Domain 3 Flashcards
1
Q
Security Design
A
Security must be incorporated and addressed from the initial planning and design phases through disposal of the system.
- Without proper attention to security , an organization’s information technology can become a source of significant risk
- With careful planning from the earliest stages, however, security becomes an enabler to achieve the organizations mission.
2
Q
NIST SP 800-160
A
System Security Engineering: Considerations for a Multidisciplinary approach in the engineering of Trustworthy Secure Systems.
SP 800-16 addresses the engineering-driven actions necessary to develop more defensible and survivable systems - including the components that compose and the services that depend on those systems.
3
Q
DevOps
A
The DevOps development methodology is built on the premise that collaboration between developers and the operations team is essential.
4
Q
Secure DevOps
A
Instead of security operating as a isolated discipline, Secure DevOps aims to integrate security into the development processes from inception.
- The Secure DevOps approach enables developers to learn more about how that they are developing and can be exploited.
- Secure DevOps proactively focused on survivability by providing reliable software with reduced attach surface.
5
Q
Business Alignment
A
Business Alignment mandates that secure design principles are supported thorough the entire organization and incorporates various viewpoints.
6
Q
Business Alignment Framework
A
- Zachman Framework
- Sherwood Applied Business Security Architecture.
7
Q
Zachman Framework
A
The Zachman Framework provides a context for understanding a complex environment by intersecting views and viewpoints.
- Views: What, how, where, who, and when.
- Viewpoints: developer, systems, engineer, security, officer, application administrator, and end user.
8
Q
Sherwood Applied Business Security Architecture. (SABSA)
A
The Sherwood Applied Business Security Architecture. (SABSA) provides a context for understanding a complex environment by intersecting views and life-cycle layers.
- Views: What, why, how, where, who, and when.
- Life-cycle Layers: Contextual, conceptual, logical, physical, component, and operational.
9
Q
Information Security Models
A
Information Security Models focus on interactions and provide structure and rules to be followed to accomplish a specific objective (e.g. confidentiality, integrity, and availability)
10
Q
Foundational Information Security Models
A
Foundational (lower level) model include State Machine, Non Inference, and Information Flow.
11
Q
Relationship Information Security Models
A
Relationship (higher level) models include Bell-LaPadula, Biba, Clark -Wilson, Harrison-Ruzzo Ullman (HRU) and Brewer Nash.
Relationship security models address the interaction between subjects and objects.
12
Q
State Machine Model
A
Conceptual model that ensures no matter what activity is taking place within a system, it is always trustworthy/
13
Q
Non-inference model (multilevel)
A
Whatever happens at one security level does not directly or indirectly affect the security environment of other levels.
14
Q
Information Flow model (multilevel)
A
Information will flow only in ways that do not violate the security policy of the system.
15
Q
Subjects
A
Subjects are active entities, generally in the form of a person, process, or device that causes information to flow among objects or changes the system state.
16
Q
Objects
A
Objects are passive entities that contain or receive information or instructions
17
Q
Bell-Lapadula
A
The goal the Bell-Lapadula model is confidentiality.
- Simple (read) confidentiality rule: A subject cannot read data at a higher security level (no read up) as secrets may be revealed to them.
- Star {*} (write) confidentiality rule. A subject cannot write information to a lower security level (no write down) as secrets may be revealed to others.
18
Q
Biba
A
The goal of the Biba model is integrity.
- Simple (read) integrity rule: A subject cannot read data at a lower security level (no read down) as they might be misled.
- Star [*] (write) integrity rule: A subject cannot write information to a higher security level (no write up) as they might mislead others.
19
Q
Clark-Wilson
A
The goal of the Clark-Wilson model is data integrity.
- Prevent unauthorized users from making modifications.
- Prevent authorized users from making improper modifications.
- Maintain internal and external consistency.
20
Q
Clark-Wilson (Access Triple)
A
The Clark-Wilson users a three-part relationship (subject/program/object) known as access control triple.
Well formed transactions ensure that a user cannot alter data arbitrarily. Instead, data can be altered only in a specified way in order to preserve its internal consistency (access triple).
- Users cannot access and manipulate objects directly but must access information through a program.
21
Q
Harrison-Ruzzo-Ullman Model (HRU)
A
The goal of Harrison-Ruzzo-Ullman Model (HRU) is integrity.
- A finite set of operations can be performed on an object to ensure integrity.
- Enforced by access permissions.
22
Q
Brewer-Nash (Chinese Wall)
A
Brewer-Nash is a context-oriented commercial model designed to defend against conflict of interest.
- Access controls change dynamically depending upon a user’s previous actions.
23
Q
Trusted System
A
A Trusted System has undergone sufficient benchmark testing, verification, and validation (by an independent third party) to ensure that the product meets the user requirements.
24
Q
Functionality
A
Functionality is verification that a security control exists and that it works correctly at least once.
25
Assurance
Assurance is a degree of confidence that the system will act in a correct and predictable manner in every computing situation (trustworthy computing)
26
Security Evaluation Objectives
A security evaluation process assesses products against defined security requirements in a consistent and repeatable manner. Third-party labs rely on standard evaluation criteria.
27
TCSEC
Developed in 1983, Trusted Computing System Evaluation Criteria (TCSEC) was used to evaluate, classify, and select systems for the DoD based upon confidentiality requirements, Superseded by the Common Criteria.
Original publication as the "Orange Book". Expanded to 20+ books known as the rainbow series.
28
ITSEC
Developed in 1991 by a consortium of European nations, IT Security Evaluation Criteria (ITSEC) is used to evaluate the functionality and assurance of a computer system based upon a vendor-defined set of requirements.
Functionality and assurance evaluated independently and separately.
29
Common Criteria
Developed in 1993 by the ISO, the Common Criteria provides a universal structure and language for expressing product and system requirements. the Common Criteria evaluates products against a protection profile and results are published.
- Common Criteria ratings categories are functional and assurance.
30
Protection Profile
A protection profile is a specific set of functional and assurance requirements for a category of products. A protection profile can be written by several different groups including vendors, customers, and accreditation agencies.
31
Security Target
A security Target is written by a product vendor, developer that explains the specifications of the product including functionality and assurance. requirements.
32
Target of Evaluation (TOE)
The Target of Evaluation (TOE) is the product or system that will be rated.
33
Certification
Certification is the process of evaluation, testing, and examining security controls. The evaluation compares the current system's security posture with specific standards.
34
Accreditation
Accreditation is the process of an authority (management) granting approval to operate a system for a specified period of time with the understanding of the residual risks identified during the certification.
35
Trusted Computing Base
Trusted Computing Base is the combination of all the security mechanisms within a computer including hardware, software, and firmware.
36
BIOS
BIOS (Basic Input Output System) is non-volatile firmware used to perform hardware initialization during the booting process, and to provide run-time services for operating systems and programs.
37
UEFI
Unified Extensible Firmware Interface (UEFI) is an open standard interface layer between the firmware and the operating system that requires firmware updates to be digitally signed.
- Designed as a replacement for traditional PC BIOS.
- Additional functionality includes support for Secure Boot, network authentication, and universal graphics drivers.
- Protects against BIOS malware attacks including rootkits.
38
Secure Boot Attestation
Secure Boot Attestation that all boot loader components (e.g. OS Kernel, drivers) attest to their identity (digital signature) and the attestation is compared to the trusted list.
39
TPM
TPM A trusted platform module (TPM) is a special hardware chip installed on a computer's motherboard that is responsible for protecting passwords, symmetric and asymmetric keys, hashes, and digital certificates are specific to that system hardware.
- The chip contains an RSA key used for encryption and authentication.
- TPMs are compatible with most operating systems.
40
HSM
Hardware Security Model (HSM) is a physical device whose function is secure cryptoprocessing.
