Lesson 10 Flashcards
(130 cards)
1
Q
Name the CIA Triad
A
Confidentiality
Integrity
Availability
2
Q
Confidentiality
A
Keeping information private and protecting it from unauthorized use
3
Q
What are some things that maybe confidential
A
Trade Secrets
Personnel Records
Tax Records
Military Secrets
4
Q
Integrity
A
Keeping information accurate, free from errors, and unauthorized modifications
5
Q
Availability
A
Making sure that the resources are available for use by end users
6
Q
How to ensure Integrity
A
Encryption
Hashing
7
Q
How to ensure Availability
A
SANS
Redundancy
8
Q
What are the four security factors that most systems rely on
A
Authorization
Access Control
Accountability
Auditing
9
Q
Authorization
A
determining what rights and privileges an entity has
10
Q
Access Control
A
assigning privileges to various resources, objects or data
11
Q
Accountability
A
Who to hold responsible for a particular activity or even such as a logon
12
Q
Auditing
A
process of tracking and recording system activities and resources
13
Q
Non repudiation
A
goal of ensuring that data remains associated with the party that creates it or send a transmission with the data
14
Q
Least Privilege
A
users or software have only the minimal level of access that is necessary for them to perform their duties
15
Q
Privilege Bracketing
A
to allow privileges only when needed and then revoke them as soon as the user finishes the task or the need has passed
16
Q
Risk
A
a concept that indicates exposure to the chance of damage or loss.
Likelihood of a hazard or threat occurring.
17
Q
Risk is often associated with
A
The loss of power
Loss of a device
Loss of the network
Other physical loss
18
Q
A disgruntled employee is a threat or vulnerability
A
Threat
19
Q
What is the determining factor when looking at information system security
A
Risk
20
Q
Unauthorized access
A
network of data access that is not explicitly approved by an organization
21
Q
Name some acts of unauthorized access
A
Attack by an outsider
Misuse of privileges
Inadvertent actions
22
Q
Does Unauthorized access result in data loss or damage
A
No
23
Q
Can unauthorized access lead to network attacks
A
Yes
24
Q
Data Breach
A
Sensitive or protected data is copied transmitted viewed stolen or used by individuals unauthorized to do so
25
Attacker
Malicious intruder
26
Hacker
Possess skills to gain access to computers
27
Security controls
safeguards to avoid counteract minimize security risks relating to personal or organizational property
28
Name some physical controls
Fences
doors
locks
fire extinguisher
29
Name some procedural controls
incident response process
management oversight
security awareness
training
30
Name some technical controls
authentication
logical access
antivirus
firewalls
31
Name some legal and regulatory compliance controls
Privacy laws
Policies
Clauses
32
Security policy
statement that defines how security will be implemented within an organization
33
This describes the means that the organization will take to protect the CIA of data and resources
Security Policy
34
What determines the security policy
needs of the organization
35
Without a formal policy you can only
react to threats instead of anticipating them
36
Which policy may include a consent to monitor clause
Security Policy
37
Consent to monitor banner normally states
You agree to be monitored
You are authorized to access or download specific data
You and the network owners have a reasonable expectation of privacy
You consent to reasonable law enforcement searches
38
What are the components of a Security policy
Policy Statement
Standards
Guidelines
Procedures
39
What outlines the plan for the individual security component
Policy Statement
40
Defines how to measure the level of adherence to he policy
Standards
41
Suggestions recommendation or best practices for how to meet the policy standard
Guidelines
42
Step[ by step instructions that detail how to implement
Procedures
43
Name some common security policy types
Acceptable Use Policy
Audit Policy
'Extranet Policy
Password Policy
Wireless Standards Policy
44
Name a Security Policy Standards Org
SANS
45
pg 258
pg 258
46
What are windows security policies
configuration settings within windows
47
Where are windows security policies found
in a policy object in the computer configuration\windows settings\security settings node
48
Group policies cab be applied to single devices or users, to groups of devices or users, to all devices or users
True
49
Group Policy
centralized account mgmt. for AD
50
Permissions
security setting that determines the level of access a user or group account hat to a resource
51
What are somethings that may have permissions
printers
files
shared folders
directory databases
52
Is it a good practice to assign rights and permissions to individual accts
NO
It is better to create group policies
53
NTFS
NT File System
file level security
NTSF permission on folder are inherited by the files and subfoldrs within it
54
What are the types of permissions
Read
Write
Read Execute
List Folder Contents
Modify
Full Control
Special permissions
55
Name some Linux permissions types
R read
W write
x execute
56
Can segmenting your network help you secure it
Yes
57
How does segmentation help secure the network
decreasing the attack surface
58
WJy segment the netwrk
Security
Compliance rqmts
Load balancing
59
Zones are defined by physical or logical boundaries
True
60
Does each zone have a security zone
Yes
61
What allows you to communicate across zones
A conduit
62
What should be segmented
```
SCADA/ICS
Legacy Systems
Private networks
Public Networks
Testing lab
Honey Net
```
63
Honey Net or Pot
used to detect deflector counteract attempts at unauthorized use
64
Wireless security is any method used to secure a wireless network from unauthorized access or data theft
T
65
Site Survey
technique to determine the coverage area of a network
66
Do WAPS and routers come with default SSIDs
Yes
67
Can an SSID be changed
Yes
68
Does disabling the SSID help secure a wireless network
Yes
| The network cannot be seen by a potential attackers
69
Can attackers still attack a network with a disabled SSID
Yes
70
Disaster
Catastrophic loss of functionality that could have been easily prevented
71
Disaster Recovery
Admin function of protecting people and resources
72
What are the disaster recovery priorities
Safety of personnel is first followed ensuring continuity of business functions
73
What are the types of disasters
Natural
Data Destruction
Hardware failure
74
Data destruction includes
Accidental deletion
Malicious destruction
Virus attack
75
How do you prevent data destruction
Good backups
76
What is business continuity
planning that is used during serious incidents or disasters to ensure critical business functions
77
What are the three key elements of Business Continuity
Resilience
Recovery
Contingency
78
What is a single point of failure
if this fails it will break the network
79
How do you combat a single point of failure
Employ redundancy
80
Vulnerability
condition that leaves a device open to attack
81
Can a device be vulnerable if there is no active threat against it
Yes
82
Vulnerability Scanner
Scans network and websites for security risks and generate steps to remediation. Some can even do patching
83
Name the physical security threats
Internal
External
Natural
Man Made
84
Examples of external threats
attackers
power failure
85
Name some environmental threats
Fire
Hurricanes and Tornadoes
Flood
Extreme Temperature
Extreme Humidity
86
Should you run unnecessary services
No
87
Open port
TCP or UDP port number that is configured to accept packets
88
Unpatched Systems
systems without software updates
89
Legacy Systems
device running an old OS
90
Unencrypted Channels
connections in which the data being sent is not encrypted by using one or more unsecure protocols
91
Clear text credentials
user passwords that are transmitted or stored unencrypted
92
Unsecure Protocols
expose data or credentials in clear text
```
Telnet
HTTP
SLIP
FTP
TFTP
SNMP v1 and v2
```
93
RF Emanation
emitting unintentional radio signals
94
TEMPEST
NSA and NATO process to deal with RF emanations
95
Name some threats
Changes to data
Interruption of services
Interruption of access
Damage to hardware
Unauthorized access or damage
96
Name some types of attacks
```
Physical Security Attacks
Network attacks
Software attacks
Social Engineering attacks
Web app attacks
```
97
Data Theft
using unauthorized access to obtain protected network info
98
Data theft attacker often uses what in the attack
Stolen credentials to authenticate or stealing the data in transit by using a sniffer
99
Social Engineering attack
uses deception to convince unsuspecting users to provide information
Takes advantage of technically ignorant users
100
Types of Social Engineering attacks
```
Spoofing
Inpersonation
Phising
Vishing
Whaling
Spam or Spim
Hoax
```
Pg 389
101
Insider Threat
Malicious employee
102
Malware attacks
malicious code attacks
103
Name some types of malware
```
Virus
Trojan Horses
Logic bombs
Worm
Spyware
Adware
Rootkit
Botnet
```
104
Virus
code that spreads from one computer to another
Code must be activated by users
105
code that spreads from one device to another without human intervention
worm
106
Must fool the users into executing it and can pave way for other attacks
Trojan HOrse
107
Sits dormant to a specified time of activation
Logic Bomb
108
Reports system usage without users consent
Spyware
109
Displyas or downloads unwanted advertisiments
Adware
110
Code that takes full or partial control of a system. Hides itself from monitoring and detection. Modifies low level system files. Used to install back doors
Rootkits
111
set of devices that are controlled remotely by a control program/. Used to mount DOS and DDOS attacks
Botnets
112
Goal of a software attack
disable or disrupt software on a users machine
113
Grayware
Spyware and adware are not often malicious in nature but they are unwanted.
114
If gray ware is disclosed in the End User License Agreement is it malware
no
115
Types of viruses
```
Boot Sector
Macro
Mailer
Poly morphic
Script
Stealth
```
Pg 393
116
Effects of malware
pg 393
117
Compromised system
system infected by malware
118
buffer overflow
targets vulnerability to cause the device OS to crash and reboot.
119
Buffer overflows are caused when
input controls are weak and attacker injects too much in of into the software causing the system to run out of allocated memory or buffer.
120
Buffer overflows allow an attacker to
open connections
Spawning shells
121
Do buffer overflows appear in system logs
no
122
Buffer overflows attack what
C programs and variants
OS
Applications
123
Password attacks
stealing passwords
124
do password attacks show in logs
Audit logs as failed login attempts or attempts at unusual times or locations
125
SAM database
pg 395
126
Types of password attacks
```
Guessing
Stealing
Dictionary attack
Brute force
Hybrid attack
```
127
Guessing
Guessing what a password is
Not very successful
Use acct lockup to thwart this attack
128
Stealing
Sniffing network comms for passwords; reading sticky notes
129
Dictionary attacks
successful lagainist easy and unsophisticated passwords
130
Brute force
Very successful but needs time
