Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP - 13 - Software Development Security Principles > 01 - Flash Cards > Flashcards

01 - Flash Cards

(66 cards)

Start Studying
1
Q

Information

A
  • Organization’s information is a term that refers to all the information pertaining to the organization.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

System

A
  • In this context, systems refer to IT systems used to provide services.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Devices

A
  • Broad term that may refer to computing systems, servers, laptops, smartphones and external devices such as printers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Subject

A
  • Active entities such as users that access passive object to gain information from or about an object.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Object

A
  • Passive entities such as files and databases that provide subject with information.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CIA Triad

A
  • Confidentiality
  • Integrity
  • Availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Confidentiality

A
  • Is a concept that encompasses a set of measures used to protect the secrecy of data, resources, and objects.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Integrity

A
  • Ability to protect reliability and correctness of data/information.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Availability

A
  • Refers to uninterrupted access to objects to all authorized subjects.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Types of Access Control

A
  • Preventive Access Control
  • Detective Access Control
  • Corrective Access Control
  • Deterrent Access Control
  • Directive Access Control
  • Compensating Access Control
  • Administrative Access Control
  • Logical/Technical Control
  • Physical Control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Preventive Access Control

A
  • Type of control that attempts to prevent incidents before they occur – for example firewall or a guard.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Detective Access Control

A
  • Type of control that identifies security violations after they have occurred –for example motion detectors.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Corrective Access Control

A
  • Type of controls that change the environment after an incident has occured in order to to return it to normal – for example antivirus programs.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Deterrent Access Control

A
  • Type of a control that attempts to discourage specific action from happening- for example security cameras or a security policy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Directive Access Control

A
  • Type of administrative control that provide guidelines – for example monitoring and supervision.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Compensating Access Control

A
  • Type of a control that provides an alternative when it is not possible to use a primary control.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Administrative Access Control

A
  • Type of controls that are stated in organization’s security policy – for example background checks and training efforts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Logical/Technical Control

A
  • Hardware and software mechanisms used to manage access and to provide protection for systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Physical Control

A
  • Type of control one can physically touch – for example fences and guards.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Identification

A
  • Term that refers to a subject claiming an identity.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Authentication

A
  • Term that refers to verifying subject’s identity by comparing it against a database such as user accounts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Authorization

A
  • Term that refers to granting access to specific resources based on a proven identity.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Accountability

A
  • Term that refers to subjects responsibility for their actions once an audit is under way.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Authentication Factors Types

A
  • Type 1
  • Type 2
  • Type 3
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Authentication Type 1
* Something you know -- for example a pin or a password.
26
Authentication Type 2
* Something you have -- for example a token or a smart card.
27
Authentication Type 3
* Something you are or you do -- for example fingertips or keystrokes.
28
Context- Aware Authentication
* Context-aware authentication is the use of situational information (such as identity, location, time, type of device) to improve information security.
29
Passwords
* Most common authentication technique that belong to Type 1 authentication.
30
Strong Password Policy Settings
* Maximum age * Password lengths * Password complexity
31
Password History
* Password history remembers a certain number of passwords and prevents a user from reusing previous passwords.
32
Password Phrase
* Passphrase is a string of characters that has a unique meaning to a user -- for example "I am awesome."
33
Cognitive Passwords
* Series of questions about the facts that only a subject would know.
34
Smartcards
* Cards that have an embedded circuit chip and contain information about an authorized user. * This information is used for identification and authentication.
35
Tokens
* Password generating device that users carry with them.
36
Token Types
* Synchronous Dynamic * Asynchronous Dynamic
37
HOTP
* HMAC includes a hash function used by HMAC-based One Time Password in order to create onetime passwords..
38
TOTP
* Time-based One-Time Password uses a timestamp and it is valid for a certain time like 30 seconds. The password expires if the user does not use it within the frame.
39
Biometrics
* Face scans * Retina scans * Iris scans * Palm scans * Hand geometry * Heart/pulse patterns * Voice pattern recognition * Signature dynamics * Keystroke patterns
40
Biometric Factor Error Ratings
* False Rejection Rate - valid subject is not authenticated * False Acceptance Rate - invalid subject is authenticated
41
Multifactor Authentication
* Authentication method that uses 2 or more factors to provide authentication.
42
Device Authentication
* Fingerprinting, 802.1x, user logs...
43
Service Authentication
* Usually refers to username and password.
44
Identity Management Implementation
* Centralized access control * Decentralized access control
45
Single Sign-On
* Centralized access control method that allows a user to be authenticated once and be able to use multiple resource without authenticating again.
46
LDAP
* Lightweight Directory Access Protocol is a directory for network services and assets.
47
Kerberos
* It is a computer network authentication protocol developed by MIT that offers sign on solution for users and provides protection for logon credentials.
48
Kerberos elements
* Key Distribution Center * Kerberos Authentication Server * Ticket Granting Ticket * Ticket
49
Hypertext Markup Language (HTML)
* It is a major markup language used to display web pages on the internet.
50
Extensible Markup Language (XML)
* It is a language commonly used by data-exchange services to send information between otherwise incompatible systems.
51
Service Provisioning Markup Language
* XML-based language that facilitates the exchange of provisioning information among applications and organizations, corporations, or agencies.
52
Extensible Access Control Markup Language
* It is an open standard XML-based language designed to express security policies and access rights to information for web services, digital rights management, and enterprise security applications.
53
OAuth 2.0
* It is an open standard used for access delegation.
54
OpenID
* It is an open standard and decentralized authentication protocol maintained by the OpenID Foundation.
55
OpenID Connect
* It simple identity layer on top of the OAuth 2.0 protocol autorization framework.
56
Scripted Access
* Logon script meant to establish communication links by providing automated process to transmit credentials at the start of a logon session.
57
Credential Management System
* Storage space for users to keep their credentials when SSO is not available.
58
AAA Protocols
* Authentication, Authorization and Accounting -- term used to refer to a family of protocols that mediate network access such as RADIUS and Diameter
59
RADIUS
* Remote Authentication Dial-In User Service is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate users and authorize their access to the requested system or service.
60
Diameter
* Enhanced version of RADIUS that supports a wide range of protocols including traditional IP, Mobile IP, Voice over IP.
61
TACACS+
* Terminal Access Controller Access-Control System refers to a family of related protocols handling remote authentication and related services for networked.
62
Identity and access provisioning lifecycle
* It is a concept that refers to creation, management, and deletion of accounts.
63
Provisioning
* In the context of setting a new account, provisioning refers to assigning appropriate privileges with an account.
64
Account Review
* Review process should be done regularly to ensure that security policies are being followed.
65
Account Revocation
* It is key to revoke accounts for terminated employees due to a risk of a sabotage. * Many systems set expiration dates for specific accounts.
66

CISSP - 13 - Software Development Security Principles (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions