Generelle Konsepter Flashcards
(46 cards)
Define “Confidentiality”, main threats and controls
The property that information is not made available or disclosed to unauthorized individuals, entities, or processes.
Main Threats:
- Theft
- Unintentional disclosure
Controls:
- Encryption
- Perimeter defence
- Access control
Define “Data Integrity” and “System integrity”, main threats and controls
Data integrity: The property that data has not been altered or destroyed in an unauthorized manner (X.800: Security Architecture for Open Systems Interconnection (OSI))
System integrity: The property of accuracy and completeness (ISO 27000)
Main Threats:
- Data corruption
- System corruption
Controls:
- Access control
- Cryptographic integrity check and encryption
- Perimeter defence
- Audit and verification of systems and applications
Define “Availability”, main threats and controls
The property of being accessible and usable upon demand by authorised entity (ISO 27000)
Main Threats:
-DOS-attack
Controls:
- Redundancy of resources
- Traffic filtering
- Incident recovery
- International collaboration and policing
Define “Non-repudiation”, main threats and controls
Making sending and receiving messages undeniable through unforgeable evidence.
Main Threats:
- Sender denies having sent message
- Receiver denies having received message
Controls:
- Digital signature. Cryptographic evidence that can be confirmed by third party.
Non-repudiation refers to a state of affairs where the author of a statement will not be able to successfully challenge the authorship of the statement or validity of an associated contract. The term is often seen in a legal setting wherein the authenticity of a signature is being challenged. In such an instance, the authenticity is being “repudiated”.
Define “Accountability”, main threats and controls
Trace actions to a spesific user and hold them responsible.
Main Threats:
- Inability to identify source of incident.
- Inability to make attacker responsible.
Controls:
- Identify and and authenticate users
- Log all system events
- Electronic signature
- Non-repudiation based on digital signature
- Forensics
Security controls categories:
What is Physical controls?
What is Technical controls?
What is Administrative controls?
- Physical controls: Security guards, locks.
- Technical controls: Firewall, logical access control, intrusion detection.
- Administrative controls: Policies and standards, Incident response.
Functional controls categories:
What is Preventive controls?
What is Detective controls?
What is Corrective controls?
- Preventive controls: Encryption of files
- Detective controls: Intrusion detection system
- Corrective controls: Restoring all system to last known good image to bring corrupted system back online.
What is Authentication?
What is Access control?
What is Authorization?
Authentication (User)
The process where user gives his/her password to prove his identity to the system that verifies the password.
Access control (System) The system checks the user and grants correct access to system or service.
Authorization (Authority)
Defines and grants permissions to users.
What is an Cryptoperiod and why is it important?
Cryptoperiod is the timespan during which a specific key is authorized for use. Consists of the protecting period( used for encryption and signing) and the processing period(used for reading only).
It is important because it:
- Limits the amount of information protected by a given key, that is available for cryptoanalysis.
- Limits the amount of exposure and damage if key is compromised
- Limits the use of a particular algorithm to its estimated effective lifetime
What is cryptography and cryptoanalysis?
- Cryptography is the science of secret writing with the goal of hiding the meaning of a message.
- Cryptoanalysis is the science and sometimes art of breaking cryptosystems.
What is the definition of “information security” according to ISO27000?
Information security is the preservation of
- Confidentiality,
- Integrity and
- Availability of information;
in addition, other properties such as
- Authenticity,
- Accountability,
- Non-repudiation and
- Reliability can also be involved.
Define
“User authentication” , main threats and controls
User authentication:
– The process of verifying a claimed identity of a user when accessing a system or an application. Log in!
Main Threats:
Unauthorised access.
Controls:
Passwords, tokens, biometrics, cryptographic protocols
Define
“System authentication”, main threats and controls
System authentication:
– The process of verifying correct identity of remote hosts/servers.
Main Threats:
- Network intrusion
- Masceurading attacks
- DDos attacks
- Replay attacks
Controls:
- System: cryptographic authentication protocols based on hashing and encryption algorithms.
(TSL, VPN, IPSEC)
Define
“Organisation authentication”, main threats and controls
Organisation authentication:
– The process of verifying correct identity of the organization.
Main Threats:
- Network intrusion
- Masceurading attacks
- DDos attacks
- Replay attacks
Controls:
- System: cryptographic authentication protocols based on hashing and encryption algorithms.
(TSL, VPN, IPSEC)
Define
“Data origin authentication” , main threats and controls
Data origin authentication (message authentication):
– The process of verifying the source of data received
Main Threats:
Data:
-false transactions
-false messages and data
Controls:
- Encryption with shared secret key
- MAC
- Security protocols
- Digital signature with private key
- Electronic signature.
What is symmetric encryption, and where is it used?
Symmetric Encryption
The key is the same and is agreed on before the exchange of data, in private. This is great for people, but for two computers it is impossible to meet in private to exchange the secret key. That is why this is not used on everyday computing. For that we have asymmetric encryption.
What is asymmetric encryption, and how does it work?
Asymmetric Encryption Divides the key into two, one public and one private.
Bobs “public key” is shared with everybody so anybody kan encrypt a message that they want to send to Bob. Bobs “private key” is the only one who can be used to decrypt and read the messages, and is stored on bobs computer.
Example: You have a mail box with two different keys; one for placing mail (Public) and one for opening the mailbox (Private). The postman and the newspaper delivery man has a copy of the key that must be used to place mail (The public). But you, and only you have the key to open the mailbox and get out the mail (The private).
Arymetric keys and cryptography solves security problems in open networks, but what is the main challenge when applying it?
Key distribution challenges.
Public key cryptography needs a PKI (Public key infrastructure) in order to be practical.
What is the definition of risk according to ISO31000?
“Risk is the effect of uncertainty on objectives”
What is ISO 27001?
ISO 27001:
Specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of the organization. Mesure efficency etc.
The ISMS-Cycle is the model in focus, which consist of planning, risk assessment, security controls, evaluation and reporting. Tasks that are repeated to continually improve an ISMS.
What is ISO 27002?
ISO 27002:
Is a checklist to implement IT security
– Contains 14 categories (control objectives) of security controls
– In total, the standard describes 113 generic security controls
What is the ISO 27K-series?
The ISO/IEC 27000-series (also known as the ‘ISMS Family of Standards) comprises information security standards published jointly by ISO and IEC.
The series provides best practice recommendations on information security management - the management of information risks through information security controls - within the context of an overall Information security management system (ISMS).
Define these three human factors:
- Personnel integrity
- Personnel as defense
- Security usability
Personnel integrity - Making sure personnel do not become attackers
Personnel as defence - Making sure personnel do not fall victim to social engineering attacks
Security usability - Making sure users operate security correctly
What is the definition of Information security risk management (ISMS) in the ISO 27005?
ISO 27005:
“Information security risk management (ISMS) analyses what can happen and what the possible consequences can be, before deciding what should be done and when, to reduce risk to an acceptable level.”
