Study 6 Flashcards
SP800-61
Incident Handling
NTP Network Time Protocol
Port 123
Inculpatory
to prove they did it
Exculpatory
to prove they did NOT DO it
Best Evidence
Original files
Direct Evidence
from a witness sense ( needs backup)
Real Evidence
something you can touch= , Fingerprint, gun
Demonstrative Evidence
reenactment
Corroborative Evidence
any supported Evidence
Conclusive Evidence
stands on it own, (Video)
Circumstantial Evidence
like a blood trial of blood
Documentary Evidence
(hearsay Rule) paper documents
Documentary Evidence
(hearsay Rule) paper documents
the five key principle that forms the core of the COBIT5 framework?
1) Meeting Stakeholders needs,
2) Covering the enterprise end to end,
3) Apply a single integrated framework,
4) Enabling a holistic approach,
5) Separating governance from management.
the five key principle that forms the core of the COBIT5 framework?
1) Meeting Stakeholders needs,
2) Covering the enterprise end to end,
3) Apply a single integrated framework,
4) Enabling a holistic approach,
5) Separating governance from management.
many security products begin the process of generating a pseudorandom key by having the user tap random keys on a keyboard or randomly moving the mouse. Such activity is known as ?
entropy.
pseudorandom
randomness
is the marriage of object-oriented and relational technologies combining the attributes of both?
object-relational database
is common in all major software vendors and is important to maintaining a trusted computing platform.
Code Signing
Looks for sequences of bit called signature that are typical malware programs.
Scanners
Defend against malware by appending sections of themselves to files – sometime in the same way Malware append themselves. it continuously check a file for changes and report changes as possible malware behavior.
Immunizers
Focus on detecting potential abnormal behavior such as writing to the boot sector or the master boot record, or making changes to executable files. It can potentially detect malware at an early stage. Most hardware based anti-malware mechanism are based on this concept.
Behavior Blocker
interpret DoS and read-only memory (ROM) BIOS calls, looking for malware like actions.
Active monitor
are simulated environments to which IDSs seamlessly transfer detected attackers and are designed to convince an attacker that the attack is going according to the plan.
Padded cells
In this Block Cipher method of encryption, a single bit change in the plain text results in multiple changes permutated throughout the rest of the encryption cycles so in the end, the ciphertext has completely changed.
Diffusion
