Security Flashcards
Ensuring that information is viewable only by authorized users or systems, and is either inaccessible or unreadable to unauthorized users.
Confidentiality
Ensuring that information remains accurate and complete over its entire lifetime. In particular, this means making sure that data in storage or transit can’t be modified in an undetected manner.
Integrity
Ensuring that information is always easily accessible to authorized users. This means making sure that connectivity and performance is maintained at the highest possible level.
Availability
The core of information security is commonly summed up into three components, known as the CIA triad
Confidentiality
Integrity
Availability
The chance of harm coming to an asset
Risk
Anything that can cause harm to an asset
Threat
Any weakness the asset has against potential threats
Vulnerability
Malicious or unwanted software designed to steal data or impair your computer’s performance
Malware
Hackers, malicious software, and other automated attacks can try to access your computer over the network to steal data, or implant malware.
Network attacks
A malicious or even negligent user getting access to your account can do damage directly, or just weaken other security measures to make your data more vulnerable
Unauthorized users
Older hardware, software, and network protocols commonly have outdated security features or known vulnerabilities that make them unsafe against modern threats
Insecure technologies
Most common vulnerabilities in the enterprise include:
Insecure technologies Weak configurations Non-compliant systems Physical environment User behavior Weak documentation
Target vulnerabilities which have not yet been patched, and may not even be known to software vendors
zero-day attacks
Watching someone who is viewing or entering sensitive information, or eavesdropping on confidential conversations
Shoulder surfing
Hunting for discarded documents and other media in a target’s trash, looking for information
Dumpster diving
Getting into a secure area by tagging along right behind someone who has legitimate access, with or without their knowledge
Piggybacking/Tailgating
Impersonating an authority figure or other relevant person over the phone and requesting sensitive information
Phone impersonation
Sending unsolicited emails or other electronic messages, with undesired or malicious content
Spam
Using fake but official-looking messages to trick users into performing dangerous actions
Phishing
A variant of phishing that targets specific people, such as members of an organization or even individual users
Spear phishing
Malware attached to an infected file, usually an executable program but possibly as a script inside a data file like an office document
Virus
Malware that spreads without any human interaction
Worm
Malware that appears to be a harmless or useful program, like a game or even an anti-virus application
Trojan horse
Any hidden way into a system or application that bypasses normal authentication systems.
Backdoor
Turn the computer into a zombie: part of a large network of computers that performs distributed network attacks or other processing tasks
Botnet
Malware that compromises boot systems and core operating system functions in order to hide from most detection methods
Rootkit
A particularly intrusive sort of malware that attempts to extort money from the victim in order to undo or prevent further damage
Ransomware
