Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SSCP > SSCP Glossary of Terms > Flashcards

SSCP Glossary of Terms Flashcards

1
Q

6to4

A

Transition mechanism for migrating from IPv4 to IPv6. It allows systems to use IPv6 to communicate if their traffic has to transverse an IPv4 network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Absolute Addresses

A

Hardware addresses used by the CPU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Abstraction

A

The capability to suppress unnecessary details so the important, inherent properties can be examined and reviewed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Accepted Ways for Handling Risk

A

Accept, Transfer, Mitigate, Avoid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Access

A

The flow of information between a subject and an object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

AC Matrix

A

Table of subjects and objects indicating what actions individual subjects can take upon individual objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

AC Model

A

Framework that dictates how subjects access objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Access Controls

A

Security features that control how users and systems communicate and interact with others systems and resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Accreditation

A

Formal acceptance of the adequacy of a system’s overall security by management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Active Attack

A

Attack where the attacker does interact with processing or communication activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ActiveX

A

Microsoft Technology composed of a set of OOP technologies and tolls based on COM and DCOM.

Framework for defining reusable software components in a programming language-independent manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Address Bus

A

Physical connections between processing components and memory segments used to communicate the physical memory addresses begin used during processing procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ARP

A

ADDRESS RESOLUTION PROTOCOL

Networking protocol used for resolution of network layer IP addresses into link layer MAC Addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ASLR

A

ADDRESS SPACE LAYOUT RANDOMIZATION

Memory protection mechanism used by some operating systems. The addresses used by components of a process are randomized so that it is harder for an attacker to exploit specific memory vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Algebraic Attack

A

Cryptoanalysis attack that exploits vulnerabilities within the intrinsic algebraic structure of mathematical functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Algorithm

A

Set of mathematical and logic rules used in cryptographic functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Analog Signals

A

Continuously varying electromagnetic wave that represents and transmits data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Analytic Attack

A

Cryptanalysis attack that exploits vulnerabilities within the algorithm structure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ALE

A

ANNUALIZED LOSS EXPECTANCY

Annual expected loss if a specific vulnerability is exploited and how ti affects a single assest.

SLE x ARO = ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

API

A

APPLICATION PROGRAMMING INTERFACE

Software interface that enables process-to-process interaction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

ALU

A

ARITHMETIC LOGIC UNIT

A component of the computer’s processing unit in which arithmetic and matching operations are performed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

AZ/NZS 4360

A

Australia and NZ business risk management approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Assemblers

A

Tools that convert assembly code into the necessary machine-compatible binary language for processing activities to take place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Assembly Language

A

A low-level programming language that is the mnemonic representation of machine-level instructions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Assurance evaluation criteria

A

Check-list and process of examining the security -relevant parts of a system (TECB, reference monitor, security kernel) and assigning the system an assurance rating.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Asymmetric algorithm

A

Encryption method that uses two different key types, public and private.

Also call Public Key Cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Asymmetric mode multiprocessing

A

When a computer has two or more CPU’s and one CPU is dedicated to a specific program while the other carries out general processing procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Asynchronous Communication

A

Transmission sequencing technology that uses start and stop bits or similar encoding mechanism. Used in environments that transmit a variable amount of data in a periodic fashion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Asynchronous token generating method

A

Employs a challenge/response scheme to authenticate the user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Attack surface

A

Components available to be used by an attacker against the product itself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Attenuation

A

Gradual loss in intensity of any kind of flux through a medium. As an electrical signal travels down a cable, the signal can degrade and distort or corrupt the data it is carrying.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Attribute

A

A column in a 2-d database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

AH Protocol

A

Authentication Header Protocol

Protocol within the IPSec suite used for integrity and authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Authenticode

A

A type of code singing, which is the process of digitally signing software components and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was digitally signed. Microsoft’s implementation of code signing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Availability

A

Reliable and timely access to data and resources is provide to authorized individuals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Avalanche Effect

A

Algorithm design requirement so that slight changes to the input result in drastic changes to the output.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Base registers

A

Beginning of address space assigned to a process. Used to ensure a process does not make a request outside its assigned memory boundaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Base-band Transmissions

A

uses the full bandwidth for only one communication channel and has a low data transfer rate compared to broadband.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Bastion host

A

A highly exposed device that will most likely be targeted for attacks, and thus should be hardened.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Behavior blocking

A

Allowing the suspicious code to execute within the OS and watches its interactions with the OS, loosing for suspicious activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Birthday Attack

A

Cryptographic attack that exploits the mathematics behind the bday problem in the probability theory forces collisions within hashing functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Block Cipher

A

Symmetric algorithm type that encrypts chucks (blocks) of data at a time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Blowfish

A

Block symmetric cipher that users 64-bit block sizes and variable-length keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

BGP

A

Border Gateway Protocol

Protocol that carries out core routing decision on the internet. Maintains a table of IP networks ‘prefixies’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Bots

A

Software applications that run automated tasks over the internet, which perform tasks that are both simple and structurally repetitive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Botnet

A

Centrally controlled collection of bots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Broadband Transmission

A

Divides the bandwidth of a communication channel into many channels, enabling different types of data to be transmitted at one time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Buffer overflow

A

Too much data is put into the buffers that make up a stack. Common attack vector used by attackers to run malicious code on a target system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Bus Topology

A

Systems are connected to a single transmission channel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

BCM

A

Business Continuity Management

Overarching approach to managing all aspects of BCP and DRP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

BCP

A

Business Continuity Plan

Document or set of documents that contains the critical information a business needs to stay running in spite of adverse events.
Aka emergency plan.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

BIA

A

Business Impact Analysis

Exercise that determines the impact of losing the support of any resource to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Cable Modem

A

Device that provides bidirectional data communication via RF.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Cache Memory

A

Fast memory type that is used by a CPU to increase read and write operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Caesar Cipher

A

Substitution Algorithm that shifts alphabetic values three positions during it’s encryption and decryption process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

CMMI

A

Capability Maturity Model Integration

Process of improvement methodology that provides guidance for quality improvement and point of reference for appraising existing processes. Developed by Carnegie Mellon.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

CMMI Model

A

Capability Maturity Model Integration Model

Process improvement approach that provides organizations with the essential elements of effective processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Capability Table

A

Specifies the access rights a certain subject possesses pertaining to specific objects.

CT - Subject is bound
ACL - Object is bound

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

CSMA/CA

A

Carrier sense multiple access with collision avoidance LANs using carrier sense multiple access with collision avoidance require devices to announce their intention to transmit by broadcasting a jamming signal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

CSMA/CD

A

Carrier Sense Multiple Access with Collision Detection Devices on a LAN listen for a carrier before transmitting data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

CBC-MAC

A

Cipher block chaining message authentication code uses encryption for data integrity and data origin authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Cell

A

An intersection of a row and a column

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Cell Suppression

A

A technique used to hide specific cells that contain sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

CPU

A

Central Processing Unit

Part of a computer that performs the logic, computation, and decision-making functions. It interprets and executes instructions as it receives them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Certificate

A

Digital identity used with a PKI. Generated and maintained by a certificate authority and used for authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

CRL

A

Certificate Revocation List

List that is maintained by the certificate authority of a PKI that contains information on all of the digital certificates that have been revoked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Certification

A

Technical evaluation of the security components and their compliance to a predefined security policy for the purpose of accreditation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Certification Authority

A

Component of a PKI that creates and maintains digital certificates throughout their life cycles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Change Control

A

Process of controlling the changes that take place during the life cycle of a system and documenting the necessary change control activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

CSU

A

Channel Service Unit

A line bridging device for use with T-carriers and that is required by PSTN provider at digital interface that terminate in a data service unit on the customer side.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

DSU

A

Data Service Unit

Telecom circuit terminating equipment that transforms digital data between telephone company lines and local equipment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Checklist Test

A

Copies of the plan are handed out to each functional area for examination to ensure the plan properly deals with area’s needs and vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Chosen-Ciphertext attack

A

Crypt-analysis attack where the attacker chooses a ciphertext and obtains its decryption under an unknown key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Chosen-plaintext Attack

A

Cryptanalysis attack where the attacker can choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Cipher

A

Another name of an algorithm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Ciphertext-only attack

A

Cryptanalysis attack where the attacker is assumed to have access only to a set of ciphertexts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

CIDR

A

Classless Interdomain Routing

A method for using the existing 32-bit internet address space efficiently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Client-Side Validation

A

Input validation is done at the client before it is even sent back to the server to process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Clipping Level

A

A threshold.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Closed System

A

Designs are built upon proprietary procedures, which inhibit interoperability capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

CMAC

A

Cipher message authentication code

Based upon and provides more security than CBC-MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

CMM

A

Block cipher mode that combines the CTR encryption mode and CBC-MAC. One encryption key is used for both authentication and encryption purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

CobiT

A

Set of control objectives used as a framework for IT governance developed by ISACA and the ITGI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Cognitive Passwords

A

Fact- or opinion-based information used to verify an individual’s identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Cohesion

A

A measurement that indicates how many different types of tasks a module needs to carry out.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Cold Site

A

Is just a building with power, raised floors, and utilities. No devices are available. This is the cheapest of the three options but can take weeks to get up and operational.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Collision

A

(1) A condition that is present when two or more terminals are in contention during simultaneous access attempts.
(2) In Cryptography, an instance when a has function generates the same output for different inputs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Collusion

A

Two or more people working together to carry out fraudulent activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Common Criteria

A

International standard used to assess the effectiveness of the security controls built into a system from functional and assurance perspectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Compilers

A

Tools that convert high-level language statements into the necessary machine-level format for specific processors to understand.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Compression Viruses

A

Another type of virus that appends itself to executables on the system and compresses them by using the user’s permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Concealment Cipher

A

Encryption method that hides a secret message within an open message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Confusion

A

Substitution processes used in encryption functions to increase randomness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Content-Based Access

A

Bases access decisions on the sensitivity of the data, not solely on subject identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Context-Based Access

A

Bases access decisions on the state of the situation, not solely on identity or content sensitivity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Different Types on Control Functions (6)

A

Deterrent - Discourage Attacker

Preventive - Stop an incident from occurring

Corrective - Fix items after an incident has occurred

Recovery - Restore necessary components to return to normal operations

Detective - Identify an incident’s activities after it took place

Compensating - Alternative control that provides similar protection as the original control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Control Types

A

Administrative, Technical (logical), and Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Control Unit

A

Part of the CPU that oversees the collection of instructions and data from memory and how they are passed to the processing components of the CPU.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Cookies

A

Data files used by web browsers and servers to keep browser state information and browsing preferences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Cooperative Multitasking

A

Multitasking scheduling scheme used by older OS to allow for computer resource time slicing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Copyright

A

A form of protection granted by law for original works of authorship fixed in a tangible medium of expression.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

COSO

A

Committee of Sponsoring Organizations

Internal Control Model used for corporate governance to help prevent fraud developed by the Committee of Sponsoring Organizations of the Treadway Commission.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Coupling

A

A measurement that indicates how much interaction one module requires for carrying out its tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

CRAMM

A

CCTA Risk Analysis and Management Method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

CCTA

A

Central Computing and Telecommunications Agency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

XSS Attack

A

Cross-Site scripting Attack

An attack where a vulnerability is found on a website that allows an attacker to inject malicious code into a web application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Crytanalysis

A

Practice of uncovering flaws within Cryptosystems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Cyptography

A

Science of secret writing that enables an entity to store and transmit data in a form that is available only to the intended individuals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Cryptology

A

The study of both cryptography and cryptanalysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Cryptosystem

A

Hardware of software implementation of cryptography that contains all the necessary software, protocols, algorithms and keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Data Bus

A

Physical connections between processing components and memory segments used to transmit data being used during processing procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Data Custodian

A

Individual responsible for implementing and maintaining security controls to meet security requirements outlined by data owner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Data Dictionary

A

Central repository of data elements and their relationships.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Data Diddling

A

The act of willfully modifying information, programs, or documentation in an effort to commit fraud or disrupt production.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

DEP

A

Data Execution Prevention

Memory protection mechanism used by some operation systems. Memory segments may be marked as non-executable so that they cannot be misused by malicious software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Data Hiding

A

Use of segregation in design decisions to protect software components from negatively interacting with each other. Commonly enforced through strict interfaces.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Data Mining

A

A methodology used by organizations to better understand their customers, products, markets, or any other phase of the business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Data Modeling

A

Considers data independently of the way the data are processed and of the components that process the data. A process used to define and analyze data requirements needed to support the business processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Data Owner

A

Individual responsible for the protection and classification of a specific data set.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

Data Structure

A

A representation of the logical relationship between elements of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Data Warehousing

A

Combines Data from multiple databases or data sources into a large database for the purpose of providing more extensive information retrieval and data analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Database

A

A cross-reference collection of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

DBMS

A

Database management system

Manages and Controls the Database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Decipher

A

Act of transforming data into a readable format.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Defense-in-depth

A

Implementation of multiple controls so that successful penetration and compromise is more difficult to attain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Delphi Method

A

Data collection method that happens in an anonymous fashion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Differential Crytanalysis

A

Cryptanalysis method that uses the study of how differences in an input can affect the resultant difference at the output.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

Diffie-Hellman Algorithm

A

First asymmetric algorithm created and is used to exchange symmetric key values. Based upon logarithms in finite fields.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

Diffusion

A

Transportation processes used in encryption functions to increase randomness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

DRM

A

Digital Rights Management

Access Control technologies commonly used to protect copyright material.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Digital Signals

A

Binary digits are represented and transmitted as discrete electrical pulses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

Digital Signature

A

Ensuring the authenticity and integrity of a message through the use of hashing algorithms and asymmetric algorithms. The message digest is encrypted with the sender’s private key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

DSL

A

Digital Subscriber Line

A set of technologies that provide Internet access by transmitting digital data over the wires of a local telephone network. DSL is used to digitize the ‘last mile’ and provide fast Internet Connectivity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Distance-vector routing protocol

A

A routing protocol that calculates paths based on the distance (or number of hops) and a vector (a direction).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

DNS Zone transfer

A

The process of replicating the databases containing the DNS data across a set of DNS servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

DNSSEC

A

A set of extensions to DNS that provide to DNS clients (resolvers) origin authentication of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attack types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

DoDAF

A

US Department of Defense architecture framework that ensures interoperability of systems to meet military mission goals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

DNS

A

Domain Name Server A hierarchical distributed naming system for computers, services, or any resource connected to an IP-based network. It associates various pieces of information with domain names assigned to each of the participating entities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

Dual-Homed Firewall

A

Device has two interfaces and sits between an untrusted network and trusted network to provide secure access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

DHCP

A

Dynamic Host Configuration Protocol

Industry-standard protocol used to dynamically assign IP addresses to network devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

DLLs

A

Dynamic Link Libraries

A set of subroutines that are shared by different applications and operating system processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

El Gamal Algorithm

A

Asymmetric algorithm based upon the Diffie-Hellman algorithm used for digital signatures, encryption, and key exchange.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

Elliptic Curve Cryptosystem Algorithm

A

Asymmetric algorithm based upon the algebraic structure of elliptic curves over finite fields. Used for digital signatures, encryption, and key exchange.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

E-Mail Spoofing

A

Activity in which the sender address and other parts of the e-mail header are altered to appear as though the e-mail originated from a different source. Since SMTP does not provide any authentication, it is easy to impersonate and forge e-mails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

ESP

A

Encapsulating Security Payload

Protocol Protocol within the IPSec suite used for integrity, authentication, and encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

EncipherK

A

Act of transforming data into an unreadable format.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

End-to-End encryption

A

The encryption of information at the point of origin within the communications network and postponing of decryption to the final destination point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

Ethernet

A

LAN technology
IEEE 802.3
48-bit MAC addressing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

Exposure

A

Presence of a vulnerability, which exposes the organization to a threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

FRAP

A

Facilitated Risk Analysis Process

A focused, qualitative approach that carries out pre-screening to save time and money.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

FMEA

A

Failure modes and effect analysis

Approach that dissects a component into its basic functions to identify flaws and those flaw’s effects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

Fault Tree Analysis

A

Approach to map specific flaws to root causes in complex systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

Federated Identity

A

A portable identity, and its associated entitlements, that can be used across business boundaries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

FDDI

A

Fiber Distributed Data Interface

Ring-based token network protocol that was derived from IEEE 802.4 token bus timed protocol. It can work with LAN or MAN environments and provides fault tolerance through dual-ring architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
155
Q

Foreign Key

A

An attribute of one table that is related to the primary key of another table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
156
Q

Fraggle Attack

A

A DDoS attack type on a computer that floods the target system with a large amount of UDP echo traffic to IP broadcast addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
157
Q

Frequency Analysis

A

Cryptanalysis process used to identify weaknesses within the cryptosystems by locating patterns in resulting ciphertext.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
158
Q

FDM

A

FREQUENCY-DIVISION MULTIPLEXING

An older technique in which the available transmission bandwidth of a circuit is divided by frequency into narrow bands, each used for a separate voice or data transmission channel, which many conversations can be carried on one circuit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
159
Q

Full-interruption Test

A

One in which regular operations are stopped and processing is moved to an alternate site.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
160
Q

Functionality versus effectiveness of Control

A

Functionality is what a control does

Effectiveness of controls is how well it does it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
161
Q

Fuzzing

A

A technique used to discover flaws and vulnerabilities in software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
162
Q

Garbage Collector

A

Tool that marks unused memory segments as usable to ensure that an OS does not run out memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
163
Q

General Registers

A

Temporary memory location the CPU uses during its processes of executing instructions.

The ALU’s ‘scratch pad’ it uses while carting out logic and math functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
164
Q

Guideline

A

Suggestions and best practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
165
Q

H.232

A

A standard that addresses call signaling and control, multimedia transport and control, and bandwidth control for point-to-point and multipoint conferences.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
166
Q

Hardware Segmentation

A

Physically mapping software to individual memory segments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
167
Q

HMAC

A

HASHED MESSAGE AUTHENTICATION CODE

Cryptographics hash function that uses a symmetric key value and is used for data integrity and data origin authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
168
Q

Hierarchical Data Model

A

Combines records and fields that are related in a logical tree structure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
169
Q

High Availability

A

Refers to a system, component, or environment that is continuously operational.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
170
Q

High-Level languages

A

Otherwise known as third-generation programming languages, due to their refined programming structures, using abstract statement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
171
Q

Honeypots

A

Systems that entice with the goal of protecting critical production systems. If two or more honeypots are used together, this is considered a honeynet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
172
Q

Hot site

A

Fully configured with hardware, software, and environmental needs. It can usually be up and running in a matter of hours. It is the most expensive option, but some companies cannot be out business longer than a day without very detrimental results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
173
Q

HTTPS

A

A combination of HTTP and SSL/TLS that is commonly used for secure internet connections and e-commerce transactions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
174
Q

Hybrid Cryptography

A

Combined use of symmetric and asymmetric algorithms where the symmetric key encrypts data and an asymmetric key encrypts the symmetric key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
175
Q

Hybrid Microkernel Architecture

A

Combination of monolithic and microkernel architectures.

The microkernel carries out critical operating system functionality, and the remaining functionality is carried out in a client/server model within kernel mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
176
Q

Hypervisor

A

Central program used to manage virtual machines within a simulated environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
177
Q

IEEE 80.21AE

A

MACSec

Standard that specifies a set of protocols to meet the security requirements for protecting data traversing Ehternet LANs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
178
Q

IEEE 802.1AR

A

Standard that specifies unique per-device indentifiers (DevID) and the management and cryptographic binding of a device (router, switch, access point) to its identifiers.

179
Q

Immunizer

A

Attaches code to the file or application, which would fool a virus into ‘thinking’ it was already infected.

180
Q

Information Gathering

A

Usually the first step in an attacker’s methodology, in which the information gathered may allow an attacker to infer additional information that can be used to compromise systems.

181
Q

ITSEC

A

Information Technology Security Evaluation Criteria

European standard used to assess the effectiveness of the security controls built into a system.

182
Q

IVs

A

Initialization Vectors

Values that are used with algorithms to increase randomness for cryptographic functions.

183
Q

Instruction Set

A

Set of operations and commands that can be implemented by a particular processor (CPU).

184
Q

ISDN

A

Integrated Services Digital Network

A circuit-switched telephone network system technology designed to allow digital transmission of voice and data over ordinary telephone copper wires.

185
Q

Integrity

A

Accuracy and reliability of the information and systems are provided and any unauthorized modification is prevented.

186
Q

IDEA

A

International Data Encryption Algorithm

Block symmetric cipher that uses a 128-bit key and 64-bit block size.

187
Q

ICMP

A

Internet Control Message Protocol

A core protocol of the IP suite used to send status and error messages.

188
Q

IGMP

A

Internet Group Management Protocol

Used by systems and adjacent routers on IP networks to establish and maintain multicast group memberships.

189
Q

IMAP

A

INTERNET MESSAGE ACCESS PROTOCOL

A method of accessing E-mail or bulletin board messages that are kept on a mail server.

Next Gen POP

190
Q

IP

A

INTERNET PROTOCOL

Core protocol of the TCP/IP Suite. Provides packet construction, addressing, and routing functionality.

191
Q

ISAKMP

A

INTERNET SECURITY ASSOCIATION AND KEY MANAGEMENT PROTOCOL

Used to establish security associates and an authentication framework in Internet connections.

Commonly used by IKE for key exchange.

192
Q

Interpreters

A

Tools that convert code written in interpreted languages to the machine-level format for processing.

193
Q

Interrupt

A

Software or hardware signal that indicates that system resources are needed for instruction processing.

194
Q

Interrupts

A

Values assigned to computer components to allow for efficient computer resource time slicing.

195
Q

ISATAP

A

INTRA-SITE AUTOMATIC TUNNEL ADDRESSING PROTOCOL

An IPv6 transition mechanism meant to transmit IPv6 packets between dual-stack nodes on top of an IPv4 network.

196
Q

IPSec

A

Protocol suite used to protect IP traffic through encryption and authentication.

De facto standard for VPN

197
Q

IPv6

A

IP version 6

128-bit addressing, integrated IPSec security protocol, simplified header formats, and some automated configuration.

198
Q

ISO/IEC 27000 Series

A

Industry- recognized best practices for the development and management of an information security management system.

199
Q

ISO/IEC 27005

A

International Standard for the implementation of a risk management program that integrates into an information security management system.

200
Q

ITIL

A

Best practices for information technology services management processes developed by the UK’s Office of Government Commerce

201
Q

Java Applets

A

Small comments (applets) that provide various functionalities and are delivered to users in the form of Java bytecode.

Can be run in a web browser using a Java Virtual Machine (JVM).

202
Q

Kerckhoff’s Principle

A

Concept that an algorithm should be known and only the keys should be kept secret.

203
Q

Kernel Mode (Supervisory State, Privilege Mode)

A

Mode that a CPU works within when carrying out more trusted process instructions.

The process has access to more computer resources when working in kernel versus user mode.

204
Q

Key

A

Sequence of bits that are used as instructions that govern the acts of cryptographic functions within an algorithm.

205
Q

Key Clustering

A

A weakness that would exist in a crytopsystem if two different keys would generate the same ciphertext from the same plaintext.

206
Q

KDFs

A

Key Derivation Functions

Generation of secret keys (subkeys) from an initial value (master key).

207
Q

Keyspace

A

A range of possible values used to construct keys.

208
Q

Keystream Generator

A

Component of a stream algorithm that creates random values for an encryption purposes.

209
Q

Known-plaintext Attack

A

Cryptanalysis attack where the attacker is assumed to have access to sets of corresponding plaintext and ciphertext.

210
Q

Layered OS Architecture

A

Architecture that separates system functionality into hierarchical layers.

211
Q

Limit Registers

A

Ending of address space assigned to a process. Used to ensure a process does not make a request outside its assigned memory boundaries.

212
Q

Linear Cryptanalysis

A

Cryptanalysis method that uses the study of affine transformation approximation in encryption processes.

213
Q

Link Encryption

A

Technology that encrypts full packets (all headers and data payload) and is carried out without the sender’s interaction.

214
Q

Link-State Routing Protocol

A

A routing protocol used in packet-switching networks where each router constructs a map of the connectivity within the network and calculates the best logical paths, which form its routing table.

215
Q

Logic Bomb

A

Executes a program, or string of code, when a certain event happens or a date and time arrives.

216
Q

Logical Addresses

A

Indirect addressing used by processes within an OS. The memory manager carries out logical-to-absolute address mapping.

217
Q

Machine Learning

A

A set of instructions in binary format that the computer’s processor can understand and work with directly.

218
Q

Macro Virus

A

A computer virus that spreads by binding itself to software such as Word or Excel.

219
Q

Maintenance Hooks

A

Code within software that provides a back door entry capability.

220
Q

Mandatory Vacation

A

Detective Administrative control used to uncover potential fraudulent activities by requiring a person to be away from the organization for a period of time.

221
Q

Maskable Interrupt

A

Interrupt value assigned to a non-critical operating system activity.

222
Q

MTBF

A

MEAN TIME BETWEEN FAILURES

Predicted amount of time between inherent failures of a system during operation.

223
Q

MTTR

A

MEAN TIME TO REPAIR

A measurement of the maintainability by representing the average time required to repair a failed component or device.

224
Q

MAC

A

MEDIA ACCESS CONTROL

Data communication protocol sub-layer of the data link layer specified in the OSI Model.

Provides hardware addressing and channel access control mechanisms that make it possible for several nodes to communicate within a multiple-access network that incorporates a shared medium.

225
Q

Meet-in-the-middle Attack

A

Cryptanalysis attack that tries to uncover a mathematical problem from two different ends.

226
Q

Meme Viruses

A

These are not actual computer viruses, but types of e-mail messages that are continually forwarded around the internet.

227
Q

Memory Card

A

Holds information but cannot process information.

228
Q

Mesh Topology

A

Network where each system must not only capture and disseminate its own data, but also serve as a relay for other systems; that is, it must collaborate to propagate the data in the network.

229
Q

MAC (Code)

A

MESSAGE AUTHENTICATION CODE

Keyed cryptographic hash function used for data integrity and data origin authentication.

230
Q

Metro Ethernet

A

A data link technology that is used as a metropolitan area network to connect customer networks to larger service networks or the Internet.

231
Q

MAN

A

METROPOLITAN AREA NETWORK

Data network intended to serve an area approximating that of a large city or college campus.

232
Q

Microarchitecture

A

Specific design of a microprocessor, which includes physical components that support a specific instruction set.

233
Q

Microkernel Architecture

A

Reduced amount of code running in kernel mode carrying out critical operating system functionality. Only the absolutely necessary code runs in kernel mode.

234
Q

Mobile Code

A

Code that can be transmitted across a network, to be executed by a system or device on the other end.

235
Q

MODAF

A

Architecture framework used mainly in military support missions developed by the British Ministry of Defense.

236
Q

Mode Transition

A

When the CPU has to change from processing code in user mode to kernel mode.

237
Q

Monolithic OS Architecture

A

All of the code of the OS working in kernel mode in an ad-hoc and non-modularized mode.

238
Q

Multilevel Security Policies

A

Outlines how a system can simultaneously process information at different classifications for users with different clearance levels.

239
Q

Multipart Virus

A

AKA Multipartitie Virus

Has several components, and can be distributed to different parts of the system. Infects and spread in multiple ways, which makes it harder to eradicate when identified.

240
Q

Multiplexing

A

A method of combining multiple channels of data over a single transmission line.

241
Q

Multiprogramming

A

Interleaved execution of more than one program (process) or task by a single OS.

242
Q

MPLS

A

MULTIPROTOCOL LABEL SWITCHING

A networking technology that directs data from one network node to the next based on short path labels.

243
Q

MIME

A

MULTIPURPOSE INTERNET MAIL EXTENSION

The standard for multimedia mail contents in the Internet Suite of Protocols.

244
Q

Multitasking

A

Simultaneous execution of more than one program or task by a single OS.

245
Q

Multithreading

A

Applications that can carry out multiple activities simultaneously by generating different instructions set.

246
Q

Natural Languages

A

AKA 5th Generation Programming Languages

Have the goal to create software that can solve problems by themselves. Used in systems that provide AI.

247
Q

NAT

A

NETWORK ADDRESS TRANSLATION

Process of modifying IP address information in packet headers while in transit across a traffic routing device, with the goal of reducing the demand for public IT addresses.

248
Q

Network Convergence

A

The combining of server, storage, and network capabilities into a single framework, which decreases the costs and complexity of data centers.

Converged Infrastructures provide the ability to pool resources, automate resource provisioning, and increase and decrease processing capacity quickly to meet the needs of dynamic computing workloads.

249
Q

NIST SP 800-30

A

Risk Management Guide for IT Systems.

A U.S. Federal Standard that is focused on IT Risks.

250
Q

NIST SP 800-53

A

Set of controls that are used to secure U.S. Federal Systems developed by NIST.

251
Q

Noise and Perturbation

A

A technique of inserting bogus information in the hopes of misdirecting an attacker or confusing the matter enough that the actual attack will not be fruitful.

252
Q

Non-maskable Interrupt

A

Interrupt Value assigned to a critical operating System Activity

253
Q

Object-Orientated Database

A

Designed to handle a variety of data, which is more dynamic in nature than a relational database.

254
Q

ORD

A

Object-Relational Database

Uses object-relational database management system (ORDBMS) and is a relational database with a software front end that is written in an object-orientated programming language.

255
Q

One-time Pad

A

A system that randomly generates a private key and is used only once to encrypt a message that is then decrypted by the receiver using a matching one-time pad and key.

256
Q

One-Way Hash

A

Cryptographic process that takes an arbitrary amount of data and generates a fixed-length value.

Used for integrity protection.

257
Q

OSCP

A

Online Certificate Status Protocol

Automated method of maintaining revoked certificates within a PKI.

258
Q

Open Mail Relay

A

An SMTP server configured in such a way that it allows anyone on the internet to send email through it, not just mail destined to or originating from known users.

259
Q

Open System

A

Designs are built upon accepted standards to allow for interoperability.

260
Q

OSI Model

A

Open System Interconnection

7 Layer Model

261
Q

OCTAVE

A

Operationally Critical Threat, Asset, and Vulnerability Evaluation

Team-orientated approach that assesses organizational and IT risks through facilitated workshops.

262
Q

Out-of-Band Method

A

Sending data through an alternative communication channel.

263
Q

Packages-EALs

A

Functional and assurance requirements are bundled into packages for reuse.

This component describes what must be met to achieve specific EAL ratings.

264
Q

Parallel Test

A

One in which some systems are actually run at the alternate site.

265
Q

Parameter Validation

A

The values that are being received by the application are validated to be within defined limits before the server application processes them within the system.

266
Q

Passive Attack

A

Attack where the attacker does not interact with processing or communication activities.

267
Q

PII

A

Personally Identifiable Information

Data that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual.

268
Q

Phishing

A

Scan in which the perpetrator sends out legitimate-looking emails, in an effort to phish for personal and financial information from the recipient.

269
Q

Ping of death

A

A DoS attack type on a computer that involves sending malformed or oversized ICMP packets to a target.

270
Q

Plaintext

A

A message before it has been encrypted or after it has been decrypted using a specific algorithm and key.

AKA cleartext.

271
Q

Policy

A

High-level document that outlines senior management’s security directives.

272
Q

Polymorphic Virus

A

Produces varied but operational copies of itself.

273
Q

Polymorphism

A

Two objects can receive the same input and have different outputs.

274
Q

POP

A

POST OFFICE PROTOCOL

Internet Standard protocol used by e-mail clients to retrieve email from a remote server and supports simple download and delete requirements for access to remote mailboxes.

275
Q

Preemptive Multitasking

A

Multitasking scheduling scheme used by operating systems to allow for computer resource time slicing.

Use in newer OS.

276
Q

PGP Cryptosystem

A

Pretty Good Privacy Cryptosystem

Used to integrate public key cryptography with email functionality and data encryption.

277
Q

Primary Key

A

Columns that make each row unique.

278
Q

PBX

A

PRIVATE BRANCH EXCHANGE

Small version of the phone company’s central SO.

279
Q

Private Key

A

Value used in public key cryptography that is used for decryption and signature creation and known to only key owner.

280
Q

Procedures

A

Step by step implementation instructions

281
Q

Process

A

program loaded in memory within an OS.

282
Q

Process Isolation

A

protection mechanism provided by OS that can be implemented as encapsulation, time multiplexing of shared resources, naming distinctions, and virtual memory mapping.

283
Q

Process States

A

Ready, Running, Blocked

284
Q

Program Counter

A

Holds the memory address for the following instructions the CPU needs to act upon.

285
Q

PSW

A

PROGRAM STATUS WORD

Condition variable that indicates to the CPU what mode instructions need to be carried out in.

286
Q

Protection Profile

A

Description of a needed security solution

287
Q

Proxy Server

A

System that acts as an intermediary for requests from clients seeking resources from other sources.

288
Q

Public Key

A

Value used in public key cryptography that is used for encryption and signature validation that can be known by all parties.

289
Q

Public Key Cryptography

A

An asymmetric cryptosystem where the encrypting and decrypting keys are different and it is computationally infeasible to calculate one from another.

Encrypting Key = Public
Decrypting Key = Kept Secret

290
Q

PSTN

A

PUBLIC-SWITCHED TELEPHONE NETWORK

Public circuit-switched telephone network, which is made up of telephone lines, fiber-optic cables, cell networks.

Fixed-line analog telephone system.

291
Q

Qualitative Risk Analysis

A

Opinion-based method of analyzing risk with the use of scenarios and ratings.

292
Q

Quantitative Risk Analysis

A

Assigning monetary and numeric values to all the data elements of a risk assessment.

293
Q

Quantum Cryptography

A

Use of quantum mechanical functions to provide strong cryptographic key exchange.

294
Q

Race Condition

A

Two or more processes attempt to carry out their activity on one resource at the same time.

295
Q

RAM

A

Hardware inside a computer that retains memory on a short-term basis and stores information while the computer is in use.

296
Q

Random Number Generator

A

Algorithm used to create values that are used in cryptographic functions to add randomness.

297
Q

RC4

A

Stream symmetric cipher

Used in SSL and WEP

298
Q

RC5

A

Block symmetric cipher that uses variable block sizes and variable-length key sizes.

299
Q

RC6

A

Clock symmetric cipher that uses a 128-bit block size and variable-length key sizes.

Built on RC5 algorithm.

300
Q

RTP

A

REAL TIME TRANSPORT PROTOCOL

Used to transmit audio and video over IP-based networks.

Used in conjunction with RTCP.

301
Q

Reciprocal Agreement

A

One in which a company promises another company it cane move in and share space if it experiences a disaster, and vise versa.

302
Q

Record

A

A collection of related data items.

303
Q

RPO

A

Recovery Point Objective

A measurement of the point prior to an outage to which data are to be restored.

304
Q

RTO

A

RECOVERY TIME OBJECTIVE

The earliest time period and a service level within which a business process must be restored after a disaster to avoid unacceptable consequences.

305
Q

Reference Monitor

A

Concept that defines a set of design requirements of a reference validation mechanism (security kernel), which enforces an access control policy over subject’s (processes, users) ability to perform operations (read, write, execute) on objects (files, resources) on a system.

306
Q

Register

A

Small, temporary memory storage units integrated and used by the CPU during its processing functions.

307
Q

RA

A

Registration Authority

Purpose is to verify an end entity’s identity and determine whether it is entitled to have a public key certificate issues.

308
Q

Relational Database Model

A

Data that is organized in two-dimensional tables or relations.

309
Q

RATs

A

Malicious programs that run on systems and allow intruders to access and use a system remotely.

310
Q

RADIUS

A

REMOTE AUTHENTICATION DIAL-IN USER SERVICE

A network protocol that provides client/server authentication and authorization, and audits remote users.

311
Q

Remote Journaling

A

Involves transmitting the journal or transaction log offsite to a backup facility.

312
Q

Replay Attack

A

Occurs when an attacker intercepts authentication information through the use of network monitoring utilities. The attacker then ‘replays’ this information to the security system in an effort to gain access to the system.

313
Q

Residual Risk

A

Risk that remains after implementing a control.

Threats x Vulnerabilities x assets x (control gap) = residual risk

314
Q

Restricted Interface

A

Limits the user’s environment within the system, thus limiting access to objects.

315
Q

Rijndael

A

Block symmetric cipher that was chosen to fulfill the AES.

Uses 128-bit block size and various key lengths.

316
Q

Ring Topology

A

Each system connects to two other systems, forming a single, unidirectional network pathway for signals, thus forming a ring.

317
Q

Risk

A

The probability of a threat agent exploiting a vulnerability and the associated impact.

318
Q

Rollback

A

An operation that ends a current transaction and cancels all the recent changes to the database until the previous checkpoint/commit point.

319
Q

ROM

A

Computer memory chips with preprogrammed circuits for storing such software as word processors and spreadsheets. Information in the computer’s ROM is permanently maintained even when the computer is turned off.

320
Q

Rootkit

A

Set of malicious tools that are loaded on a compromised system through stealthy techniques. The tools are used to carry out more attacks on either the infected systems or surrounding systems.

321
Q

Rotation of Duties

A

Detective administrative control used to uncover potential fraudulent activities.

322
Q

Rule-Based Access

A

Access is based on a list of rules created or authorized by system owners that specify the privileges granted to users.

323
Q

Running Key Cipher

A

Substitution cipher that creates keystream values, commonly from agree-upon text passages, to be used for encryption purposes.

324
Q

SABSA

A

Framework risk-driven enterprise security architecture that maps to business initiatives, similar to the Zachman Framework.

325
Q

Sandbox

A

A virtual environment that allows for very fine-grained control over the actions that code within the machine is permitted to take. This is designed to allow safe execution of untrusted code from remote sources.

326
Q

Schema

A

Defines the structure of the database.

327
Q

Screened Host

A

A firewall that communicates directly with a perimeter router and the internal network. The router carries out filtering activities on the traffic before it reaches the firewall.

328
Q

Screened Subnet Architecture

A

When two filtering devices are used to create a DMZ.

The external device screens the traffic entering the DMZ network, and the internal filtering device screens the traffic before it enters the internal network.

329
Q

Scytale Cipher

A

A simple transposition cipher system that employs a rod of a certain thickness around which was wrapped a long, thin strip of parchment.

330
Q

SET

A

SECURE ELECTRONIC TRANSACTION

The SET specification has been developed by VISA and MASTERCARD to allow for secure credit card and offline debit car transactions.

331
Q

S/MIME

A

Secure MIME

Secure/Multipurpose Internet Mail Extensions

Outlines how public key cryptography can be used to secure MIME data types.

332
Q

SSH

A

Secure Shell

Network protocol that allows for a secure connection to a remote system. Developed to replace Telnet and other insecure remote shell methods.

333
Q

SAML

A

Security Assertion Markup Language

An XML standard that allows the exchange of authentication and authorization data to be shared between security domains.

334
Q

Security Assurance Requirements

A

Measures taken during development and evaluation of the product to assure compliance with the claimed security functionality.

335
Q

Security Domain

A

Resources within this logical structure are working under the same security policy and managed by the same group.

336
Q

Security Functional Requirements

A

Individual security functions which must be provided by a product.

337
Q

Security Kernel

A

The central part of a computer system that implements the fundamental security procedures for controlling access to system resources.

338
Q

Security Perimeter

A

Mechanism used to delineate between the components within and outside of the trusted computing base.

339
Q

Security Policy

A

Strategic tool used to dictate how sensitive information and resources are to be managed and protected.

340
Q

Security Target

A

Vendor’s within explanation of the security functionality and assurance mechanisms that meet the needed security solution.

341
Q

Security Through Obscurity

A

Relying upon the secrecy or complexity of an item as its security, instead of practicing solid security practices.

342
Q

Self-Garbling Virus

A

Attempts to hide from antivirus software by modifying its own code so that it does not match predefined signatures.

343
Q

SPF

A

Sender Policy Framework

An email validation system designed to prevent email spam by detecting email spoofing, a common vulnerability, by verifying sender IP address.

344
Q

Separation of Duties

A

Preventive administrative control used to ensure one person cannot carry out a critical task alone.

345
Q

SSI

A

Server-Side Includes

An interpreted server-side scripting langauge used almost exclusively for web-based communication. It is commonly used to include the contents of one or more files into a web page on a web server. Allows web developers to reuse content by inserting the same content into multiple web documents.

346
Q

SPML

A

SERVICE PROVISIONING MARKUP LANGUAGE

Allows for the automation of user management and access entitlement configuration related to electronically published services across multiple provisioning systems.

347
Q

Session Hijacking

A

An intruder takes over a connection after the original source has been authenticated.

348
Q

SIP

A

SESSION INITATION PROTOCOL

The signaling protocol widely used for controlling communication, as in voice and video calls over IP based networks.

349
Q

Session Keys

A

Symmetric keys have a short lifespan, thus providing more protection than static keys with longer lifespans.

350
Q

Shoulder Surfing

A

Viewing information in an unauthorized manner by looking over the should of someone else.

351
Q

Side-Channel Attack

A

Non-intrusive attack that uses information that has been gathered to uncover sensitive data or processing functions. Often tries to figure out how a component works without trying to compromise any type of flaw or weakness.

352
Q

SMTP

A

SIMPLE MAIL TRANSFER PROTOCOL

An Internet standard protocol for email transmission across IP based networks.

353
Q

SNMP

A

Simple Network Management Protocol

Provides remote administration of network device; simple because the agent requires minimal software.

354
Q

SOAP

A

SIMPLE OBJECT ACCESS PROTOCOL

A lightweight protocol for exchange of information in a decentralized, distributed environment.

355
Q

Simulation Test

A

A practice execution of the plan takes place. A specific scenario is established, and the simulation continues up to the point of actual relocation to the alternate site.

356
Q

SLE

A

SINGLE LOSS EXPECTANCY

One instance of an expected loss if a specific vulnerability is exploited and how it affects a single asst.

Asset Value x Exposure Factor = SLE

357
Q

Six Sigma

A

Business management strategy developed by Motorola with the goal of improving business processes.

358
Q

Smart Card

A

Plastic Cards, typically with an electronic chip embedded, that contain electronic value tokens.

359
Q

Smurf Attack

A

A DDoS attack type on a computer that floods the target system with spoofed broadcast ICMP packets.

360
Q

Social Engineering

A

Gaining unauthorized access by tricking someone into divulging sensitive information.

361
Q

SCM

A

SOFTWARE CONFIGURATION MANAGEMENT

Identifies the attributes of software at various points in time, and performs a methodical control of changes for the purpose of maintaining software integrity and traceability throughout the software development life cycle.

362
Q

Software deadlock

A

Two processes cannot complete their activities because they are both waiting for system resources to be released.

363
Q

Software escrow

A

Storing of the source code of software with a third-part escrow agent. The software source code is released to the licensee if the licensor files for bankruptcy or fails to maintain and update the software product as promised.

364
Q

Source Routing

A

Allows a sender of a packet to specify the route the packet takes through the network versus routers determining the path.

365
Q

STP

A

SPANNING TREE PROTOCOL

A network protocol that ensures a loop-free topology for any bridged Ethernet LAN and allows redundant links to be available in case connection links go down.

366
Q

Special Registers

A

Temporary memory location that holds critical processing parameters. They hold values as in the program counter, stack pointer, and program status word.

367
Q

Stack Memory

A

Construct that is made up of individually addressable buffers. Process-to-Process communication takes place through the use of stacks.

368
Q

Standard

A

Compulsory rules that support the security policies.

369
Q

Star Topology

A

Network consists of one central device, which acts as a conduit to transmit messages.

370
Q

SOW

A

STATEMENT OF WORK

Describes the product and customer requirements. A detailed-orientated SOW will help ensure that these requirements are properly understood and assumptions are not made.

371
Q

Static Analysis

A

A debugging technique that is carried out by examining the code without executing the program, and therefore is carried out before the program is compiled.

372
Q

Statistical Attack

A

Cryptanalysis attack that uses identified statistical patterns.

373
Q

STDM

A

STATISTICAL TIME-DIVISION MULTIPLEXING

This form of of multiplexing uses all available time slots to send significant information and handles inbound data on a first come- first served basis.

374
Q

Stealth Virus

A

A virus that hides the modifications it has made. The virus tries to trick antivirus software by intercepting its requests to the operating system and providing false and bogus information.

375
Q

Steganography

A

1) The method of concealing the existence of a message or data within seemingly innocent covers.
2) A technology used to embed information in for example, audio and graphical material. The audio and graphical materials appear unaltered until a stenography tool is used to reveal the hidden message.

376
Q

Stream Cipher

A

An encryption method in which a cryptographic key and an algorithm are applied to each bit in a datastream, one bit at a time.

377
Q

Structured walk-through test

A

Representatives from each functional area or department get together and walk through the plan from beginning to end.

378
Q

Subject

A

An active entity that requests access to an object or the data within an object.

379
Q

Subnet

A

Logical subdivision of a network that improves network administration and helps reduce network traffic congestion. Process of segmenting a network into smaller networks through the use of an addressing scheme made up of network and host portions.

380
Q

Substitution Cipher

A

Encryption method that uses an algorithm that changes out (substitutes) one value for another value.

381
Q

Symmetric Algorithm

A

Encryption method where the sender and receiver use an instance of the same key for encryption and decryption process.

382
Q

Symmetric Mode Multiprocessing

A

When a computer has two or more CPUs and each CPU is being used in a load-balancing method.

383
Q

SYN Flood

A

DoS Attack where an attacker sends a succession of SYN packets with the goal of overwhelming the victim system so that it is unresponsive to legitimate traffic.

384
Q

Synchronous Communication

A

Transmission sequencing technology that uses a clocking pulse or timing scheme for data transfer synchronization.

385
Q

SONET and SDH

A

Synchronous Optical Networking (SONET) and Synchronous Digital Hierarchy (SDH)

Standardized multiplexing protocols that transfer multiple digital bit streams over optical fiber and allow for simultaneous transportation of many different circuits of differing origin within a single framing protocol.

386
Q

Synchronous Token Device

A

Synchronizes with the authentication service by using time or a counter as the core piece of the authentication process. If the synchronization is time-based, the token device and the authentication service must hold the same time within their internal clocks.

387
Q

SDLC

A

SYSTEM DEVELOPMENT LIFE CYCLE

The scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation, operation and maintenance, and ultimately, its disposal, which instigates another system initiation.

388
Q

TOE

A

TARGET OF EVALUATION

Product proposed to provide a needed security solutions.

389
Q

T-carriers

A

Dedicated lines that can carry voice and data information over trunk lines.

390
Q

TCP/IP Models

A

Standardization of device-based network communication through a modular four-layer architecture.

391
Q

Teredo

A

Transition mechanism for migrating from IPv4 to IPv6. it allows systems to use IPv6 to communicate if their traffice has to transverse an IPv4 network.

392
Q

Thread

A

Instruction set generated by a process when it has a specific activity that needs to be carried out by an OS. When the activity is finished, the thread is destroyed.

393
Q

Threat

A

The danger of a threat agent exploiting a vulnerability.

394
Q

Threat Agent

A

Entity that can exploit a vulnerability

395
Q

Threat Modeling

A

A systematic approach used to understand how different threats could be realized and how a successful compromise could take place.

396
Q

Time Multiplexing

A

Technology that allows processes to use the same resources

397
Q

TDM

A

Time-Division Multiplexing

A type of multiplexing in which two or more bit streams or signals are transferred apparently simultaneously as sub-channels in one communication channel, but are physically taking turns on a single channel.

398
Q

TOC/TOU

A

TIME-OF-CHECK/TIME-OF-USE ATTACK

Attacker manipulates the ‘condition check’ step and the ‘use’ step within software to allow for unauthorized activity.

399
Q

TOGAF

A

Enterprise architecture framework used to define and understand a business environment developed by The Open Group.

400
Q

Token Ring

A

LAN medium access technology that controls network communication traffic through the use of token frames. This technology has been mostly replaced by Ethernet.

401
Q

Total Risk

A

Full Risk amount before a control is put into place.

Threats x Vulnerabilities x Assets = Total Risk

402
Q

Trade Secrets

A

Proprietary business or technical information, processes, designs, practices, etc., that are confidential and critical to the business.

403
Q

Trademark

A

Protect words, names, product shapes, symbols, colors, or a combination of these used to identify products or a company. These items are used to distinguish products from the competitors’ products.

404
Q

TCP

A

TRANSMISSION CONTROL PROTOCOL

The major transport protocol in the Internet suite of protocols providing reliable, connection-orientated, full-duplex streams.

405
Q

Transport Mode

A

Mode that IPSec protocols can work in that provides protection for packet data payload.

406
Q

Transposition

A

Encryption method that shifts (permutation) values.

407
Q

3-DES

A

Triple DES

Symmetric cipher that applies DES three times to each block of data during the encryption process.

408
Q

Trojan Horse

A

A program that is disguised as another program with the goal of carrying out malicious activities in the background without the user knowing.

409
Q

TCSEC

A

TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA

U.S. DoD standard used to assess the effectiveness of the security controls built into a system. Replaced by the Common Criteria. Also known as the Orange Book.

410
Q

TCB

A

TRUSTED COMPUTING BASE

A collection of all the hardware, software, and firmware components within a system that provide security and enforce the system’s security policy.

411
Q

Trusted Path

A

Trustworthy software channel that is used for communication between two processes that cannot be circumvented.

412
Q

Tunnel Mode

A

Mode that IPSec protocols can work in that provides protection for packet headers and data payload.

413
Q

Tuple

A

A row in a 2-D Database

414
Q

Two-Phase Commit

A

A mechanism that is another control used in databases to ensure that integrity of the data held within the database.

415
Q

Type I Error

A

When a biometric system rejects an authorized individual (FRR)

416
Q

Type II Error

A

When the system accepts impostors who should be rejected (FAR)

417
Q

Uncertainty Analysis

A

Assigning Confidence level values to data elements.

418
Q

UDP

A

User Datagram Protocol

Connectionless, unreliable transport layer protocol, which is considered a ‘best effort’ protocol.

419
Q

User Mode

A

‘Problem State’

Protection Mode that a CPU works within when carrying out less trusted process instructions.

420
Q

User Provisioning

A

The creation, maintenance, and deactivation of user objects and attributes as they exist in one or more systems, directories, or applications, in response to business processes.

421
Q

Validation

A

Determines if the product provides the necessary solution for the intended real-world problem.

422
Q

Verification

A

Determines if the product accurately represents and meets the specs.

423
Q

Very High-Level Languages

A

Otherwise known as 4th generation programming languages and are meant to take natural language-based statements one step ahead.

424
Q

View

A

A virtual relation defined by the database administrator in order to keep subjects from viewing certain data.

425
Q

VLAN

A

VIRTUAL LOCAL AREA NETWORK

A group of hosts that communicate as if they were attached to the same broadcast domain, regardless of their physical location. VLAN membership can be configured through software instead of physically relocating devices or connections, which allows for easier centralized management.

426
Q

Virtual Memory

A

Combination of main memory (RAM) and secondary memory within an OS.

427
Q

Virutalization

A

Creation of a simulated environment (hardware platform, OS, Storage, etc.) that allows for central control and scalability.

428
Q

Virus

A

A small application, or string of code, that infects host applications. It is a programming code that can replicate itself and spread from one system to another.

429
Q

Vishing

A

VOICE AND PHISHING

Social engineering activity over the telephone system, most often using features faciliated by VoIP, to gain unauthorized access to sensitive data.

430
Q

VLAN Hopping

A

An exploit that allows an attacker on a VLAN to gain access to traffic on other VLANs that would normally not be accessible.

431
Q

VoIP

A

VOICE OVER IP

The set of protocols, technologies, methodologies, and transmission techniques involved in the delivery of voice data and multimedia sessions over IP-based networks.

432
Q

Vulnerability

A

Weakness or a lack of a countermeasure.

433
Q

War Dialing

A

When a specialized program is used to automatically scan a list of telephone numbers to search for computers for the purpose of exploitation and hacking.

434
Q

Warm Site

A

Does not have computers, but it does have some peripheral devices, such as disk drives, controllers, and tape drives. This option is less expensive than a hot site but takes more effort and time to become operational.

435
Q

WDM

A

WAVE-DIVISION MULTIPLEXING

Multiplying the available capacity of optical fibers through use of parallel channels, with each channel on a dedicated wavelength of light. The bandwidth of an optical fiber can be divided into as many as 160 channels.

436
Q

Web Proxy

A

A piece of software installed on a system that is designed to intercept all traffic between the local web browser and the web server.

437
Q

WAN

A

WIDE AREA NETWORK

A telecommunication network that covers a broad area and allows a business to effectively carry out its daily function, regardless of location.

438
Q

Wiretapping

A

A passive attack that eavesdrops on communications. It is only legal with prior consent or a warrant.

439
Q

WBS

A

WORK BREAKDOWN STRUCTURE

A project management tool used to define and group a project’s individual work elements in an organized manner.

440
Q

Wormhole Attack

A

This takes place when an attacker captures packets at one location in the network and tunnels them to another location in the network for a second attacker to use against a target system.

441
Q

Worms

A

These are different from viruses in that they can reproduce on their own without a host application and are self-contained programs.

442
Q

Zachman Framework

A

Enterprise architecture framework used to define and understand a business environment developed by John Zachman.

443
Q

Zero Knowledge Proof

A

One entity can prove something to be true without providing a secret value.

SSCP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions