Module 1 Introduction to Cybersecurity Flashcards
Rogue access point
Is an unauthorized access point connected to a network. Ransomware disables the victim’s access to data until a ransom is paid. (e.g., Ryuk). Fileless malware changes files native to the OS (e.g., Astaroth).
Spyware
Collects user activity data without the user’s knowledge (e.g., DarkHotel).
Adware
Serves unwanted advertisements (e.g., Fireball types of malware and their characteristics).
Trojans
Disguise themselves as desirable code (e.g., Emotet).
Worms
Spread through a network by replicating themselves (e.g., Stuxnet).
Rootkits
Gives hackers remote control of a victim’s device (e.g., Zacinlo).
Keyloggers
Monitor a user’s keystrokes (e.g., Olympic Vision).
Bots
Launch a broad flood of attacks (e.g., Echobot).
Mobile malware
Infects mobile devices (e.g., Triada).
Malware
Broad term used to describe malicious software, including spyware, ransomware, viruses, and worms. Malware breaches a network through a vulnerability, typically when a user clicks a dangerous link or email attachment that installs risky software.
Phishing
Involves sending fraudulent communications that appear to come from a reputable source, usually through email. The goal is to steal sensitive data like credit card and login information or install malware on the victim’s machine. Phishing is an increasingly common cyberthreat.
On-Path
Attacks are also known as eavesdropping attacks, which occur when attackers insert themselves into a two-party transaction. Once the attackers interrupt the traffic, they can filter and steal data.
Denial of Service
Attacks flood systems, servers, or networks with traffic to exhaust resources and bandwidth. As a result, the system is unable to fulfill legitimate requests. Attackers can also use multiple compromised devices to launch this type of attack. It may also be known as a Distributed Denial of Service (DDoS) attack.
Distributed Denial of Service (DDOS)
Attack is executed from multiole synchronized computers to disable or deny one or more services on a targeted machine
SQL injection
Is a Structured Query Language (SQL) injection that occurs when an attacker inserts malicious code into a server that uses SQL and forces the server to reveal information it normally would not. An attacker may carry out a SQL injection by simply submitting malicious code into a vulnerable website search box. Learn how to defend against SQL injection attacks.
Zero-day exploits
Hit after a network vulnerability is announced but before a patch or solution is implemented. Attackers target the disclosed vulnerability during this window of time. Zero-day vulnerability threat detection requires constant awareness.
DNS tunneling
Utilizes the Domain Name System (DNS) protocol to communicate non-DNS traffic over port 53. DNS tunneling sends HTTP and other protocol traffic over DNS. There are various legitimate reasons to utilize DNS tunneling. However, there are also malicious motivations for using DNS tunneling virtual private network (VPN) services. This tactic is used to disguise outbound traffic like DNS, concealing data typically shared through an internet connection. DNS requests are manipulated to exfiltrate data from a compromised system to the attacker’s infrastructure for malicious use. It can also be used for command and control callbacks from the attacker’s infrastructure to a compromised system.
File Signature based anti-virus
Identifies malware based on raw data, name, size, hash,bits, address, author and magic bits. Cannot detect code change
Heuristics based malware
Analyzes malware behavior, including the memory it uses and communication with the kernal, system, and network via DDLs.
Confidentiality
Confidentiality preserves authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
Integrity
Guards against improper information modification or destruction, ensuring information nonrepudiation and authenticity.
Availability
Ensures timely and reliable access to and use of information.
What are the 5 Steps of NIST Cybersecurity Framework
Identify, Protect, Detect, Respond, Recover
Identify
Asset management, business environment, governance, risk assessment, risk management strategy
Protect
Access control, awareness training, data security, information protection processes and procedures, maintenance, protective technology
Detect
Anomalies and events, security continuous monitoring, detection processes
Respond
Response planning, communications, analysis, mitigation, improvements
Recover
Recovery planning, improvements, communications
What are the 6 Phases of Risk Management Lifecycle
Categorize, Select, Implement, Assess, Authorize, Monitor, Focus
Incident
Is a security event that compromises an information asset’s integrity, confidentiality, or availability.
Breach
Is an incident that results in the confirmed disclosure—not just potential exposure—of data to an unauthorized party.
Assets
Depend on the type of organization; for example, a bank’s asset is its money while the assets of a software company are in its computer code.
Vulnerabilities
Exist in both software and hardware. The discovery of such vulnerabilities is only a matter of time.
Exploitation
Exploits are the means through which a vulnerability can be leveraged for malicious activity by hackers; these include pieces of software, sequences of commands, or even open-source exploit kits.
Risk
Risk is the level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system, given the potential impact of a threat and the likelihood of that threat occurring.
Threat
Is any circumstance or event that can adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and denial of service; also, the potential for a threat source to successfully exploit a particular information system vulnerability.
Pen-test
Is the method of employing hacker tools and techniques to evaluate security and implemented controls. Another way of understanding a pen test is to discover both known and unknown vulnerabilities.
Defense-in-Depth
Is an information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and dimensions of the organization.
Security controls
Include safeguards, measures, or steps taken to avoid, transfer, mitigate, reduce, or share the risks to organizational assets
Penetration Testing
Authorized simulated cyberattack on a computer system or network designed to check for exploitable vulnerabilities, Purposes is to test simulate a cyber attack on an orgainizatins infursture and services, devices and any vector that can be expoited.
4 Types of penetration testing
Internal, External Web Application and mobile application
Internal pen test
A Penetration tester will assume the role of an ontruder in an internal network
External pen test
A Penetration tester will examine publicly available information about the organization or any publicly facing assets, such as cloud servers, mail servers and websites and attempt to breach remotely
Web Application pen test
A penetration tester will gather information abou the target web applications, fid exploits, and exploit them
Mobile appliction pen test
The tester will use various techniques to understand the applications clogic and methods of an operation via tools used for static and dynamic analysis. Siphon information or change the app’s behavior
Local Area Network (LAN)
Connects users and end devices located in a small geographical area
Metropolitan Area Networking (MAN)
Spans across a city or a metropolitan area
Wide Area Network (WAN)
A collection of LANs spread over a large geographical area
Cybersecurity threats and attacks against the network aim to compromise the
confidentiality, integrity, and availability of network communication
Confidentiality
Ensures that only intended recipients can read the data