- HSM take the form of an adapter cards,m USBs, or appliances.
- Fast, scalable, and expensive.
41
CPU Protection Rings
CPU Protection Rings are conceptual boundaries that control how processes are executed. A process is a set of instructions and assigned resources.
42
CPU Protection Rings
CPU Protection Rings are conceptual boundaries that control how processes are executed. A process is a set of instructions and assigned resources.
- Each process has a PID (Process ID) and a level of trust (ring number) assigned to it.
- The level of trust determines the level of access to system resources, drivers, and data.
43
CPU Protection Rings Levels
- Ring 0: OS Kernel and device Drivers.
- Ring 1 Operating System
- Ring 2: OS Utilities.
- Ring 3: Applications.
44
Set of CPU instructions and assigned resources.
Process.
45
Centralized Systems
In a centralized computing environment, processing occurs within mainframe or terminal host and clients, (terminals, thin clients) are limited to simple interaction and emulation.
- Security advantage is controls can be implemented and tightly controlled.
- Security disadvantage is that configuration errors and unaddressed vulnerabilities can impact all clienteles systems.
46
Client | Server Environments
In a heterogeneous client-server environment, processing is distributed and there is a inherent trust, which makes every endpoint a potential target and every connection a potential conduit.
Security Considerations:
- Privileged use.
- Outdated operating systems and applications.
- Malware distribution.
- Unauthorized remote access.
47
Distributed Systems
In a distributed system environment, there is no central Authority.
Security Considerations:
- Each node is responsible for its own security.
- Distributed ownership and management.
- Local data stores
- Peer-to-Peer (P2P) access.
- Malware Distribution.
48
Large-scale Parallel Systems
Large-scale Parallel Systems are disparate systems working in concert. Examples include cluster computing, grid computing, and cloud computing. Security Considerations:
- Distributed ownership and management.
- Dependencies (SPOF)
- Force multiplier effect (dramatic increased efficiency and/or capability.
- Big data aggregation.
49
Grid Computing
Grid Computing is a sharing of CPU and other resources across a network, in a way that all machines function as one large computer. Grid participants can be heterogeneous and multitasking. Security Considerations:
- Transmission between nodes.
- Authentication controls.
- Activity isolation
50
Industrial Control Systems (ICS)
Industrial Control Systems (ICS) are computer-based systems that monitor and control industrial processes that exists in the physical world. ICS are either data-driven or operated remotely.
Well-known industrial control systems include:
- Distributed control systems (DCS).
- Programmable logic controllers (PLC).
- Supervisory control and data acquisition (SCADA)
51
SCADA
SCADA usually refers to centralized systems which monitor and control entire sites, or complexes of systems spread out over large areas (e.g. electrical, grid, oil, and gas pipelines). Security Considerations:
- Weak Authentication.
- Use of outdated OS.
- Inability to patch systems.
- Unauthorized remote access.
52
Cloud Computing
Cloud Computing is a model for enabling ubiquitous, convenient, on-demand, network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
53
Cloud Competing Service Models
- SaaS
- PaaS
- IaaS
54
Cloud Computing Deployment models
- Private Cloud
- Community Cloud
- Public Cloud
- Hybrid Cloud
55
Public Cloud
Provisioned for public use. Considerations:
- Location
- Multi-tenancy.
56
Community cloud
Provisioned for the exclusive use by a well-defined group. Considerations:
- Multi-tenancy
57
Private Cloud
Provisioned for exclusive of single organization. Considerations:
- Scalability.
58
Hybrid Cloud
The public and private cloud infrastructures communicate over an encrypted connection, using technology that allows for the portability of data and applications.
59
Cloud Access Security Brokers
Cloud Access Security Brokers (CASBs) are security policy points (software or appliance) placed between 'the cloud' and enterprise users.
- Security policies are interjected as cloud-based resources are accessed. for example, authentication, encryption, visibility, and DLP
60
Security as a Service (SecaaS)
Security as a Service (SecaaS) is the delivery of managed security services for public, private, and hybrid cloud environments.
- SeccaS relieves the burden of relying on the SaaS, PassS, or IaaS vendor for security protection and enforcement.
- Services include encryption, activity monitoring, DLP, malware detection, filtering, firewall, policy enforcement, email security, intrusion detection, authentication, and more.
61
Injection Attack
Tricking an application into including unintended commands in the data sent to an interpreter (e.g. OS, LDAP, SQL)
- Flaw: Improper input/output validation.
- Impact: Can result in unauthorized access, data exfiltration, and data corruption.
- Mitigation: Use of 'safe' API, positive 'whitelist' input output validation.
62
Broken Authentication
The attacker uses flaws in the authentication or session management Functions to impersonate users> Privileged accounts are frequently targeted.
63
Bluejacking
Bluejacking is injecting a unsolicited message.
64
Bluesnarfing
Bluesnarfing is unauthorized device pairing.
65
Blueborne
Blueborne exploits protocol weakness to take over the device
66
Embedded Systems Defined
An embedded system is an electronic product that contains a microprocessor and software designed to perform a specific task. An embedded system can either be fixed or programmable.
- The devices are designed for functionality and convenience - not security.
67
Embedded System components.
- System on a chip (SOC)
- Real-time OS (RTOS)
- APP
68
Internet of Things (IoT)
"The internet of things is the network of physical objects or 'things' embedded with electronics, software, sensors, and connectivity to enable it to achieve greater value and service by exchanging data with the manufacturer, operator, and/or other connected devices. Each thing is uniquely identifiable through its embedded computing system but is able to interoperate within the existing Internet infrastructure.
69
Fog Computing
Architecture that uses collaborative edge computing devices for local resource pooling.
70
Term that describes the use of IT solutions that are managed outside of and without the knowledge of the IT department
ShadowIT
71
Cryptography Use Cases
- Confidentiality (encryption)
- Integrity (Hashing)
- Non-repudiation (digital signatures)
- Authentication (digital certificates)
72
Plaintext (clear-text)
Human readable.
73
Ciphertext
Encrypted and/or human unreadable text.
74
Cipher
A technique that transforms plaintext into ciphertext and back to clear-text.
75
Algorithm
A cryptographic algorithm is a mathematically complex modern cipher.
76
Stream Cypher
Algorithm that works with one bit at a time.
| Example: RC4
77
Block Cypher
Algorithm that works with blocks of data.
| Examples: DES, 3DES, AES, BLOWFISH, TWOFISH, IDEA
78
Cryptographic Key / Cryptovariable
Secret used with an algorithm.
| - The key dictates what parts of the algorithm will be used, in what order, and with what values.
79
Key Space
Number of possible key combinations.
80
Key Stretching
The initial key is fed into an algorithm that outputs an enhanced (stronger) key.
81
Symmetric Key
Using a single key.
82
Asymmetric Key
Using two mathematically related keys (public / private)
83
Substitution Cipher
Substitution cipher replaces one character or bit for another character or bit. The key is the shift pattern.
84
Transposition Cipher
Transposition Cipher moves characters or bits to another place within the block. The key is the transposition code.
85
Confusion
Confusion is the process of changing the values. Complex substitution functions are used to create confusion. Substitution ciphers are enforced through confusion.
86
Diffusion
Diffusion is the process of changing the order sending bits through multiple rounds of transposition is used to create diffusion.
87
Lightweight Cryptography.
Emerging lightweight cryptographic algorithms are being developed to support low power devices as well as low latency and high resiliency requirements.
88
Strength of a Cryptographic Algorithm
Strength of a Cryptographic Algorithm is a combination of the algorithm, the algorithmic process, the length of the key, and the secrecy of the key. If one element is weak, the cryptosystem can potentially be compromised.
89
Workfactor
The work factor is the amount of time and effort it would take to penetrate (break) a cryptosystem.
90
Key Management
Key management describes the activities involving the handling of cryptographic keys and other related security parameters (e.g. passwords) during their entire life-cycle.
- A key should only be used for one purpose (e.g. encryption).
- Keys should be frequently changed to increase work-factor.
- Provate keys must be securely stored.
91
Key Escrow
Key Escrow is a proactive arrangement in which the keys needed to decrypt encrypted data are held in escrow so that, under certain circumstances, a authorized third party may gain access to those keys.
92
Block Cipher Modes
- Electronic CodeBook (ECB)
- Cipher Block Chaining (CBC)
- Counter Mode (CTR)
- Galois/Counter Mode (GCM)
93
Electronic CodeBook (ECB)
With Electronic CodeBook (ECB) mode, each block is independent (doesn't hide patterns - not suitable for long message).
94
Cipher Block Chaining (CBC)
Cipher Block Chaining (CBC) mode, includes an initialization vector (IV) and a compartment mode of the previous ciphertext to leverage randomization.
95
Counter Mode (CTR)
Counter Mode (CTR) mode does not have any dependencies. Converts block cipher to a stream cipher using XOR functions.
96
Galois/Counter Mode (GCM)
Galois/Counter Mode (GCM) is an efficient mode of operation for symmetric key cryptographic 128-bit blocks. GCM can take advantage of parallel processing.
97
Symmetric Algorithms
- DES
- 3DES
- AES
- Blowfish
- IDEA
- Twofish
- RC4
98
Data Encryption Standard
64-bit key size / 16 rounds of substitution and transposition.
- 1977 established a US Government standard
- 1998 demonstrated that it could be "broken" in less than 56 hours.
99
Triple DES (3DES)
64-bit key size / 48 rounds of substitution and transposition using either 2 or 3 key.
- 1999 replaced DES as a US Government standard.
- Considered deprecated.
100
Advanced Encryption Standard (Rijndael)
128- or 192- or 256-bit key / 10 or 12 or 14 rounds of substitution and transposition.
- 2002 replaced 3DES as a US Government standard.
101
Asymmetric Ciphers
- RSA
- ECC-Elliptic Curve Cryptosystem
- Diffie-Hellman
- El Gamal
102
RSA
Widely implemented.
- Defacto commercial standard.
- Works with both encryption and digital signatures.
103
ECC-Elliptic Curve Cryptosystem
Similar function to RSA but with smaller key sizes (require less computing power).
- Current US Government standard for Asymmetric encryption.
104
Diffie-Hellman
Primarily used for key agreement (key exchange)
- Allows two parties (in the same DH group) that have no prior knowledge of each other to jointly establish a shared secret key.
- DHE uses modular arithmetic to computer the shared secret..
- ECDH uses algebraic curves to generate keys.
105
El Gamal
Primarily used for transmitting digital signatures and key exchange.
106
Hashing
Hashing produces a visual representation of a data set. The objective of hashing is proving integrity.
- Validate that a message has not been changed during transmission (message digest).
- Verify that a forensic clone is intact.
107
Hash Function Characteristics.
In order to be considered secure, cryptographic hash functions must meet three criteria:
- Output must not be reversible (one-way-representation).
- Variable length input must produce fixed length output.
- Output must be unique.
108
Hashing Collision
If a hash function produces the same value for two different inputs, the result is known as a collision.
109
Message Digest (MDx)
MD5 has been shown to be subject to collision attacks and is 'broken'
110
Secure Hash Algorithm (SHA)
Created by the NSA
- SHA-1 has been shown to be subject to collision attacks
- Sha-2 family is widely used and includes SHA-256, SHA-384, and SHA-512.
111
RIPEMD
RIPEMD was based on MD4; it has been replaced by RIPEMD-160
112
Hashed MAC
A hashed message authentication code (HMAC) is a hashed value that includes a symmetric key.
- An HMAC cannot be reproduced without knowing the key.
- An HMAC provides integrity and data origin authentication.
- HMAC is used by cryptographic protocols such as the TLS and IPsec to verify the integrity of transmitted data during secure communications.
113
Digital Signature
A digital sinature is a message digest that has been encrypted using a private key.
The goal of a digital signature is integrity and non-repudiation.
114
Non-repudiation
Non-repudiation means that the signer cannot deny sending the message. Conversely, the receiver can trust that the message came from the named signer.
115
Digital Signature Algorithms
- RSA
| - Digital Signature Algorithms (DSA)
116
Digital Signature Algorithms (DSA)
Published by NIST in cooperation with the NSA US Government Digital Signature standard.
117
Public Key Infrastructure
Public Key Infrastructure consists of programs, data formats, procedures, communication protocols, security policies, and public key cryptographic mechanisms working together in a comprehensive manner to enable secure communication.
118
x509
- Public Key Infrastructure x506 (PKIX) is the working group formed by the IETF to develop standards and models (known as x.509).
- Public Key Cryptography Standards (PKCS) is a set of voluntary standards created by RSA and other industry leaders.
119
Digital Certificates
Digital Certificates are the mechanisms to generate a private key and to associate a public key with a collection of components sufficient to authenticate the claimed owner.
- The x509 standards defines the certificate format and fields for public key.
- The x509 standard defines the distribution procedures.
- The current version of x509 for certificates is v3.
120
Self-Signed Certificate
A Self-Signed certificate is signed by the person creating it.
- The advantage is that there is no additional expense.
- The disadvantages is that a self-signed certificate can easily be impersonated, will present the user with a warning message and cannot be revoked.
- Use cases include a internal development server.
121
Trust Models (Chain of Trust)
A Trust Model defines how users trust other users, organizations, CAs and RAs within the PKI.
- Web of Trust.
- Third party (single Authority) Trust.
- Hierarchical Model.
122
Web of Trust
No central authority. Each user creates and signs their own certificate. Users sign each others public key indicating "trust"
123
Third party (single Authority) Trust.
A central third-party Certificate Authority (CA) signs a key and authenticates the owner.
124
Hierarchical Trust Model.
Extension of third party in which root CAs issues certificate to lower level "intermediate" CAs who can then issue certificates. Trust is inherited.
125
Trusted Certificate Life-Cycle.
- CSR - Certificate Signing Requrest (CSR).
- Certificate is issued
- Certificate is published
- Certificate is received
- Certificate is Installed
- Certificate renewed, suspended, revoked or expired.
- Key is destroyed.
126
Certificate Revocation List (CRL)
CA maintain list of certificates that have been revoked.
- Pull Model - CRL is downloaded by the user or organization.
- Push model - CRL is automatically sent out by the CA at regular intervals.
127
Online Certificate Status Protocol (OCSP)
Process designed to query the status of certificate in real-time.
- OCSP stapling is a time stamped (cached) OCSP response.
128
Cyptanalysis
The process of finding a cryptographic weakness (vulnerability)
129
Known Ciphertext
A sample of ciphertext is available without the plaintext associated with it.
130
Known Plaintext
A sample of ciphertext and the corresponding known plaintext is available.
131
Chosen Plaintext
Can choose the plaintext to get encrypted and obtain the corresponding ciphertext
132
Chosen Ciphertext
Can select the ciphertext and obtain the corresponding plaintext.
133
Cryptographic Key Attacks
- Brute Force
- Dictionary
- Frequency
- Replay
134
Brute Force Attack
Every possible key is tested (Online, Offline)
135
Dictionary Attack
List of known keys tested.
136
Frequency Attack
Looking for patterns to reveal the key.
137
Replay Attack
Attacker tries to reuse a cryptographic transmission.
138
Birthday Attack
Exploits the mathematics behind the birthday problem probability theory to cause collision.
139
Pass-the-hash Attack
Using captured hashed credentials from one machine to successfully gain control of another machine.
