Security Fundamentals Flashcards
What to protect or what information to secure
Data. The information assets
Resources. Virtual or physical system components
Information security refers to
The protection of information resources from unauthorized access, attacks, thefts, or data damage
The three primary goals of security
Prevention. Prevent users gaining unauthorized access to confidential information.
Detection. Users discovered trying to access unauthorized data
Recovery. Employ a process to recover vital data
In terms of security what is collateral damage
Compromised reputation, loss of goodwill, reduce investor confidence, loss of customers and financial losses.
Risk is
Exposure to the chance of damage or loss. The likelihood of a hazard or threat occurring. Associated with the loss of a system, power, or network.
A threat is
Any action that could cause damage to an asset.
Some potential threats to computer and network security
Unauthorized access or changes to data Interruption of services Interruption of access to assets Damage to hardware Unauthorized access or damage to facilities
A vulnerability is
Any condition that leaves a system open to harm
List some vulnerabilities in terms of security
Improperly configured or installed hardware or software Untested software or firmware patches Bugs in software or OS misuse of software or communication protocols Poorly designed networks Poor physical security Insecure passwords Design flaws in software or OS Unchecked user Input
An intrusion occurs when
An attacker accesses a computer system without the authorization. Occurs when the system is vulnerable to Attacks.
Three types of intrusions
Physical
Host-based
Network-based
An attack is
Exploit a vulnerability in a system without the authorization
Attacks on a computer system and network security include
Physical Network-based Software-based Social engineering Web application-based
Controls are
The countermeasures (solutions and activities) put in place to avoid, mitigate, or counteract security risks due to threats or attacks.
Type of controls
Prevention controls
Detection controls
Correction controls
Prevention controls help to
Prevent a threat or attach from exposing a vulnerability
Detection controls help to
Discover If a threat or vulnerability has entered the computer system
Correction controls help to
Mitigate the consequences of a threat or attack from adversely affecting the computer system
The security management process involves
Identify security controls detect problems and determine how to protect a system
Implement security controls installing control mechanisms to prevent problems in a system
Monitor security controls detecting and solving security issues that arise
Information security seeks to address three specific principles
Confidentiality
Integrity
Availability
Confidentiality is the fundamental principle of
Keeping information and communication private and protecting them from unauthorized access
Integrity is the fundamental principle of
Keeping organization information accurate, free of errors, and without unauthorized modifications.
Confidentiality is typically controlled through
Encryption, access controls and steganography
Integrity is typically controlled through
Hashing, digital signature, certificates, and non-reputation.
Availability is the fundamental principle of
Ensuring that systems operate continuously and that authorized users can access the data they need.
Availability is typically controlled through
Redundancy, fault tolerance, and patching.
Non-repudiation is
Ensuring that the part that sent a transmission or created data remains associated with that data and cannot deny sending or creating that data.
Identification is a method that
Ensures that an entity requesting access to resources by using a set of credentials is the true owner of the credentials.
Authentication is the method of
Validating unique credentials
Authorization is the process of
Determining what rights and privileges a particular entity has.
Access control is the process of
Determining and assigning privileges.
How authorization is managed.
The four access control models
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control
In security terms accounting is
The process of tracking and recording system activities and resource access
In security terms auditing is
Examining logs of what was recorded.
Implicit deny dictates that
Everything that is not explicitly allowed is denied. Users only allowed to access data and perform actions when permissions are specifically granted to them.
Principle of least privilege
Users and software should only have the minimal level of access necessary for them to perform their duties.
List common security practices
Implicit deny Least privilege Separation of duties Job rotation Mandatory vacation Time of day restrictions Privilege management
Separations of duties states that
No one person should have too much power or responsibility. Duties Divided among individuals to prevent ethical conflicts or abuse of powers
Job rotation is
No one person stays in a vital Job role too long. Helps prevent abuse of power, reduces boredom, and enhances professional skills.
Mandatory vacations is used to
Provide an opportunity to review employees activities. Requires that employees take at least one vacation a year for a full week. The corporate audit and security employees have time to investigate and discover any discrepancies
Time of day restrictions are
Controls that restrict the period of time when users are allowed to access systems. Can be applied to individual systems and wireless access points also.
