Terminology

Question 1

Rainbow Table

Answer 1

contains hashes of common passwords to speed up brute force attacks. Defeated by salting the hashes differently for each user on a system.

Question 2

https://haveibeenpwned.com

Answer 2

website to see if your password has been stolen by email address

Question 3

skimming

Answer 3

stealing credit card information usually by adding hardware to a legitimate reader

Question 4

evasion attacks

Answer 4

Cause an AI to misunderstand something like SPAM by changing your pattern

Question 5

poisoning the training data

Answer 5

modify an AI’s training data to confuse it or cause it to act incorrectly.

Question 6

downgrade attack

Answer 6

A cryptographic attack where the attacker exploits the need for backward compatibility to force a computer system to abandon the use of encrypted messages in favor of plaintext messages (Prof Messer considers this a downgrade attack even if the encryption version is moved to something insecure rather than completely plaintext)

Question 7

risk register

Answer 7

A risk register is a document showing the results of risk assessments in a comprehensible format. The register may resemble the heat map risk matrix shown earlier with columns for impact and likelihood ratings, date of identification, description, countermeasures, owner/route for escalation, and status. Risk registers are also commonly depicted as scatterplot graphs, where impact and likelihood are each an axis, and the plot point is associated with a legend that includes more information about the nature of the plotted risk.

Question 8

data owner

Answer 8

role with ultimate responsibility for maintaining confidentiality, integrity and availability of info asset

Question 9

data steward

Answer 9

responsible for data quality, i.e. for ensuring data is labeled and identified with appropriate metadata and that data is collected and stored in a format and with values that comply with applicable laws and regulations

Question 10

data custodian

Answer 10

manages the system on which the data is stored; enforces access control, encryption and backup/recovery measures.

Question 11

Data Privacy Officer (DPO)

Answer 11

responsible for oversight of any personally identifiable information (PII) assets managed by the company. The privacy officer ensures that the processing, disclosure, and retention of PII complies with legal and regulatory frameworks.

Question 12

Data controller

Answer 12

responsible for determining why and how data is stored, collected, and used and for ensuring that these purposes and means are lawful. The data controller has ultimate responsibility for privacy breaches, and is not permitted to transfer that responsibility.

Question 13

Data processor

Answer 13

engaged by the data controller to assist with technical collection, storage, or analysis tasks. A data processor follows the instructions of a data controller with regard to collection or processing.

Question 14

dns sinkhole

Answer 14

Temporary DNS record that redirects malicious traffic to a controlled IP address

Question 15

hping

Answer 15

Open-source spoofing tool that provides a penetration tester with the ability to craft network packets to exploit vulnerable firewalls and IDSs.

Question 16

tcpreplay

Answer 16

tcpreplay takes previously captured traffic that has been saved to a .pcap file and replays it though a network interface (linux.die.net/man/1/tcpreplay).