140
Rainbow Tables
Rainbow Tables are publicly available tables of pre-computed hashes.
141
Salting
Salts are values appended to the input to negate the value of rainbow tables.
142
Downgrade Attack
A Downgrade Attack is an attack on a system or communications protocol that forces degradation to a lower-quality crypto mode (if available) designed for backward compatibility
143
Weak Implementations
Attackers take advantage of miscommunications, weak keys, broken, or deprecated versions.
144
Physical Security Controls
Physical security principles of deter, detect, and delay* supported by a response plan are designed to frustrate and disrupt an adversary's attack timeline.
- Deter: Stop or displace an attack.
- Detect: Verify an attack, initiate a response.
- Delay: Prevent the attack from reaching the asset (including measures to minimize the consequence of an attack)
145
Layered Defense (Defense-in-depth)
The premise of a layered defense model is that it an intruder can bypass one layer of controls, the next layer of controls should provide additional deterrence or detection capabilities. Layers defense is both physical and psychological.
146
Physical Security zones
The principles of deter, detect, and delay* extend to the following security zones.
- Beyond the perimeter
- Perimeter
- Within site
- Building
- Asset
147
Fail-Safe
Fail-Safe implies that in an emergency situation, controls will default to open.
148
Fail-Secure
Fail-Secure implies that in an emergency situation, controls will default to locked.
149
CPTED
The basic premise of Crime Prevention through Environmental Design (CPTED) is that the proper design and effective use of the physical environment can lead to a reduction in the incidence ad fear of crime.
150
Lighting
Lighting can be continuous, motion triggered, random, timed, or standby.
Lighting should be tamper proof and have a backup power supply.
151
Physical Signs
Signs for personnel safety and intruder deterrence.
152
Physical Barrier
fences, walls, gates, barricades, and bollards define perimeter.
153
Security Guards
Security personnel may be stationed at checkpoints, and patrol the area, manage surveillance, and respond to breaches and/or suspicious activity.
154
Conventional Lock
Key Controlled cylinder -susceptible to "bumping".
155
Pick Resistant Lock
Conventional locks that have complex and difficult to reproduce keys.
156
Cipher Lock
Uses a programmable key pad.
157
Electronic (digital) Lock
Cipher lock with centralized control and auditing capabilities.
158
Biometric Lock
Biometric recognition - may also require a key code.
159
Entrance / Exit Access Controls
- ID Card / badge
- Smart Card
- Biometric
- Access logs
- Audit Logs
- Mantrap
160
ID Card / badge
Identification card with or without picture (non electronic)
161
Smart Card
Card with integrated circuitry used in conjunction with a card reader.
162
Biometric
Use of bio-metric technology to identify and authenticate a person.
163
Access Logs
Requirement to document access (sign-in/out)
164
Audit Logs
Logs generated by smart and biometric systems.
165
Mantrap
Two-tier barrier. Entry door on one side and an exit door on the opposite side. One door of a mantra cannot be unlocked and opened until the opposite door has been closed and locked.
166
Surveillance
Surveillance technologies such as closed-circuit TV (CCTV) and camera detect suspicious, abnormal, or unwanted behavior.
A surveillance system can:
- Identify the presence of an intruder
- Trigger an alarm or an alert
- Provide enough detail to determine the type of incident response.
- Provide Evidence.
167
Physical Intrusion Detection Systems types
- Proximity: Measure magnetic field.
- Motion: Detect physical disturbance.
- Photometric: Changes in light.
- Passive Infrared: Changes in Heat.
- Acoustical: Changes in noise
- Contact: - Electrical circuit si broken,
168
Data Center Considerations
- Located in the center of a facility with no external windows or doors.
- Located on floors other that the basement, first floor, and top floor.
- Full walls extending from floor to ceiling.
- Partitioned ceiling.
169
Airgap Isolation
Airgap Isolation refers computers or networks that are physically isolated from the internet or to any other computers that are connected to the internet.
170
Isolated Networks
A physically isolated network is completely disconnected from any other network, period.
171
Clean Room
Clean Room network/computer is located in a secured room or facility.
172
Data Center Temperature.
Data Centers (inclusive of server rooms and networking closets) need to be kept cool.
- Recommended temperature for an area containing computing devices is between 70-74 degrees Fahrenheit.
- Damaging temperatures: Computers >175F, Magnetic Storage >100F, Paper products >350F
173
Data Center Humidity
Data Center humidity can cause corrosion and low humidity can cause excessive static electricity.
- Relative humidity between 45-60% is acceptable for areas that are processing data.
- Electronic discharge (ESD) is the release of static electricity when two objects touch. ESD can damage or destroy electronic components.
174
EMI and RFI
Equipment copper cable are sensitive to electromagnetic interference (EMI) and radio frequency interference (RFI).
Equipment should have limited exposure to magnets, fluorescent lights, electric motors space heaters, and wireless access points.
175
Electromagnetic Interference (EMI)
Electromagnetic Interference (EMI) is due to electromagnetic conduction or radiation. Almost any type of electrical device can cause EMI
176
Radio Frequency Interference (RFI)
Radio Frequency Interference (RFI) is due to AM/FM and cellular tower transmissions.
177
Data Emanation
Data Emanation (or signal emanation) is the electromagnetic (EM) field generated by a coax or copper cable or network devices, which can be manipulated to eavesdrop on conversations or to steal data.
178
Faraday Cage
A Faraday Cage is shield is an enclosure used to block electromagnetic (EM) fields (incoming and outgoing).
Faraday bags are after used in digital forensics to prevent remote wiping and alteration of criminal digital evidence.
179
Blackout
Prolonged period without power
| - Mitigating Control: Battery backup (UPS), Alternate power supply (generator), Supplier diversity,
180
Brownout
Prolonged period of low voltage.
| - Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)
181
Sag
Moment of low voltage.
| - Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)
182
Surge
Prolonged period of high voltage.
| - Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)
183
Spike
Moment of high voltage.
| - Mitigation control: Voltage regulator, surge protectors, power line conditioners, battery backups (UPS)
184
Power Supply Failure
Failure of internal power supply or fan.
| - Mitigation control: Redundant power supply.
185
Fire protection elements
- Fire Prevention: is the first line of defense.
- Fire Detection: Is to realize that there is a fire while it is still small and controllable.
- Fire Suppression: Is the containment and actually dealing with the fire.
186
Fire Type "A"
Ordinary combustibles: wood, paper, rubber, fabrics, and many plastics.
Type of Extinguisher: Water, Dry Powder, Halon.
187
Fire Type "B"
Flammable Liquids and Gases: gasoline, oils, paint, lacquer, and tar.
Type of Extinguisher: carbon Dioxide, Dry Powder, Halon
188
Fire Type "C"
Fires involving Live electrical Equipment.
| Type of Extinguisher: carbon Dioxide, Dry Powder, Halon
189
Fire Type "D"
Combustible Metals or Combustible Metal Alloys.
| Type of Extinguisher: Special Agents.
190
Fire Type "K"
Fires in Cooking appliances that involve Combustible Cooking Media: Vegetable or Animal Oils, and Fats.
191
Water-based Fire Suppression Systems
Sprinkler system effective on Class A (ordinary combustible) fires.
192
Dry-Pipe
Sprinkler system effective on Class A (Ordinary combustible) fires Pipes do not have water in them until system is activated. Automatic Shut-off.
193
Halon
Pressurized Halon gas that removes oxygen from the air with no residue (Banned by the Montreal Protocol of 1987)
194
FM-200
Colorless, orderless gaseous halo-carbon with no residue. Safe for Humans.
195
Argonite
Mixture of argon and nitrogen gas. Although non-toxic, it can be dangerous for humans.
196
CO2
Pressurized gas - manual discharge required. Extremely dangerous to humans.
