Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

networks > CS2005 - Lecture 12 - Security > Flashcards

CS2005 - Lecture 12 - Security Flashcards

(80 cards)

Start Studying
1
Q

What defines a system as ‘secure’?

A

A system is secure if its resources are used and accessed as intended under all circumstances; However, total security cannot be guaranteed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a threat in cybersecurity?

A

A potential security violation; May or may not happen; Can lead to attacks on systems or networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who is an intruder in the context of system security?

A

Someone attempting to gain unauthorized access; May try to damage or disrupt data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the main types of security violations?

A

Breach of confidentiality; Breach of integrity; Breach of availability; Theft of service; Denial of service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a breach of confidentiality?

A

Unauthorized access to or theft of data (e.g., credit card data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a breach of integrity?

A

Unauthorized modification of data (e.g., altering website content)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a breach of availability?

A

Destruction or disruption of data (e.g., website defacement)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is denial of service (DoS)?

A

Preventing legitimate users from accessing system services by overwhelming them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is masquerading in network security?

A

Pretending to be another user or system to gain unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a replay attack?

A

Maliciously repeating a valid data transmission to gain advantage (e.g., money transfer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is session hijacking?

A

Taking over an active communication session to bypass authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the four levels of effective security measures?

A

Physical; Human; Operating System; Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Trojan Horse in cybersecurity?

A

A program disguised as something benign; May delete/modify data or install backdoors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a trap door in software?

A

A hidden access point (e.g., hardcoded credentials) left by the developer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a logic bomb?

A

Malicious code triggered under specific conditions (e.g., a date/time)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a worm?

A

A standalone, self-replicating program that spreads and consumes resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How did the Morris Worm work?

A

Exploited UNIX vulnerabilities; Used a ‘grappling hook’ and main program; Conducted attacks via rsh, finger, and sendmail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the purpose of cryptography?

A

Ensure secure communication without trusting the network; Encode messages so only parties with the correct key can decode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define: Cipher, Plaintext, Ciphertext.

A

Cipher: Algorithm for encryption/decryption; Plaintext: Original message; Ciphertext: Encrypted message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is symmetric encryption?

A

Uses the same key for both encryption and decryption; Requires secure key sharing between sender and receiver

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Name some symmetric encryption algorithms.

A

DES, Triple DES, AES (block ciphers); RC4 (stream cipher)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is asymmetric encryption?

A

Uses different keys for encryption and decryption (public/private); Public key is shared openly; private key is secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How does RSA encryption work?

A

Based on factoring large prime numbers; Public key for encrypting; private key for decrypting; Often used to securely share symmetric keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does the macro in the diagram do?

A

Runs a Visual Basic script that silently formats the C: drive; Exploits the FileSystemObject and Shell to execute the command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Why is this script dangerous?
It causes irreversible data loss by reformatting the hard drive; Can be embedded in a macro-enabled document for stealth execution
26
What does the 'Man-in-the-middle' diagram show?
An attacker intercepting communication between sender and receiver; Appears legitimate to both ends
27
What does the 'Normal' communication diagram illustrate?
Direct communication between sender and receiver without interception
28
How does a man-in-the-middle attack differ from session hijacking?
Man-in-the-middle maintains ongoing interception; Session hijacking takes over after authentication has occurred
29
What security threat is depicted in the masquerading diagram?
An attacker pretending to be a trusted sender to deceive the receiver
30
Why is masquerading considered a breach of authentication?
It allows access to resources or privileges under false identity
31
What attack method is illustrated with the 'grappling hook' and 'worm'?
The Morris Worm attack; Uses a grappling hook to exploit vulnerabilities (e.g., rsh, sendmail) and downloads the worm
32
What services were exploited in the Morris Worm?
rsh, finger, sendmail
33
What does this encryption diagram represent?
Symmetric key encryption over an insecure channel
34
What are the key components shown in the diagram?
Key exchange; Encryption algorithm (E) and Decryption algorithm (D); Attacker attempting to intercept ciphertext
35
How is secure communication maintained despite an insecure channel?
Only the intended recipient with the correct key can decrypt the message
36
What is a breach of availability?
Unauthorized destruction or disabling of data or services, e.g., website defacement or DoS attacks
37
How does theft of service occur in a system?
Unauthorized use of system resources like CPU or network bandwidth, often through rogue processes
38
What is confidentiality in the context of security?
Ensuring that information is only accessible to those authorized to view it
39
What example best illustrates a breach of integrity?
Modifying the content of a trusted website or falsifying database entries
40
Why is a DoS attack considered a serious security violation?
It disrupts availability, preventing legitimate users from accessing system resources
41
Why must physical security be part of cybersecurity?
Unauthorized physical access can bypass digital safeguards completely
42
What are examples of human-level threats to security?
Phishing, social engineering, careless password handling
43
Why is network-level security crucial?
Data in transit can be intercepted, spoofed, or altered
44
What is the weakest link principle in security?
The overall system security is only as strong as its least protected component
45
What is the goal of defense in depth?
To use multiple layers of security to protect against different types of threats
46
What is a Trojan horse in cybersecurity?
A malicious program disguised as a useful one that grants unauthorized access
47
How does a trap door threaten a system?
It provides a hidden way to access the system, often without authentication
48
What is a logic bomb?
A code segment that triggers a malicious function when specific conditions are met
49
What distinguishes a virus from a worm?
A virus requires a host file to propagate; a worm does not and can self-replicate
50
How does buffer overflow pose a security risk?
It can overwrite memory, allowing attackers to execute arbitrary code
51
What is port scanning used for by attackers?
To find open ports that may have exploitable services
52
What are zombie systems in the context of network threats?
Compromised machines used to launch attacks like DDoS without the owner's knowledge
53
How does a worm exploit network systems?
By self-replicating and spreading across connected devices, consuming resources
54
What kind of services might be abused in a system attack?
Email servers, open ports, and default login credentials
55
What is a hybrid threat involving both system and network vectors?
A worm that installs a Trojan horse through a network exploit
56
What is the difference between encryption and cryptography?
Cryptography is the study of secure communication; encryption is one of its methods
57
Define the term 'cipher'.
An algorithm used for encryption and decryption
58
What is plaintext in cryptography?
The original readable message before encryption
59
What does ciphertext mean?
The encrypted, unreadable version of a message
60
What is cryptanalysis?
The study of breaking or analyzing encryption to reveal plaintext without a key
61
Why is encryption used in network communication?
To prevent unauthorized users from reading transmitted data
62
What is the function of a decryption algorithm?
To transform ciphertext back into readable plaintext using a key
63
What makes an encryption function secure?
Its output cannot be deciphered without the correct key
64
What does key management involve in encryption?
Generating, distributing, and securely storing cryptographic keys
65
What is a cryptosystem?
A suite of algorithms and keys used for secure communication
66
Why is key secrecy fundamental to encryption?
If the key is compromised, the security of all encrypted data is lost
67
What does it mean for decryption to be infeasible without a key?
It should not be computationally practical to decrypt data without knowing the key
68
Why is public-key infrastructure needed in asymmetric encryption?
To ensure the authenticity and trustworthiness of shared public keys
69
What ensures encryption resists brute-force attacks?
The key length and algorithm complexity
70
Can encryption be secure if the algorithm is public? Why?
Yes, as long as the key remains secret, public algorithms can still be secure (Kerckhoffs's principle)
71
What is the main advantage of symmetric encryption?
It is computationally efficient and fast
72
What is AES?
Advanced Encryption Standard — a widely used symmetric block cipher
73
Why is secure key exchange a problem in symmetric encryption?
Both parties must already share a secret key, which is hard to do securely
74
How does DES differ from Triple DES?
Triple DES applies the DES algorithm three times for improved security
75
What is RC4?
A stream cipher previously used in SSL; now considered insecure
76
What are the two keys used in asymmetric encryption called?
Public key (for encryption) and private key (for decryption)
77
What is RSA based on?
The difficulty of factoring large prime numbers
78
Why is asymmetric encryption slower than symmetric?
It uses more complex mathematical operations and larger keys
79
When is asymmetric encryption typically used?
For securely exchanging symmetric keys or in digital signatures
80
How does a recipient know a message came from a trusted source in asymmetric encryption?
Using digital signatures verified by the sender's public key

networks (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions