Security+ Book Flashcards
An organization can avoid a risk by not providing a service or not participating in risky activity. For example, an organization may evaluate an application that requires multiple open ports on the firewall that it considers too risky. It can avoid the risk by purchasing another application.
Risk Avoidance
The organization transfers the risk to another entity. The most common method is by purchasing insurance. Another method is by outsourcing.
Risk Transference
When the cost of a control outweighs a risk, an organization will often accept the risk. For example, spending $100 in hardware locks to secure a $15 mouse does not make sense.
Risk Acceptance
The organization implements controls to reduce the risk. These controls may reduce the vulnerabilities or reduce the impact of the threat. For example, up-to-date antivirus software mitigates the risks of malware.
Risk Mitigation
An organization can deter a risk by implementing some security controls.
Risk Deterrence
_____ are executable files that masquerade as something useful but are actually malicious software.
Trojan
_____ is a specific type of DNS poisoning attack that redirects a websites traffic to another website.
Self-replicating malware that travels throughout a network without the assistance of a host application or user interaction. It resides in memory and is able to use different transport protocols to travel over the network.
Worm
___ is a set of malicious code that attaches itself to a host application. The host application must be executed to run, and when the host application is executed, the malicious code executes. It will try to find other host applications to infect with this malicious code.
Virus
_____ is a string of code embedded into an application or script that will execute in response to an event. The event may be a specific date or time, when a user launches a specific program, or any event the programmer decides on. Antivirus scanners most unlikely are able to discover this.
Logic Bomb
Group of programs that hides the fact that the system has been infected or compromised by malicious code. A user may suspect something is wrong, but antivirus scans and other checks may indicate everything is fine since the _____ hides it running processes to avoid detection.
Rootkit
Specific type of command injection attack that attempts to access a file by including the full directory path, or traversing the directory structure.
Directory Traversal
The attacker learns the user’s session ID and uses it to impersonate the user. Attackers can read cookies installed on systems through cross-site scripting attacks, or with a sniffer if they are on the same network.
Session Hijacking
____ allows an attacker to redirect users to malicious websites and steal cookies. Websites prevent these type of attacks through input validation to detect and block input that include HTML and javascript tags. Many sites prevent the use of < and > characters to block this.
Cross-Site Scripting
is an attack where an attacker tricks the user into performing an action on a website. The attacker creates a specially crafted HTML link and the user performs the action without realizing it.
XSRF (Criss-site request forgery)
The attacker enters additional data into the web page form to generate different SQL statements.
SQL Injection
This ensures that data is only viewable by authorized users. If there is a risk of sensitive data falling into the wrong hands, it should be encrypted to make it unreadable. Any data should be protected with access controls to enforce this.
Confidentiality
This is used to verify that data has not been modified, and loss of this can occur through unauthorized or unintended changes. Hashing algorithms such as MD5, HMAC, or SHA1 can calculate hashes to verify this.
This ensures that systems are up and operational when needed and often addresses single points of failure. You can increase this by adding fault tolerance, and redundancies such as RAID, clustering, backups, and generators. HVAC also increases this.
Availability
This is used to prevent entities from denying they took an action. Digitally signed email prevents individuals from later denying they sent it. An audit log provides non-repudiation since audit log entries include who took an action in addition to what the action was, where the action took place, and when it occurred.
Non-Repudiation
This is a network authentication protocol within a MS AD domain or a Unix realm. IT uses a database of objects such as AD and a KDC (Key Distribution Center) to issue time stamped tickets that expire after a certain period. This requires internal time synchronization and uses Port 88.
Kerberos
This uses port 88 by default and uses symmetric key cryptography to prevent unauthorized disclosure and to ensure confidentiality.
Kerberos
Specifies formats and methods to query directories. This is an extension of the X.500 standard that was used extensively by Novell and early MS Exchange server editions. Well known ports used by this is port 389 for secure and port 636 when encrypted with SSL or TLS.
LDAP
This is a control that uses technology to reduce vulnerabilities. Some examples include the principle of least privilege, antivirus software, IDS, and firewalls.
Technical Control
This control is primarily administrative in function. They use planning and assessment methods to provide an ongoing review of the organization’s ability to reduce and manage risk.
Management Control
This control helps ensure the day-to-day operations of an organization comply with their overall security plan. Types of this control includes: Awareness and training, configuration management, contigency planning, media protection, physical and environmental protection.
Operational Control
This functional control attempt to prevent an incident from occurring. The goal is to take steps to prevent the risk. Examples are: Security guards, change management, account disablement policy, and system hardening.
Preventative Controls
This functional control can detect when a vulnerability has been exploited. Two examples are security audits and CCTV systems.
Detective Control
This functional control attempts to reverse the impact of an incident or problem after it has occurred. Some examples include: Active IDS, Backups and system recovery.
Corrective Control
This access control uses roles o manage rights and permissions for users. This is useful for users within a specific department that perform the same job functions.
Role Based Access Control
This access control is based on a set of approved instrucitons configured on rules. A simple example is the rules of a router or firewall.
Rule Based Access Control
In this access control model, every object has an owner, and the owner establishes access for the objects.
DAC (Discretionary Access Control)
This access control model uses labels (sometimes referred to as sensitivity labels or security labels) to determine access. SELinux is a trusted operating system platform using the MAC model that prevents malicious or suspicious code from executing on the system.
Mandatory Access Control
This is a common DoS attack. The attacker sends multiple SYN packets but never completes the third part of the handshake. Instead the attacker witholds the last ACK packet, leaving the server with several open sessions waiting to complete the handshake in each.
Syn Flood Attack
Some implementations of this use port 989 and 990.
FTPS
This uses UDP port 69
TFTP
