Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Chapter 7: Security Operations > Flashcards

Chapter 7: Security Operations Flashcards

(79 cards)

Start Studying
1
Q

Operations Security

A

Security is primarily concerned with the protection and control of information processing assets in centralized and distributed environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security Operations

A

are primarily concerned with the daily tasks required to keep security services operating reliable and efficiently. Operations security is a quality of other services. Security operations is a service in its own right”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

control Mechanisms

A

Protect information and resources from unauthorized disclosure, modification, and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Types of Control Mechanisms

A

PhysicalAdministrativeTechnical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Administrative Controls

A

Development of policies, standards, and procedures Screening personnel, security awareness training, monitoring system and network activity, and change controlExample: - Procedures indicating how servers should be installed, annual security awareness education for all employees, implementing a change control program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Technical Controls

A

Logical mechanisms that provide password and resource management, identification and authentication, and software configurationsExample: - Anti-virus software, intrusion detection systems, locking down operating systems, encryption, firewalls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Physical Controls

A

Protecting individual systems, the network, employees, and the facility from physical damageExample: - Removing floppy drives from computers, locking chassis’s, security guards monitoring the facility, air conditioning and humidity control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Preventative Access Control

A

Controls to prevent undesirable events from taking place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Detective Access Control

A

Controls used to identify undesirable events that have occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Corrective Access Control

A

Controls Used to Correct effects of undesirable events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Deterrent Access Control

A

Controls used to discourage security violations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Recovery Access Control

A

Controls used to restore resources and capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Compensation Access Control

A

Controls used to provide alternate solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

MTBF

A

mean time to failure how long will a device last

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

MTTR

A

mean time to repair how long for the recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RAID - 0

A

Disk striping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Raid 1

A

mirroring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Raid 5

A

Disk striping with parity: fault tolerance + speed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Clustering

A

2 or more nodes acting as a single or logical entity. can provide load balancing but not always.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Full Backup

A

Archive bit is reset (is is a flag saying hey i got backed up)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Incremental Backup

A

Backs up all files that have been modified since last backupArchive Bit is reset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Differential Backup

A

Backs up all files that have been modified since last full backupArchive Bit is not resetAlways will have to restore 2 tapes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Copy Backup

A

Same as full backup, but Archive Bit is not resetUse before upgrades, or system maintenanceCopy backup before making a system backup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

configuration management

A

a process of identifying and documenting hardware components, software and the associated settings.” including bios settings…etc.everything needs to be documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
System Hardening
Removing Unnecessary ServicesInstalling the latest services packs and patchesRenaming default accountsChanging default settingsEnabling security configurations like auditing, firewalls, updates, etc***Don’t forget physical security!***
26
Change Management
Directive, Administrative Control that should be incorporated into organizational policy. The formal review of all proposed changes--no “on-the-fly” changes Only approved changes will be implementedThe ultimate goal is system stabilityPeriodic reassessment of the environment to evaluate the need for upgrades/modifications***know the flow of how it works****
27
Change management process
Request SubmittalRisk/Impact AssessmentApproval or Rejection of ChangeTestingScheduling/User Notification/TrainingImplementationValidationDocumentation
28
Patch Management
An essential part of Configuration and Change ManagementMay come as a result of vendor notification or pen testingCve.mitre.org (Common Vulnerability and Exposures) database provides standard conventions for known vulnerabilitiesNvd.nist.gov Enables automation of vulnerability management, security measurement, and compliance. NVD includes databases of security checklists, security related software flaws, incorrect configurations, product names, and impact metrics. www.cert.gov: Online resource concerning common vulnerabilities and attacks
29
Trusted Recovery
System reboot, emergency system restart, system cold startNo compromise of protection mechanisms or possibility of bypassing themPreparing system for failure and recovering the systemFailure of system cannot be used to breach securityFails - in a secure manner....
30
Media Management
Production Libraries--Holds software used in production environmentProgrammer Libraries--Holds work in progressSource Code Libraries--Holds source code and should be escrowed (3rd Party Storage)Media Library--Hardware centrally controlled
31
Media Librarian
Librarian to control accessLog who takes what materials out and whenMaterials should be properly labeledMedia must be properly sanitized when necessaryZeroization (Previous DoD standards required seven wipes. Currently, only one is required.)Degaussing (Only good for magnetic media)Coercivity: Amount of energy required to reduce the magnetic field to zeroPhysical destruction (The best means of removing remnants).
32
Identity Management
Controls the lifecycle for all accounts is a system
33
Access Managament
Controls the assignment of rights/privileges to those accounts.
34
ID and Access management per ISC2
“focus on harmonizing the provisioning of users and managing their access across multiple systems with different native access control systems”.
35
Security Review
Conducted by system maintenance or security personnel Goal is determine vulnerabilities within a system. Also known as a vulnerability assessment
36
Security Audit
Conducted by 3rd partyDetermines the degree to which required controls are implemented
37
Vulnerability Assesment
Physical / Administrative/ LogicalIdentify weaknessesless intrusive
38
PEN Testing
Ethical hacking to validate discovered weaknessesRed Teams (Attack)/Blue Teams (Defend)
39
Zero Knowledge attack
(Black Box Testing): Team has no knowledge of the target and must start with only information that is publically available. This simulates an external attack
40
Partial Knowledge attack
The team has limited knowledge of the organization
41
Full Knowledge attack
This simulates an internal attack. The team has full knowledge of network operations
42
Blind PEN
attacker have no internal staff know
43
Double Blind
attack have no internal structure staff doesn't know what's up
44
Targeted
Staff works with pen guys on specific things
45
Attack Methodology 1 of 2
1. Reconnaissance WhoIs Database, Company Website, Job Search Engines, Social Networking2. Footprinting Mapping the network (Nmap) ICMP ping sweeps DNS zone transfers3. Fingerprinting Identifying host information Port scanning4. Vulnerability assessment Identifying weaknesses in system configurations Discovering unpatched software
46
Attack Methodology 2 of 2
5. The “attack” Penetration Privilege escalation Run As, SU Root kits Colllection of tools to allow continued access. Includes Back Door softwareCan update the kernel of the operating systemVery difficult to detect Cover tracksTrojaned Programs: The Attacker replaces default utilities with ones that masquerade as system utilities that provide normal services, with the exception of helping identifiy the backdoor softwareLog Scrubbers
47
Why PEN Test???
Risk analysisCertificationAccreditationSecurity architecturesPolicy developmentResponsible approach to overall securityBoost company’s position in marketplace
48
Why do PEN test work?
Lack of awarenessPolicies not enforced Procedures not followedDisjointed operations between departmentsSystems not patched
49
PEN Test Requiremetn
Three basic requirements:Defined goal, which should be clearly documentedLimited timeline outlined with managementApproved by senior management; only management should approve this type of activitySIGNED OFF....
50
PEN Rules of Engagement
Specific IP addresses/ranges to be tested Any restricted hostsA list of acceptable testing techniquesTimes when testing is to be conductedPoints of contact for the penetration testing team, the targeted systems, and the networks Measures to prevent law enforcement being called with false alarmsHandling of information collected by penetration testing team
51
3 Types of PEN Test
Physical Security --Access into building or department--Wiring closets, locked file cabinets, offices, server -room, sensitive areasRemove materials from buildingAdministrative Security---Help desk giving out sensitive information, data on disposed disksLogical Security--Attacks on systems, networks, communication
52
nmap
a port scanner
53
vulnerability scanning
ID'ing:Active hosts on network Active and vulnerable services (ports) on hostsApplicationsOperating systemsVulnerabilities associated with discovered OS & applicationsMisconfigured settings
54
dictionary attack
goes through dictionary
55
Brute Force
try every single pass combo
56
Rainbow Table
Trying to find a match to the hash
57
Rogue Infrastructures
unathorized dhcp and dns servers
58
War Dialing
trying to find modem lines
59
PEN discover serious issue
stop and report
60
Log Reviews
Periodically check the logs...good to be proactive and taking a look
61
side channel attacks
looking where traffic is going
62
traffic padding
Generating spurious data in traffic to make traffic analysis more difficultSending out decoy attacksThe amount and nature of traffic may be maskedAttempt to keep traffic constant so no information can be gained
63
IDS
Software is used to monitor a network segment or an individual computerUsed to detect attacks and other malicious activityDynamic in naturePASSIVE SYSTEM***** a glorified snifferhas analysis engine
64
Network Based IDS
Monitors traffic on a network segmentComputer or network appliance with NIC in promiscuous modeSensors communicate with a central management consolesniffer with analysis engine
65
Host Based IDS
Small agent programs that reside on individual computerDetects suspicious activity on one system, not a network segment
66
where put IDS
in the DMZ
67
Difference between IDS and Sniffer
the anlysis engine with works like this you hunk:Pattern Matching-Rule-Based Intrusion Detection-Signature-Based Intrusion Detection-Knowledge-Based Intrusion DetectionProfile Comparison-Statistical-Based Intrusion Detection-Anomaly-Based Intrusion Detection-Behavior-Based Intrusion Detection
68
Sig Based IDS Systems
Signature-based—MOST COMMONIDS has a database of signatures, which are patterns of previously identified attacksCannot identify new attacks Database needs continual updates
69
Behaviors IDS system
Behavior-basedCompares audit files, logs, and network behavior, and develops and maintains profiles of normal behaviorBetter defense against new attacksCreates many false positives
70
IDS response options
Passive:Page or e-mail administratorLog eventActiveSend reset packets to the attacker’s connectionsChange a firewall or router ACL to block an IP address or rangeReconfigure router or firewall to block protocol being used for attack
71
IDS Portspan
make switch act like hub for IDS captures
72
Permiscous mode
IDS Needs an interface that gets everything...
73
Insertion Attack
disguising malicious code
74
honeypot
a distractorPseudo Flaw: Loophole purposely added to operating system or application to trap intruders Sacrificial lamb system on the networkAdministrators hope that intruders will attack this system instead of their production systemsIt is enticing because many ports are open and services are runninghoneynet- a collection of honeyposts
75
Enticement vs Entrapment
make it look vunerable keep attacker buys
76
padded cell
and area of isolation like java...a sandbox
77
Phishing
Social engineering crazy email to entice user.
78
spoofing
emails that look authentic
79
whitelist
all traffic is denied except...what is on list.

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions