Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security Threats > Chapters 7-9 > Flashcards

Chapters 7-9 Flashcards

(69 cards)

Start Studying
1
Q

What is a Security Audit?

A

Independent review of a system’s records and activities to determine adequacy of system controls, compliance, detect breaches, and change recommendations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the Objective of a Basic Security Audit?

A

Establish accountability for security system entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a Security Audit Trail?

A

Chronological record of system activities that can reconstruct and examine a sequence of environments and activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Common Criteria for an Event

A
  • Introduction of Objects
  • Deletion of Objects
  • Distribution or Revocation of Access Rights or Capabilities
  • Changes to Subject or Security Attributes
  • Policy Checks by Security Software
  • Use of Access Rights to Bypass Policy Check
  • Use of Identification and Authentication Functions
  • Security-related actions of user
  • Import/Export of data from/to Removable Media
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the Event Detection Criteria?

A
  • Appropriate Hooks must be Available
  • Monitoring Software needs to be Added
  • Event Recording Function is Needed
  • Audit Trail Analysis Software Tools May be Used to Analyze Collected Data
  • Additional Security for Auditing Function
  • Auditing System Should Have Minimal Effect on Functionality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the Implementation Guidelines?

A
  1. Agree on Audit Requirements with Management
  2. Scope of Technical Audit Tests Should be Agreed and Controlled
  3. Audit Tests should be Limited to Read-only Access to Software and Data
  4. Excemptions of 3 Should Only be on Isolated Copies of System Files
  5. Additionaly Requirements for Processing Should be Identified and Agreed
  6. Auditint Tests that Limit Availability Should be Run Outside Business Hours
  7. All Access Should be Monitored and Logged
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What Should Be Collected in an Auditing Trail?

A
  • Events Related to Use of Auditing Software
  • Events Related to Security Mechanisms
  • Events Collected for Use By Security Detection and Prevention Mechanisms
  • Events Related to System Management and Operation
  • Operating System Access
  • Application Access of Selected Applications
  • Remote Access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are Physical Access Audit Trails?

A

Audit Trails Generated By Equipment that Control Physical access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the Data of Interest of Physical Access Audit Trails?

A
  • Date/time/location/ of Access
  • Valid and Invalid Access Attempts
  • Attempts to Add/Modify/Delete Physical Access Privileges
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a Hook?

A

Capture Points that Trigger Data Collection and Storage, depends on OS and Applications Involved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Contained in an Event Log?

A
  • Numeric Identification Code
  • Set of Attributes
  • Optional User-supplied Data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 3 Types of Event Logs?

A
  • System
  • Application
  • Security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the Windows Event Categories?

A
  • Account Logon Events
  • Account Management
  • Directory Service Access
  • Logon Events
  • Object Access
  • Policy Changes
  • Privilege Use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the UNIX Syslog Elements?

A
  • syslog() : API referenced by several standard system utilities
  • logger : Command to add single-line entries to system log
  • /etc/syslog.conf : Config file used to control logging and routing of system log events
  • syslogd : Daemon to receive/route log events
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Syslog Service?

A
  • Means of Capturing Relevant Events
  • Storage Facility
  • Protocol for Transmitting syslog Messages from Other Machines to a Syslog Server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What Add-on Features Can be Included in the Syslog Service?

A
  • Robust Filtering
  • Log Analysis
  • Event Response
  • Alternative Message Formats
  • Log File Encryption
  • Database Storage
  • Rate Limiting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Syslog Protocol?

A

Transport Allowing Hosts to Send IP Event Notification Messages to Syslog Servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do Messages in the BSD Syslog Format Consist of?

A
  • PRI : facilities/severity code
  • Header : timestamp and hostname/IP address
  • Msg - program name and content
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are Interposable Libraries?

A

Allows the generation of audit data without needing to recompile the system libraries or application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the Three Types of Interposable Libraries?

A
  • Statistically Linked Libraries
  • Statically Linked Shared Libraries
  • Dynamicall Linked Shared Libraries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a Statically Linked Library?

A

Separate Copy of the Linked Library function is loaded into the program’s virtual memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a Statically Linked Shared Library?

A

Referenced Shared Object is Incorporated into the Target Executable at Link Time by the Link Loader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Dynamically Linked Shared Libraries

A

The linking to shared library routines is deferred until load time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Dynamic Binary Rewriting

A

Postcompilation technique that directly changes the binary code of executables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are Loadable Modules?
Modules that can automatically be loaded and unloaded on demand
26
What are the Types of Audit Trail Analysis
- Audit Trail After an Event: focuses on audit trail entries relevant to a specific event - Periodic Review: review bulk data to identify problems and behavior - Real-time Audit Analysis: part of intrusion detection
27
What is an Audit Review
- Provides administrator with information from selected audit records - Used to Provide Security Baseline
28
What are the Approaches to Data Analysis?
- Basic Alerting: Indicate interesting event occurred - Baselining: Define normal versus unusual events/patterns and compare it to new data - Windowing: detection of events within given set of parameters - Correlation: seeks relationship among events
29
What are SIEM Systems?
Centralized logging software package that is similar but more complex that syslog
30
What are the 2 general configuration approaches?
- Agentless: server receives data from log-generating hosts without special software - Agent-based: agent program installed on host performs filtering and aggregation and transmit it to server for analysis and storage
31
What are the 4 Processes of Access Control?
- Identification - Authentication - Autherization - Accountability
32
What is Identification?
Mechanism that provides Information about a supplicant that requests access
33
What is an ID?
An identifier is a unique label applied to a supplicant
34
What are the Authentication Mechanism Types?
- Something you Know - Something you Have - Something you are - Something you produce
35
What is Strong Authentication?
A system that uses two different authentication mechanism types
36
Differentiate Password vs Passphrase
- Passwords are private words or combination of characters that only the user should know - Passphrases are plain-language phrases from which a virtual password is derived
37
What are the Two forms of Cryptographic Tokens?
- Synchronous: time-based OTPs - Asynchronous: challenge-response for authentication
38
What are the Different Types of Biometric Evaluation Criteria?
- False Reject Rate (Type 1 Error) - False Accept Rate (Type 2 Error) - Crossover Error Rate (CER)W
39
What is a Type 1 Error?
False Negatives
40
What is a Type 2 Error?
False Positives
41
What is a CER?
The Crossover Error Rate is the point at which the number of false rejections equals the number of false acceptances
42
What are the Types of Authorization?
- Each Authenticated User: System verifies an entity and only grants access to that entity - Members of a Group: System matches authenticated entities to a list of entities and then grants access based on the group's access rights - Across Multiple Systems: Central system verifies identity and grants a set of credentials to the entity
43
What are Firewalls?
- Limit access - Enforce Security Policy - Monitor/log activity
44
What Can Firewalls Not Protect Against?
- Malicious Insiders - Unforseen Threats - Connections Not Passing Through - All Viruses
45
What are the Major Firewall Categories
- Packet-filtering - Application Layer Proxies - Media Access Control Layer - Hybrids
46
What are the Three Packet-filtering Firewall Subsets?
- Static Packet Filtering: configuration rules need to be manually set and modified - Dynamic Packet filtering: reacts and adapts to network traffic - Stateful Packet Inspection (SPI): Keeps track of each network connection using a state table and that expedites the filtering of those communications
47
What is an Application Layer Proxy Firewall?
- Device capable of functioning as a firewall and an application layer proxy server
48
What are the types of Application Layer Proxy Firewalls?
- Proxy Servers - Reverse Proxies - Demilitarized Zone (DMZ)
49
What is a Proxy Server?
Intercepts and accommodates requests for internal servers
50
What are Reverse Proxies?
Proxies that return queries to users after passing requests to relevant servers
51
What is a DMZ?
A Demilitarized Zone is an immediate area designed to provide servers and and firewall filtering
52
Differentate UTMs and NGFWs
Unified Threat Management devices are rudimentary hybrid firewalls, while Next Generation Firewalls have additional features such as deep packet inspections and the ability to decrypt encrypted traffic
53
Differentate RADIUS and TACACS+
Radius has less protection and support but falls under UDP while TACACS+ has more protection and support but falls under TCP
54
What is a VPN?
A Virtual Private Network keeps the contents of the network messages hidden from observers who may have traffic access
55
What are the Three VPN Technologies?
- Hybrid: a combination of trusted and secure VPN implementations - Secure: uses security protocols to encrypt transmitted traffic - Trusted (Legacy): uses leased circuits from a service provider with a contractual obligation that no one else is allowed to use said circuits
56
What is a Host?
Anything with an IP Address because they can be attacked
57
What are the Elements of Host Hardening?
- Backup - Restrict Physical Access - Configure OS with Secure Options - Minimize Running Applications - Harden Applications - Download and Patches - Manage Users and Groups Securely - Manage Access Permissions for Users and Groups Securely - Encrypt Data (if appropriate) - Add a firewall - Regularly Read OS log files - Run vulnerability tests
58
What are the Types of Vulnerability and Exploit Fixes?
- Work-arounds: manual, expensive, and error-prone - Patches: small programs that fix vulnerabilities, easy to download and install - Service Packs - Version Upgrades
59
What are the Problems with Patching?
- Must fine OS System Patches - Clients get overwhelmed with number of patches - costs time and labor - Priorities might lead to some patches being left out - Risky if untested
60
What is a Super User Account?
Account has access to everything, present in all OS. Should only be used when needed
61
What is Hacking Root?
Taking over the super user account
62
What are Permissions?
Specify what a user/group can do to files and directories
63
What is Inheritable Permission?
A directory receives the permissions of the parent directory
64
What are the Steps of Vulnerability Testing?
- Run Software Against Hosts to be Tested - Interpret Reports - Fix Problems
65
What are the Four Main Policies for Sensitive Data?
- Limit what sensitive data can be stores on all mobile devices - Require data encryption - Protect notebook with strong password - Audit 2 previous policies
66
What are the Benefits of Centralized PC Security Management?
- Allows One Knowledgeable User to Manage Security - Reduces Cost through Automations
67
What is NAC?
A Network Access Control checks connecting parties before allowing connection
68
What are the stages of NAC?
1. Initial Health Check 2. Ongoing Traffic monitoring (not always done)
69
What are the Advantages of GPOs?
- Consistency - Reduced Administrative Costs - Compliance - Control

Security Threats (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions