Chapter 10 - Social Engineering & Other Foes Flashcards Preview

Security + > Chapter 10 - Social Engineering & Other Foes > Flashcards

Flashcards in Chapter 10 - Social Engineering & Other Foes Deck (28)
Loading flashcards...
1
Q

why is social engineering also called wetware?

10 - 355

A

because it doesn’t require software or hardware, is dependent on the gray matter of the brain

2
Q

tell me the 7 types of social engineering attacks

10 - 356 thru 361

A

shoulder surfing - watching someone over their shoulder, fight this with privacy filters
dumpster diving - just what it sounds like
tailgating - follow someone through the door they just unlocked
impersonation - can be done in person, over the phone, by email, etc.
hoaxes - phony threats
whaling - phishing or spear phishing for big users
vishing - VoIP phishing

3
Q

there are reasons why social engineering is effective. there are 7 of them. tell me what they are.

10 - 362,363

A
authority
intimidation
consensus/social proof
scarcity
urgency
familiarity/liking
trust
4
Q

the only preventative measure to combat social engineering is what?

10 - 365

A

educating yourself and never handing stuff out

5
Q

as far as physical barriers go, your system should have a minimum of 3. tell me what they are.

10 - 367

A

the perimeter
a door locked by ID badges, prox readers, keys, all for the computer center
a locked door on the computer room

6
Q

tell me 2 types of hardware locks and security

10 - 369

A

cable lock

safe and locking cabinets

7
Q

how does a mantrap work?

10 - 371

A

you need visual identification AND authentication to gain access

8
Q

what is the purpose of an access list?

10 - 373

A

to identify specifically who can enter a facility

9
Q

protected distribution system. tell me what it is.

10 - 376

A

one in which the network is secure enough to allow for the transmission of classified information in non-encrypted format

so, physical security has been substituted for encryption security

10
Q

what is HVAC?

10 - 378

A

heating, ventilation, and air conditioning

11
Q

there are 4 types of fire extinguishers. tell me their letters, their use, their retardant composition

10 - 378

A

a - wood and paper, largely water or chemical
b - flammable liquids, fire-retardant chemicals
c - electrical, non-conductive chemicals
d - flammable metals, varies; type specific

12
Q

tell me the 2 things that most common fixed systems combine

10 - 379

A

fire detectors

fire-suppression systems

13
Q

what can you use to provide electronic shielding for the computer room?

hint: constant trap

10 - 380

A

Faraday cage

14
Q

Tell me the difference between EMI and RFI.

10 - 380, 381

A

EMI will distort the signal in the data cable, and the receiver reads the wrong message or doesn’t read it at all.

RFI adds too much energy to the RF energy pool, and so the receivers become deaf and don’t hear the signal they’re supposed to hear.

15
Q

you are eavesdropping on CRT and LCD displays by detecting their electromagnetic emissions. what is this called?

what’s a good countermeasure for this?

10 - 381

A

Van Eck phreaking

shielding

16
Q

The U.S. government had a project back in the 50s for reducing electronic noise from devices that would divulge intelligence about systems and information. What was this project called?

10 - 382

A

TEMPEST

17
Q

In your hot and cold aisles setup, will you find the air conditioning units adjacent to the hot aisles or the cold aisles?

10 - 382

A

the hot aisles

18
Q

Most fire-suppression systems work off of the concept of removing one of the three elements needed for a fire. tell me the three elements.

10 - 383

A

heat, fuel, oxygen

19
Q

if your humidity gets too low, electrostatic damage is likely to occur. what’s the humidity percentage that your computer center should never drop below?

10 - 383

A

50%

20
Q

what is the deterrent security control type?

10 - 384

A

anything intended to warn a would-be attacker that they should not attack

21
Q

what is the preventive security control type?

10 - 384

A

stop something from happening

22
Q

what is the detective security control type?

10 - 384

A

to uncover a violation

23
Q

what is the compensating security control type?

10 - 384

A

backup controls that come into play when other controls have failed

24
Q

what is the technical security control type?

10 - 384

A

controls implemented through technology. they can be any of the other types of control EXCEPT for administrative

25
Q

what is the administrative security control type?

10 - 384

A

comes down through policies, procedures, and guidelines

26
Q

a data policy should be focused on what 4 issues?

10 - 385,386

A

wiping - data removal
disposing - physical media is discarded
retention - how long do you keep it?
storage - where is the data kept?

27
Q

tell me the 3 steps to destroying a flash drive

10 - 386,387

A

crack open the drive
turn the chip to powder
finish it off

28
Q

tell me the two frequencies that RFID readers run at.

10 - 367

A

13.56MHz and 125kHz