Chapter 1 - Introduction Flashcards
assets
items you value
vulnerability
a weakness in the system that might be exploited to cause loss or harm.
threat
a set of circumstances that has the potential to cause loss or harm
attack
A human who exploits a vulnerability
availability:
the ability of a system to ensure that an asset can be used by any authorized parties
integrity:
the ability of a system to ensure that an asset is modified only by authorized parties
confidentiality:
the ability of a system to ensure that an asset is viewed only by authorized parties
authentication:
the ability of a system to confirm the identity of a sender
nonrepudiation or accountability
the ability of a system to confirm that a sender cannot convincingly deny having sent something
Auditability
ability of a system to trace all actions related to a given asset.
subject
the person, process, or program
object
the data item
access mode
the kind of access (such as read, write,
or execute)
the authorization
policy
Nonmalicious
someone’s accidentally spilling a soft drink on a laptop, unintentionally deleting text, inadvertently sending an email message to the wrong person, and carelessly typing “12” instead of “21” when entering a phone number or clicking “yes” instead of “no” to overwrite a file.
malicious, human-caused harm
person actually wants to cause harm, and so we often use the term attack
random attack
the attacker wants to harm any computer or user;
directed attack
the attacker intends harm to specific computers, perhaps at one organization or belonging to a specific
individual
advanced persistent threat
attacks come from organized, well financed, patient
assailants. Often affiliated with governments or quasi-governmental groups, these attackers engage in long term campaigns. They carefully select their targets, crafting attacks that appeal to specifically those targets; email messages called spear phishing are intended to seduce their recipients.
harm
The negative consequence of an actualized threat
risk management
Involves choosing which threats to control and what
resources to devote to protection.
residual risk.
The risk that remains uncovered by controls
impact
the amount of damage it can cause
likelihood
threat is not just one that someone might want to pull off but rather one that could actually occur.
