Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security+ > 1.2 Summarize fundamental security concepts > Flashcards

1.2 Summarize fundamental security concepts Flashcards

(63 cards)

Start Studying
1
Q

Confidentiality

A

Information is accessible only to authorized personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Integrity

A

data remains accurate and unaltered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

availability

A

data and resources are accessible when needed (e.g redundancy measure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How do we achieve Availability

A

Redundancy : back up options of critical components or functions of system with the intention of enhancing its reliability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Various type of redundancy

A

Server Redundancy
Data Redundancy
Network Redundancy
Power Redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Non Repudiation

A

provides proof of the origin, authenticity and integrity of data.
can’t deny having performed an action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How do we achieve Non Repudiation

A

Digital Signature : hashing then, encrypting the hash digest with the user private key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why Non Repudiation is important

A
  • Confirming the authenticity of Digital Signature
  • Ensuring Integrity
  • Providing Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Authentication

A

Verifying the identity of individuals or entities in digital interactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Five commonly used authentication methods

A

Something you know : knowledge factor ( username, password

Something you have : possession factor, physical item ( ID, phone)

Something you are : Inherence factor :unique physical or behavioral characteristics ( biometric authentication )

Something you do : Action factor, user conducting a unique action

Somewhere you are : location factor user being in certain geographic location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

2FA and MFA

A

Two authentication method

Two or more authentication methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why authentication is critical

A
  • Prevent unauthorized access
  • protect user data and privacy
  • Ensure resources validity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Authorization

A

Determining actions or resources an authenticated user can access (permission: who can access what)

Set of rules and policies to dictate who can access, or modify what.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authorization mechanisms

A

role-based
rule- based
attribute - based controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why authorization is important

A
  • protect sensitive data
  • maintain system integrity
  • create more streamline the user experience
    serve as gatekeeper
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Accounting

A

all user activities are properly tracked and recorded ( monitoring and logging)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

why we need accounting

A

to achieve
- transparency
- Security
- Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are we accounting in the system

A

logging and accessing files
modifying configurations
downloading or installing software
attempting unauthorized actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what are some of accounting systems

A

Audit Trail ( chronological record of all user activities)

Regulatory Compliance : maintain a comprhensive record of all the users’ activities.

Forensic Analysis: detail accounting and event logs

Resource Optimization : tracking resource utilization and allocation decision

User Accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Technologies used for accounting

A

Syslog servers : aggregate logs from various network devices and systems

Network analysis tools : like wireshark capture and analyze network traffic

SIEMs : Security Information and Event Management : real-time analysis of security alerts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

6 Types of Security Control

A
  1. Preventative control
  2. Deterrent Controls : warning
  3. Detective Controls : detect and alert
  4. Corrective Controls : address issue after they arise
    5/ Compensating Controls : alternative
  5. Directive Controls : dictate specific action
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Methods to achieve integrity

A

checksums: method to verify integrity of data during transmission.

Access Control: only authorized individuals can modify data.

Regular Audits: review logs and operations.

Hashing: process of converting data into fixed size values.

Digital Signature: uses encryption to ensure integrity and authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Integrity is important for three main reasons

A

■ To ensure data accuracy
■ To maintain trust
■ To ensure system operability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How to achieve Confidentiality

A

Encryption: convert data to code

Access Control: authorized personnel only access certain data

Data masking: obscuring data with in database

Physical Security

Training and awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
CIA triad
Basis for the development of Security confidentiality : making sure data is kept secret or private. Integrity : making sure data is trustworthy and free from tempering. Availability: make sure system is functioning and accessible
26
CIANA
Confidentiality: safeguard Integrity : not altered Authentication : verification Non -repudiation : proof Authorization : access
27
CIA triad
Basis for the development of Security confidentiality : making sure data is kept secret or private. Integrity : making sure data is trustworthy and free from tempering. Availability: make sure system is functioning and accessible
28
The Integrity of your data is maintained only if
the data is authentic, accurate, and reliable.
29
Authentication Authorization, and Accounting (AAA)
security framework that controls access to resources, enforces policies, and audits usage screening and keeping track of users activity while they are connected. login -> privileges to access -> keep track
30
Gap Analysis
process of evaluating the differences between an organization's current performance and its desired performance
31
Steps to conduct gap analysis
1. define the scope of analysis( desired outcome) 2. gather data on the current state of the organization (done through gather survey, interviews, forms of data collection) 3. Analyze the data to identify the gaps ( where the organization's current performance falls short) 4. Develop a plan to bridge the gaps( change of process or system or other area of the organization). The plan should also include specific goal, objectives and timeline for achieving them.
32
Type of Gap analysis
1. Technical Gap Analysis : evaluating an organization's current technical infrastructure and identifying where it falls short of technical capabilities required to fully utilize their security solution. 2. Business Gap Analysis :evaluating an organization's current business process and identifying where it falls short of the capabilities required to fully utilize their security solution.
33
Zero Trust
Trust nothing and verify everything. demand continuous verification happens for every transaction within our network regardless of where it came from.
34
Type of planes to to create zero trust architecture
1. Control plane 2. Data plane
35
What is control plane in zero trust architecture
refers to the overarching framework and set of components that are responsible for defining, managing, and enforcing the policies related to user and system access within an organization. It provides a centralized way to dictate and control how, when, and where access is going to be granted to ensure that only authenticated and authorized entities can access specific resources.
36
What is Data plane in zero trust architecture
ensure policies and procedures are being properly executed.
37
key elements in control plane in zero trust architecture
Adaptive identity: real-time validation that takes into account the user's behavior, their device, their location, and other factors. Threat scope reduction: limit our users' access to only what they need for their work task because this drastically reduces the network's potential attack surface. Policy-driven access control: develop, manage, and enforce user access policies based on their roles and responsibilities. Secured zones. isolated environments within a network that are designed to house sensitive data.
38
Data Plane is consist of
subject/system: verify the authenticity to the individual or entity attempting to gain access. policy engine cross-references: the access request with its predefined policies. policy administrator: is an essential part of the Zero Trust model that's going to be used to establish and manage the access policies.( dictates who gets access to what) policy enforcement point: allow or restrict access and it will effectively act as a gatekeeper to the sensitive areas of your systems or networks.
39
To learn from the different threat actors that are attacking your network is to set up and utilize
deception and disruption technologies
40
How to Outsmarting Threat Actors
- deception and disruption technologies - Tactics, Techniques, and Procedures (TTPs): Specific methods and patterns of activities or behaviors associated with a particular threat actor or group of threat actors
41
What Deceptive and Disruption Technologies
Technologies designed to mislead, confuse, and divert attackers from critical assets while simultaneously detecting and neutralizing threats
42
Deception and disruption technology
- Honeypot - Honeynet - Honeyfile - Honeytoken
43
Honeypots
● Decoy system or network set up to attract and deceive attackers
44
Honeynets
● Network of honeypots to create a more complex system that is designed to mimic an entire network of systems ○ Servers ○ Routers ○ Switches
45
Honeyfiles
● Decoy files placed within a system to detect unauthorized access or data breaches
46
■ Honeytokens
● Fake data to alert administrators when accessed or used
47
Some disruption technologies and strategies
■ Bogus DNS entries : Fake Domain Name System entries introduced into your system's DNS server ■ Creating decoy directories : Fake folders and files placed within a system's storage ■ Dynamic page generation: Effective against automated scraping tools or bots trying to index or steal content from your organization's website ■ Use of port triggering to hide services ● Port Triggering: Security mechanism where specific services or ports on a network device remain closed until a specific outbound traffic pattern is detected ■ Spoofing fake telemetry data: When a system detects a network scan is being attempted by an attacker, it can be configured to respond by sending out fake telemetry or network data
48
Physical securities
- Bollards - Access control vestibule - Fencing - Video surveillance - Security guard - Access badge - Lighting - Sensors o Infrared o Pressure o Microwave o Ultrasonic
49
what is a Physical Security ?
■ Measures to protect tangible assets (buildings, equipment, people) from harm or unauthorized access
50
Bollards
○ Short, sturdy vertical posts controlling or preventing vehicle access
51
Fences
○ Barriers made of posts and wire or boards to enclose or separate areas
52
what is a Surveillance System and the categories?
● An organized strategy to observe and report activities ● Components ○ Video surveillance Security guards ○ Lighting ○ Sensors - Security Guards
53
Access Control Vestibules
● Double-door system electronically controlled to allow only one door open at a time ● Prevents piggybacking and tailgating
54
kind of Door Locks
● Padlocks : Easily defeated and offer minimal protection ● Pin and tumbler locks ● Numeric locks ● Wireless locks ● Biometric locks ● Cipher locks : Mechanical locks with numbered push buttons, requiring a correct combination to open. commonly used for server rooms ● Electronic access control systems
55
Modern Electronic Door Locks Authentication Methods
- Identification Numbers - Wireless Signals: e NFC, Wi-Fi, Bluetooth, or RFID for unlocking - Biometrics : Biometrics
56
Biometric Challenges
● False Acceptance Rate (FAR) ○ Occurs when the system erroneously authenticates an unauthorized user ○ Lower FAR by increasing scanner sensitivity ● False Rejection Rate (FRR) ○ Denies access to an authorized user. Adjusting sensitivity can increase FRR ● Crossover Error Rate (CER) ○ A balance between FAR and FRR for optimal authentication effectiveness
57
Video Surveillance Can include the following.
○ Motion detection ○ Night vision ○ Facial recognition
58
Sensors
Devices that detect and respond to external stimuli or changes in the environment
59
categories of sensors
○ Infrared Sensors: ■ Detect changes in infrared radiation that is often emitted by warm bodies like humans or animals Pressure Sensors ■ Activated whenever a specified minimum amount of weight is detected on the sensor that is embedded into the floor or a mat ○ Microwave Sensors ■ Detect movement in an area by emitting microwave pulses and measuring their reflection off moving objects ○ Ultrasonic Sensors ■ Measures the reflection of ultrasonic waves off moving objects
60
Access Control Vestibules
■ Double-door system that is designed with two doors that are electronically controlled to ensure that only one door can be open at a given time help prevent piggybacking and tailgating.
61
Piggybacking
● Involves two people working together with one person who has legitimate access intentionally allows another person who doesn't have proper authorization to enter a secure area with them
62
Tailgating
● Occurs whenever an unauthorized person closely follows someone through the access control vestibule who has legitimate access into the secure space without their knowledge or consent
63
Badges contains
● RFID (Radio-Frequency Identification) ● NFC (Near-field Communication) ● Magnetic strips

Security+ (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions