Computer Security Principles and Terminology

Question 1

Computer Security definition

Answer 1

measures and controls that ensure confidentiality, integrity, and availability of information processed and stored by a computer, including software, hardware, firmware, information data, and telecommunications

Question 2

Essential Network and Computer Security Requirements

Answer 2

Confidentiality
Integrity
Availability
Accountability
Authenticity

Question 3

Confidentiality

Answer 3

The preservation of authorized restrictions on information access and disclosure (protecting personal privacy and proprietary information)

Question 4

Integrity

Answer 4

Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity

Question 5

Availability

Answer 5

ensuring timely and reliable access to and use of information

Question 6

Low Impact

Answer 6

limited adverse effect on the effected (organizations, individuals)

Question 7

Moderate Impact

Answer 7

Serious adverse effect on the effected

Question 8

High

Answer 8

Severe or catastrophic adverse effect

Question 9

Adversary (threat agent)

Answer 9

Individual, group, organization, or government that conducts or has the intent to conduct detrimental activities

Question 10

Attack

Answer 10

Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself

Question 11

Countermeasure

Answer 11

A device or technique that has as its objective the impairment of the operational effectiveness of undesirable or adversarial activity, or the prevention of espionage, sabotage, theft, or unauthorized access to or use of sensitive information or information systems

Question 12

Risk

Answer 12

A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of 1) the adverse impacts that would arise if the circumstance or event occurs; and 2) the likelihood of occurrence

Question 13

Security Policy

Answer 13

A set of criteria for the provision of security services. It defines and constrains the activities of a data processing facility in order to maintain a condition of security for systems and data

Question 14

System Resource (Asset)

Answer 14

A major application, general support system, high impact program, physical plant, mission critical system, personnel, equipment, or a logically related group of systems

Question 15

Threat

Answer 15

Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through a information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service

Question 16

Vulnerability

Answer 16

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source

Question 17

Assets of a Computer System

Answer 17

Hardware
Software
Data
Communication facilities and networks

Question 18

Categories of vulnerabilities

Answer 18

Corrupted (loss of integrity)
Leaky (loss of confidentiality)
Unavailable or very slow (loss of availability)

Question 19

Threats

Answer 19

Capable of exploiting vulnerabilities
Represent potential security harm to an asset

Question 20

Attacks (threats carried out)

Answer 20

Active - attempt to alter system resources or affect their operation
Passive - attempt to learn or make use of system information that does not affect system resources
Insider - initiated by an entity inside the security parameter
Outsider - initiated from outside the perimeter

Question 21

Countermeasures

Answer 21

prevention, detection, recovery
may introduce new vulnerability, residual vulnerabilities may remain
goal is to minimize residual level of risk to the assets

Question 22

Unauthorized Disclosure

Answer 22

A circumstance or event whereby an entity gains unauthorized access to data

Question 23

Unauthorized Disclosure Threat Actions

Answer 23

Exposure: Sensitive data are directly released to an unauthorized
entity.
Interception: An unauthorized entity directly accesses sensitive data traveling between authorized sources and destinations.
Inference: A threat action whereby an unauthorized entity indirectly accesses sensitive data (but not necessarily the data contained in the communication) by reasoning from characteristics or by-products of communications.
Intrusion: An unauthorized entity gains access to sensitive data by circumventing a system’s security protections.

Question 24

Deception

Answer 24

A circumstance or event that may result in an authorized entity receiving false data and believing it to be true

Question 25

Deception Threat Action

Answer 25

Masquerade: An unauthorized entity gains access to a system or
performs a malicious act by posing as an authorized entity.
Falsification: False data deceive an authorized entity.
Repudiation: An entity deceives another by falsely denying
responsibility for an act.

Question 26

Disruption

Answer 26

A circumstance or event that interrupts or prevents the correct operation of system services and functions

Question 27

Disruption Threat Action

Answer 27

Incapacitation: Prevents or interrupts system operation by disabling
a system component.
Corruption: Undesirably alters system operation by adversely
modifying system functions or data.
Obstruction: A threat action that interrupts delivery of system
services by hindering system operation

Question 28

Usurpation

Answer 28

A circumstance or event that results in control of system services or functions by an unauthorized entity

Question 29

Usurpation

Answer 29

Misappropriation: An entity assumes unauthorized logical or
physical control of a system resource.
Misuse: Causes a system component to perform a function or
service that is detrimental to system security