Seccion 1 Flashcards
What is the main goal of Information Security?
Protecting data and information from unauthorized access, modification, disruption, disclosure, and destruction
Define Information Systems Security.
Protecting the systems (e.g., computers, servers, network devices) that hold and process critical data
What does the CIA Triad stand for?
- Confidentiality
- Integrity
- Availability
What is Confidentiality in the context of the CIA Triad?
Ensures information is accessible only to authorized personnel (e.g., encryption)
What does Integrity ensure?
Ensures data remains accurate and unaltered (e.g., checksums)
What is the purpose of Availability?
Ensures information and resources are accessible when needed (e.g., redundancy measures)
Define Non-Repudiation.
Guarantees that an action or event cannot be denied by the involved parties (e.g., digital signatures)
What is the CIANA Pentagon?
An extension of the CIA triad with the addition of non-repudiation and authentication
List the Triple A’s of Security.
- Authentication
- Authorization
- Accounting
What is the difference between Authentication and Authorization?
Authentication verifies the identity of a user or system; Authorization determines actions or resources an authenticated user can access
Identify the categories of Security Controls.
- Technical
- Managerial
- Operational
- Physical
What are the types of Security Controls?
- Preventative
- Deterrent
- Detective
- Corrective
- Compensating
- Directive
What is the Zero Trust Model?
Operates on the principle that no one should be trusted by default
What does the Control Plane in the Zero Trust Model include?
- Adaptive identity
- Threat scope reduction
- Policy-driven access control
- Secured zones
Define Threat in the context of cybersecurity.
Anything that could cause harm, loss, damage, or compromise to our information technology systems
What is a Vulnerability?
Any weakness in the system design or implementation
Where do threats and vulnerabilities intersect?
That is where the risk to your enterprise systems and networks lies
What is Risk Management?
Finding different ways to minimize the likelihood of an outcome and achieve the desired outcome
What are the five basic methods to ensure Confidentiality?
- Encryption
- Access Controls
- Data Masking
- Physical Security Measures
- Training and Awareness
What does Integrity ensure?
Helps ensure that information and data remain accurate and unchanged from its original state unless intentionally modified by an authorized individual
List the methods used to maintain Integrity.
- Hashing
- Digital Signatures
- Checksums
- Access Controls
- Regular Audits
What is the importance of Availability in cybersecurity?
Ensures that information, systems, and resources are accessible and operational when needed by authorized users
Define Redundancy in the context of Availability.
Duplication of critical components or functions of a system with the intention of enhancing its reliability
What are the types of Redundancy to consider in system design?
- Server Redundancy
- Data Redundancy
- Network Redundancy
- Power Redundancy
What is the role of Digital Signatures in Non-repudiation?
Provide undeniable proof in the world of digital transactions
What are the five commonly used authentication methods?
- Something you know (Knowledge Factor)
- Something you have (Possession Factor)
- Something you are (Inherence Factor)
- Something you do (Action Factor)
- Somewhere you are (Location Factor)
What is Multi-Factor Authentication (MFA)?
Security process that requires users to provide multiple methods of identification to verify their identity
What is the purpose of Accounting in security?
Ensures all user activities during a communication or transaction are properly tracked and recorded
List the types of technologies used for Accounting.
- Syslog Servers
- Network Analysis Tools
- Security Information and Event Management (SIEM) Systems
What are the four broad categories of Security Controls?
- Technical Controls
- Managerial Controls
- Operational Controls
- Physical Controls
What are the six basic types of Security Controls?
- Preventive Controls
- Deterrent Controls
- Detective Controls
- Corrective Controls
- Compensating Controls
- Directive Controls
What is Gap Analysis?
Process of evaluating the differences between an organization’s current performance and its desired performance
What are the two basic types of Gap Analysis?
- Technical Gap Analysis
- Business Gap Analysis
What does the Plan of Action and Milestones (POA&M) outline?
Specific measures to address each vulnerability, allocate resources, and set up timelines for each remediation task
What does the Control Plane encompass in Zero Trust architecture?
- Adaptive Identity
- Threat Scope Reduction
- Policy-Driven Access Control
- Secured Zones
What is the role of the Policy Engine in the Control Plane?
Cross-references the access request with its predefined policies
Define the Data Plane in Zero Trust architecture.
Consists of the subject/system and policy enforcement point where access decisions are executed
