Lecture 1 Flashcards
(46 cards)
What is Computer Security according to NISTIR 7298?
Measures and controls that ensure confidentiality integrity and availability of information processed and stored by a computer including hardware software firmware information data and telecommunications.
What is Confidentiality?
Preserving authorized restrictions on information access and disclosure including means for protecting privacy and information
What is Integrity?
Guarding against improper information modification or destruction including ensuring information nonrepudiation and authenticity
What is Availability?
Ensuring timely and reliable access to and use of information
What is Authenticity?
Ensuring trustworthiness and confidence in the source of information
What is Accountability?
Allowing to trace actions to the actual originator supporting non-repudiation deterrence intrusion detection and prevention and legal action
What is Low Impact?
The loss could be expected to have a limited adverse effect on organizational operations organizational assets or individuals
What is Moderate Impact?
The loss could be expected to have a serious adverse effect on organizational operations organizational assets or individuals
What is High Impact?
The loss could be expected to have a severe or catastrophic adverse effect on organizational operations organizational assets or individuals
What is a key challenge in Computer Security?
Attackers only need to find a single weakness while the designer must find and eliminate all weaknesses to achieve perfect security
What is a common perception problem in Computer Security?
There is a natural tendency on the part of users and system managers to perceive little benefit from security investment until a security failure occurs
What type of monitoring is required for security?
Security requires regular and constant monitoring
What is an adversary threat agent?
Individual group organization or government that conducts or has the intent to conduct detrimental activities.
What is an attack?
Any kind of malicious activity that attempts to collect disrupt deny degrade or destroy information system resources or the information itself.
What is a countermeasure?
A device or technique that has as its objective the impairment of the operational effectiveness of undesirable or adversarial activity or the prevention of espionage sabotage theft or unauthorized access to or use of sensitive information or information systems.
What is risk?
A measure of the extent to which an entity is threatened by a potential circumstance or event and typically a function of 1 the adverse impacts that would arise if the circumstance or event occurs and 2 the likelihood of occurrence.
What is a security policy?
A set of criteria for the provision of security services. It defines and constrains the activities of a data processing facility in order to maintain a condition of security for systems and data.
What is a system resource asset?
A major application general support system high impact program physical plant mission critical system personnel equipment or a logically related group of systems.
What is a threat?
Any circumstance or event with the potential to adversely impact organizational operations including mission functions image or reputation organizational assets individuals other organizations or the Nation through an information system via unauthorized access destruction disclosure modification of information andor denial of service.
What is a vulnerability?
Weakness in an information system system security procedures internal controls or implementation that could be exploited or triggered by a threat source.
What is hardware in computer systems?
Devices and equipment you use in your environment
What is software in computer systems?
Code you run in any instance in your environment
What is data in computer systems?
Any information that you collect process create log
What are communication facilities and networks in computer systems?
The infrastructure that allows devices and users to cooperate in any digital form
