Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia Security+ Personal > Section 1: Overview of Security > Flashcards

Section 1: Overview of Security Flashcards

1
Q

CIA Triad

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Confidentiality

A

Information has not been disclosed to unauthorised people

Information is only disclosed to authorised people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Integrity

A

Information has not been modified or altered without proper authorisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is availability

A

Information is able to be stored, accessed, or protected at all times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the AAA of Security

A

Authentication, Authorisation, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Authentication in AAA

A

Something you
- have
- are
- know
- do
- somewhere you are.

Think HAKDA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Authorisation in AAA

A

When a user is given access to a certain piece of data or certain areas of a building

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Accounting in AAA

A

Tracking of data, computer usage, and network resources.

In case of data breach or an insider threat, you can go back and look at all the data in the log files to figure out who did what and when.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Non-repudiation

A

When you have proof that someone did something.

Sending an email to someone is signed with a digital signature, you are the only person in the world with that signature. That’s proof that you indeed sent that email.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Information Systems Security

A

The security of the systems that hold and process critical data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Information Security

A

Act of protecting data and information from unauthorised access, unlawful modification and disruption, disclosure, corruption, and destruction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Malware

A

Short-hand term for malicious software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When does Unauthorised Access occur?

A

Occurs when access to computer resources and data happens without the consent of the owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

System Failure

A

When a computer crashes or an individual application fails (Blue Screen of Death / BSOD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Social Engineering

A

Act of manipulating users into revealing confidential information or performing other detrimental actions (could be through email phishing or pretending to be someone you are not (i.e delivery person to gain access to premises)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the 3 controlls of Mitigating Threats?

A
  1. Physical Controls
  2. Technical Controls
  3. Administrative (or Managerial) Controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are Physical Controls?

A

Alarm systems, locks, surveillance cameras, identification cards, and security guards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are Technical Controls?

A

Smart cards, encryption, access control lists (ACL’s) intrusion detection systems, and network authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are Administrative Controls?

A

Policies, procedures, security awareness training, contingency planning, and disaster recovery plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Most cost effective security control?

A

User Training!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the 5 types of Hackers?

A
  1. White Hats
  2. Gray Hats
  3. Black Hats
  4. Blue Hats
  5. Elite Hats
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

White Hats

A

Non-malicious hackers who attempt to break into a company’s system at their request

  • Ethical Hackers / Pen testers
  • They use open source tools
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Gray Hats

A

Hackers without any affiliation to a company. They attempt to break into a company’s network and risk breaking the law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Difference between Black & Gray hats?

A

Black hats:
- have malicious intent

Grey hats:
- Just want to see if they can break into a company, don’t necessarily want to cause harm (still breaking the law)

  • They some times break into a company and then inform them that “hey, this is how we did it, you need to patch it”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Black Hats

A

Malicious hackers who break into a computer systems and networks without authorisation or permission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Blue Hats

A

Hackers who attempt to hack into a network with permission of the company but are not employed by the company.

  • Freelance ethical hackers / pen testers
  • Could be doing this as part of bug bounty program (hackerone)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Elite Hats

A

Hackers who find and exploit vulnerabilities before anyone else does.

  • create their own tools
  • do their own programming
  • develop tools that everyone else ends up using
  • Can have 2 categories:
    - Black Hat Elite Hackers
    - White Hat Elite Hackers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Script Kiddies

A

Limited skill and only run other peoples exploits and tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Organised Crime

A

Hackers who are part of a crime group that is well-funded and highly sophisticated

  • well funded
  • highly sophisticated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Hacktivists

A

Hackers who are driven by a cause like social change, political agendas, terrorism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Advanced Persistent Threats (APT)

A

Highly trained and funded groups of hackers (often by nation states) with covert and open-source intelligence at their disposal

  • Russia trying to hack US elections
  • China trying to hack into US companies to steal their intellectual properties
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Skill Level rankings

A

High to Low

  1. APTs
  2. Organised Crime
  3. Hactivists
  4. Script Kiddies
33
Q

Always consider the sources of your intelligence!
What are some factors to weigh the value of the intelligence you are getting?

A
  1. Timeliness
  2. Relevancy
  3. Accuracy
  4. Confidence Level
34
Q

Intelligence Timeliness

A

Property of an intelligence source that ensures it is up-to-date

  • intelligence over time is not very valuable (newer the better)
  • if I know that your network is being attacked now, but wait 3 years to tell you, it is not useful
  • once an adversary understands that they have been identified, they will change tactics and the way they do things. So the report you write today, might not be valid for tomorrow, 2 weeks, 3 months, or a year from now. Things change!
35
Q

Intelligence Relevancy

A

Property of an intelligence source that ensures it matches the use cases intended for it

  • if I am using windows or Linux but someone is attacking mac OS machines, is it really relevant to me?
  • have to see what affects me or my organisation so I can defend against it
36
Q

Intelligence Accuracy

A

Property of an intelligence source that ensures it produces effective results

  • information must be valid and true
  • eliminate false positives especially when using Automated Software/Machine Learning/ Artificial Intelligence
37
Q

Intelligence Confidence Levels

A

Property of an intelligence source that ensures it produces qualified statements about reliability

  • you put a grade on how good you think the information is
38
Q

Three places you can get information from

A
  1. Proprietary
  2. Closed-Source
  3. Open-Source
39
Q

Proprietary Information

A

Threat intelligence is widely provided as a commercial service offering, where access to updates and research is subject to subscription fee

  • Not nearly as useful. Most of these package readily available information from the internet without adding their own information in them
40
Q

Closed-Source Information

A

Data that is derived from the provider’s own research and analysis efforts, such as data from honeynets that they operate, plus information mined from its customers’ systems, suitably anonymised

  • FIREYE
41
Q

Open-Source Information (OSINT)

A

Data available to use without subscription, which may include threat feeds similar to the commercial providers, and may contain reputation lists and malware signature databases

  • US-CERT
  • UK’s NCSC
  • AT&T Security (OTX)
  • MISP (Malware Information Sharing Project)
  • VirutsTotal (checks for viruses on uploaded files and is a repo for malware)
  • Spamhaus (spam & email)
  • SANS ISC Suspicious Domains
42
Q

Threat Feeds

A

Are a form of explicit knowledge, but implicit knowledge from experience practitioners is also useful

43
Q

Explicit knowledge

A

Is knowledge you can

  • write down
  • feel
  • see
  • touch
44
Q

Implicit knowledge

A

Is knowledge you

  • only get from experience in the field
  • ‘ah I know something is wrong here because of my experience’
  • Cant write down this knowledge, its just something you know because of your experience
45
Q

Open-Source Intelligence (OSINT)

A

Methods of obtaining information about a person or organisation through public records, websites, and social media

46
Q

What is Threat Hunting

A

A Cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring

  • a pro active response
47
Q

Is Threat hunting potentially less disruptive than penetration testing?

A

Yes. You analyse data within the system you have instead of trying to break in

48
Q

First step of Threat Hunting?

A

Establish a Hypothesis

  • It is derived from the threat modelling and is based on potential events with higher likelihood and higher impact
49
Q

Second step of Threat Hunting?

A

Profiling Threat Actors and Activities

  • Create scenarios that show how a prospective attacker might attempt an intrusion and what their objectives might be
  • understand who is trying to attack you
  • what systems they might be going after
50
Q

What does Threat Hunting rely on?

A

On the use of tools developed for regular security monitoring and incident response

51
Q

What should you assume when Threat Hunting?

A

That the existing rules you have in place for protection have most likely failed

52
Q

What are the steps you need to take for the following scenario:

You have threat intelligence that there is this new Windows malware that is infecting your Windows computers and there are no current malware definitions for it.

A
  1. Analyse network traffic
  2. Analyse the executable process lists on the host you are analysing
  3. Identify how the malicious process was executed
53
Q

What are the 5 benefits of Threat Hunting?

A
  1. Improve detection capabilities
  2. Integrate Intelligence
  3. Reduce attack surface
  4. Block attack vectors
  5. Identify critical assets
54
Q

What does the benefit of Threat Hunting, “Improve detection capabilities” include?

A

Once you find out how someone infiltrated and bypassed detection. Feed it back to the detection plan, rewrite rule sets, detection algorithms, and use better scripting. You can also improve signature based detection and prevent future attacks.

55
Q

What does the benefit of Threat Hunting, “Integrate Intelligence” include?

A

Correlate external threat intelligence with your internal logs and sources. When combined you get Actionable Intelligence

56
Q

What does the benefit of Threat Hunting, “Reduce Attack Surface” include?

A

Identify your attack surface. Where the bad guy might have gotten in to the network. Based on that you can go back and reduce the attack surface

57
Q

What does the benefit of Threat Hunting, “Block Attack Vectors” include?

A

There are different attack vectors and TTP (Tactics, Techniques, Procedures) used by bad guys.

You can add additional security controls to try and block those different ports or interfaces and prevent infiltrations.

58
Q

What does the benefit of Threat Hunting, “Identify Critical Assets” include?

A

You can identify what people go after and figure out what the best offensive options for those critical systems and data assets are.

59
Q

What does TTP mean?

A

Tactics, Techniques, Procedures

60
Q

What are the 3 attack frameworks?

A
  1. Lockheed Martin Kill Chain
  2. MITRE ATT&CK Framework
  3. Diamond Model of Intrusion Analysis
61
Q

What is the Lockheed Martin Kill Chain Framework?

A

A model developed by Lockheed Martin that describes the stages by which a threat actor progresses a network intrusion

62
Q

What are the 7 steps of Lockheed Martin Kill Chain Framework?

A
  1. Reconnaissance
  2. Weaponisation
  3. Delivery
  4. Exploitation
  5. Installation
  6. Command & Control (C2)
  7. Actions on Objective
63
Q

What is the Reconnaissance step in Kill Chain?

A

Process which an attacker determines what methods to use to complete the phases of the attack

  • passive information gathering
  • passive / active scanning techniques
  • OSINT
64
Q

What is the Weaponisation step in Kill Chain?

A

When the attacker prepares the payload code with exploit code that will take advantage of the vulnerability in the target system and execute by using the vulnerability.

65
Q

What is the Delivery step in Kill Chain?

A

When a vector is identified which allows the weaponised code to be transmitted to the target environment

  • email (phishing)
  • USB
66
Q

What is the Exploitation step in Kill Chain?

A

The weaponised code is executed on the target system

  • email with phishing link, exploitation when the link is clicked
  • when infected USB is plugged in, and auto runs
67
Q

What is the Installation step in Kill Chain?

A

Mechanism that enables the weaponised code to run a remote access tool and achieve persistence on the target system

  • gives us control of the system going forwards
  • persistence is what we are looking for
68
Q

What is the Command & Control (C2) step in Kill Chain?

A

An outbound channel is established to a remote server that can then be used to control the remote access tool and possibly download additional tools to progress the attack (reverse shell)

  • You have access, control, and you can run commands
69
Q

What is the Actions on Objective step in Kill Chain?

A

Use the access you achieved to covertly collect information from target systems and transfer it to a remote system (data exfiltration) or achieve other goals and motives

70
Q

How can Kill Chain Analysis be used to our advantage?

A

Can be used to identify defensive course-of-action matrix to counter the progress of an attack at each stage

  • block the kill chain steps
  • detect, deny, disrupt, degrade, deceive, destroy the attacker’s capabilities (6 Ds)
71
Q

What are the 6 D’s of Kill Chain Analysis?

A
  1. Detect
  2. Deny
  3. Disrupt
  4. Degrade
  5. Deceive
  6. Destroy
72
Q

What is the MITRE ATT&CK Framework?

A

A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques and common knowledge or procedures (attack.mitre.org)

73
Q

What is the MITRE ATT&CK Framework focusing on?

A

Focusing more on the Exploitation Phase

74
Q

What does the pre-ATT&CK tactics matrix align with?

A

Reconnaissance and Weaponisation phases of the Kill Chain

  • detect things before they become real attacks
75
Q

What is the Diamond Model of Intrusion Analysis framework?

A

A framework for analysing cybersecurity incidents and intrusions by exploring the relationship between four core features

76
Q

What are the 4 core features of the Diamond Model of Intrusion Analysis Framework?

A
  1. Adversary
  2. Capability
  3. Infrastructure
  4. Victim
77
Q

What does the Diamond Model of Intrusion Analysis framework represent?

A

An intrusion event

78
Q

How can you automate the Diamond Model of Intrusion Analysis framework?

A

By creating a Tuple and adding it to a SIEM

79
Q

Can the 3 attack Frameworks be combined or used individually only?

A

They can be combined or used individually.

Comptia Security+ Personal (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions