Overview of Security

Question 1

Information Security

Answer 1

Act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure, corruption, and destruction.

Question 2

Information Systems Security

Answer 2

Act of protecting the systems that hold and process our critical data.

Question 3

Confidentiality - C.I.A.

Answer 3

Information has not been disclosed to unauthorized people.

Question 4

Integrity - C.I.A.

Answer 4

Information has not been modified or altered without proper authorization.

Question 5

Availability - C.I.A.

Answer 5

Information is able to be stored, accessed, or protected at all times.

Question 6

Authentication - AAA of Security

Answer 6

When a person's identity is established with proof and confirmed by a system:
Something you know
Something you are
Something you have 
Something you do
Somewhere you are

Question 7

Authorization - AAA of Security

Answer 7

Occurs when a user is given access to a certain piece of data or certain areas of a building.

Question 8

Accounting - AAA of Security

Answer 8

Tracking of data, computer usage, and network resources.

Question 9

Non-Repudiation

Answer 9

Assurance that the sender of information is provided with proof of delivery.
When you have proof that someone has taken an action.

Question 10

Security Threats

Answer 10

Malware - malicious software.
Unauthorized Access - occurs when access to computer resources and data occurs without the consent of the owner.
System Failure - occurs when a computer crashes or an individual application fails.
Social Engineering - act of manipulating users into revealing confidential information or performing other detrimental actions.

Question 11

Mitigating Threats

Answer 11

Physical Controls - alarm systems, locks, surveillance cameras, identification cards, and security guards.
Technical Controls - smart cards, encryption, ACLs, IDS, and network authentications.
Administrative Controls - policies, procedures, security awareness training, contingency planning, and disaster recovery plans. User training is the most cost-effective security control to use

Question 12

Hackers

Answer 12

White Hats - non-malicious hackers who attempt to break into a company’s systems at their request.
Black Hats - malicious hackers who break into computer systems and networks without authorization or permission.
Gray Hats - Hackers without any affiliation to a company who attempt to break into a company’s network but risk the law by doing so.
Blue Hats - hackers who attempt to hack into a network with permission of the company but are not employed by the company.
Elite - hackers who find and exploit vulnerabilities before anyone else does. 1 in 10,000 are elite.

Question 13

Threat Actors

Answer 13

Script Kiddies - little to no skill, who only use the tools and exploits written by others.
Hacktivists - hackers who are driven by a cause like social change, political agendas, or terrorism.
Organized Crime - hackers who are part of a crime group that is well-funded and highly sophisticated.
Advanced Persistent Threats - highly trained and funded groups of hackers (often by nation states) with covert and open-source intelligence at their disposal.
APTs > Organized Crime > Hacktivists > Script Kiddies - Skill Level