Network Security Concepts Flashcards
(47 cards)
CIA Triad
- Confidentiality: Ensures only authorized individuals can access information.
- Integrity: ensures data is not altered and is accurate.
- Availability: Ensures authorized users can access information and systems.
Checksum
A checksum is a small piece of data—usually a number—that is generated from a larger set of data (like a file or message) using a mathematical algorithm. It’s used to detect errors in data, especially during transmission or storage.
Data Sovereignty
A country’s right to control data within its borders.
Mission Essential Functions (MEFs)
Tasks the business must perform, and it is too critical to be deferred.
Business Impact Analysis (BIA)
Estimates the cost of disruptions (e.g., from a DoS attack)
Data locality
Ensures data is stored and processed only in specific geographic regions.
Payment Card Industry Data Security Standard (PCI DSS)
The information security standard for organizations that process credit or bank card payments.
General Data Protection Regulation (GDPR)
Provisions and requirements protecting the personal data of European Union (EU) citizens.
Encryption Algorithm
Scrambling the characters used in a message so that the message can be seen but not understood or modified unless it can be deciphered.
Exploit
- The method or code used to take advantage of a vulnerability.
0 Day Vulnerability
Vulnerability in software that is unpatched by the developer or an attack that exploits such a vulnerability.
Vulnerability Assessment
Evaluation of a system’s security and ability to meet compliance requirements based on the configuration state of the system, as represented by information collected from the system. Also called vulnerability testing.
Honeypot/Honeynet
Honeypots and honeynets are cybersecurity tools used to detect, mislead, and analyze attackers by creating fake systems that appear real.
Threat Research
A counterintelligence gathering effort in which security companies and researchers attempt to discover the tactics, techniques, and procedures (TTPs) of threat actors.
Three Types of Threat Research
- Behavioral threat research—Narrative commentary describing examples of attacks and TTPs gathered through primary research sources.
- Reputational threat intelligence—Lists of IP addresses and domains associated with malicious behavior, plus signatures of known file-based malware.
- Threat data—Computer data that can correlate events observed on a customer’s own networks and logs with known TTP and threat actor indicators.
Footprinting
Footprinting allows a threat actor to discover the topology and general configuration of the network and security systems.
Fingeprinting
Fingerprinting allows a threat actor to identify device and OS types and versions.
Phishing
A fraudulent attempt to get users to click a malicious link or open an attachment by pretending to be a trustworthy entity (like a bank or employer).
Usually delivered through:
Email (most common)
Text message (smishing)
Phone calls (vishing)
Fake websites
Pharming
A more technical attack that redirects users to a fake website, even if they type the correct URL.
How it works:
DNS poisoning: Attacker corrupts the DNS server or local DNS cache, so when you try to visit a real website, you’re silently redirected to a malicious clone.
Hosts file modification: The attacker changes your computer’s configuration to redirect traffic.
Denial of Service (DoS) Attack
Attack causes a service at a given host to fail or to become unavailable to legitimate users.
Distributed Denial of Service
An attack launched by multiple systems simultaneously to flood a target network or system.
Distributed Reflection DoS
An enhanced DDoS attack that uses third-party servers to reflect and amplify traffic back to the victim.
- Attacker spoofs the victim’s IP address in requests to legitimate servers.
- Those servers respond to the victim, thinking the requests are real.
- The response is often much larger than the original request (amplification).
Fileless Malware
Uses lightweight shellcode that resides in memory. Often initiated via scripts, malicious attachments, or Trojans.
Common behavior and technics of Fileless Malware
- Doesn’t write its code on disk. The malware uses memory-reside techniques to run its own process.
- It uses lightweight Shellcode to achieve a backdoor mechanism on the host.
- Fileless malware may use “live off the land” techniques rather than compiled techniques which means the malware uses legitimate system scripting tools like PowerShell and Windows Management Instrument.
