Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Domain 3 - Security Engineering > Flashcards

Domain 3 - Security Engineering Flashcards

1
Q

What is the simultaneous execution of more than one

application on a computer and is managed by the operating system.

A

Multitasking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

This permits multiple concurrent tasks to be performed within a single process.

A

Multithreading

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The use of more than one processor to increase computing power.

A

Multiprocessing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Similar to multitasking but takes place on mainframe systems and requires specific programming.

A

Multiprogramming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Processors that are capable of operating at only one security level at a time,

A

Single state processors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Processors that can simultaneously operate at multiple security levels.

A

Multistate processors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the four security modes approved by the federal government for processing classified information.

A

Dedicated systems - require that all users have appropriate clearance, access permissions, and need to know for all information stored on the system.
System high mode - removes the need-to-know requirement.
Compartmented mode - removes the need-to-know requirement and the access permission requirement. Multilevel mode - removes all three requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The two layered operating modes used by most modern processors.

A

User mode and Privileged mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

User applications operate in a limited instruction set environment

A

User mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The operating system performs controlled operations

A

Privileged mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Nonvolatile memory that can’t be written to by the end user or PC

A

Read only memory (ROM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Similar to a ROM chip in functionality, but with one exception; special functionality
that allows an end user to burn in the chip’s contents later. However once it is burned in no further changes are possible

A

Programmable Read-Only Memory (PROM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Memory chips that may be erased through the use of ultraviolet light and then can have new data written to
them.

A

Erasable Programmable Read-Only Memory (EPROM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Memory chips may be erased with electrical current and then have new data written to them.

A

Electronically Erasable Programmable Read-Only Memory (EEPROM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Memory chips that are volatile and lose their contents when the computer is powered off.

A

Random Access Memory (RAM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A limited amount of memory that is included in the CPU that provide it with directly accessible memory locations that the brain of the CPU, the arithmeticlogical unit (ALU), uses when performing calculations or processing instructions.

A

Registers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

At the computer level, it contains the basic instructions needed to start a computer. It is also used to provide operating instructions in peripheral devices such as printers.

A

Firmware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

This ensures that individual processes can access only

their own data.

A

Process isolation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

This creates different realms of security within a process and limits
communication between them.

A

Layering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

This creates “black-box” interfaces for programmers to use without requiring knowledge of an algorithm’s or device’s inner workings.

A

Abstraction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

This prevents data from being discovered or accessed by a subject by positioning it in a location that is not seen by the subject.

A

Data hiding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Enforces process isolation with physical controls.

A

Hardware segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The role of a _____ ______ is to inform and guide the design, development, implementation, testing, and maintenance of some particular system.

A

Security Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The popular term referring to a concept of computing where processing and storage are performed elsewhere over a network connection rather than locally. It is often thought of as Internet-based computing.

A

Cloud computing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Typically designed around a limited set of specific functions in relation to the larger product of which it’s a component.

A

Embedded System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Applications, OSs, hardware sets, or networks that are confi gured for a specifi c need, capability, or function, and then set to remain unaltered.

A

Static environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Ensures that only a minimum number of processes are authorized to run in supervisory mode.

A

Principle of lease privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Any method that is used to pass information but that is not normally used for information.

A

Covert Channels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

This occurs when the programmer fails to check the size of input data prior to writing the data into a specific memory location.

A

Buffer Overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Checking data before it is saved to a database

A

Input checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

An engineering discipline concerned with the design and construction of computing systems at a logical level.

A

Computer architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

From a security standpoint, _____ _____ organize code and components in an operating system (as well as applications, utilities, or other code that runs under the operating system’s control) into concentric rings. The deeper inside the circle you go, the higher the privilege level associated with the code that occupies a specific ring.

A

Protection rings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

This is not a memory addressing scheme perse but rather a way of referring to data that is supplied to the CPU as part of an instruction.

A

Immediate addressing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

In this memory addressing scheme, the CPU is provided with an actual address of the memory location to access.

A

Direct addressing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

In this scheme the memory address supplied to the CPU as part of the instruction doesn’t contain the actual value that the CPU is to use as an operand. Instead, the memory address contains another memory address

A

Indirect addressing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

This contains the operating system–independent primitive instructions that a computer needs to start up and load the operating system from disk.

A

BIOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Database attack where attacker collects details at lower level to determine information at a higher level.

A

Aggregation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Combining several pieces of nonsensitive information to gain access to information that should be classified at a higher level. Requires some level of deduction.

A

Inference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Facility construction and selection, site management, personnel controls, awareness training, and emergency response and procedures are all examples of what?

A

Administrative Physical security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Access controls, intrusion detection, alarms, CCTV, monitoring, HVAC, power supplies, and fire detection and suppression are all examples of what?

A

Technical physical security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Fencing, lighting, locks, construction materials, mantraps, dogs, and guards are all examples of what?

A

Physical controls for physical security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are the key elements in making a site selection?

A

Visibility, composition of the surrounding area, area accessibility, and the effects of natural disasters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the key element in designing a facility for construction?

A

Understanding the level of security needed by your

organization and planning for it before construction begins.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Name the three categories of security controls implemented to manage physical security

A

administrative, technical, and physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Using someone else’s security ID to gain entry to a facility

A

Masquerading

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Following someone through a secured gate or doorway without being identified or authorized personally.

A

Piggybacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Ideal temperature for a computer room

A

60 to 75 degrees Fahrenheit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Ideal Humidity for a computer room

A

between 40 and 60 percent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

A systematic effort to identify relationships between mission-critical applications, processes, and operations and all the necessary supporting elements.

A

Critical path analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

The tendency for various technologies, solutions, utilities, and systems to evolve and merge over time.

A

Technology convergence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

This clearly defines the response time a vendor will provide in the event of an equipment failure emergency.

A

service-level agreement (SLA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

The expected typical functional lifetime of the device given a specific operating environment.

A

mean time to failure (MTTF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

The average length of time required to perform a repair on the device.

A

mean time to repair (MTTR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

A box, mobile room, or entire building designed with an
external metal skin, often a wire mesh that fully surrounds an area on all sides (in other words, front, back, left, right, top, and bottom).

A

Faraday cage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

A momentary loss of power

A

Fault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

A complete loss of power

A

Blackout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Momentary low voltage

A

Sag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Prolonged low voltage

A

Brownout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Momentary high voltage

A

Spike

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Prolonged high voltage

A

Surge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

An initial surge of power usually associated with connecting to a power source, whether primary or alternate/secondary

A

Inrush

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

A steady interfering power disturbance or fluctuation

A

Noise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

A short duration of line noise disturbance

A

Transient

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Nonfluctuating pure power

A

Clean

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

The wire in an electrical circuit that is grounded

A

Ground

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Class A fire extinguishers can be used on what? And what is the suppression material used?

A

Common combustibles; Water, soda acid (a dry powder

or liquid chemical)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Class B fire extinguishers can be used on what? And what is the suppression material used?

A

Liquids; CO2 , halon (or EPA approved halon substitue), soda acid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Class C fire extinguishers can be used on what? And what is the suppression material used?

A

Electrical; CO2 , halon (or EPA approved halon substitue)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Class D fire extinguishers can be used on what? And what is the suppression material used?

A

Metal; Dry powder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

This suppression system is always full of water. Water

discharges immediately when suppression is triggered.

A

Wet Pipe System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

This suppression system contains compressed air. Once suppression is triggered, the air escapes, opening a water valve that in turn causes the pipes to fill and discharge water into the environment.

A

dry pipe system

72
Q

This suppression system is another form of dry pipe system that uses larger pipes and therefore delivers a significantly larger volume of water. They are inappropriate for environments that contain electronics and computers.

A

Deluge system

73
Q

This suppression system is a combination dry pipe/wet pipe system. The system exists as a dry pipe until the initial stages of a fire (smoke, heat, and so on) are detected, and then the pipes are filled with water. The water is released only after the sprinkler head activation triggers are melted by sufficient heat. If the fire is quenched before sprinklers are triggered, pipes can be manually emptied and reset. This also allows manual intervention to stop the release of water before sprinkler triggering occurs.

A

Preaction system

74
Q

The art of creating and implementing secret codes and ciphers.

A

Cryptography

75
Q

The study of methods to defeat codes and ciphers.

A

Cryptanalysis

76
Q

Specific implementations of a code or cipher in hardware and Software.

A

Cryptosystems

77
Q

What are the main goals of cryptography?

A

confidentiality, integrity, authentication, and nonrepudiation

78
Q

Cryptosystems that use a shared secret key available to all users of the cryptosystem.

A

Symmetric Key Systems

79
Q

Cryptosystems that use individual combinations of public and private keys for each user of the system.

A

Asymmetric Cryptosystems

80
Q

Cryptographic systems of symbols that represent words or phrases and are sometimes secret but don’t always provide confidentiality.

A

Codes

81
Q

These use a variety of techniques to alter and/or rearrange the characters or bits of a message to achieve confidentiality. They are always meant to hide the true meaning of a message.

A

Ciphers

82
Q

Ciphers that use an encryption algorithm to rearrange the letters of a plaintext message, forming the ciphertext message.

A

Transposition Ciphers

83
Q

Ciphers that use the encryption algorithm to replace each character or bit of the plaintext message with a different character.

A

Substitution ciphers

84
Q

In this cipher, the encryption key is as long as the message itself and is often chosen from a common book.

A

Running Key Ciphers

85
Q

These ciphers operate on “chunks,” or blocks, of a message and apply the encryption algorithm to an entire message block at the same time.

A

Block ciphers

86
Q

These ciphers operate on one character or bit of a message (or data stream) at a time.

A

Stream ciphers

87
Q

An extremely powerful type of substitution cipher. It uses a different substitution alphabet for each letter of the plaintext message.

A

One-time pad

88
Q

This occurs when the relationship between the plain text and the key is so complicated that an attacker can’t merely continue altering the plain text and analyzing the resulting ciphertext to determine the key.

A

Confusion

89
Q

This occurs when a change in the plain text results in multiple changes spread throughout the ciphertext.

A

Diffusion

90
Q

Mathematical operation that easily produces output values for each possible combination of inputs but makes it impossible to retrieve the input values.

A

One-way Function

91
Q

Boolean representation of AND operation

A
92
Q

Boolean representation of OR operation

A

˅

93
Q

Boolean representation of NOT operation

A

~

94
Q

Boolean representation of Exclusive OR operation. Most commonly used in cryptographic applications.

A

© (Looks similar to this symbol)

95
Q

Returns a true value when only one of the input values is true. If both values are false or both values are true, the output is false.

A

XOR (Exclusive OR)

96
Q

A random number that acts as a placeholder variable in mathematical functions. When the function is executed, it is replaced with a random number generated at the moment of processing for one-time use. It must be a unique number each time it is used.

A

Nonce

97
Q

A random bit string that is the same length as the block size and is XORed with the message. They are used to create unique ciphertext every time the same message is encrypted using the same key.

A

Initialization Vector (IV)

98
Q

Prove your knowledge of a fact to a third party without revealing the fact itself to that third party. This is often done with passwords and other secret authenticators.

A

Zero-Knowledge Proof

99
Q

The information or privilege required to perform an operation is divided among multiple users. This ensures that no single person has sufficient privileges to compromise the security of the environment.

A

Split Knowledge

100
Q

A way to measure the strength of a cryptography system by measuring the effort in terms of cost and/or time to decrypt messages. The security and protection offered by a cryptosystem is directly proportional to this value.

A

Work Function or work Factor

101
Q

DES Operational Modes

A
  • Electronic Codebook (ECB) – Least secure
  • Cipher Block Chaining (CBC)
  • Cipher Feedback (CFB) -
  • Output Feedback (OFB) –
102
Q

Uses three iterations of DES with 2 or 3 different keys to increase the effective key strength to 112 or 168.

A

3DES (Triple DES)

103
Q

The US government standard for the secure exchange of sensitive but unclassifi ed data. It uses the Rijndael algorithm.

A

AES

104
Q

This system relies on pairs of keys assigned to each user of the cryptosystem. Every user maintains both a public key and a private key.

A

Public Key Cryptosystems

105
Q

The most famous public key cryptosystem; it was developed by Rivest, Shamir, and Adleman in 1977. It depends on the difficulty of factoring the product of prime numbers.

A

RSA

106
Q

An extension of the Diffie-Hellman key exchange algorithm that depends on modular arithmetic.

A

El Gamal

107
Q

Algorithm depends on the elliptic curve discrete logarithm problem and provides more security than other algorithms when both are used with keys of the same length. Often used when hardware resources are low.

A

Elliptical Curve

108
Q

They take a potentially long message and generate a unique output value derived from the content of the message. This value is commonly referred to as the message digest.

A

Hash Functions

109
Q

This and its successors are government standard hash functions developed by the National Institute of Standards and Technology (NIST) and are specified in an official government publication.

A

SHA

110
Q

Hashing algorithm that takes an input of virtually any length and produces a 160-bit message digest. The SHA-1 algorithm processes a message in 512-bit blocks. Therefore, if the message length is not a multiple of 512, the SHA algorithm pads the message with additional data until the length reaches the next highest multiple of 512.

A

SHA-1

111
Q

Latest version of government standard hash functions. It supports variable length, ranging up to 512 bits.

A

SHA-2

112
Q

A hash algorithm was developed by Ronald Rivest in 1989. It was later proved that it is not a one-way function. Therefore it should no longer be used.

A

MD2

113
Q

Enhanced version of MD2 hashing algorithm. It processes 512-bit blocks of the message in three rounds of computation. The final output is a 128-bit message digest.

A

MD4

114
Q

Latest version of MD2 algorithm. It uses four distinct rounds of computation to produce a digest of the same length as the MD2 and MD4 algorithms.

A

MD5

115
Q

These are added to passwords before hashing them to reduce the effectiveness of rainbow table attacks.

A

Cyrptographic Salts

116
Q

These have two distinct goals: assure the recipient that the message truly came from the claimed sender and assure the recipient that the message was not altered while in transit between the sender and recipient.

A

Digital Signatures

117
Q

First use a hashing function to generate a message digest. Then encrypt the digest with your private key. To verify the digital signature on a message, decrypt the signature with the sender’s public key and then compare the message digest to one you generate yourself. If they match, the message is authentic.

A

Digital Signatures Implementation

118
Q

uses the SHA-1 and SHA-2 message digest functions along with the one of three encryption algorithms: the Digital Signature Algorithm (DSA); the Rivest, Shamir, Adleman (RSA) algorithm; or the Elliptic Curve DSA (ECDSA) algorithm.

A

Digital Signature Standard (DSS)

119
Q

Certificate Authorities (CAs) generate digital certificates containing the public keys of system users. Users then distribute these certificates to people with whom they want to communicate. Certificate recipients verify a certificate using the CA’s public key.

A

Public Key Infrastructure (PKI)

120
Q

These are the glue that binds the public key infrastructure together. These neutral organizations offer notarization services for digital certificates.

A

Certificate authorities (CAs)

121
Q

These are maintained by the various certificate authorities and contain the serial numbers of certificates that have been issued by a CA and have been revoked along with the date and time the revocation went into effect.

A

Certificate revocation lists (CRLs)

122
Q

This protocol eliminates the latency inherent in the use of certificate revocation lists by providing a means for real-time certificate verification.

A

Online Certificate Status Protocol (OCSP)

123
Q

A protocol that has emerged as a de facto standard for encrypted email. It relies on the use of X.509 certificates for exchanging cryptographic keys. The public keys contained in these certificates are used for digital signatures and for the exchange of symmetric keys used for longer communications sessions.

A

S/MIME

124
Q

Secure email system developed by Phil Zimmerman.

A

Pretty Good Privacy (PGP)

125
Q

Based on SSL technology. It provides secure communications on the Internet.

A

TLS

126
Q

Developed by Netscape to provide client/server encryption for web traffic. It relies on the exchange of server digital certificates to negotiate encryption/decryption parameters between the browser and the web server. Its goal is to create secure communications channels that remain open for an entire web browsing session.

A

SSL

127
Q

A security architecture framework that supports secure communication over IP. It establishes a secure channel in either transport mode or tunnel mode. It can be used to establish direct communication between computers or to set up a VPN between networks. It uses two protocols: Authentication Header (AH) and Encapsulating Security Payload (ESP).

A

IPsec

128
Q

Provides assurances of message integrity and nonrepudiation. It also provides authentication and access control and prevents replay attacks. Part of IPSec

A

Authentication Header

129
Q

Provides confidentiality and integrity of packet contents. It provides encryption and limited authentication and prevents replay attacks. Part of IPSec

A

Encapsulating Security Payload

130
Q

In IPSec only packet contents are encrypted for peer-to-peer communication

A

Transport Mode

131
Q

In IPSec the entire packet, including header information, is encrypted for gateway-to-gateway communications

A

Tunnel Mode

132
Q

an attack that attempts every possible valid combination for a key or password. They involve using massive amounts of processing power to methodically guess the key used to secure cryptographic communications.

A

Brute-force attacks

133
Q

The attacker has a copy of the encrypted message along with the plaintext message used to generate the ciphertext (the copy). This knowledge greatly assists the attacker in breaking weaker codes.

A

Known Plaintext attacks

134
Q

the attacker has the ability to encrypt plaintext messages of their choosing and can then analyze the ciphertext output of the encryption algorithm.

A

Chosen plaintext attacks

135
Q

the attacker has the ability to decrypt chosen portions of the ciphertext message and use the decrypted portion of the message to discover the key.

A

Chosen ciphertext attacks

136
Q

Used to defeat encryption algorithms that use two rounds of encryption.

A

Meet-in-the-middle attack

137
Q

a malicious individual sits between two communicating parties and intercepts all communications (including the setup of the cryptographic session).

A

Man-in-the-middle attack

138
Q

also known as a collision attack or reverse hash matching seeks to find flaws in the one-to-one nature of hashing functions. In this attack, the malicious individual seeks to substitute in a digitally signed communication a different message that produces the same message digest, thereby maintaining the validity of the original digital signature.

A

Birthday attack

139
Q

attack is used against cryptographic algorithms that don’t incorporate temporal protections. In this attack, the malicious individual intercepts an encrypted message between two parties (often a request for authentication) and then later “replays” the captured message to open a new session. This attack can be defeated by incorporating a time stamp and expiration period into each message.

A

Replay attack

140
Q

These allow content owners to enforce restrictions on the use of their content by others. They commonly protect entertainment content, such as music, movies, and e-books but are occasionally found in the enterprise, protecting sensitive information stored in documents.

A

Digital rights management (DRM)

141
Q

A system that is always secure no matter what state it is in. It ensures that all instances of subjects accessing objects are secure.

A

State Machine model

142
Q

This model is focused on the flow of information. Designed to prevent unauthorized, insecure, or restricted information flow. Bell-LaPadula and Biba are both examples of this model.

A

Information Flow model

143
Q

prevent the actions of subject A at a high level of security classification from affecting the system state at a lower level.

A

Noninterference model

144
Q

employs a directed graph to dictate how rights can be passed from one subject to another or from a subject to an object.

A

Take-Grant model

145
Q

a table of subjects and objects that indicates the actions or functions that each subject can perform on each object.

A

Access Control Matrix

146
Q

subjects have a clearance level that allows them to access only those objects with the corresponding classification levels. Developed by the Department of Defense. It is focused on maintaining the confidentiality of objects. “No read up”. Concerned with confidentiality.

A

Bell-LaPadula

147
Q

prevents subjects with lower security levels from writing to objects at higher security levels. “No Write Up”. Concerned with Integrity

A

Biba

148
Q

Bell-LaPadula Simple Security Property

A

states that a subject may not read information at a higher sensitivity level (no read up).

149
Q

Bell-LaPadula * Star Security Property

A

states that a subject may not write information to an object at a lower sensitivity level (no write down).

150
Q

Bell-LaPadula Discretionary Security Property

A

states that the system uses an access matrix to enforce discretionary access control.

151
Q

Biba Simple Security Property

A

states that a subject cannot read an object at a lower integrity level (no read-down).

152
Q

Biba * star Security Property

A

states that a subject cannot modify an object at a higher integrity level (no write-up).

153
Q

an integrity model that relies on auditing to ensure that unauthorized subjects cannot access objects and that authorized users access objects properly. It allows modifications through only a small set of programs.

A

Clark-Wilson

154
Q

also known as Chinese Wall. it creates a class of data that defines which security domains are potentially in conflict and prevents any subject with access to one domain that belongs to a specific conflict class from accessing any other domain that belongs to the same conflict class.

A

Brewer and Nash Model

155
Q

the technical evaluation of each part of a computer system to assess its concordance with security standards.

A

Certification

156
Q

is the process of formal acceptance of a certified configuration from a designated authority.

A

Accreditation

157
Q

systems that are designed using industry standards and are usually easy to integrate with other open systems.

A

Open Systems

158
Q

systems that are generally proprietary hardware and/or software. Their specifications are not normally published, and they are usually harder to integrate with other systems.

A

Closed Systems

159
Q

restricts a process to reading from and writing to certain memory locations. Also known as sandboxing.

A

Confinement

160
Q

the limits of memory a process cannot exceed when reading or writing. Also the area within which a process is confined or contained.

A

Bounds

161
Q

the mode a process runs in when it is confined through the use of memory bounds.

A

Isolation

162
Q

the user or process that makes a request to access a resource.

A

Subject

163
Q

the resource a user or process wants to access.

A

Object

164
Q

use access rules to limit the access by a subject to an object. Also allows subjects to access only authorized objects. Primary goal is to ensure the confidentiality and integrity of data by disallowing unauthorized access by authorized or unauthorized subjects.

A

Security Controls

165
Q

Static attributes of the subject and the object are considered to determine the permissibility of an access. Each subject possesses attributes that define its clearance, or authority, to access resources. Each object possesses attributes that define its classification.

A

Mandatory Access Controls

166
Q

Allows the creator/owner of an object to grant access as he or she sees fit.

A

Discretionary Controls

167
Q

Provides access to resources based on profiles connected to a user’s role in an organization.

A

Role Based Access Control

168
Q

Predefined rules state which subjects can access which objects. Often used in firewalls.

A

Rule-Based access control

169
Q

Also known as the Rainbow Series.

A

TCSEC

170
Q

Europe’s version of the Rainbow Series.

A

ITSEC

171
Q

defines various levels of testing and confirmation of systems’ security capabilities, and the number of the level indicates what kind of testing and confirmation has been performed. Designed as a product evaluation model.

A

Common Criteria

172
Q

the combination of hardware, software, and controls that form a trusted base that enforces the security policy.

A

Trusted Computing Base (TCB)

173
Q

is the imaginary boundary that separates the TCB from the rest of the system. TCB components communicate with non-TCB components using trusted paths.

A

Security Perimeter

174
Q

is the logical part of the TCB that confirms whether a subject has the right to use a resource prior to granting access.

A

Reference Monitor

175
Q

is the collection of the TCB components that implement the functionality of the reference monitor.

A

Security Kernel

176
Q

A cryptoprocessor chip on a motherboard that stores the encryption key that is used to encrypt the hard drive. This helps prevent hard drives being stolen from PC and the data accessed.

A

Trusted Platform Module (TPM)

177
Q

the ability of a system to suffer a fault but continue to operate.

A

Fault tolerance

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions