IA 2 - UNIT 1 Flashcards
1
Q
is data endowed with relevance and purpose.
Converting data into information thus requires knowledge.
Knowledge by definition is specialized
A
Information
2
Q
And what characteristics should information possess to be useful
A
- accurate,
- timely,
- complete,
- verifiable,
- consistent,
- available
3
Q
raw facts with an unknown coding system
A
Noise
4
Q
raw facts with a known coding system
A
Data
5
Q
processed data
A
Information
6
Q
accepted facts, principles, or rules of thumb that are useful for specific domains. Knowledge can be the result of inferences and implications produced from simple information facts
A
Knowledge
7
Q
- Actions taken that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality and non-repudiation.
- This includes providing for restoration of information systems by incorporating protection, detection and reaction capabilities
A
assurance
8
Q
study of how to protect your information assets from destruction, degradation, manipulation and exploitation. But also, how to recover should any of those happen
A
Information Assurance (IA)
9
Q
timely, reliable access to data and information services for authorized users
A
Availability
10
Q
protection against unauthorized modification or destruction of information
A
Integrity
11
Q
assurance that the sender is provided with proof of a data delivery and recipient is provided with proof of the sender’s identity, so that neither can later deny having processed the data
A
Non-repudiation
12
Q
assurance that information is not disclosed to unauthorized persons
A
Confidentiality
13
Q
broad field that there is no universally accepted definition.
Researchers often give their own
spin to IA, usually reflecting their own concerns.
A
Information Assurance
14
Q
security measures to establish validity of a transmission, message, or originator
A
Authentication
15
Q
According to Debra Herrmann, IA has four major categories
A
- physical security
- personnel security
- IT security
- operational security
16
Q
Four Security Domains
A
- Physical security
- Personnel security
- IT security
- Operational security
17
Q
a variety of ongoing measures taken to reduce the likelihood and severity of accidental and intentional alteration, destruction, misappropriation, misuse, misconfiguration, unauthorized distribution, and unavailability of an organization’s logical and physical assets, as the result of action or inaction by insiders and known outsiders, such as business partners
A
Personnel security
18
Q
refers to the protection of hardware, software, and data against physical threats to reduce or prevent disruptions to operations and services and loss of assets
A
Physical security
19
Q
inherent technical features and functions that collectively contribute to an IT infrastructure achieving and sustaining confidentiality, integrity, availability, accountability,
authenticity, and reliability
A
IT security
20
Q
involves the implementation of standard operational security procedures that define the nature and frequency of the interaction between users, systems, and system resources, the purpose which to
- achieve and sustain a known secure system state at all times, and
- prevent accidental or intentional theft, release, destruction, alteration, misuse, or sabotage of system resources
A
Operational security
21
Q
IA Levels
A
- Physical
- Infrastructure
- Perceptual
22
Q
- The second level focus of IA is the information structure level.
- This covers information and data manipulation ability maintained in cyberspace, including: data structures, processes and programs, protocols, data content and databases.
- Desired Effects: to influence the effectiveness and performance of information functions supporting perception, decision making, and control of physical processes.
- Attacker’s Operations: impersonation, piggybacking, spoofing, network attacks, malware, authorization attacks, active misuse, and denial of service attacks.
- Defender’s Operations: information security technical measures such as: encryption and key management, intrusion detection, anti-virus software, auditing, redundancy, firewalls, policies and standards.
A
IA Levels: Infrastructure
23
Q
- The third level focus of IA also called social engineering.
- This is abstract and concerned with the management of perceptions of the target, particularly those persons making security decisions.
Desired Effects: to influence decisions and behaviors. Attacker’s Operations: psychological operations such as: deception, blackmail, bribery and corruption, social engineering, trademark and copyright infringement, defamation, diplomacy, creating distrust. - Defender’s Operations: personnel security including psychological testing, education, and screening such as biometrics, watermarks, keys, passwords.
A
IA Levels: Perceptual
24
Q
- The lowest level focus of IA: computers, physical networks, telecommunications and supporting systems such as power, facilities and environmental controls.
- Also at this level are the people who manage the systems.
- Desired Effects: to affect the technical performance and the capability of physical systems, to disrupt the capabilities of the defender.
- Attacker’s Operations: physical attack and destruction, including: electromagnetic attack, visual spying, intrusion, scavenging and removal, wiretapping, interference, and eavesdropping.
- Defender’s Operations: physical security, OPSEC, TEMPEST.
A
IA Levels: the Physical
25
Note that IA is both proactive and reactive involving:
1. protection,
2. detection,
3. capability restoration,
4. response.
26
IA Functional Components
1. IA environment protection pillars
2. Attack detection:
3. Capability restoration:
4. Attack response:
27
ensure the availability, integrity, authenticity, confidentiality, and non-repudiation of information”
IA environment protection pillars
28
timely attack detection and reporting is key to initiating the restoration and response processes
Attack detection
29
relies on established procedures and mechanisms for prioritizing restoration of essential functions. Capability restoration may rely on backup or redundant links, information system components, or alternative means of information transfer
Capability restoration
30
relies on established procedures and mechanisms for prioritizing restoration of essential functions. Capability restoration may rely on backup or redundant links, information system components, or alternative means of information transfer
Capability restoration
31
involves determining actors and their motives, establishing cause and complicity, and may involve appropriate action against perpetrators... contributes ... by removing threats and enhancing deterrence
Attack response
32
a computing environment is made up of five continuously interacting components
1. activities,
2. people,
1. data,
2. technology,
2. networks.
33
types of assets
1. physical asset
2. logical assets:
3. system assets:
34
logical assets
information, data (in transmission, storage, or processing), and intellectual property;
35
physical assets:
devices, computers, people;
36
the items being protected by the system (documents, files, directories, databases, transactions, etc.)
Objects
37
system assets
any software, hardware, data, administrative, physical, communications, or personnel resource within an information system.
38
entities (users, processes, etc.) that execute activities and request access to objects.
Subjects
39
operations, primitive or complex, that **can operate on objects and must be controlled.**
Actions
40
the information is genuine
authenticity
41
authorized users are able to access it
availability
42
Threats can be categorized by ____: accidental or purposeful (error, fraud, hostile intelligence);
intent
43
the information is free of error and has the value expected
accuracy
44
Examples of Threats
1. Interruption
2. Interception
3. Modification
4. Fabrication
45
assets is one that has **known threats.** Example: locating an asset in a war zone or a flood zone, or placing an unprotected machine on the Internet.
A hostile environment
46
is a category of entities, or a circumstance, that poses a **potential danger to an asset** (through unauthorized access, destruction, disclosure, modification or denial of service).
threat
47
the information has **value for the intended purpose**
utility
48
the information has not been disclosed to unauthorized parties;
confidentiality
49
Threats can be categorized by ____: type of asset, consequences.
impact
50
Threats can be categorized by the kind of ____ involved: human (hackers, someone flipping a switch), processing (malicious code, sniffers), natural (flood, earthquake);
entity
51
is a specific instance of a threat, e.g. a specific hacker, a particular storm, etc.
threat actor
52
the information is whole, complete and uncorrupted;
Integrity
53
the data is **under authorized ownership** and control.
possession:
54
an unauthorized party tampers with an asset.
Modification
55
an **asset becomes unusable,** unavailable, or lost
Interruption
56
an **unauthorized party gains access to an information asset.**
Interception:
57
an asset has been counterfeit.
Fabrication:
58
a nonhostile environment that may be protected from external hostile elements by physical, personnel, and procedural countermeasures.
A benign environment
59
a **collection of computing environments connected by one or more internal networks** under the control of a single authority and security policy, including personnel and physical security.
An enclave
60
**weakness or fault in a system** that **exposes** **information** to attack.
vulnerability
61
a method for **taking** **advantage** of a **known vulnerability.**
exploit
62
one for which there is **no known threat (vulnerability is there but not exploitable).**
A dangling vulnerability
63
one that does **not pose a danger as there is no vulnerability to exploit** (threat is there, but can’t do damage).
A dangling threat
64
Three types of attacks
1. passive attack
2. active attack
3. unintentional attack
65
an attack in which the **attacker observes interaction with the system.**
Passive attack
66
an **attempt to gain access, cause damage to or otherwise compromise information** and/or systems that support it.
An attack
67
an attack where there is not a deliberate goal of misuse
Unintentional attack:
68
attack in which the attacker directly interacts with the system.
Active attack
69
the active entity, usually a threat actor, that interacts with the system.
Attack subject
70
an organization/entity is the set of ways in which **an adversary can enter the system and potentially cause damage.**
The attack surface
71
the targeted information system asset.
Attack object
72
an instance when the **system is vulnerable to attack.**
Exposure
73
is a situation in which the attacker has succeeded.
compromise
74
**is a recognized action**—specific, generalized or theoretical—that an adversary (threat actor) might be expected to take in preparation for an attack.
indicator
75
**is the outcome of an attack.** In a purposeful threat, the threat actor has typically chosen a desired consequence for the attack, and selects the IA objective to target to achieve this.
consequence
76
Disruption: targets availability
Disruption
77
targets confidentiality
Exploitation:
78
targets integrity
Corruption:
79
is a type of consequence, involving accidental exposure of information to an agent not authorized access.
Inadvertant disclosure
80
process for an **organization to identify and address the risks in their environment.**
Risk management
81
are any actions, devices, procedures, techniques and other measures that reduce the vulnerability of an information system.
Controls, safeguards and countermeasures
82
kindsn of controls, safeguards and countermeasures
1. technical
1. policy, procedures and practices education, training and awareness cover and deception (camouflage)
1. human intelligence (HUMINT), e.g. disinformation
1. monitoring of data and transmissions
1. surveillance countermeasures that detect or neutralize sensors,
1. e.g. TEMPEST
1. assessments and inspections.
83
A **security profile** is the implementation (policy, procedures, technology) of the **security effort within an organization.**
security posture
84
* is the possibility that a particular threat will adversely **impact an information system by exploiting a particular vulnerability.**
* The assessment of risk must take into account the consequences of an exploit.
Risk
85
One particular risk management procedure (from Viega and McGraw) consists of six steps:
1. Assess assets
1. Assess threats
1. Assess vulnerabilities
1. Assess risks
1. Prioritize countermeasure options
1. Make risk management decisions
86
* **risks not avoided or transferred** are retained by the organization.
* E.g. sometimes the cost of insurance is greater than the potential loss.
* Sometimes the loss is improbable, though catastrophic.
Risk acceptance:
87
**not performing an activity** that would incure risk.
Risk avoidance
88
* shift the risk to someone else.
* E.g. most insurance contracts, home security systems.
Risk transfer:
89
taking actions to **reduce the losses due to a risk;** many technical countermeasures fall into this category.
Risk mitigation:
90
are the security features of a system that provide enforcement of a security policy.
Trust mechanisms
91
is about **preventing the risk from being actualized.** E.g., not parking in a high crime area.
Risk avoidance
92
is about limiting the damage should the risk be actualized. E.g., having a LoJack or cheap car stereo.
Risk mitigation
93
generic term that implies a mechanism in place to provide a basis for confidence in the reliability/security of the system. Failure of the mechanism may destroy the basis for trust.
Trust
94
is a **collection of all the trust mechanisms** of a computer system which collectively enforce the policy.
The trusted computing base (TCB)
95
a measure of confidence that the security features, practices, procedures, and architecture of a system accurately mediates and enforces the security policy.
Assurance
96
The concept of ____ provides a **unified approach to conceptualizing (parts of) IA.**
trust management
97
waterfall model
1. Requirements
2. Design
1. Coding
1. Testing
2. Deployment
3. Production
4. Decommission
98
the process by which an asset is managed from its arrival or creation to its termination or destruction.
lifecycle
99
is a process by which the **project managers for a system will ensure that appropriate information assurance** safeguards are incorporated into a system.
Security systems lifecycle management
