Weak Spots Flashcards
SAML
Used to exchange authentication and authorization information between federated organizations; often SSO
SPML
Service Provisioning Markup Language. Designed for exchanging user information for federated identity SSO purposes; can display LDAP based directory information in XML format.
SPML is used to provision users, resources, and services, not for authentication and authorization
Type 4 Authentication
Somewhere you are (IP/MAC address)
Type 5 Authentication
Something you do (signature, pattern unlock)
Due Care
Due care principle states that an individual should react in a situation using the same level of care that would be expected from any reasonable person.
Due Diligence
Due diligence is more specific than due care; states that an individual assigned a responsibility should exercise due care to complete it accurately in a timely manner
SOC 1
Financial audit report; has Type 1 and Type 2.
“focuses guidance for auditors assessing financial statement controls at service organizations”; internal use
SOC 2
IT security audit report; has Type 1 and Type 2; available to management and others under strict NDA–not widely public
SOC 3
More generalized, less sensitive version of SOC 2 IT security audit report ; public facing document, sanitized
Atomicity
All or nothing; if part fails, the entire tx must fail and roll back
Consistency
Rules must be all still in tact after a tx
Isolation
Txs operate separately from each other. One tx must complete in its entirety, before the next is allowed to modify the same data
Durability
One a tx is committed to a db, it must be preserved, by way of backup mechanisms such as tx logs
Confusion
Relationship between key and ciphertext. One bit change in key should cause 50% change in ciphertext
Diffusion
Relationship between plain text and cipher text. One bit change in plain text should cause 50% change in ciphertext
SOC (#) Type 1
Describes controls and provides auditors opinion based on that description. Covers a single point in time and does not involve actual testing of the controls
SOC (#) Type 2
Covers a minimum 6 month point in time and includes opinion of auditor about effectiveness based on ACTUAL testing
SDLC (First half)
1) Project initiation and planning; 2) Functional requirements definition; 3) System design specification
SDLC (Second half)
4) Development and implementation; 5) Documentation and common program controls; 6) Testing and evaluation (which includes certification and accreditation); 7) Transition to production / implementation
Swapping
Moving entire process from memory to disk
Paging
Moving fixed-length blocks of memory to disk
DARPA TCP/IP Model Layers To to Bottom
Application / Host-to-host Transport / Internet / Network access
What layers are segements, packets, frames, and bits at
Transport/segments Network/packet Datalink/frames Physical/bits
GDPR provisions
data breach notification in 72 hours; each member nation must create a centralized data protection authority; individuals must have access to their own data; information must be transferrable; individuals have right to be forgotten / have information deleted
Forced Browsing
Brute-force attempt to access content by modifying urls or trying /admin
CSMA/CD
half duplex; one device at a time, if collision occurs, random wait
STRIDE
an aggregated threat-modeling methodology developed by Microsoft (Spoofing; tampering; repudiation; information disclosed; DoS; elevation of privilege)
Live workloads
Simulated behavior, and do not involve live data
Virtual memory
Maps hw memory addresses to applications; not a copy process to disk technique
Type I biometric errors
False reject rate
Type II biometric errors
False accept rate
Boundary testing
A specific form of negative testing in which values that are known to be out of
the range of accepted values are input into given form fields to determine whether the application
handles such errors appropriately.
Positive testing
A form of software testing that is intended to determine whether an application is
working as it is designed to work.
CRUD testing
Create. Read. Update. Delete. A form of software testing that is intended to ensure that database objects are being
created correctly. CRUD testing can be used to reveal and troubleshoot caching issues as well as any
issues that might arise from simultaneous attempts to perform the same function.
Extra SLC Phases (post SDLC)
8) Operation and maintenance support; 9) Revision and system replacement / disposal
