Essential Security Principles Flashcards
(30 cards)
Vulnerabilities
Weaknesses or flaws in a system’s design, implementation, or configuration that can be exploited to compromise its security.
Threats
Potential dangers or harmful events that can exploit vulnerabilities and cause harm to a system or organization’s assets, operations, or reputation
Exploits
Techniques or methods used to take advantage of vulnerabilities in a system or software to gain unauthorized access, disrupt operations, or extract sensitive information.
Risks
The likelihood and potential impact of a threat exploiting a vulnerability, resulting in harm or damage to an organization. Risk management involves identifying, assessing, and mitigating risks to protect assets effectively.
Attack Vectors
Paths or means through which an attacker can gain access to a system or exploit vulnerabilities. Attack vectors can include email attachments, malicious websites, network vulnerabilities, social engineering, and more.
Hardening
The process of securing a system by reducing vulnerabilities, removing unnecessary services, implementing security controls, and following best practices to minimize the attack surface.
Defense-in-Depth
An approach that involves deploying multiple layers of security controls and measures to protect systems and data. If one layer is compromised, other layers can still provide protection
CIA
Confidentiality: Ensuring that sensitive information is only accessible to authorized individuals or entities.
Integrity: Maintaining the accuracy, consistency, and trustworthiness of data and system resources.
Availability: Ensuring that authorized users have timely and uninterrupted access to information and system resources.
Types of Attackers
Script Kiddies: Individuals with limited technical skills who use pre-existing tools and scripts to launch attacks for fun or curiosity.
Hacktivists: Individuals or groups who carry out cyber attacks to promote a political or social agenda.
Cybercriminals: Individuals or organized groups who engage in illegal activities for financial gain, such as stealing sensitive data or conducting ransomware attacks.
Nation-state Actors: State-sponsored attackers who conduct cyber espionage, sabotage, or disruption on behalf of a nation-state.
Insider Threats: Employees, contractors, or trusted individuals who misuse their access privileges to cause harm or breach security.
Reasons for Attacks
Financial Gain: Stealing sensitive information or carrying out ransomware attacks to extort money.
Espionage: Gathering classified or valuable information for political, economic, or military advantage.
Sabotage: Disrupting or disabling critical infrastructure, systems, or services.
Ideological or Political Beliefs: Carrying out attacks to promote a specific ideology or political agenda.
Personal Vendettas: Seeking revenge or causing harm to specific individuals or organizations.
Code of Ethics
A set of principles and guidelines that professionals in the cybersecurity field follow to ensure ethical conduct, respect for privacy, and responsible use of their skills. It promotes integrity, professionalism, and adherence to legal and ethical standards.
Malware
Malicious software designed to damage, disrupt, or gain unauthorized access to computer systems. This includes viruses, worms, Trojans, and spyware
Ransomware
A type of malware that encrypts a victim’s files or locks their system, demanding a ransom payment in exchange for restoring access.
Denial of Service (DoS)
Attacks aimed at rendering a network, system, or service unavailable by overwhelming it with a flood of illegitimate requests or excessive traffic
Botnets
Networks of compromised computers controlled by a central attacker, typically used for launching coordinated attacks, distributing spam, or conducting DDoS attacks.
Social Engineering Attacks
Tailgating: Unauthorized individuals gaining physical access to restricted areas by following an authorized person.
Spear Phishing: Targeted email attacks that deceive victims into revealing sensitive information or downloading malware.
Phishing: Deceptive emails, websites, or messages designed to trick recipients into providing personal information or login credentials.
Vishing: Social engineering attacks carried out through voice calls to manipulate individuals into divulging sensitive information
Smishing: Similar to phishing, but carried out through text messages (SMS) or messaging apps.
Physical Attacks
Physical tampering or unauthorized access to hardware, systems, or infrastructure, such as stealing devices, tapping into network cables, or infiltrating data centers.
Man-in-the-Middle (MitM)
Attacks where an attacker intercepts and alters communication between two parties without their knowledge. This allows the attacker to eavesdrop, modify, or steal information.
IoT Vulnerabilities
Internet of Things devices often lack robust security measures, making them susceptible to attacks. Vulnerabilities in IoT devices can lead to unauthorized access, data breaches, or control manipulation.
Insider Threats
Attacks or security breaches caused by individuals within an organization who have authorized access but misuse it for personal gain, sabotage, or negligence
Advanced Persistent Threat (APT)
Sophisticated, long-term cyber attacks carried out by skilled adversaries who stealthily penetrate a target’s network to extract sensitive information or maintain persistent access
Access Management Principles:
Authentication: The process of verifying the identity of a user or entity requesting access to a system or resource. Authentication ensures that only authorized individuals or entities gain access.
Common authentication methods include passwords, PINs, biometrics (fingerprint, facial recognition), smart cards, and certificates.
Strong authentication practices involve using multiple factors (multifactor authentication) to enhance security.
Authorization: The process of granting or denying specific privileges, permissions, or access rights to authenticated users based on their role, responsibilities, or attributes.
Authorization mechanisms ensure that authenticated users have appropriate access privileges and restrictions.
Access control lists (ACLs), role-based access control (RBAC), and attribute-based access control (ABAC) are common authorization techniques.
Accounting (or Auditing): The process of tracking and monitoring user activities, including logins, access attempts, system actions, and resource usage.
Accounting helps in identifying security incidents, monitoring compliance, and generating audit trails for forensic investigations.
AAA (Authentication, Authorization, and Accounting)
Authentication verifies the user’s identity.
Authorization determines what the authenticated user is allowed to do.
Accounting tracks and logs the user’s activities for auditing purposes.
RADIUS (Remote Authentication Dial-In User Service)
A protocol commonly used for centralized authentication, authorization, and accounting for remote access services.
RADIUS servers authenticate and authorize users attempting to access network resources, such as virtual private networks (VPNs) or wireless networks.
