Section 2 - Architecture and Design Flashcards
Baseline configuration
Is a group of settings placed on a system before it is approved for production. Using baselines is a technique that evolved from administration checklists to ensure systems were set up correctly for their intended purpose.
In case of workstations, it would be an OS image with pre-installed software.
Data sovereignty
Often refers to the understanding that data which are stored outside of an organization’s host country and still subject to the laws in the country where the data are stored
Data masking
Is the process of modifying sensitive data in such a way that it is of no or little value to unauthorized intruders while still being usable by software or authorized personnel.
Data tokenization
Is the process of substituting a sensitive data element with a non-sensitive equivalent, referred to as a token, that has no intrinsic or exploitable meaning or value. The token is a reference that maps back to the sensitive data through a tokenization system.
Hardware security module (HSM)
Is a physical computing device that safeguards and manages secrets (most importantly digital keys), performs encryption and decryption functions for digital signatures, strong authentication and other cryptographic functions. These modules traditionally come in the form of a plug-in card or an external device that attaches directly to a computer or network server.
Cloud access security broker (CASB)
Is cloud-hosted software or on-premises software or hardware that act as an intermediary between users and cloud service providers. It combines and interjects enterprise security policies as cloud-based resources are accessed.
System resilience
The ability of an information system to continue to: (i) operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities; and (ii) recover to an effective operational posture in a time frame consistent with mission needs.
Cold site
A backup facility that has the necessary electrical and physical components of a computer facility, but does not have the computer equipment in place. The site is ready to receive the necessary replacement computer equipment in the event that the user has to move from their main computing location to an alternate site.
Hot site
A fully operational offsite data processing facility equipped with hardware and software, to be used in the event of an information system disruption.
Warm site
An environmentally conditioned work space that is partially equipped with information systems and telecommunications equipment to support relocated operations in the event of a significant disruption.
Infrastructure-as-a-Service (IaaS)
Is a form of cloud computing that delivers fundamental compute, network, and storage resources to consumers on-demand, over the internet, and on a pay-as-you-go basis. IaaS enables end users to scale and shrink resources on an as-needed basis, reducing the need for high, up-front capital expenditures or unnecessary “owned” infrastructure, especially in the case of “spiky” workloads. In contrast to PaaS and SaaS (even newer computing models like containers and serverless), IaaS provides the lowest-level control of resources in the cloud.
Software as a Service (SaaS)
SaaS utilizes the internet to deliver applications, which are managed by a third-party vendor, to its users. A majority of SaaS applications run directly through your web browser, which means they do not require any downloads or installations on the client side.
Platform as a Service (PaaS)
Provides software developers with on-demand platform—hardware, complete software stack, infrastructure, and even development tools—for running, developing, and managing applications without the cost, complexity, and inflexibility of maintaining that platform on-premises.
With PaaS, the cloud provider hosts everything—servers, networks, storage, operating system software, middleware, databases—at their data center.
Everything as a Service (XaaS)
Describes a general category of services related to cloud computing and remote access. It recognizes the vast number of products, tools, and technologies that are now delivered to users as a service over the internet.
Essentially, any IT function can be transformed into a service for enterprise consumption. The service is paid for in a flexible consumption model rather than as an upfront purchase or license.
Cloud deployment models
Public cloud is cloud computing that’s delivered via the internet and shared across organizations.
Private cloud is cloud computing that is dedicated solely to your organization.
Hybrid cloud is any environment that uses both public and private clouds.
Fog computing
Places a decentralized enterprise computing layer between the source of data and a central cloud platform. Like edge computing, fog computing also brings the processing power closer to where the data is extracted from. While fog computing enhances efficiency, it can also be leveraged for cybersecurity and regulatory compliance.
Edge computing
Brings processing and storage systems as close as possible to the application, device, or component that generates and collects data. This helps minimize processing time by removing the need for transferring data to a central processing system and back to the endpoint
Containerization
Is a form of virtualization where applications run in isolated user spaces, called containers, while using the same shared operating system (OS).
Microservices
Are component parts of an application that are designed to run independently. A microservices-based application is a collection of loosely coupled services that are lightweight and independently deployable and scalable
Kubernetes
Is a container orchestration tool—an open-source, extensible platform for deploying, scaling, and managing the complete life cycle of containerized applications across a cluster of machines.
Infrastructure as code (IaC)
Is the process of managing and provisioning computer data centers through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools.
Software-Defined Networking (SDN)
Is an approach to networking that uses software-based controllers or application programming interfaces (APIs) to communicate with underlying hardware infrastructure and direct traffic on a network.
Software Defined Visibility (SDV)
Is a framework that allows customers, security and network equipment vendors, as well as managed service providers, to control and program Gigamon’s Visibility Fabric via REST-based Application Program Interfaces (APIs). By writing programs that utilize Gigamon’s APIs, critical functions previously requiring manual intervention can be automated to improve responsiveness, enhance analysis and increase protection of key resources and information assets.
Serverless architecture
Is a software design pattern where we host our applications on a third-party service.
Virtualization sprawl (VM sprawl)
Is a phenomenon that occurs when the number of virtual machines (VMs) on a network reaches a point where administrators can no longer manage them effectively
VM escape
Is the process of a program breaking out of the virtual machine on which it is running and interacting with the host operating system.
Provisioning vs Deprovisioning
Provisioning is the process of making information technology (IT) systems available to users.
Deprovisioning is the process of removing user access to software and network services.
Database normalization
Refers to organizing tables and columns in a database to reduce redundant data and improve overall database performance.
Stored procedure
This is the practice of storing business logic, rules, algorithms and data within a database. These procedures can be run at any time by the database, rather than being triggered when a user tries to access the logic.
Code Obfuscation/Camouflage
Is the process of making code more difficult to understand. This is typically done by replacing certain words and phrases in the code with numbers. There are several methods for obfuscating code, and most can eventually be reverse engineered, but it does add one more layer of protection.
Code Reuse
Reusing code can be risky, though, if the code being used isn’t secure and gets spread throughout the application. It can also be a problem if the reused code doesn’t work well in the new environment or if the changes aren’t as secure as they would have been had the code been written expressly for the purpose at hand.
Dead Code
Refers to code that’s non-executable at runtime. Sometimes, it means source code that’s executed but not used in any other computation, making it obsolete. It’s more secure to remove any dead code. If it doesn’t exist, it can’t be exploited.
Memory management
Most common memory vulnerabilities are unchecked buffer-copy input size, incorrectly calculated buffer size, and uncontrolled format strings.
Data exposure
Involves unintended exposure of personal and confidential data. This can come from weak or non-existent encryption, coding flaws, or misapplied database uploads.
Open Web Application Security Project (OWASP)
Is an online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security. The OWASP provides free and open resources. It is led by a non-profit called The OWASP Foundation.
Elasticity in devops
The purpose of elasticity is to match the resources allocated with the actual amount of resources needed at any given point in time.
Scalability in devops
Handles the changing needs of an application within the confines of the infrastructure via statically adding or removing resources to meet applications demands if needed.
