfer of data outside an organization
147
What is DLP?
data loss prevention. techniques and technologies which help prevent data loss. Can block transfer of data to USB devices and analyze outgoing data via email to detect unauthorized transfers
148
Define viruses vs worms vs trojans
virus: malicious code that attaches itself to a host application. Host app must be executed for the virus to run. Virus tries to replicate by finding other host applications to infect with the code. payload is typically damaging, deleting files, causing random reboots, join computer to botnet, or enable backdoors.
Worm: self-replicating malware that travels without the assistance of a host application. Resides in memory and uses different transport protocols to travel the network. consume network bandwidth and can replicate hundreds of times to spread all over network
trojan: looks like something beneficial but is actually malicious. often delivered via drive-by downloads
149
what is a logic bomb
string of code embedded into an app or script that will execute in response to an event.
150
What is a RAT?
remote access trojan. allows attackers to take control of systems from remote locations. often delivered via drive-by downloads
151
what is a rootkit?
malware with system-level or kernel access and can modify system files and system access. hide their running processes to avoid detection with hooking techniques. tools that can inspect RAM can discover these hooked processes
152
what is hooking, with regards to rootkits?
intercepting system-level function calls, events, or messages in order to control the system's behaviour
153
what is a waterin hole attack?
attempts to discover which web sites a group of people are likely to visit and then infects those websites with malware
154
what is Vishing?
phishing using the phone system to trick users into giving up personal and financial information
155
What's the difference between DoS and DDoS?
DoS is an attack from a single source
DDoS attacks include multiple computers attacking a single target and are typically sustained abnormally high network traffic
156
What are two common types of spoofing?
MAC address and IP address
157
What is a SYN flood attack?
attacker sends a flood of SYN packets but never returns a SYN/ACK packet in response to the ACK packet, leaving the full TCP session unistablished and the server with multiple half-open connections
158
What is one way to prevent a MITM attack?
Kerberos using mutual authentication
159
How can ARP poisoning be used in a DoS attack?
attacker sends ARP reply with a bogus MAC address for the default gateway. without the correct default gateway address, traffic can never leave the network
160
what is a pharming attack?
manipulates the DNS process. tries to corrupt the DNS server or the DNS client. redirects users to a different site.
161
what is an amplification attack?
a type of DDoS attack. typically uses a method that significantly increases the amount of traffic sent to or requested from a victim.
162
What is a smurf attack?
spoofs the source address of a directed broadcast ping packet to flood a victim with ping replies
163
what are two effective counter measure against replay attacks?
timestamps and sequence numbers
164
what is session hijacking?
attackers hijack session ID from cookies and impersonate the user
165
what is domain hijacking?
attacker changes the registration of a domain name without permission from the owner
166
What is a man-in-the-browser attack?
a proxy trojan horse that infects vulnerable web browsers. can capture browser session data, including keyloggers to captures keystrokes, and all data sent to and from web browser
167
what is driver manipulation?
attackers can create shims or rewrite internal code to fool the OS into using a manipulated driver instead of the real driver
168
What is a memory leak?
bug in a computer app that causes app to consume more and more memory the longer it runs. can eventually cause system crash.
169
What is integer overflow?
attack attempts to use or create a numeric value that is too big for an application to handle resulting in inaccurate results
170
what is a DLL injection?
an attack that injects a DLL into a system's memory and causes it to run
171
What is XSRF/CSRF?
cross-site request forger. An attack where an attacker tricks a user into performing an action on a web site
172
what is a framework?
a structure used to provide a foundation. in cybersecurity, they typically use a structure of basic concepts and provide guidance to professionals on how to implement security in various systems
173
What are regulatory frameworks?
frameworks based on relevant laws and regulations such as HIPAA
174
What are non-regulatory frameworks?
frameworks not required by law, but typically identify common standards and best practices that orgs can follow such as COBIT (control objectives for information related technologies)
175
what is a hash collision?
when two different passwords produce the same hash. occurs with weak hashing algorithms
176
What is a birthday attack?
when an attacker tries to produce a password that produces the same hash as the real password
177
what is password salting?
adding additional characters to passwords before hashing them to prevent many types of attacks, including dictionary, brute force, and rainbow table attacks
178
what is a driver shim?
additional code that can be run instead of the original driver
179
what is code signing?
using a digital signature within a certificate to authenticate and validate software code
180
At a minimum, where should input validation occur?
server side.
Client side can be used as well, but can be bypassed, so server side is better
181
What is quantitative risk assessment?
measures the risk using a specific monetary amount, making it easier to prioritize risks
182
What is SLE?
single loss expectancy. the cost of any single loss
183
what is ARO?
annual rate of occurrence. indicates how many times the loss will occur in a year
184
What is ALE?
annual loss expectancy. the value of SLE * ARO
185
what is qualitative risk assessment?
uses judgment to categorize risks based on likelihood of occurrence
186
what is a risk register?
a record of information about identified risks, or a repository for all risks identified and includes additional information abotu each risk
187
What is a supply chain assessment?
evaluating the raw materials supply sources and all the processes required to create, sell, and distribute a product
188
what is network mapping?
discovering devices on the network and how they are connected to each other
often done as part of a network scan, but a full network scan also includes identifying open ports, running services, and OS details
189
What is banner grabbing?
a technique used to gain information about remote systems and is used by many network scanners
often used to identify the OS along w/ information about some applications
190
What are some common vulnerabilities and misconfigurations that can be discovered by a vulnerability scanner?
```
open ports
weak passwords
default accounts and passwords
sensitive data
security and configuration errors
```
191
what is passive reconnaissance?
collecting information about a targeted system, network, or organization using open-source intelligence such as social media, news, or an org's website or from passively collecting info from a network such as SSIDs
192
what is active reconnaissance?
includes using tools to send data to systems and analyzing the responses
193
What is tcpdump?
command-line packet analyzing (protocol analyzer) allowing you to capture packets like with Wireshark, but for Linux
194
What is nmap?
a network scanner. its graphical counterpart is zenmap. can identify all active hosts and IP addresses in a network, the protocols and services running on each, and the OS
Has switches Tx (x = 0 through 5, with 0 being slowest and 5 being fastest); -A (indicates the scan should include OS detection, version detection, script scanning, and traceroute); and -v, indicating the verbosity level. can get more data with -vv or -vvv
195
What is netcat?
can be used for remotely accessing Linux systems. doesn't include native encryption but can be used with SSH. can be used for banner grabbing; transferring files; port scanning
196
what are some common Linux logs to view?
- var/log/messages (contains general system messags)
- var/log/boot.log (log entries created when the system boots)
- var/log/auth.log (authentication log of logins)
- var/log/kern.log (information logged by system kernel)
- var/log/faillog (information on failed login attempts
- var/log/httpd/ (if system is an apache server, this shows error logs)
- utmp (info on current status of system, such as who is logged in)
- wtmp (archive of utmp file)
- btmp (reords failed login attempts)
197
what is SIEM?
security information and event management system.
provides a centralized solution for collecting, analyzing, and managing data from multiple sources
can be used to aggregate and correlate logs
198
which type of scan results in fewer false positives?
credentialed scan, because it allowed the scan to see more information
199
how does humidity affect electrical equipment?
high humidity can cause condensation on the equipment, causing water damage. low humidity allows a higher incidence of ESD
200
define the different levels of RAID
RAID-0 (striping only. requires at least 2 disks. increased R/W speed)
RAID-1 (Mirroring ony. uses at least 2 disks. provides redundency)
RAID-5 and 6 (5 requires 3 or more disks. provides striping similar to 0, but also includes parity for fault tolerance. one drive can fail and the data is not lost. 6 is an extension of 5 with an extra parity block. can recover even if 2 drives fail, but requires min of 4 disks)
RAID-10 (Mirroring and Striping. min of 4 drives.
201
what is a failover cluster?
two or more servers in a cluster configuration. at least one is active and at least one is inactive. if one fails, the inactive can take over without interruption
202
What is a load balancer?
optimizes and distributes data loads across multiple computers or networks. can be hardware or software
203
what are the different types of backups?
full backup (backs up all the selected data)
differential backup (all data that has changed or is different since last full backup)
incremental backup (backs up all data that has changed since the last full OR incremental backup)
snapshots (captures the data at a point in time)
204
What is RTO?
recovery time objective. The max amount of time it should take to restore a system after an outage
205
what is RPO?
recovery point objective. refers to the amount of data you can afford to lose
206
what is MTBF?
mean time between failures. the average time between failures
207
what is MTTR?
mean time to recover. average time it takes to restore a failed system.
208
what is DRP?
disaster recovery plan. includes a hierarchical list of critical systems and often prioritizes services to restore after an outage
209
what is affinity?
load spreading technique in which users are directed to servers based on their IP
210
What are some common hashing algorithms?
MD5 an SHA
211
what size hash does MD5 produce?
128 bits - MD5 is considered cracked and is now only used for verifying file integrity
212
what size of hashes can SHA create?
SHA-1: 160 bit
| SHA-2 & 3: 224, 256, 384, and 512 bit
213
What is HMAC?
hash-based message authentication code.
a fixed-length string of bits similar to those from hashing algorithms. however, it also uses a shared secret key to add some randomness to the result and only the sender and receiver know the secret key
provides integrity through hashing, and authenticity by using the secret key
often used by IPsec and TLS
HMAC-MD5 creates 128 bit hashes
HMAC-SHA1 creates 160 bit hashes
214
What is RIPEMD?
RACE integrity primitives evaluation message digest.
Another hash function used for integrity, but not widely used. can create 128, 160, 256, and 320 bit hashes
215
what is key stretching?
a technique used to increase the strength of stored passwords and can help thwart brute force and rainbow table attacks
salts passwords with additional random bits to make them more complex
two common techniques are bcrypt and Password-Based Key Derivation Function 2 (PBKDF2)
216
what is bcrypt?
a key stretching technique based on the Blowfish block cipher. used on Unix and Linux distributions to protect passwords.
217
What is PBKDF2?
a key stretching technique that uses salt of at least 64 bits and uses a pseudo-random function such as HMAC.
used by WPA2, iOS, and Cisco OSs, among others. Hash size can be 128, 256, or 512, most commonly
218
what is an initialization vector?
IV
starting value for cryptographic algorithm. fixed size random or pseudorandom number that helps create random encryption keys
219
what is XOR?
logical operation used in some encryption schemes. compares two inputs. outputs false if they are they same, true if they are the different
220
what are confusion and diffusion in regards to encryption?
confusion: ciphertext is significantly different than plaintext
diffusion: ensures that small changes in plaintext result in large changes in ciphertext
221
what is resiliency?
the security of an encryption key even if an attacker discovers part of the key
222
what's the difference between stream and block ciphers?
stream encrypt bit by bit and are more efficient when encrypting data in a continuous stream such as video or audio.
block encrypt data in specific sized block and are more efficient when the size of data is known
223
what are the different cipher modes used for block ciphers?
ECB: electronic codebook (simplest cipher mode. divide plaintext into blocks and encrypt each block using the same key)
CBC: Cipher Block Chaining (uses an IV for randomization when encrypting the first block. then combines each subsequent block with previous block using an XOR operation. sometimes less efficient due to pipeline delays)
CTM: counter mode (converts a block cipher into a stream cipher. combines an IV with a counter and uses the result to encrypt each plaintext block. runs faster on multiprocessor or multicore systems. widely used and respected as a secure mode)
GCM: Galois/Counter mode (combines counter mode with Galois mode. doesn't authenticate users or systems, but provides integrity and confidentiality. includes hashing techniques for integrity)
224
what is symmetric encryption?
uses same key to encrypt and decrypt data
225
what is AES?
advanced encryption standard. strong symmetric block cipher that uses 128 bit blocks
can use 128, 192, or 256 bit keys
226
what is DES?
data encryption standard. symmetric block cipher that was widely used dating back to the 70s. encrypts data in 64 bit blocks. uses 56 bit key. not used today
227
what is 3DES?
triple DES. a symmetric block cipher designed as an improvement over DES. encrypts data using DES in 3 separate passes and uses multiple keys. still uses 64 bit blocks. can use keys of 56, 112, or 168 bits
228
what is RC4?
Rivest Cipher. symmetric stream cipher using between 40 and 2,048 bits.
it is speculated that agencies such as NSA can break RC4, so it is recommended to disable RC4 and use AES instead.
229
What are Blowfish and Twofish?
blowfish: strong symmetric block cipher encrypting 64-bit blocks and supporting keys between 32 and 448 bits. still widely used today and actually faster than AES in some instances.
twofish: related to blowfish, but encrypts in 128 bit blocks and supports 128, 192, or 256 bit keys
230
what is asymmetric encryption?
uses two different keys, a public and a private key, to encrypt and decrypt data
231
what is a certificate?
a digital document that typically includes the public key and information on the owner of the certificate
232
what is RSA?
Rivest, Shamir, Adleman. asymmetric encryption method widely used due to its strong security. recommended key sizes of 2,048 bits through 2030, 3,072 bits for beyond 2030
233
what are the two primary categories of asymmetric keys?
static: semitransparent and stays the same over long periods of time
ephemeral: has a very short lifetime and is re-created for each session
234
what is ECC?
elliptic curve cryptography. doesn't take as much processing power as other cryptographic methods. often used with small wireless devices. formulates an elliptical curve, then graphs points on the curve to create keys
235
what is DH?
diffie-hellman. key exchange algorithm used to privately share a symmetric key between two parties. supports both static and ephemeral keys.
RSA is based on DH using static keys
DHE uses ephemeral keys with a new key each session.
ECDHE uses ephemeral keys generated using ECC
236
Which key encrypts/decrypts in email digital signatures?
senders private key encrypts, sender's public key decrypts
237
Which key encrypts/decrypts in email encryption?
recipients public key encrypts, recipients private key decrypts
238
which key encrypts/decrypts in web site encryption?
web site's public key encrypts, web site's private key decrypts, the symmetric key encrypts data in the web site session
239
what is a digital signatures?
encrypted hash of a message. sender's private key encrypts the hash of the message and the recipient decrypts the hash with the sender's public key. if successful, it provides authentication, non-repudiation, and integrity
240
what is S/MIME?
secure/multipurpose internet mail extensions. standard used to digitally sign/encrypt email. uses RSA for asymmetric encryption and AES for symmetric.
241
what is PGP/GPG?
pretty good privacy. method used to secure email communication. can encrypt, decrypt, and digitally sign email.
GPG is GNU Privacy Guard, based on OpenPGP standard
uses RSA algorithm and public/private keys for encrytion/decryption
242
what is a crypto module?
a set of hardware, software, and/or firmware that implements cryptographic functions including encryption, hashing, key gen, and authentication techniques
243
what is a crypto service provider?
a software library of cryptographic standards and algorithms. typically distributed within crypto modules
244
what is a downgrade attack?
an attack which forces a system to downgrade its security. the attacker then exploits the lesser security control. to prevent this, admins should disable weak cipher suites and weak protocols on servers
245
what is a root certificate?
the first certificate created by the CA that identifies it. if the root certificate is placed in the root CA store, all certificates issued by the CA are trusted
246
what is a CSR
certificate signing request. a request sent to CA including the purpose of the certificate, info on the web site, public key, and the requester. CA validates the request and creates the certificate. first step in CSR is to create the RSA-based private key, which is used to create the public key included in the request
247
what is CRL?
certificate revocation list. ncludes a list of revoked certificates and is publicly available.
248
what is an alternate to using the CRL?
the Online Certificate Status Protocol (OCSP) which returns answers such as good, revoked, or unknown. OCSP stapling appends a digitally signed OCSP response to a certificate.
249
what is public key pinning?
a security mechanism designed to prevent attackers from impersonating a web site using fraudulent certificates.
web server sends a list of public key hashes that clients can use to validate certificates sent to clients in subsequent sessions
250
what is key escrow?
the process of placing a copy of a private key in a safe environment.
useful for recovery. if original is lost, organization retrieves a copy of the key to access data
in some cases, a copy of the key is provided to a 3rd party
251
what is a recovery agent?
a designated individual who can recover or restore cryptographic keys
252
what is a wildcard certificate?
starts with an asterisk and can be sued for multiple domains, but each domain must have the same root domain. for example, *.google.com may be used for all google domains
253
what is a SAN?
subject alternative name. used for multiple domains that have different names but are owned by the same org.
254
what are the different certificate formats?
CER: .cer extension, ASCII format, used for ASCII certificates
DER: .der extension, binary format, used for binary certificates
PEM: .pem, .cer, .crt, .key; used for binary or ASCII formats, can be used for almost any certificate purpose, can contain server certificates, certificate chains, keys, CRL
P7B: .p7b, .p7c; used to share public key in ASCII format. never holds private key
P12/PFX: .p12, .pfx; commonly used to store private keys in binary format
255
what is a security policy?
written documents that lay out a security plan within a company
256
what is an acceptable use policy?
defines proper system usage or the rules of behaviour for employees when using IT systems
257
what is the purpose of mandatory vacation?
help detect when employees are involved in malicious activity such as fraud or embezzlement
258
what is separation of duties?
a principle that prevents any single person or entity from being able to complete all the functions of a critical or sensitive process
259
what are job rotation policies?
require employees to change roles on a regular basis to help ensure that employees cannot continue with fraudulent activity indefinitely
260
what is a clean desk policy?
directs users to keep their areas organized and free of papers in order to reduce threats of security incidents by ensuring the protection of sensitive data
261
what is an ISA?
interconnection security agreement. specifies technical and security requirements for planning, establishing, maintaining, and disconnecting a secure connection between two or more entities
262
What is an SLA?
service level agreement. agreement between a company and a vendor that stipulates performance expectations
263
What is a MOU/MOA?
memorandum of agreement/understanding. expresses an understanding between two or more parties indicating their intention to work together toward a common goal. often supports an ISA
264
what is a BPA?
business partners agreement. a written agreement that details the relationship between business partners including their obligation towards the partnership
265
what is purging?
general sanitization term indicating that all sensitive data has been removed from a device
266
what is HIPAA?
mandates that organizations protect PHI
267
What is GLBA?
Gramm-Leach Bliley Act. also known as Financial Services Modernization Act and includes a Financial Privacy Rule. requires financial institutions to provide consumers with a privacy notice explaining what information they collect and how it is used
268
What is SOX?
Sarbanes-Oxley Act. requires that executives within an organization take individual responsibility for the accuracy of financial reports
269
What is GDPR?
General Data Protection Regulation. EU directive mandating the protection of privacy data for individuals within the EU
270
what are the common phases of the IRP (incident response plan)?
- Preparation: occurs before an incident, provides guidance to personnel on how to respond
- Identification: verify that a reported incident is an actual security incident
- Containment: attempt to isolate or contain the incident through quarantine or removing the device from the network
- Eradication: remove components of the attack such as installed malware, or deleting/disabling compromised accounts
- Recover: return all affected systems to normal ops and verify they are operating normally. may include rebuilding systems from images, restoring data from backups, etc.
- Lessons learned: review the incident for possible lessons learned for future incidents
271
what is the order of volatility?
the order in which you should collect evidence. the order from most volatile to least is:
- data in cache memory including processor and HDD
- data in RAM including system and network processes
- A paging file on the system disk
- data stored on local disk drives
- logs stored on remote systems
- archive media
272
which authentication method uses x.500 based phrases to identify components?
LDAP
273
which type of firewall can also provide load balancing?
web app firewall (WAF)
274
what typically includes data loss prevention capabilities for email and is placed between an email server and the internet?
mail gateway
