Flashcards
EISA
Enterprise Information Security Architecture - the practice of applying a comprehensive and rigorous method for describing a current and/or future structure and behavior for an organization’s security processes
What are the 5 asset ownership categories?
- Owner – owns the information, determines the classification level
- Steward – manages the data/metadata, ensures compliance (standards/controls) and data quality
- Custodian – keeper of the information, ensures CIA is maintained (security role)
- User – accesses data
- CPO – Chief Privacy Officer ensures privacy of all data in the entire organization, manages all other roles
Define a Data Retention Policy.
A data retention policy identifies how, where, and why data will be retained (e.g. operational use, adherence to legal and regulatory requirements, periodic audits, etc.) The intent is to define how long data needs to be kept.
What is the difference between data Sanitization and data Destruction?
Data Sanitization – Data is irreversibly removed from media
Data Destruction – Data and media are both destroyed
Name 4 methods of data sanitization.
- Degaussing – removing the magnetic field of drive
- Purging – clearing everything off the media
- Wiping – overwriting every sector of drive with 1 and 0
- Encryption – encrypting all files before deleting or disposing of media
Name 4 methods of data destruction.
- Burning – incinerating fibers
- Shredding – cutting vertical/horizontal lines
- Pulverizing – reducing fibers into fine particles using crushing, grinding, etc.
- Pulping – breaks down fibers using chemicals
What are the government data type categories?
- Top Secret
- Secret
- Confidential
- Sensitive But Unclassified (SBU)
- Unclassified
What are the private sector data type categories?
- Confidential
- Private
- Sensitive
- Public
What are the 5 security control types?
- Preventive – Stops attacker from performing attack
- Detective – Identifies an attack that is happening
- Corrective – Restores a system to state before attack
- Deterrent – Discourages attacker from performing attack
- Compensating (recover) – Aids controls already in place
What are the three security control categories?
- Administrative – Defines policies, procedures, and guidelines (e.g. password policy, hiring/screening policy, mandatory vacations, training).
- Technical – Controls access to a resource (e.g. firewalls, encryption, passwords, IDS/IPS, smartcards, biometrics, etc.)
- Physical – Controls access to facility (e.g. locks, guards, fences, video cameras, gates, etc.)
What are the three data states?
- Data at Rest (storage) – Data on hard disks, memory cards, datacenters, cloud storage, archives, and backups, external and removable drives, etc.
- Data in motion (transit) – Data sent on LAN, WAN, MAN, dedicated lines, wired, wireless, etc.
- Data in use – Data in CPU registers, RAM memory, volatile storage such as router/switch, etc.
How do you protect data at rest?
- Conventional perimeter-based defenses like firewalls, IPS, and antivirus programs
- Defense-in-depth access controls and MFA
- Volume, disk, and file encryption
- Partitioned storage (i.e. container security)
How do you protect data in motion?
- Encapsulation
- Dedicated Channels (e.g. B2B)
- Transport Layer Security (SSL/TLS 1.2)
- IPSec VPNs
- Extensible Authentication Protocol (EAP) wireless variants
- 802.1X and 802.11AE MACsec
What does CIA or Security Triad stand for?
- Confidentiality – ensuring only authorized users have the ability to access sensitive information
- Integrity – ensuring only authorized subjects can edit/change/delete data
- Availability – ensuring data access is uninterrupted
What is a cryptographic hash?
Maps data of any size to a fixed-length string (e.g. hash value, fingerprint, checksum, message digest, etc.). It is a one-way mathematical function with 128-512 bit length
What is hashing used for?
- Authentication
- Data integrity
- Nonrepudiation
- Fingerprinting
- Password storage
What are common hashing functions?
- MD5 (128-bit digest produced)
- SHA-1 (160-bit digest produced)
- SHA-2 and SHA-3
- RIPEMD (128-, 160-, 256-, 320-bit versions)
- Hashes are actually only half as strong as the key lengths due to the birthday paradox
What is a Substitution Ciphers?
Replaces one letter for another. They are based on a rotation scheme or other key. Common ciphers include ROT13 and Caesar ciphers.
What is a Polyalphabetic Cipher?
Replaces letters using multiple substitution alphabets and character sets. Vigenere is an example that uses a series of different Caesar ciphers based on the letters of a keyword (or secret key).
What is a Transposition Cipher?
Rearranges or permutates letters (e.g. Rail Fence Cipher)
What is the One-Time Pad (OTP) encryption cipher?
Considered unbreakable. Uses random number generator (RNG) or pseudorandom (PRNG) keys to generate values. Must be as long as the original message, which makes it difficult to deploy. (e.g. Vernam’s cipher)
What are the different types of encryption keys?
• Manually generated • Number generated o Random number generator (RNG) o Pseudorandom number generator (PRNG) • Static keys • Session keys • Ephemeral keys (not stored in long-term memory)
