Security Concepts - CyberSecurity Fundamentals Flashcards
1
Q
- typically found in web applications.
- enable attackers to inject client-side scripts into web pages viewed by other users
A
Cross-site scripting (XSS)
2
Q
- also known as one-click attack or session riding
- cause victims to run actions on already authenticated sessions
- is a type of malicious exploit of a website where unauthorized commands are submitted from a user that the web application trusts.
A
Cross-site request forgery (CSRF)
3
Q
- type of malware from cryptovirology that threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid
A
Ransomware
4
Q
- is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker)
A
SQL Injection
5
Q
- is any software intentionally designed to cause damage to a computer, server, client, or computer network
A
Malware (malicious software)
6
Q
- is the fraudulent attempt to obtain sensitive information or data, such as usernames, passwords and credit card details, by disguising oneself as a trustworthy entity in an electronic communication
A
Phishing
7
Q
- is a cyberattack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other
A
man-in-the-middle
8
Q
- is a malicious software that allows an unauthorized user to have privileged access to a computer and to restricted areas of its software. may contain a number of malicious tools such as keyloggers, banking credential stealers, password stealers, antivirus disablers, and bots for DDoS attacks
- design to go undetected
- can be installed in computer kernel
A
Rootkit
9
Q
- in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. typically accomplished by flooding the targeted machine or resource with superfluous requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled
A
denial-of-service attack (DoS attack)
10
Q
- the incoming traffic flooding the victim originates from many different sources
A
distributed denial-of-service attack (DDoS attack)
11
Q
- is a vulnerability that allows attackers to break out of a web server’s root directory and access other locations in the server’s file system
A
Path Traversal
12
Q
- occurs when data written to a buffer also corrupts data values in memory addresses adjacent to the destination buffer due to insufficient bounds checking. This can occur when copying data from one buffer to another without first checking that the data fits within the destination buffer
A
Buffer Overflow
13
Q
- is a type of malware that propagates by inserting a copy of itself into and becoming part of another program
- will not be active or able to spread until a user runs or opens the malicious host file or program
A
Virus
14
Q
- replicate functional copies of themselves and can cause the same type of damage.
- standalone software and do not require a host program or human help to propagate
- attack vulnerability’s of the system
A
Worms
15
Q
- It is a harmful piece of software that looks legitimate.
- do not reproduce by infecting other files nor do they self-replicate
- create backdoors to give malicious users access to the system
- cannot replicate itself and must be installed by user
A
Trojans
16
Q
- Software that generates revenue for its developer by automatically generating online advertisements in the user interface of the software or on a screen presented to the user during the installation process
A
Adware
17
Q
- Software that aims to gather information about a person or organization without their knowledge, that may send such information to another entity without the consumer’s consent, or that asserts control over a device without the consumer’s knowledge.
A
Spyware
18
Q
- convincing victims they are trusted authority
- the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.
A
Social Engineering
19
Q
Type of Phishing with no target
A
Bulk Phishing
20
Q
Type of Phishing with specific target
A
Spear Phishing
21
Q
- Spear Phishing high profile target
- is a method used by cybercriminals to masquerade as a senior player at an organization and directly target senior or other important individuals at an organization,
A
Whaling
22
Q
- Type of Phishing the Clone Logos of Legit Service
A
Clone Phishing
23
Q
NIST stands for
A
National Institute of Standards and Technology
24
Q
- is a collection of industry standards and best practices to help organizations manage cybersecurity risk
A
NIST CyberSecurity Framework
25
Q
- a potential danger to asset
A
Threat
26
Q
- entity that takes advantage of vulnerability
A
Malicious Actor
27
Q
- Path use by Malicious Actor
A
Threat Agent/Vector
28
Q
Weakness in the system design, implementation, software or code or lack of a mechanism
A
Vulnerability
29
Q
- vulnerabilities identifier
- is a list of publicly disclosed computer security flaws.
A
CVE - Common Vulnerabilities and Exposures
30
Q
- refers to a piece of software, tool, technique or a process that takes advantage of a vulnerability
A
Exploit
31
Q
- no one may even know vulnerability exist and it is exploited
A
Zero Day Exploit
32
Q
- the probability of likelihood of the occurrence or realization of threat
A
risk
33
Q
3 Elements of risk
A
Asset, threats, Vulnerabilities
34
Q
- any item of economic value owned by individual or corporation
A
Asset
35
Q
- non profit charitable organization that leads several industry wide initiatives to promote the security of applications and software
A
OWASP (Open Web Application Security Project)
