Security Flashcards
What is Triple A?
Conceptual securiy model
- Authentication
- Authorization
- Accounting
What is Authentication?
Verifying who a user claims to be.
May use separate credentials or a centralized storage system
What is Authorization?
Establishing and enforcing rules for who is permitted to access what
What is Accounting?
Recording each attempt to authenticate or authorize a user.
Informtion often used for auditing
What is CIA(NA)?
Another conceptual model for security
- Confidentiality
- Integrity
- Availibility
- Non-repudiation
- Authentication
What is encryption?
Using a cipher (computer program) to convert plaintext to ciphertext
What is decryption?
Reverses encryption (ciphertext to plaintext)
What is a key?
A long string of bits used to encrypt or decrypt data
Explain symmetric key encryption?
A shared key is used to encrypt AND decrypt plaintext
Explain asymmetric key encryption?
Each user has their own pair of keys:
public key - shared with public
private key - only user has access
ONE key is used for encrypt and the OTHER is used to decrypt
What is a message digest?
A unique identified for a message created using a hash function
What is a digital signature?
An encrypted message digest
What is a digital certificate?
Certifies that a digital signature is authentic
What is Public Key Infrastructure?
The tools used to create and manage key certificates.
What is a VPN?
Uses encryption to extend an enterprise network onto the internet
What are flows?
Collections of packets sent between two specific hosts
What are rules?
Identifies the host involved in a flow, the protocols used, and determines if the flow is allowed or not
What is a firewall?
A router configured to enforce rules
What is a DMZ?
Additional network managed by an enterprise used to separate devices that may receive external flows
Why use a DMZ?
Simplifies firewall rules
What is an IDS?
Monitors a network switch for unusual behavior
Explain the client-server model
- Web servers store resources
- Web clients request resources and render them
What is a protocol?
Common language between two programs
What is HTTP?
Protocol used between web servers and browsers
Examples of static web resources?
HTML, CSS docs, images
What are dynamically generated web resources?
programming instructions executed on a server host
What are dynamic web resources?
programming instructions included in HTTP response for browser to execute
What does a browser consist of?
- rendering engine
- JavaScript engine
- environment where JS can execute
What is Just-in-Time complilation?
compilation during program execution rather than before
Provide a layered view of the web
- Content
- Structure: organizes content
- Presentation: formats organized content
- Behavior: enhances user interactions
What is JavaScript?
programming language used to provide browser’s behavioral instructions
