Chapter 17 Flashcards
Intrusion detection systems
A system that monitors network use for potential hacking attempts. Such a system may take preventative action to block, isolate, or identify attempted infiltration, and raise further alarms to warn security personnel.
distributed denial of service (DDoS)
An attack where a firm’s computer systems are flooded with thousands of seemingly legitimate requests, the sheer volume of which will slow or shut down the site’s use. DDoS attacks are often performed via botnets.
honeypots
A seemingly tempting, but bogus target meant to draw hacking attempts. By monitoring infiltration attempts against a honeypot, organizations may gain insight into the identity of hackers and their techniques, and they can share this with partners and law enforcement.
public key encryption
A two key system used for securing electronic transmissions. One key distributed publicly is used to encrypt (lock) data, but it cannot unlock data. Unlocking can only be performed with the private key. The private key also cannot be reverse engineered from the public key. By distributing public keys, but keeping the private key, Internet services can ensure transmissions to their site are secure.
hack
A term that may, depending on the context, refer to either 1) breaking into a computer system, or 2) a particularly clever solution.
CAPTCHAs
An acronym for Completely Automated Public Turing Test to Tell Computers and Humans Apart. CAPTCHAs are those scrambled character images that many sites require to submit some sort of entry (account setup, ticket buying) and are meant to be a Turing Test—a test to distinguish if a task is being performed by a computer or a human.
hacker
A term that, depending on the context, may be applied to either 1) someone who breaks into computer systems, or 2) to a particularly clever programmer.
cash-out fraudsters
Criminals that purchase assets from data harvesters to be used for illegal financial gain. Actions may include using stolen credit card numbers to purchase goods, creating fake accounts via identity fraud, and more.
encryption
Scrambling data using a code or formula, known as a cipher, such that it is hidden from those who do not have the unlocking key.
zero-day exploits
Attacks that are so new that they haven’t been clearly identified, and so they haven’t made it into security screening systems.
whitelists
Highly restrictive programs that permit communication only with approved entities and/or in an approved manner.
blacklists
Programs that deny the entry or exit of specific IP addresses, products, Internet domains, and other communication restrictions.
certificate authority
A trusted third party that provides authentication services in public key encryption schemes.
Phishing
A con executed using technology, typically targeted at acquiring sensitive information or tricking someone into installing malicious software.
spoofed
Term used in security to refer to forging or disguising the origin or identity. E-mail transmissions and packets that have been altered to seem as if they came from another source are referred to as being “spoofed.”
brute-force attack
An attack that exhausts all possible password combinations in order to break into an account. The larger and more complicated a password or key, the longer a brute-force attack will take.
white hat hackers
Someone who uncovers computer weaknesses without exploiting them. The goal of the white hat hacker is to improve system security.
key
Code that unlocks encryption.
multi-factor authentiction
When identity is proven by presenting more than one item for proof of credentials. Multiple factors often include a password and some other identifier such as a unique code sent via e-mail or mobile phone text, a biometric reading (e.g. fingerprint or iris scan), a swipe or tap card, or other form if identification.
hacktivists
A protester seeking to make a political point by leveraging technology tools, often through system infiltration, defacement, or damage.
