Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sto-701 > Section 1 General Security Concepts > Flashcards

Section 1 General Security Concepts Flashcards

1
Q

What are security risks?

A

come in many different categories and types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the varied assets in security?

A

Assets include data, physical property, and computer systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the purpose of security controls?

A

To prevent security events, minimize the impact, and limit the damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are technical controls?

A

Controls implemented using systems, such as operating system controls, firewalls, and anti-virus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are managerial controls?

A

Administrative controls associated with security design and implementation, including security policies and standard operating procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are operational controls?

A

Controls implemented by people instead of systems, such as security guards and awareness programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are physical controls?

A

Controls that limit physical access, including guard shacks, fences, locks, and badge readers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a preventive control?

A

A control that blocks access to a resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are examples of preventive controls?

A

Firewall rules, following security policy, guard shack checks all identification, and enabling door locks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a deterrent control?

A

A control that discourages an intrusion attempt but does not directly prevent access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are examples of deterrent controls?

A

Application splash screens, threat of demotion, front reception desk, and posted warning signs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the purpose of preventive controls?

A

To block access to resources and prevent unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of deterrent controls?

A

To make an attacker think twice before attempting an intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are detective control types?

A

Detective control types identify and log an intrusion attempt but may not prevent access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What actions are involved in detecting the issue?

A

Collect and review system logs, review login reports, regularly patrol the property, and enable motion detectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are corrective control types?

A

Corrective control types apply a control after an event has been detected, reverse the impact of an event, and continue operating with minimal downtime.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What actions are involved in correcting the problem?

A

Restoring from backups can mitigate a ransomware infection, create policies for reporting security issues, contact law enforcement to manage criminal activity, and use a fire extinguisher.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are compensating control types?

A

Compensating control types use other means when existing controls aren’t sufficient and may be temporary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What actions can compensate the exploitation of a weakness?

A

A firewall blocks a specific application instead of patching the app, implement a separation of duties, require simultaneous guard duties, and use a generator after a power outage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a directive control type?

A

A directive control type directs a subject towards security compliance.

It is considered a relatively weak security control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are some examples of directive controls?

A

Examples include:
- Store all sensitive files in a protected folder
- Create compliance policies and procedures
- Train users on proper security policy
- Post a sign for ‘Authorized Personnel Only’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are security controls?

A

measures implemented to manage and mitigate risks.

They can be categorized into various types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Are the lists of security controls inclusive?

A

No, the lists of security controls are not inclusive; there are many categories of control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the main categories of security controls?

A

The main categories of security controls are Technical, Managerial, Operational, and Physical.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is an example of a technical security control?

A

An example of a technical security control is a firewall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is an example of a managerial security control?

A

An example of a managerial security control is an on-boarding policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is an example of a physical security control?

A

An example of a physical security control is a door lock.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are some types of security controls?

A

Types of security controls include Preventive, Detective, Corrective, Deterrent, and Compensating.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is an example of a detective security control?

A

An example of a detective security control is system logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is an example of a corrective security control?

A

An example of a corrective security control is backup recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is an example of a compensating security control?

A

An example of a compensating security control is blocking instead of patching.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Can security controls exist in multiple categories?

A

Yes, some security controls may exist in multiple types or categories.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How do security controls evolve?

A

New security controls are created as systems and processes evolve.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the CIA Triad?

A

A combination of principles that form the fundamentals of security.

Sometimes referenced as the AIC Triad.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What does Confidentiality in the CIA Triad refer to?

A

Preventing disclosure of information to unauthorized individuals or systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What does Integrity in the CIA Triad ensure?

A

Messages can’t be modified without detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the focus of Availability in the CIA Triad?

A

Ensuring systems and networks must be up and running.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a key aspect of Confidentiality?

A

Certain information should only be known to certain people.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is Encryption?

A

Encoding messages so only certain people can read it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are Access controls?

A

Selectively restricting access to a resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is Two-factor authentication?

A

An additional confirmation before information is disclosed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What does integrity in data refer to?

A

Data is stored and transferred as intended. Any modification to the data would be identified.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is hashing?

A

Hashing maps data of an arbitrary length to data of a fixed length.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the purpose of digital signatures?

A

Digital signatures are a mathematical scheme to verify the integrity of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

How do certificates work in data integrity?

A

Certificates combine with a digital signature to verify an individual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is non-repudiation?

A

Non-repudiation provides proof of integrity and can be asserted to be genuine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What does availability in data security mean?

A

Information is accessible to authorized users and is always at your fingertips.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is redundancy in the context of availability?

A

Redundancy involves building services that will always be available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is fault tolerance?

A

Fault tolerance means the system will continue to run, even when a failure occurs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is the purpose of patching in data security?

A

Patching ensures stability and closes security holes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What are the main objectives of data security?

A

The main objectives are integrity, availability, and confidentiality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is non-repudiation?

A

You can’t deny what you’ve said; there’s no taking it back.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

How does signing a contract relate to non-repudiation?

A

Your signature adds non-repudiation; you really did sign the contract and others can see your signature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What perspective does non-repudiation add for cryptography?

A

It provides proof of integrity and proof of origin, with high assurance of authenticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is proof of integrity?

A

It verifies that data does not change; the data remains accurate and consistent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

How is data represented in cryptography for integrity?

A

We use a hash, which represents data as a short string of text, known as a message digest or fingerprint.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What happens if the data changes?

A

If the data changes, the hash changes; if the person changes, you get a different fingerprint.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Does hashing associate data with an individual?

A

No, it only tells you if the data has changed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What happens when one character is changed in a file?

A

The hash changes

If the hash is different, something has changed, indicating data integrity has been compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What does integrity prove in a message?

A

It proves the message was not changed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What does authentication prove in a message?

A

It proves the source of the message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What does non-repudiation ensure?

A

It ensures that the signature isn’t fake.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

How is a message signed?

A

Sign with the private key

The message doesn’t need to be encrypted, and nobody else can sign this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

How is a signature verified?

A

Verify with the public key

Any change to the message will invalidate the signature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is the first step of the AAA framework?

A

Identification: This is who you claim to be, usually your username.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What is the second step of the AAA framework?

A

Authentication: Prove you are who you say you are, using a password and other authentication factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is the third step of the AAA framework?

A

Authorization: Based on your identification and authentication, what access do you have?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is the fourth step of the AAA framework?

A

Accounting: Resources used include login time, data sent and received, and logout time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Why is authenticating systems challenging?

A

You have to manage many devices, often devices that you’ll never physically see.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Why can’t a system type a password?

A

A system can’t type a password, and you may not want to store one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

How can you truly authenticate a device?

A

Put a digitally signed certificate on the device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What business processes rely on the certificate?

A

Access to the VPN from authorized devices and management software can validate the end device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What is a trusted Certificate Authority (CA)?

A

An organization has a trusted Certificate Authority (CA). Most organizations maintain their own CAs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

How is a certificate created for a device?

A

The organization creates a certificate for a device and digitally signs the certificate with the organization’s CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

How is a certificate used as an authentication factor?

A

The CA’s digital signature is used to validate the certificate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What happens after a user or device has authenticated?

A

They need to know what they have access to.

This is the time to apply an authorization model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What does associating individual users directly to access rights not do?

A

It does not scale.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What should be placed in the middle of user access?

A

An authorization model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What can an authorization model be defined by?

A

Roles, Organizations, Attributes, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What is a simple relationship in authorization?

A

User -> Resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What are some issues with the simple relationship method?

A

It is difficult to understand why an authorization may exist and does not scale.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What is the purpose of using an authorization model?

A

To add an abstraction, reduce complexity, and create a clear relationship between the user and the resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

How does an authorization model streamline administration?

A

It makes authorizations easy to understand and supports any number of users or resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What is Gap Analysis?

A

It is the comparison of where you are with where you want to be, identifying the ‘gap’ between the two.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What may be required when collecting information in a Gap Analysis?

A

Extensive research may be required, considering various factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

How long can Gap Analysis take?

A

It can take weeks or months, involving an extensive study with numerous participants.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What should you prepare for during Gap Analysis?

A

Be ready for emails, data gathering, and technical research.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What is important when choosing a framework?

A

Work towards a known baseline, which may be an internal set of goals or formal standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What regulations should be determined as part of the framework?

A

The end goal, such as NIST Special Publication 800-171 Revision 2 or ISO/IEC 27001.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What does NIST Special Publication 800-171 Revision 2 focus on?

A

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What does ISO/IEC 27001 pertain to?

A

Information security management systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What is the first step in evaluating people and processes?

A

Get a baseline of employees, including formal experience, current training, and knowledge of security policies and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What should be examined in current processes?

A

Research existing IT systems and evaluate existing security policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

What is the purpose of comparison in security analysis?

A

To evaluate existing systems and identify weaknesses along with the most effective processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What does a detailed analysis in security involve?

A

Examining broad security categories and breaking those into smaller segments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What does the final comparison in an analysis and report include?

A

Detailed baseline objectives and a clear view of the current state.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

What is necessary to transition from the current security state to the goal?

A

A path that will almost certainly include time, money, and lots of change control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What is created during the gap analysis report?

A

A formal description of the current state and recommendations for meeting the baseline.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What is Zero Trust?

A

Zero trust is a holistic approach to network security that covers every device, every process, and every person.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What is a key principle of Zero Trust?

A

Everything must be verified; nothing is inherently trusted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What are some methods used in Zero Trust?

A

Multi-factor authentication, encryption, system permissions, additional firewalls, monitoring, and analytics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What does splitting the network into functional planes involve?

A

It applies to both physical, virtual, and cloud components.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What is the data plane?

A

The data plane processes the frames, packets, and network data, including processing, forwarding, trunking, encrypting, and NAT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What is the control plane?

A

Manages the actions of the data plane, defines policies and rules, and determines how packets should be forwarded.

Includes routing tables, session tables, and NAT tables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What is adaptive identity?

A

Considers the source and the requested resources, utilizing multiple risk indicators such as relationship to the organization, physical location, type of connection, and IP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

What are subjects and systems in policy enforcement?

A

Includes end users, applications, and non-human entities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What is a policy enforcement point (PEP)?

A

Acts as the gatekeeper to allow, monitor, and terminate connections.

Can consist of multiple components working together.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

What is the Policy Decision Point?

A

There’s a process for making an authentication decision.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

What does the Policy Engine do?

A

Evaluates each access decision based on policy and other information sources. It can grant, deny, or revoke access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

What is the role of the Policy Administrator?

A

Communicates with the Policy Enforcement Point, generates access tokens or credentials, and instructs the PEP to allow or disallow access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

How can the Policy Administrator enhance security?

A

By making the authentication stronger, if needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What is threat scope reduction?

A

Decrease the number of possible entry points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

What is policy-driven access control?

A

Combine the adaptive identity with a predefined set of rules.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

What is the nature of security relationships?

A

Security is more than a one-to-one relationship. Broad categorizations provide a security-related foundation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

What are the key categories for security zones?

A

Trusted, untrusted, internal network, external network, VPN 1, VPN 5, VPN 11, Marketing, IT, Accounting, Human Resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

What can using security zones achieve?

A

Using the zones may be enough by itself to deny access.

For example, Untrusted to Trusted zone traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

What is an example of an implicitly trusted zone?

A

Some zones are implicitly trusted.

For example, Trusted to Internal zone traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

What is the primary function of barricades and bollards?

A

Prevent access, channel people through a specific access point, and identify safety concerns.

119
Q

How do barricades and bollards manage access?

A

They allow people while preventing cars and trucks.

120
Q

What extreme measures can barricades take?

A

Concrete barriers, bollards, and moats.

121
Q

What is an access control vestibule?

A

A system where opening one door causes others to lock.

122
Q

What happens when all doors are normally locked in an access control vestibule?

A

Unlocking one door prevents others from being unlocked.

123
Q

What is the function of having one door open and the other locked?

A

When one door is open, the other cannot be unlocked.

124
Q

What is meant by ‘one at a time, controlled groups’ in access control?

A

Managed control through an area.

125
Q

What is the purpose of fencing?

A

To build a perimeter, which is usually very obvious.

126
Q

What are the characteristics of fencing?

A

Fencing can be transparent or opaque, robust, and designed to prevent climbing.

127
Q

What is the role of video surveillance?

A

CCTV can replace physical guards.

128
Q

What are important features of surveillance cameras?

A

Motion recognition can alarm and alert, while object detection can identify a license plate or face.

129
Q

How are surveillance cameras typically organized?

A

Often many different cameras are networked together and recorded over time.

130
Q

What is the role of a security guard?

A

Provides physical protection at the reception area of a facility and validates identification of existing employees.

131
Q

What is two-person integrity/control?

A

Minimizes exposure to an attack by ensuring no single person has access to a physical asset.

132
Q

What details are included on an access badge?

A

Includes a picture, name, and other details. Must be worn at all times and is electronically logged.

133
Q

How does lighting contribute to security?

A

More light means more security as attackers avoid the light, making it easier to see when lit.

134
Q

What is the importance of lighting design?

A

Consider overall light levels and angles, which are important for facial recognition and to avoid shadows and glare.

135
Q

What does an infrared sensor detect?

A

Detects infrared radiation in both light and dark, commonly used in motion detectors.

136
Q

What does a pressure sensor detect?

A

Detects a change in force, used in floor and window sensors.

137
Q

What is the function of a microwave sensor?

A

Detects movement across large areas.

138
Q

How does an ultrasonic sensor work?

A

Sends ultrasonic signals and receives reflected sound waves to detect motion and collisions.

139
Q

What is the purpose of honeypots?

A

Honeypots attract the bad guys and trap them there.

140
Q

Who is typically the attacker in honeypots?

A

The ‘attacker’ is probably a machine, which makes for interesting reconnaissance.

141
Q

What do honeypots create?

A

Honeypots create a virtual world to explore.

142
Q

What are the options for honeypots?

A

There are many different options, most of which are open source and available to download.

143
Q

What is the challenge associated with honeypots?

A

There is a constant battle to discern the real from the fake.

144
Q

What is a honeynet?

A

A honeynet is a real network that includes more than a single device, such as servers, workstations, routers, switches, and firewalls.

145
Q

What does a honeynet do?

A

A honeynet builds a larger deception network with one or more honeypots.

146
Q

What is the benefit of a honeynet?

A

A honeynet provides more than one source of information.

147
Q

What are honeyfiles?

A

Honeyfiles attract attackers with more honey by creating files with fake information.

148
Q

What characteristics do honeyfiles have?

A

Honeyfiles contain something bright and shiny.

149
Q

What are honeyfiles?

A

Bait for the honeynet (e.g., passwords.txt)

Add many honeyfiles to file shares.

150
Q

What happens when a honeyfile is accessed?

A

An alert is sent if the file is accessed

It acts as a virtual bear trap.

151
Q

What are honeytokens?

A

Data used to track malicious actors

Add some traceable data to the honeynet.

152
Q

What happens if honeytoken data is stolen?

A

You’ll know where it came from.

153
Q

What are API credentials in the context of honeytokens?

A

They do not actually provide access

Notifications are sent when used.

154
Q

How can fake email addresses be used as honeytokens?

A

Add it to a contact list

Monitor the Internet to see who posts it.

155
Q

What are some other examples of honeytokens?

A

Database records, browser cookies, web page pixels.

156
Q

What is change management?

A

The process of making changes such as upgrading software, patching applications, changing firewall configurations, or modifying switch ports.

157
Q

What is one of the most common risks in the enterprise?

A

Change management risks occur very frequently and are often overlooked or ignored.

Did you feel that bite?

158
Q

What should be established for effective change management?

A

Clear policies regarding frequency, duration, installation process, and rollback procedures.

159
Q

What makes change management sometimes extremely difficult?

A

It can be hard to change corporate culture.

160
Q

What is the change approval process?

A

A formal process for managing change to avoid downtime, confusion, and mistakes.

161
Q

What are the steps in a typical change approval process?

A
  1. Complete the request forms
  2. Determine the purpose of the change
  3. Identify the scope of the change
  4. Schedule a date and time of the change
  5. Determine affected systems and the impact
  6. Analyze the risk associated with the change
  7. Get approval from the change control board
  8. Get end-user acceptance after the change is complete.
162
Q

What is ownership in the context of process change?

A

An individual or entity needs to make a change and they own the process. They don’t (usually) perform the actual change.

163
Q

What does the owner of a process do?

A

The owner manages the process, receives updates, and ensures the process is followed and acceptable.

164
Q

Who owns the process for upgrading address label printers?

A

The Shipping and Receiving department owns the process, while IT handles the actual change.

165
Q

Who are stakeholders in a change management process?

A

Stakeholders are those who are impacted by the change and will want to have input on the change management process.

166
Q

Can a single change impact multiple stakeholders?

A

Yes, a single change can include one individual or the entire company.

167
Q

What are some examples of stakeholders affected by upgrading software for shipping labels?

A

Shipping/receiving, accounting reports, product delivery timeframes, and revenue recognition (CEO visibility).

168
Q

What is impact analysis?

A

Impact analysis involves determining a risk value, categorized as high, medium, or low.

169
Q

What types of risks can be identified?

A

Risks can be minor or far-reaching, including issues where the ‘fix’ doesn’t actually resolve the problem or breaks something else.

170
Q

What are some examples of risks?

A

Examples include operating system failures and data corruption.

171
Q

What is the risk of NOT making a change?

A

Not making a change can lead to security vulnerabilities, application unavailability, and unexpected downtime to other services.

172
Q

What is a sandbox testing environment?

A

A sandbox testing environment has no connection to the real world or production system, serving as a technological safe space.

173
Q

When should a sandbox be used?

A

A sandbox should be used before making a change to production, such as trying an upgrade or applying a patch.

174
Q

What should be confirmed before deploying a system change?

A

It is important to confirm the backout plan to move everything back to the original state.

175
Q

What is a limitation of a sandbox?

A

A sandbox can’t consider every possibility.

176
Q

What is a backout plan?

A

A backout plan is a strategy to revert changes if they do not work as intended.

Prepare for the worst, hope for the best.

177
Q

Why should you always have a way to revert changes?

A

You should always have a way to revert your changes to mitigate potential issues.

178
Q

Is reverting changes always easy?

A

No, some changes are difficult to revert.

179
Q

What is essential to have when implementing changes?

A

Always have backups to ensure data safety.

180
Q

What is a maintenance window?

A

A maintenance window is the scheduled time for implementing changes.

181
Q

When might changes be scheduled?

A

Changes might be scheduled during off-peak hours to minimize disruption.

182
Q

Why might the workday not be the best option for changes?

A

Potential downtime during the workday could affect a large part of production.

183
Q

What is often a better choice for scheduling changes?

A

Overnight changes are often a better choice.

184
Q

What is a challenge with overnight changes?

A

Overnight changes can be challenging for 24-hour production schedules.

185
Q

What seasonal consideration should be taken into account?

A

The time of year may be a consideration, as retail networks are frozen during the holiday season.

186
Q

Why is change management critical?

A

Change management is critical because it affects everyone in the organization.

187
Q

What must the change management process be?

A

The process must be well documented and available on the Intranet.

188
Q

What should be included with the change management documentation?

A

All standard processes and procedures should be included.

189
Q

How are changes to the process reflected?

A

Changes to the process are reflected in the standards, making it a living document.

190
Q

What is the first step in technical change management?

A

Put the change management process into action.

191
Q

What does executing the plan in change management entail?

A

It involves implementing the planned changes.

192
Q

Is there such a thing as a simple upgrade?

A

No, there are often many moving parts involved.

193
Q

What may be required during a technical change?

A

Separate events may be required.

194
Q

What is change management primarily concerned with?

A

‘what’ needs to change.

195
Q

What is the technical team’s focus in change management?

A

‘how’ to change it.

196
Q

What can any application potentially be?

A

Any application can be dangerous due to vulnerabilities, trojan horses, and malware.

197
Q

How can security policy control application execution?

A

Through an allow list or deny/block list.

198
Q

What is an allow list?

A

An allow list means nothing runs unless it’s approved, making it very restrictive.

199
Q

What is a deny list?

A

A deny list means nothing on the ‘bad list’ can be executed, often used in anti-virus and anti-malware.

200
Q

Why is the scope of a change important?

A

It defines exactly which components are covered.

201
Q

Does a change approval allow for any change?

A

No, a change approval isn’t permission to make any change; it is very specific.

202
Q

What may happen to the scope during the change window?

A

The scope may need to be expanded, as it’s impossible to prepare for all possible outcomes.

203
Q

What determines the next steps in the change management process?

A

The change management process itself determines the next steps.

204
Q

What is in place to ensure a successful change?

A

There are processes in place to make the change successful.

205
Q

What is downtime?

A

Downtime refers to the period when services are unavailable.

Services will eventually be unavailable due to the change process, which can be disruptive and is usually scheduled during non-production hours.

206
Q

How can downtime be prevented?

A

Downtime can be prevented by switching to a secondary system, upgrading the primary, and then switching back.

If possible, this method helps to maintain service availability.

207
Q

What are strategies to minimize downtime events?

A

Minimizing downtime events involves automating the process, switching back to the secondary system if issues arise, and including this in the backout plan.

The process should be as automated as possible.

208
Q

What communication should be done before downtime?

A

Emails and calendar updates should be sent to inform relevant parties about downtime.

This ensures that everyone is aware of the service interruptions.

209
Q

What is a common requirement during system changes?

A

It is common to require a restart to implement the new configuration.

This may involve rebooting the OS, power cycling the switch, or bouncing the service.

210
Q

Can the system recover from a power outage?

A

It is important to assess whether the system can recover from a power outage.

This consideration is crucial for maintaining service continuity.

211
Q

What can you do with services failure?

A

You can stop and restart the service or daemon. It may take seconds or minutes.

212
Q

What actions can be performed on applications?

A

You can close the application completely or launch a new application instance.

213
Q

What are legacy applications?

A

Legacy applications were present before you arrived and will remain after you leave.

214
Q

What is a common issue with legacy applications?

A

They are often no longer supported by the developer, making you the support team.

215
Q

What should you do when facing fear of the unknown with legacy systems?

A

Face your fears and document the system; it may not be as bad as you think.

216
Q

What is a characteristic of legacy applications?

A

They may be quirky, so it’s important to create specific processes and procedures.

217
Q

What should you aim to become regarding legacy applications?

A

Become the expert on the legacy applications.

218
Q

What are dependencies in the context of services and applications?

A

To complete A, you must complete B; for example, a service will not start without other active services.

219
Q

What is a potential challenge when modifying components?

A

Modifying one component may require changing or restarting other components.

220
Q

How can dependencies occur across systems?

A

For example, you may need to upgrade the firewall code first, then upgrade the firewall management software.

221
Q

What should be upgraded in network management?

A

Upgrade the firewall management software.

222
Q

What is a challenge in maintaining documentation?

A

It can be challenging to keep up with changes.

223
Q

How quickly can documentation become outdated?

A

Documentation can become outdated very quickly.

224
Q

What is required with the change management process?

A

Updating diagrams, modifications to network configurations, and address updates.

225
Q

What may be required when adding new systems?

A

New procedures may be required.

226
Q

What is version control?

A

Track changes to a file or configuration data over time.

227
Q

What is a benefit of version control?

A

Easily revert to a previous setting.

228
Q

What are some ways to see previous versions?

A

Router configurations, Windows OS patches, and application registry entries.

229
Q

Is version control always straightforward?

A

Not always straightforward.

230
Q

What do some devices and operating systems provide?

A

Version control features.

231
Q

What may be required for version control management?

A

Additional management software.

232
Q

What is Public Key Infrastructure (PKI)?

A

Policies, procedures, hardware, software, people involved in creating, distributing, managing, storing, and revoking digital certificates.

PKI also refers to the binding of public keys to people or devices, emphasizing trust.

233
Q

What are digital certificates used for?

A

To create, distribute, manage, store, and revoke keys.

Digital certificates are essential in establishing trust within PKI.

234
Q

What is a characteristic of symmetric encryption?

A

It uses a single, shared key for both encryption and decryption.

If the key is compromised, a new key is needed.

235
Q

What is a secret key algorithm?

A

A method that relies on a shared secret key for encryption.

This method does not scale well and can be challenging to distribute.

236
Q

What are the advantages of symmetric encryption?

A

It is very fast to use and has less overhead than asymmetric encryption.

Symmetric encryption is often combined with asymmetric encryption.

237
Q

What defines asymmetric encryption?

A

It involves public key cryptography with two or more mathematically related keys.

This includes a private key, which must be kept private, and a public key, which can be shared.

238
Q

What is the role of the private key in asymmetric encryption?

A

The private key must be kept confidential and secure.

It is essential for decrypting information that was encrypted with the corresponding public key.

239
Q

What is the role of the public key in asymmetric encryption?

A

The public key can be shared with anyone and is used for encrypting data.

It allows secure communication without needing to share a secret key.

240
Q

What is the role of the private key in asymmetric encryption?

A

The private key is the only key that can decrypt data encrypted with the public key.

241
Q

Can you derive the private key from the public key?

A

No, you can’t derive the private key from the public key.

242
Q

What is asymmetric encryption also known as?

A

Public Key Cryptography.

243
Q

What is involved in key generation for asymmetric encryption?

A

Build both the public and private key at the same time with lots of randomization, large prime numbers, and lots of math.

244
Q

Who can have the public key?

A

Everyone can have the public key, but only Alice has the private key.

245
Q

What is key escrow?

A

Someone else holds your decryption keys, meaning your private keys are in the hands of a 3rd-party.

246
Q

Can key escrow be a legitimate business arrangement?

A

Yes, a business might need access to employee information, and government agencies may need to decrypt partner data.

247
Q

Is key escrow controversial?

A

Yes, it is controversial, but may still be required.

248
Q

What is essential for managing encryption keys?

A

Need clear process and procedures as keys are incredibly important pieces of information.

249
Q

What must you be able to do with your 3rd-party in key escrow?

A

You must be able to trust your 3rd-party since access to the keys is at their control.

250
Q

Under what conditions should key access be controlled?

A

Access should be under carefully controlled conditions, such as legal proceedings and court orders.

251
Q

What is the purpose of encrypting stored data?

A

To protect data on storage devices such as SSDs, hard drives, USB drives, and cloud storage. This is known as data at rest.

252
Q

What are the methods for encrypting stored data?

A

Full-disk and partition/volume encryption using tools like BitLocker and FileVault.

253
Q

What is file encryption?

A

Encrypting individual files using EFS (Encrypting File System) or third-party utilities.

254
Q

What is database encryption?

A

Protecting stored data and the transmission of that data.

255
Q

What is transparent encryption in databases?

A

Encrypting all database information with a symmetric key.

256
Q

What is record-level encryption?

A

Encrypting individual columns in a database and using separate symmetric keys for each column.

257
Q

What is transport encryption?

A

Protecting data traversing the network.

258
Q

How is data encrypted in applications?

A

Browsers can communicate using HTTPS.

259
Q

What is a VPN?

A

A Virtual Private Network that encrypts all data transmitted over the network, regardless of the application.

260
Q

What are the types of VPN?

A

Client-based VPN using SSL/TLS and site-to-site VPN using IPsec.

261
Q

What are encryption algorithms?

A

There are many different ways to encrypt data.

262
Q

What must be used during encryption and decryption?

A

The proper ‘formula’ must be used.

263
Q

Who decides on the algorithm before encrypting the data?

A

Both sides decide on the algorithm.

264
Q

Are the details of the encryption algorithm visible to the end user?

A

The details are often hidden from the end user.

265
Q

What are some factors to consider when choosing an encryption algorithm?

A

There are advantages and disadvantages between algorithms, such as security level, speed, and complexity of implementation.

266
Q

What is known about the cryptographic process?

A

There’s very little that isn’t known about the cryptographic process. The algorithm is usually a known entity. The only thing you don’t know is the key.

267
Q

What does the key determine in cryptography?

A

The key determines the output, which includes encrypted data, hash value, and digital signature.

268
Q

Why is it important to keep your key private?

A

It’s the only thing protecting your data.

269
Q

How does key length relate to security?

A

Larger keys tend to be more secure and prevent brute-force attacks.

270
Q

What are common key lengths for symmetric encryption?

A

128-bit or larger symmetric keys are common.

271
Q

What are common key lengths for asymmetric encryption?

A

Common to see key lengths of 3,072 bits or larger.

272
Q

What is key stretching?

A

Key stretching involves making a weak key stronger by performing multiple processes, such as hashing a password multiple times.

273
Q

How do brute force attacks relate to key stretching?

A

Brute force attacks would require reversing each of those hashes, making it much more time-consuming for the attacker.

274
Q

What is a key exchange?

A

A logistical challenge of sharing an encryption key across an insecure medium without physically transferring the key.

275
Q

What is out-of-band key exchange?

A

A method where the symmetric key is not sent over the internet, but shared through telephone, courier, in-person, etc.

276
Q

What is in-band key exchange?

A

A method where the key is shared over the network, protected with additional encryption, and uses asymmetric encryption to deliver a symmetric key.

277
Q

What is the need for real-time encryption/decryption?

A

There is a need for fast security without compromising the security part.

278
Q

How is a symmetric session key shared using asymmetric encryption?

A

The client encrypts a random symmetric key with the server’s public key, and the server decrypts this shared key to encrypt data.

279
Q

What are session keys?

A

Keys that need to be changed often (ephemeral keys) and must be unpredictable.

280
Q

How can a symmetric key be created from asymmetric keys?

A

By using public and private key cryptography to create a symmetric key.

The math is powerful.

281
Q

What is a Trusted Platform Module (TPM)?

A

A specification for cryptographic functions.

282
Q

What are the key components of a Trusted Platform Module (TPM)?

A

Cryptography hardware on a device, cryptographic processor, random number generator, and key generators.

283
Q

What type of memory does a Trusted Platform Module (TPM) use?

A

Persistent memory with unique keys burned in during manufacturing.

284
Q

What is versatile memory in a Trusted Platform Module (TPM)?

A

It stores keys and hardware configuration information, including securely storing BitLocker keys.

285
Q

How does a Trusted Platform Module (TPM) protect passwords?

A

It is password protected and prevents dictionary attacks.

286
Q

What is a Hardware Security Module (HSM)?

A

Used in large environments to securely store thousands of cryptographic keys.

287
Q

What are the features of a Hardware Security Module (HSM)?

A

High-end cryptographic hardware, key backup, and cryptographic accelerators.

288
Q

What is a key management system?

A

A system that manages various keys from a centralized manager.

289
Q

Where can key management services be found?

A

On-premises and cloud-based.

290
Q

What are the functions of a key management system?

A

Create keys for specific services, associate keys with users, rotate keys, and log key use.

291
Q

Why is keeping data private challenging?

A

Data is located in many places, constantly changing, and attackers are always finding new techniques.

292
Q

What is a secure enclave?

A

A protected area for secrets, often implemented as a hardware processor isolated from the main processor.

293
Q

What security features does a secure enclave provide?

A

Extensive security features including its own boot ROM, system boot monitoring, true random number generator, real-time memory encryption, and root cryptographic keys.

Sto-701 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions