1 Flashcards by Eric Zierke

Incident response phases

Preparation
Detection & Analysis
Containment, Eradication & Recovery
Post-event activity

From NiST

How well did you know this?

Not at all

Perfectly

Types of halon

1211 only in portable, streaming agent

1301 only in fixed, flooding agent

How well did you know this?

Not at all

Perfectly

Sha

Secure Hash Algorithm
Hashing algorithm
20 byte output

How well did you know this?

Not at all

Perfectly

AES

Advanced Encryption Standard 
Original name rijndael
Block cipher
Block size 128
Key length 128, 192, 256

How well did you know this?

Not at all

Perfectly

EAP

Extensible authentication protocol
Used by ppp
Support multi auth mechanisms
Token cards, smart cards, certs, opt, public key enc

How well did you know this?

Not at all

Perfectly

Usage gap

Total potential - actual current usage

How well did you know this?

Not at all

Perfectly

Used to authent asym keys

Password

How well did you know this?

Not at all

Perfectly

Circuit level firewall

Provides udp and tcp connection security

Operates transport and application layers such as session

How well did you know this?

Not at all

Perfectly

Stream cipher

Faster than block

How well did you know this?

Not at all

Perfectly

PEAP

Protected Extensible Authentication Protocol
Mschap
Gtc

How well did you know this?

Not at all

Perfectly

IDEA

International data encryption algorithm

Symmetric block cipher

How well did you know this?

Not at all

Perfectly

DES

Data encryption standard

Symmetric block

How well did you know this?

Not at all

Perfectly

Blowfish

Symmetric block

Key 32 to 448 bits

How well did you know this?

Not at all

Perfectly

Two fish

Symmetric block
Block 128
Key up to 256

How well did you know this?

Not at all

Perfectly

ECB

Electronic Code Book
Block Cipher
Same key on each block

How well did you know this?

Not at all

Perfectly

CBC

Cipher Block Chaining
Block cipher
Uses IV on first block
Plaintext XORed with previous ciphertext before being encrypted

How well did you know this?

Not at all

Perfectly

PCBC

Propagating Cipher Block Chaining
Block Cipher
uses IV on first block
Plaintext XORed with both previous plaintext and previous ciphertext before being encrypted

How well did you know this?

Not at all

Perfectly

CFB

Cipher Feedback
makes a block cipher into a self-syncronizing stream cipher
if part of encrypted message lost, only part of decryption lost.

How well did you know this?

Not at all

Perfectly

OFB

Output Feedback
makes a block cipher into a synchronous stream cipher
allows many error correction codes to function even when applied before encryption

How well did you know this?

Not at all

Perfectly

smart cards

typically credit card sized
embedded IC
some have electrical contacts
does not display

How well did you know this?

Not at all

Perfectly

MD5

Message Digest
Hash
128 hash output

How well did you know this?

Not at all

Perfectly

SOM

Service-Oriented Modeling
Comprehensive view of analysis, design and arch of all software entities
View software entities as assets referred to as services

How well did you know this?

Not at all

Perfectly

SOMF

Service-Oriented Modeling Framework
Modeling language for software development
practices, environments, disciplines, artifacts
SOA Value Proposition
Software Assets reuse
Architectural components abstraction
Business Traceability

IPSEC Authentication Methods

Pre-shared key
Certificate
Kerberos

Kerberos Components

3 main Authentication Server Ticket Granting Server Principles Database

IPComp

IP Payload Compression

SABSA

Sherwood Applied Business Security Architecture Business driven, risk and opportunity focused security architectures traceably support business objectives

SSH encrypt options

inlcude AES, Blowfish, 3DES, CAST128, Arcfour (RC4), IDEA

L2TP

layer 2 Tunneling Protocol operates at layer 2 Extenion of PPTP Used to enable the operation of a VPN over Internet Does not provide encryption or confidentiality by itself

IPSec

protocol suite that authenticates and encrypts the packets of data sent over an IP network. used in VPNs. Mutual Authentication

RC4

aka ARC4 | stream cipher

RC5

Rivest Cipher Symmetric block cipher

SKA

Shared Key Authentication | WEP encryption key shared in advance

SwIPe

1993 | Provides confidentiality, Integrity and authentication with end to end and intermediate hop security

ALE

Annualized Loss Expectency | product of ARO (Annual Rate of Occurance) and SLE (Single Loss Expectancy)

SLE

Single Loss Expectency

ARO

Annual Rate of Occurance

Exposure Factor | Potential percentage of loss if a specific threat is realized

Asset Value

MS-CHAPv2

Provides mutual authentication

Layer 1 protocols

10BaseT DSL, ISDN Infrared

Layer 2 protocols

``` ARP ATM CHAP CDP Ethernet L2TP MAC PPP PPTP STP Spanning Tree Protocol VLAN ```

Layer 3

``` network layer NAT AppleTalk IP ICMP ARP RIP OSPF IPSec ```

Layer 4

``` Transport Layer ESP NetBios SPX TCP UDP ```

layer 5

``` Session Layer - provides session management netbios RPC SMB SOCKS ```

Layer 6

``` Presentation layer TLS SSL FTP IMAP SSH ```

Layer 7

``` Application Layer SOAP DHCP DNS HTTP/S NFS POP3 SNMP Telnet SSH TFTP ```

X.25

ITU-T protocol suite for packet switched WAN

Skipjack

used by clipper chip | symmetric block cipher

Clipper Chip

used Skip Jack to encrypt and Diffie Hellman key exchange

MAC

Message Authentication Code

SKIP

Simple Key Management for Internet Protocol encryption tool used to protect sessionless datagram protocols. designed to integrate with IPSec layer 3

ElGamal

Asymetric encryption | based on Diffie Hellman key exchange

Blueprint

A detailed plan or program of action. | overall architecture first, then individual components

Security Architecture

Think of same way home architecture How many doors and windows are there? Who is allowed in and out of each opening? Must people in home identify self before going out and back in? What possessions need protection? What people need protection?