701 Flashcards
Secuirty (141 cards)
1
Q
Term
A
Definition
2
Q
Domain 1: General Security Concepts
A
Security Controls
3
Q
Technical: Security controls implemented through technology (e.g.
A
firewalls
4
Q
Physical: Physical barriers and controls to protect resources (e.g.
A
locks
5
Q
Deterrent: Controls that discourage violations (e.g.
A
warning signs).
6
Q
Compensating: Alternative controls that compensate for weaknesses (e.g.
A
increased monitoring).
7
Q
CIA Triad:
A
Confidentiality: Ensuring that information is accessible only to those authorized.
8
Q
Availability: Ensuring that information is accessible when needed.
A
Non-repudiation: Ensuring that a party cannot deny the authenticity of their signature or actions.
9
Q
Authentication: Verifying the identity of a user or system.
A
Authorization: Granting permissions to authenticated users or systems.
10
Q
Authenticating people/systems: Methods used to verify identities (e.g.
A
passwords
11
Q
Control Plane: Manages the flow of data to enforce policies.
A
Data Plane: Carries the actual data or application traffic.
12
Q
Bollards: Physical barriers to prevent vehicle access.
A
Access control vestibule: Small
13
Q
Video surveillance: Monitoring using cameras.
A
Security guard: Human security personnel.
14
Q
Lighting: Use of light to deter or detect unauthorized access.
A
Sensors: Devices to detect movement
15
Q
Honeypot: Decoy systems to attract attackers.
A
Honeynet: Network of honeypots.
16
Q
Honeytoken: Decoy data used to detect unauthorized access.
A
Cryptographic Solutions
17
Q
Public key: Key used to encrypt data
A
known to everyone.
18
Q
Encryption: Converting data into a coded form.
A
Full-disk: Encrypting all data on a disk.
19
Q
File: Encrypting individual files.
A
Volume: Encrypting a specific volume.
20
Q
Record: Encrypting individual records.
A
Transport/communication: Encrypting data in transit.
21
Q
Symmetric: Encryption using a single key for both encryption and decryption.
A
Key exchange: Method of securely exchanging encryption keys.
22
Q
Key length: Length of the encryption key.
A
Tools:
23
Q
HSM (Hardware Security Module): Device for managing cryptographic keys.
A
Key management system: Software for managing encryption keys.
24
Q
Obfuscation:
A
Steganography: Hiding data within other data.
25
Data masking: Obscuring data to protect sensitive information.
Hashing: Converting data into a fixed-size string of characters.
26
Digital Signatures: Cryptographic signatures to verify authenticity.
Key Stretching: Techniques to strengthen keys.
27
Certificates: Digital certificates used for authentication.
Certificate authorities: Entities that issue certificates.
28
OCSP (Online Certificate Status Protocol): Protocol for checking certificate status.
Self-signed: Certificates signed by the entity itself.
29
Root of trust: Base level of trust in a security model.
CSR (Certificate Signing Request): Request for a digital certificate.
30
Change Management
Business Processes:
31
Ownership: Responsibility for changes.
Stakeholders: Parties affected by changes.
32
Test results: Outcomes of testing changes.
Backout plan: Plan for reverting changes if needed.
33
SOP (Standard Operating Procedure): Established procedures for tasks.
Technical Implications:
34
Restricted activities: Actions that are limited.
Downtime: Period when systems are unavailable.
35
Application restart: Restarting applications.
Legacy applications: Older software systems.
36
Documentation:
Updating diagrams: Keeping architectural diagrams current.
37
Version Control: Managing changes to documents or code.
Domain 2: Threats
38
Threat Actors:
Nation-state: Government-sponsored attackers.
39
Hacktivist: Activists using hacking.
Insider threat: Internal personnel posing a threat.
40
Shadow IT: Unapproved IT systems or devices.
Attributes:
41
Resources/funding: Financial and material support.
Level of sophistication/capability: Skills and techniques.
42
Data exfiltration: Stealing data.
Espionage: Spying activities.
43
Blackmail: Forcing action through threats.
Financial gain: Monetary benefits.
44
Ethical: Driven by moral principles.
Revenge: Retaliation motives.
45
War: Conflict motives.
Threat Vectors and Attack Surfaces
46
Image-based: Attacks hidden in images.
File-based: Attacks in files.
47
Removable device: Attacks via USB drives.
Vulnerable software (Client-based vs. agentless): Exploiting software weaknesses.
48
Unsecure networks (Wireless
Wired
49
Supply chain (MSPs
Vendors
50
Application:
Memory injection: Injecting malicious code into memory.
51
Race conditions (TOC/TOU): Exploiting timing issues.
Malicious update: Compromised software updates.
52
Web-based:
SQLi (SQL Injection): Injecting SQL commands.
53
Hardware:
Firmware: Vulnerabilities
54
Hardware:
Firmware: Vulnerabilities in the firmware of devices.
55
Network:
DNS poisoning: Corrupting DNS cache to redirect traffic.
56
DDoS (Distributed Denial of Service): Overloading a service with excessive traffic.
Cloud:
57
Misconfiguration: Incorrectly configured cloud services.
Mobile:
58
Unsecure connections: Unencrypted or poorly secured connections.
IoT (Internet of Things):
59
Unpatched firmware: Vulnerabilities in outdated firmware.
Industrial control systems (ICS):
60
Unsecure protocols: Use of unsecure communication protocols.
Exploit Techniques
61
Phishing: Fraudulent attempts to obtain sensitive information.
Spear phishing: Targeted phishing attacks.
62
Pretexting: Creating a fabricated scenario to steal information.
Baiting: Offering something enticing to lure victims.
63
Network attacks:
Man-in-the-middle: Intercepting communication between two parties.
64
Replay attack: Reusing captured data packets.
Spoofing: Impersonating another device or user.
65
Virus: Malicious code that attaches to a host file and spreads.
Worm: Self-replicating malware that spreads without user interaction.
66
Ransomware: Malware that encrypts data and demands payment for decryption.
Spyware: Malware that collects information without consent.
67
Rootkit: Malware designed to gain root-level access.
Code-based attacks:
68
Cross-site scripting (XSS): Injecting malicious scripts into web pages.
Buffer overflow: Exploiting buffer overflow vulnerabilities to execute arbitrary code.
69
USB drop attack: Leaving malicious USB drives for victims to use.
Hardware keyloggers: Physical devices that record keystrokes.
70
Security Assessment
Vulnerability assessments: Identifying and evaluating security weaknesses.
71
Security audits: Reviewing and evaluating security measures.
Risk assessments: Identifying and analyzing risks.
72
Bug bounty programs: Offering rewards for finding security vulnerabilities.
Mitigation Strategies
73
Firewalls: Devices or software that control network traffic based on security rules.
Intrusion detection systems (IDS): Systems that detect unauthorized access.
74
Network segmentation: Dividing networks into segments to improve security.
Endpoint security:
75
Endpoint detection and response (EDR): Tools for detecting and responding to endpoint threats.
Patch management: Keeping software up to date with patches and updates.
76
Code review: Examining code for vulnerabilities.
Application hardening: Securing applications by reducing vulnerabilities.
77
Data protection:
Encryption: Converting data into a coded form to prevent unauthorized access.
78
Access controls: Restricting access to data based on user roles and permissions.
Physical security:
79
Access control systems: Systems that control entry to physical spaces.
Surveillance cameras: Cameras used to monitor physical spaces.
80
Incident response planning: Preparing for and responding to security incidents.
Domain 3: Architecture and Design
81
Network Architecture:
Intranet: Internal private network.
82
DMZ (Demilitarized Zone): Network segment that separates internal networks from untrusted networks.
NAC (Network Access Control): Policies to control access to network resources.
83
SDN (Software-Defined Networking): Network management using software.
Microsegmentation: Dividing networks into smaller segments.
84
Public cloud: Cloud services offered to multiple customers.
Private cloud: Cloud services for a single organization.
85
Community cloud: Cloud services shared by a community of organizations.
Virtualization: Creating virtual versions of resources.
86
Containers: Lightweight virtualization for applications.
Virtual networks: Virtualizing network resources.
87
Zero Trust Architecture: Security model that assumes no implicit trust.
Control Plane: Manages the flow of data to enforce policies.
88
Security Frameworks and Models
Security Frameworks:
89
ISO/IEC 27001: Standard for information security management systems.
COBIT: Framework for managing and governing IT.
90
CSA (Cloud Security Alliance): Guidelines for cloud security.
Security Models:
91
Biba Model: Security model focused on data integrity.
Clark-Wilson Model: Security model focused on data integrity through well-formed transactions.
92
Secure System Design
Principles of Secure Design:
93
Separation of duties: Dividing responsibilities to prevent fraud.
Defense in depth: Using multiple layers of security.
94
Economy of mechanism: Keeping security mechanisms simple.
Complete mediation: Checking access permissions every time a resource is accessed.
95
Least common mechanism: Minimizing shared security mechanisms.
Psychological acceptability: Security mechanisms should not be overly complex for users.
96
Secure Protocols:
SSL/TLS: Protocols for secure communication over a network.
97
IPsec: Protocol suite for securing Internet Protocol (IP) communications.
Virtual Private Networks (VPNs):
98
Remote access VPN: VPN that allows individual users to connect to a network.
Wireless Security:
99
WPA2: Wi-Fi security protocol using AES encryption.
WEP: Older
100
Antivirus/anti-malware: Software that detects and removes malicious software.
EDR (Endpoint Detection and Response): Tools for detecting and responding to endpoint threats.
101
Application control: Restricting applications that can be run on endpoints.
Cloud Security
102
Cloud Security Controls:
CASB (Cloud Access Security Broker): Tools that provide visibility and control over cloud applications.
103
Encryption: Protecting data in transit and at rest in the cloud.
Monitoring: Continuously monitoring cloud environments for threats.
104
Compliance: Ensuring cloud environments meet regulatory requirements.
Data Security
105
Public: Data that can be freely shared.
Internal: Data meant for internal use only.
106
Top secret: Highly sensitive data with the highest level of protection.
Data Retention: Policies for how long data should be kept.
107
Data Masking: Obscuring data to protect sensitive information.
Tokenization: Replacing sensitive data with non-sensitive tokens.
108
contunue with the other domian
ChatGPT
109
Continuing with the definitions for Domain 4 and Domain 5:
Domain 4: Security Operations and Monitoring
110
Log Types:
Event logs: Logs generated by operating systems
111
Audit logs: Logs that track changes and access to data and systems.
Log Management:
112
Log aggregation: Combining logs from different sources for analysis.
Log correlation: Analyzing logs to identify patterns and relationships between events.
113
SIEM (Security Information and Event Management): Tools that provide real-time analysis of security alerts.
ELK Stack (Elasticsearch
114
Security Monitoring:
Network monitoring: Tracking and analyzing network traffic for signs of malicious activity.
115
Application monitoring: Tracking and analyzing application performance and behavior.
Continuous Monitoring: Ongoing assessment of security controls and risk.
116
Anomaly Detection: Identifying unusual patterns or behaviors that may indicate a security incident.
Trend Analysis: Identifying trends and patterns over time to predict future security incidents.
117
Incident Response
Incident Response Process:
118
Identification: Detecting and identifying potential security incidents.
Containment: Limiting the impact of the incident.
119
Recovery: Restoring systems and operations to normal.
Lessons Learned: Reviewing and improving the incident response process.
120
Incident Response Plan: Documented plan detailing how to respond to security incidents.
Forensics: Collecting and analyzing digital evidence related to security incidents.
121
Threat Intelligence Sources:
Open source: Publicly available threat intelligence data.
122
Internal: Threat intelligence data generated within the organization.
Threat Intelligence Types:
123
Tactical: Detailed intelligence related to specific threats and attack methods.
Operational: Intelligence related to ongoing threats and incidents.
124
Threat Intelligence Sharing: Sharing threat intelligence data with other organizations and communities.
Vulnerability Management
125
Penetration Testing: Simulated attacks to identify vulnerabilities and assess security controls.
Patch Management: Process of applying patches and updates to software and systems to address vulnerabilities.
126
Domain 5: Incident Response
Forensics
127
Identification: Detecting and determining the nature of an incident.
Containment: Isolating affected systems to prevent further damage.
128
Recovery: Restoring systems and operations to normal.
Lessons Learned: Reviewing the incident and improving response processes.
129
Digital Forensics: Collecting
preserving
130
EnCase: Digital forensics software for examining data.
FTK (Forensic Toolkit): Digital forensics tool for data analysis.
131
Forensic Analysis:
Disk imaging: Creating a bit-by-bit copy of a storage device.
132
Memory forensics: Analyzing volatile memory (RAM) for evidence.
Legal Considerations: Ensuring compliance with laws and regulations during forensic investigations.
133
Disaster Recovery (DR):
DR Plan: Documented strategy for recovering IT systems and data after a disaster.
134
DR Testing: Regular testing of disaster recovery plans and procedures.
Recovery Time Objective (RTO): Target time to restore systems after a disaster.
135
Business Continuity (BC):
BC Plan: Documented strategy for maintaining business operations during and after a disaster.
136
Business Impact Analysis (BIA): Identifying critical business functions and their dependencies.
Continuity of Operations: Ensuring essential functions continue during a disruption.
137
Internal Communication: Coordinating communication within the organization during incidents.
External Communication: Communicating with external stakeholders
138
Incident Coordination: Collaborating with external organizations
including law enforcement and industry groups.
139
GDPR (General Data Protection Regulation): EU regulation on data protection and privacy.
HIPAA (Health Insurance Portability and Accountability Act): US regulation on health data privacy.
140
SOX (Sarbanes-Oxley Act): US regulation on corporate financial practices and disclosures.
FISMA (Federal Information Security Management Act): US regulation on federal information security.
141
Compliance Audits: Regular audits to ensure compliance with laws and regulations.
Data Breach Notification: Informing affected individuals and authorities about data breaches.
