Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

LIS 4774 > Midterm Prep > Flashcards

Midterm Prep Flashcards

1
Q

Weakness in an information system that could be exploited or triggered by a threat source.

A

Vulnerablility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A circumstance or event or event that results in control of system services or functions by an unauthorized entity.

A

usurpation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

An event involving the exposure of information to entities not authorized access to the information

A

Unauthorized disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Inference of information from observable characteristics of data flow, even when the data is encrypted or otherwise not directly available.

A

Traffic analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Assures that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.

A

system integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A database that provides data of a statistical nature, such as counts and averages.

A

statistical database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A service that enhances the security of the data processing systems and the information transfers of an organization. The services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service.

A

security service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A set of rules and practices that specify or regulate how a system or organization provides security services to protect sensitive and critical system resources.

A

security policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A mechanism that is designed to detect, prevent, or recover from a security attack.

A

security mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles.

A

role-based access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

An exception of loss expressed as the probability that a particular threat will exploit a particular vulnerability with a particular harmful result.

A

risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Denial by one of the entities involved in a communication of having participated in all or part of the communication.

A

repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An attack in which a service already authorized and completed is forged by another, duplicate request in an attempt to repeat authorized commands.

A

replay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed.

A

privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An attempt to learn or make use of information from the system that does not affect system resources.

A

passive attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

An attack initiated by an entity outside the security perimeter (an “outsider”)

A

outside attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A management-oriented security standard that focuses on the OSI model and on networking and communications aspects of security.

A

OSI security architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the senders identity, so neither can later deny having processed the information.

A

non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A major application, general support system, high impact program, physical plant, mission critical system, or a logically related group of systems.

A

asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The degree of confidence one has that the security measures, both technical and operational, work as intended to protect the system and the information it processes.

A

assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A threat that is carried out and if successful, leads to an undesirable violation of security

A

attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.

A

authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator.

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The property of a system or a system or a system resource being accessible and usable upon demand by and authorized system entity.

A

availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

A

confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An attack on system on system integrity. Malicious software in this context could operate in such a way that system resources or services function in an unintended manner. Or a user could gain unauthorized access to a system and modify some of its functions

A

corruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Actions, devices, procedures, techniques, or other measures that reduce the vulnerability of information system.

A

countermeasure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The property that information is not made available or disclosed to unauthorized individuals, entities, or processes

A

Data confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The property that data has not been changed, destroyed, or lost in an unauthorized or accidental manner.

A

data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The prevention of authorized access to resources or the delaying of time-critical operations.

A

denial of service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A threat to availability or system integrity

A

disruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

The conversion of plaintext or data into unintelligible form by means of a reversible translation, based on a translation table or algorithm

A

encryption

33
Q

The process of examining a computer product or system with respect to certain criteria.

A

evaluation

34
Q

Can be deliberate, as when an insider intentionally releases sensitive information, such as credit card numbers, to an outsider. It can also be the result of a human, hardware, or software error, which results in an entity gaining unauthorized knowledge of sensitive data.

A

exposure

35
Q

The altering or replacing of valid data or the introduction of false data into a file or database.

A

falsification

36
Q

An attack on system availability. This could occur as a result of physical destruction of or damage to system hardware. More typically, malicious software, such as Trojan horses, viruses, or worms, could operate in such a way as to disable a system or some if its services.

A

incapacitation

37
Q

A threat action whereby an unauthorized entity indirectly accesses sensitive data by reasoning from characteristics or byproducts of data to which the entity does have access.

A

inference

38
Q

An attack initiated by an entity inside the security perimeter. The insider is authorized to access system resources but uses them in a way not approved by those who granted the authorization.

A

inside attack

39
Q

A term that covers the related concepts of data integrity and system integrity.

A

integrity

40
Q

A threat action whereby an unauthorized entity directly accesses sensitive data traveling between authorized sources and destinations.

A

interception

41
Q

A security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system without having authorization to do so.

A

intrusion

42
Q

This is the principle that access control should implemented so that each system entity is granted the minimum system resources and authorizations the the entity needs to do its work. This principle tends to limit damage that can be caused by an accident, error, or fraudulent or unauthorized act.

A

least privilege

43
Q

A type of attack in which one system entity illegitimately poses as another entity.

A

masquerade

44
Q

A threat action whereby an entity assumes unauthorized logical or physical control of a system resource.

A

misappropriation

45
Q

A threat action that causes a system component to perform a function or service that is detrimental to system security

A

misuse.

46
Q

The process of granting or denying specific requests: 1) for obtaining and using information and related information processing services; and 2) to enter specific physical facilities.

A

Access control

47
Q

An attempt to alter system resources or affect their operation.

A

Active attack

48
Q

An entity that attacks, or is a threat to, a system

A

adversary

49
Q

What is computer security

A

The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of information system resources (includes hardware, software, firmware, information/ data, and telecommunications)

50
Q

What are the four categories of Active Attack?

A

Replay
masquerade
Modification of messages
Denial of service

51
Q

What are the two types of Passive Attack?

A

Release of message contents

Traffic analysis

52
Q

What is the difference between passive and active security threat?

A

Passive attack is to learn or make use of information from the system that does not affect system resources, and Active attack is to alter system resources or affect their operation.

53
Q

Passive Attack Category:

Release of message contents

A

An advesary is trying to read but not alter messages contents sent from a sender and rcvr.

54
Q

Passive Attack Category:

Traffic analysis

A

The opponent monitors the traffic from a system without altering any information.

55
Q

Active Attack Category:

Involves the passive capture of a data unit and its subsequent retransmission to produce an unauthorized effect.

A

Replay

56
Q

Active Attack Category:

Takes place when one entity pretends to be a different entity.

A

Masquerade

57
Q

Active Attack Category:
Simply means that some portion of a legitimate message is altered, or that messages are delayed or reordered, to produce an unauthorized effect.

A

Modification of messages

58
Q

Active Attack Category:

Prevents or inhibits the normal use or management of communication facilities.

A

Denial of service

59
Q

What are the security design principles?

A 
Economy of mechanism
Fail-safe defaults 
Complete mediation 
Open design 
Separation of privilege
Least privilege 
Least common mechanism
Psychological acceptability 
Isolation 
Encapsulation 
Modularity 
Layering
Least astonishment
60
Q

______ __ _____ means that the design of security measures embodied in both hardware and software should be as simple and small as possible.

A

Economy of mechanism

61
Q

____-____ _____ means that access decisions should be based on permission rather than exclusion.

A

Fail-safe default

62
Q

______ _____ means that every access must be checked against the access control mechanism.

A

Complete mediation

63
Q

_____ _____ means that the design of a security mechanism should be open rather that secret.

A

Open design

64
Q

______ __ _____ is defined as a practice in which multiple privilege attributes are required to achieve access to a restricted resource

A

Separation of privilege

65
Q

____ _____ means that every process and every user of the system should operate using the lease set of privileges necessary to perform the task.

A

Least privilege

66
Q

____ _____ _____ means that the design should minimize the functions shared by different users, providing mutual security.

A

Least common mechanism

67
Q

________ _______ implies that the security mechanisms should not interfere unduly with the work of users, while at the same time meeting the needs of those who authorize access.

A

Psychological acceptability

68
Q

______ is a principle that applies in three contexts. Public access systems, files of individual users, and finally security mechanisms.

A

Isolation

69
Q

_______ can be viewed as a specific from of isolation based on object-oriented functionality.

A

Encapsulation

70
Q

_______ refers both to the development of security functions as separate, protected modules and to the use of a _____ architecture for mechanisms design and implementations.

A

Modularity, modular

71
Q

_____ refers to the use of multiple, overlapping protection approaches addressing the people, technology, and operational aspects of information systems.

A

Layering

72
Q

_____ ______ means that a program or user interface should always respond in the way that is least likely to astonish the user.

A

Least astonishment

73
Q

An ____ ____ consists of the reachable and exploitable vulnerabilities in a system.

A

attack surface

74
Q

What are attack surfaces three categories?

A

network attack surface
software attack surface
human attack surface

75
Q

This category refers to vulnerabilities over an enterprise network, WAN, or the internet

A

network attack surface

76
Q

This refers to vulnerabilities in application, utility, or operating system code.

A

Software attack surface

77
Q

This category refers to vulnerabilities created by personnel or outsiders, such as social engineering, human error, and trusted insiders

A

Human attack surface

78
Q

An _____ ____ is a branching, hierarchical data structure that represents a set of potential techniques for exploiting security vulnerabilities.

A

attack tree

79
Q

Explain the difference between an attack surface and an attack tree.

A

an attack surface is actual reachable vulnerabilities in a system, and an attack tree is a list of potential techniques of exploiting vulnerabilities.

LIS 4774 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions