Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

From Flashcardlet > SSCP Notes > Flashcards

SSCP Notes Flashcards

0
Q

What is AIC security triad?

A

Availability, Integrity, and Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Three primary goals of Information Security?

A
  • Preventing loss of availability
  • The loss of integrity
  • The loss of confidentiality for systems and data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Organization protect against loss of availability using?

A
  • Backups
  • Redundant disks
  • Redundant servers
  • Redundant connections
  • redundant sites
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Redundant sites are know as:

A
  • Hot site - Ready at a moments notice
  • Cold site - An empty building with electricity, and running water
  • Warm site - a cross between a cold site and hot site.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Fault-tolerant and redundant technologies ensure

A

that availability is not lost even if a system suffers a failure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrity

A

Prevents any unauthorized or unwanted modification of data. It ensures that data is correct and current.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A hash

A

is simply a number created by performing a mathematical algorithm against a file or message. As long as the the file or message stay the same, the hash (the number) will always be the same.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Message Digest version 5 (MD5)

A

Is a commonly used hashing algorithm. It creates a fixed-size 128-bit number (represented as 32 hexadecimal characters) from any message or file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An audit log

A

Tracks changes to a resource, including what was changed, who changed it, and when. This creates an audit trail.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

You protect against the loss of confidentiality by

A

Ensuring that data is not disclosed to unauthorized users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Access controls

A

Are implemented to control or restrict access to resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Encryption

A

Provides another layer of protection for confidentiality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Confidentiality

A

Works when secure encryption algorithms are implemented and sound security practice are followed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security controls

A

Attempt to reduce risk by either reducing vulnerabilities or the impact of a threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

One benefit of of a defense-in-depth strategy

A

That even if a single control fails, other controls still provided protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A defense-in depth strategy

A

Provides a layered approached to security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The AAA of security

A

Authentication - system verifies the credentials.

Authorization - Based on who the user is, authorization is granted to different resources.

Accounting Logging tracks activity of a user through monitoring. Audit logs create an audit trail.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

If a system can identify individual users, track their actions, and monitor their behavior, It provides

A

Accountability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Nonrepudiation

A

Ensures that a party cannot believably deny (or repudiate) taking an action. Nonrepudiation is enforced through audit logging and with digital signatures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The principle of least privilege

A

This means that you grant users access to what they need to perform their job, and no more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Separation of duties

A

It ensures that no single person has complete control over a process. It significantly reduces the risk of fraud within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Many companies also use ________ and __________ to reduce the risk of collusion.

A

Job rotation and Mandatory vacations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Due Diligence

A

Refers to the investigative steps that an organization takes prior to taking on something new, such as signing a contract or making a major purchase. An organization has an obligation to exercise due diligence to discover risks associated with large purchases.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Due Care

A

is the practice of implementing security policies and practices to protect resources. It ensures that a certain level of protection is applied to protect against losses from known risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Management decides what risks to mitigate, and the risk that remain is

A

Residual risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Organizations have a requirement to exercise due care to protect

A

PII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Identifcation

A

Occurs when a user professes, or claim, an identity by presenting the identity to a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Authentication

A

Is the process of a user proving an identity that he or she has claimed.

28
Q

Identification and Authentication

A

Are the two primary controls used by most access control systems.

29
Q

Three Factors of Authentication

A
  • Something you know
  • Something you have
  • something you are
30
Q

Something you know

A

This includes knowledge, such as passwords, personal Identification numbers (PINs), your mother’s maiden name, or even personal information such as the name of your first pet.

31
Q

Something you have

A

This includes items such as proximity cards, smart cards, hardware tokens, and identification badges.

32
Q

Something you are

A

This includes the use of biometrics to authenticate an individual based on fingerprints, retina scans, and other facial characteristics, keystroke dynamics, and hadwriting.

33
Q

A password Audit

A

Ensures that passwords are strong (never blank), are of a minimum length, and have been changed within a given period of time. (such as 90 days).

34
Q

A password policy

A

Often identifies requirements for strong passwords, the minimum amount of time before a password should be changed, and how passwords are audited.

35
Q

A proximity card

A

includes data electronically embedded within the card.

36
Q

Requiring something you have (the smart card) with somnething you know (the pin)is

A

Two-factor Authentication (or multifactor authentication) and is more secure than just one or the other.

37
Q

Something you are

A

Fingerprints, Retinal and iris scans, Face recognition,Voice Recognition, Keystroke dynamics and Handwriting analysis.

38
Q

False Reject Rate (FRR)

A

Also called type 1 error, refers to the percentage of times a biometric system falsely rejects a known user and instead indicates.

39
Q

False accept Rate (FAR) (also called type 2 error) refers to

A

the percentage of times a biometric system falsely identifies an unknown user as a know user.

40
Q

Crossover Error Rate (CER)

A

The CER identifies the point where the FAR and FRR of a biometric system are equal or cross over each on the chart. A lower CER indicates a better-performing biometric system.

41
Q

Systems with Low CERs are more accurate than systems with high

A

CERs

42
Q

When two factors are require, it’s also called

A

Two-factor authentication. Multifactor authentication is more secure than any single authentication type used by itself.

43
Q

Single sign-on (SSO)

A

A user authenticates once and then the system uses the same credentials when the user accesses any resource in the organization. Some example of SSO included Kerberos and federated access system.

44
Q

Kerberos

A

Is a vendor-neutral authentication protocol. It uses a complex process of issuing tickets to authenticated accounts and then uses the tickets to access resources. Kerberos uses symmetric encryption to protect the confidentiality of the Kerberos transmission.

45
Q

Since the Kerberos server issues different types of tickets used for authentication, it is also known as a

A

ticket-granting server.

46
Q

Identification

A

Occurs when a user professes, or claims, an identify, or claims, an identity by presenting the identity to a system

47
Q

Authentication

A

Is the process of a user proving an identity that he or she has claimed.

48
Q

Identification and authentication

A

Are the two primary controls use by most access control systems.

49
Q

Kerberos requires a database of accounts and time synchronization for all systems. It uses symmetric encryption to encrypt tickets in a secure format between systems.

A

The Kerberos Authentication server and ticket granting server can be single server performing two functions or two server.

50
Q

Federated access

A

Provides SSO to different operating systems or network. A federated databased provides central central SSO authentication.

51
Q

Secure European system for applications in a multivendor Environment (SESAME)

A

It is used in European countries and is an alternative to Kerberos.

52
Q

KryptoKnight

A

IBM created KryptoKnight as an alternative to Kerberos. It does not have has a much network overhead as Kerberos.

53
Q

Kerberos, SESAME, and KryptoKnight

A

Each provide SSO capabilities. With SSO, users only have to log on once and then use the same credentials to access multiple resources.

54
Q

Offline Authentication

A

Allows users who have logged in to the system at one time to still log in even when they are disconnected from a network.

55
Q

One-time Passwords

A

are passwords created to be used only once.

56
Q

One-time passwords

A

Are especially useful when passwords are transmitted across untrusted networks such as the internet.

57
Q

Token-based Passwords

A

Is an example of a one-time password.

58
Q

Because the token is synchronized with a server based on time

A

It is a synchronous one-time password.

59
Q

Multifactor authentication

A

The user must have something and know something.

60
Q

OPIE

A

Is based on S/Key, one-time password system used on some unix systems. The goal of both OPIE and S/Key

61
Q

OPIE is based on S/Key

A

A one-time password system used on some unix systems.

62
Q

The goal of of both OPIE and S/Key

A

Is to generate a password known to both a client and server and used in a single session.

63
Q

Access Control

A

Provides A mechanism to restrict or control access to Resources.

64
Q

Subject

A

Access a Resourse

65
Q

Logical Access Control

A

Are those that are implemented with technologies and often use Access control list (ACL).

66
Q

Security Kernel

A

Is the central part of the operating systems that controls access to the system’s resources.

67
Q

In the DAC model

A

Users have ownership of the data and can exercise full control over it, including assigning permissions to others.

From Flashcardlet (85 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions