Exam Prep Flashcards
The final iteration. Learn these, and hopefully you'll be fine! (47 cards)
What does the term ‘Something you know’ mean in the context of Authentication in Security?
Something you know - A secret, memorised piece of information like a password or PIN
What does the term ‘Something you have’ mean in the context of Authentication in Security?
Something you have - A material possession such as a device or physical object, which can be used to prove your identity
What does ‘Something you are’ mean in the context of Authentication in Security?
Something you are - A biologically inherent feature that is unique to the individual
How does DNS Spoofing work?
A DNS resolver is tricked into caching a false IP address for a given domain name.
This redirects future queries for that domain to a malicious server controlled by the attacker.
What additional attacks can be performed after a successful DNS Spoofing attack?
Man-in-the-middle attack: Forwards requests from the malicious server to the real server whilst intercepting data such as usernames and passwords
Phishing:
Users may be redirected to a fake website where they unknowingly enter sensitive credentials
What is an example attack that could affect Confidentiality in terms of Security?
Brute-force password attacks attempting to guess user credentials so that the attacker may access private information
What is an example attack that targets Integrity in terms of Security?
An attacker altering database entries to manipulate financial records
What is an example attack that could affect Availability in terms of Security?
A Denial-of-Service attack which aims to make a service unavailable
What is an issue that could occur regarding TOCTTOU (Time of Check to Time of Use)?
Issue occurs when a program checks a resource for a certain condition, and then later uses it based on that check. If an attacker is able to change that resource between the initial check and use, then they could exploit the timing window to bypass security controls
What is an example of a possible problem that could arise from the issue that occurs with TOCTTOU (Time of Check to Time of Use)?
Program checks a file to see if the user owns it and if it is writeable. If the attacker replaces the link to myfile with a pointer to another sensitive file e.g. password file, between the check and the use, then the program may inadvertently allow unauthorised access or modification.
What is Controlled Invocation?
Used by Operating Systems to allow user-mode programs (Ring 3) to safely execute privileged operations that exist in kernel mode (Ring 0). This is done through system calls, which are pre-defined, tightly controlled entry points that switch the CPU into kernel mode temporarily.
How does Controlled Invocation make it hard for attackers to circumvent?
Direct access to kernel functions is blocked, the CPU enforces privilege levels
System calls are audited and validated
Transition is mediated by the OS, involving interrupts or exceptions, which cannot be forged by standard user-mode processes
What is an SQL Injection attack?
It occurs when a webpage constructs SQL queries by concatenating unsanitised user input directly into the query string. This allows attackers to inject malicious SQL code, potentially gaining unauthorised access, modifying data or deleting database content.
How can you prevent an SQL Injection attack?
- Parameterised queries to bind input values rather than concatenate them
- Sanitise user inputs to filter or escape special SQL characters
- Using established libraries that abstract query construction and enforce secure practices
How does Signature-based Detection work in regards to viruses?
Signature-based Detection relies on maintaining a database of known malware signatures. When a file is scanned, signature-based detection will compare it to the database.
How does Heuristic-based Detection work in regards to viruses?
Heuristic-based detection will scan a program for suspicious patterns or behaviours that are indicative of malware, such as self-modifying code or attempts to access system areas.
How are Digital Signatures defined?
Digital Signatures are cryptographic values created by hashing a message and then encrypting the hash with the sender’s private key.
How can you verify a digital signature?
To verify:
- Decrypt the signature using the sender’s public key
- Re-hash the message
- If the hashes match, then the signature is valid. Else, it is invalid
How do you secure passwords stored in a password database?
- Use salting for the passwords before the hashing process, and ensure it’s a unique salt each time
- Hash the passwords with a computationally expensive hashing algorithm, in order to slow down brute-force attacks and make them impractical.
How could you defend a network from any outside threats? List as many as you can remember
DMZ - Increases resilience of the internal network by placing external-facing services in a DMZ, and limiting direct access. It also contains multiple firewalls
Segmented Network - Divide the network into smaller segments to prevent viruses from spreading freely across the network
Using anti-virus/anti-malware to prevent viruses from entering the system/being run on the network
Maintain regular back-ups - If a virus does compromise the network, you can purge the network and reinstantiate it with a previous state
What is a Denial of Service Amplification attack?
This type of attack sends a small request to a 3rd party server that generates a much larger response. By using the victim’s IP, the attacker redirects that response to be sent to the victim instead, overwhelming the network.
What is an example of a DoS Amplification attack scenario?
Attacker sends a small DNS query to an open DNS resolver. The resolver returns a response that is significantly larger, which is then redirected to the victim’s IP.
What is the formal definition of a packet filter?
A packet filter makes decisions based on IP addresses, ports and protocol types. It specifies what types of packets are allowed or are dropped depending on these factors.
What is the formal definition of an Application Gateway?
An application gateway analyses the protocols currently being used by the application, and operates at the application layer. It aims to block certain protocols being used when unexpected commands or abnormal behaviour starts to appear.
