Chapter Five & Six Flashcards
(45 cards)
Incident Response is…
Responding to a matter of organizational security following existing policy.
Disaster Recovery is…
Policies that define how to recover stole data, mitigate damage, reclaim compromised systems, etc.
Business Continuity is…
Continuing day-to-day business operations before, during, and after security breaches.
Remediation is
recovery from a compromise
Why do we not use
its native OS to analyze its content
This changes information on the hard drive
To handle magnetic data…
Reading data: We generate a current if a coil of wire moves past a magnet
Writing data: We magnetize a surface if it moves past a coil of wire containing a current
Data on a hard drive: What are sectors?
Each sector is an independent data block on the hard drive
– Typical drives have fixed-size sectors
* 512 bytes each, larger on some new drives
– Each sector has a unique address
* Drive may read or write each sector independently
– doesn’t affect other sectors
Moore’s Law:
-– Named for Gordon Moore of Intel
– Noted that, by the mid-1960s, integrated
circuits double size and performance yearly
– Later refined the estimate:
* Doubles every 18 months
True or false: The number of bits determines the maximum
size of any number
True
Signed integers…
– Can be both positive and negative
– Range from [-2147483648 to 2147483647]
– Use a “sign bit” (first bit of a string) as a flag to indicate positive or negative (magnitude)
Unsigned Integers…
– Can ONLY be positive
– Range from [0 to 4294967295]
– Do not have the capacity for negative sign flags to change internal binary interpretation
Clusters are..
Each cluster is a series of sectors treated as a single block of data by the file system
Parity bit…
binary flag which enforces
communication protocol between two computers
Cyclic Redundancy Checks (CRCs)
– Can detect a “burst” of errors
* A series of all 0s replacing the real data
– More sensitive to a change of order
* Simple checksum won’t detect swaps
Error Correcting Codes (ECC)
– Can detect larger-scale errors
– Can correct smaller errors
– Used on RAMs and DVDs
The binary address size
number of bits in the
binary number that holds the address
– We use k bits to store addresses up to size n
k = log2(n)
FAT… (file allocation table)
- A relatively simple and widely used file system
– Introduced in Microsoft’s MSDOS
– Supported in Windows, OS-X, Linux, etc.
– Used in digital products like cameras, medical
equipment, etc. - Supports many modern features
– Longer, mixed-case file names
– Hierarchical directories
– Individual files sized up to 4GB
Boot blocks…
– Contain bootstrap program on bootable drive
– Contains details of the volume format
True or False: FAT Locates free clusters and clusters in files
True
Can we delete a file’s data?
No.
– Sometimes we can retrieve the file’s data if:
* The file’s clusters were all stored in
sequence on the hard drive
* Another file hasn’t overwritten its clusters
– Application Programming Interface (API)
- A simple, standard way for programs to use I/O devices and files
Device Independence
Converts API operations into specific
commands for individual devices
File System
converts file operations into API
operations performed on the hard drive
A compromised system has…
had defenses
weakened, and possibly no other damage
