CBK1 - terms Flashcards
(35 cards)
what is steganography
a way of hiding information in plain sight. it is a method/technique that is part of the confidentiality tenet (CIA)
what is traffic padding (in network security)
adding content to traffic so as to make it appear less readable/more random
what is a logic bomb
a set of instructions secretly incorporated into a program so that if a particular condition is satisfied they will be carried out, usually with harmful effects. typically affects the INTEGRITY tenet (CIA)
how many items comprise a AAA system
identification, authentication, authorization, auditing, accounting
what does AAA stand for
Access, Authorization, Accounting
What is the purpose of DATA CLASSIFICATION
To determine what level of effort should be put into place to protect the data in question. It is part of SECURITY GOVERNANCE. Another item of SECURITY GOVERNANCE is CHANGE CONTROL
What are the steps/phases to implementing a DATA CLASSIFICATION SCHEME - how many steps are there
- Identify the custodian/identify their responsibilities
- Specify the evaluation criteria (how the info will be classified and labeled)
- Classify and label each resource
- Document exceptions to the classification policy
- Select the security controls to be applied to each classification level
- Specify procedures for declassification and transfer of custody
- Create an enterprise-wide awareness program/training on the classification system
Name the classification of data for use by GOV/MIL
TOP SECRET (CLASSIFIED), SECRET (CLASSIFIED), CONFIDENTIAL (CLASSIFIED), SENSITIVE BUT UNCLASSIFIED [SBU], UNCLASSIFIED
Name the commercial/business/private sector CLASSIFICATION LEVELS (as used in the CISSP exam)
CONFIDENTIAL (HIGH), sometimes PROPRIETARY (if related to critical impact on competitive edge of the company)
PRIVATE (HIGH),
SENSITIVE (LOW),
PUBLIC (LOW)
List the 6 organizational roles and responsibilities in security
Senior manager: (organizational owner of the policy and sign off on all measures)
Security Professional: (functional responsibility for security - writes procedures for approval by SM/follows/implements procedures in alignment with the security policy mandated by the senior manager) - not a decision-maker.
Data Owner: responsible for classifying the data and its protection within the security solution
Data Custodian: implements the prescribed procedures to protect the data according to the CIA triad.
User: person who has access to the data (but according to the principle of least privilege)
Auditor: responsible for reviewing and verifying that the security policy is properly implemented - produces compliance reports
What is COBIT
A documented set of best IT Security practices. A framework of governance and management of enterprise IT. Designed to help map a set of IT security ideals to business objectives. Based on 5 principles:
- Meeting Stakeholder needs
- Covering the Enterprise end-to-end
- Applying a Single-Integrated Framework
- Enabling a holistic approach
- Separating Governance from Management
what is a baseline (as part of a formal security policy structure) - what organizations can be referenced to govern security standards and baselines
A baseline is a minimum level of security that has to be met. Orgs: NIST, TCSEC, ITSEC
what elements comprise a formal security policy structure
Policies, Standards & Baselines, Guidelines, and Procedures
What is Threat Modeling
A process where potential threats are identified, categorized, and analyzed
Identify 2 approaches to Threat Modeling
Proactive (example Microsoft SD3+C)
Reactive (or adversarial) such as ethical hacking
What is FUZZ testing
a specialized dynamic testing technique that provides many different inputs to test the limits of software and find previously undetected flaws.
what is STRIDE
A system created by Microsoft to categorize threats
What acronyms comprise STRIDE
Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, elevation of Privilege
What is PASTA
A 7-step thread modeling methodology - it is a risk-centric approach
What are the acronyms of PASTA
Process for Attack Simulation and Threat Analysis
What are the 7 stages of PASTA
- Definition of Objectives for the analysis of risks (DO)
- Definition of the technical scope (DTS)
- Application Decomposition and analysis (ADA)
- Threat Analysis (TA)
- Weakness and vulnerability analysis (WVA)
- Attack modeling and simulation (AMS)
- Risk analysis and management (RAM)
What are the main phases of Threat Modeling
- Determine and Diagram Potential Attacks
- Perform Reduction Analysis
- Define/document prioritization and response (DREAD)
What are the key concepts found/broken down in a reduction analysis
Trust boundaries Data Flow paths Input points Privileged operations Details about security stance and approach
What is DREAD
A Threat ranking system/technique
