Security Primer Flashcards
Confidentiality
Examples of confidentiality protections
Protecting information from unauthorized access/dissemination
Protect secrets
ex. Encryption, Data Classification, NDA, TPM/HSM, Access Control
Integrity
Examples of integrity protections
maintains the accuracy, validity, and completeness of information
Ensures the data has not been tampered with by anyone other than an authorized party for an authorized purpose
Protect accuracy and authenticity; verifies that information is processed correctly and is not modified either at rest, in use or in transit
Ex. Hasing, Message Authentication Code (MAC), Digital Signatures
Availability
Examples of availability protections
Ensuring that authorized users can access the information when they are permitted to do so
Protects stability and reliability; ensures systems and data are up and running so that the y may be accessed as needed by authenticated and authorized users
ex. UPS, Clustering, Load Balancing, HVAC
Checksum
a value derived from a piece of data that uniquely identifies that data and is used to detect changes that may have been introduced during storage or transmission
generated based on cryptographic hashing algorithm
Least Privilege
Asserts that access to information should only be granted on a need to know basis
DDOS
Distributed Denial of Service
coordinated attack by multiple compromised machines causing a disruption to a systems availability
Threat
anything capable of intentionally or accidentally compromising an assets security
something that may harm an asset
Vulnerability
a weakness or gap existing within a system that may be exploited to compromise an assets CIA
Risks
the intersection of threat and vulnerability that defines the likelihood of a vulnerability being exploited and the impact should that exploit occur
Identification
act of establishing who or what someone or something is
Authentication
Validates identification (user’s/system identity)
Generally what are the 3 factors/methods of authentication
- Something you know - password, PIN
- Something you have - security token, smart card
- Something you are - fingerprints, iris scan, voice analysis, other biometrics
Authorization
Process for granting access to a user based on their authenticated identity and the policies set for them
Cryptography
science of encrypting or decrypting information to protect its confidentiality or integrity
Encryption
process of using an algorithm or cipher to convert plain text into cipher text
Decryption
allows authorized party to convert cipher text back to its original plain text using the encryption key - a piece of information that allows the holder to encrypt or decrypt
Symmetric Key Encryption
Describe, AKA, Benefits, Drawbacks
AKA - Secret Key Encryption
Desc - Uses the same key (e.g. secret key) to decrypt and encrypt and the key must given to the recipient before the message can be decrypted
Benefits - simple, fast, cheap
Drawbacks - requires secure channel for initial key exchange
Asymmetric Encryption
AKA, Desc, Drawbacks
AKA - Public Key Encryption
Desc - Uses two keys, one public and one private, public key is public available for encryption, while private key remains secret for decryption
Drawbacks - slower than symmetric encryption
TLS
Desc, What Type of Encryption is used to implement?
Transport Layer Security
used to encrypt traffic over the network when privacy and data integrity need to be maintained
uses a combination of asymmetric and symmetric encryption
Digital Signature
asserts or proves the identity of the user
used in public key schemes
requires the sender to use their private key to sign a message
recipients can use the senders public key to verify their identity
VPN
Desc, What Type of Encryption is Used?
Virtual Private Network
Encrypts traffic between two networks over the internet by creating a secure tunnel for communication
Mix of symmetric and asymmetric encryption
Business Continuity
policies, procedures, and tools you put in place to ensure critical business functions continue during and after a disaster or crisis
Disaster Recovery
subset of Business Continuity focusing on recovering IT systems that are lost or damaged during a disaster
restoration of full operation of and access to hardware, software, and data as quickly as possible after a disaster
Difference between BC and DR
BC - broadly focuses on procedures and systems you have in place to keep a business up and running during and after a disaster
DR - narrowly focuses on getting systems and data back after a crisis