Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Information Security > notes > Flashcards

notes Flashcards

(64 cards)

Start Studying
1
Q

CIA Triad stands for

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Confidentiality:

A

People can’t see things they shouldn’t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Integrity:

A

Information cannot be modified or corrupted by unauthorised parties or system limitations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Availability:

A

Information is available when needed - The secure information needs to be available to the right people and when those people need to access it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

High and low confidentiality:

A

High: Encrypted
Low: Open on the web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

High and low integrity:

A

High: carved in stone
Low: it’s on a wiki that anyone can edit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Authentication:

A

Techniques for deciding that someone is who they say they are: passwords, biometrics etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Acess controls and permissions:

A

Techniques for deciding that given someone has a particular identity, that identity can only see what they need to see

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Access control elements:

A

Identification - claimed identity
Authentication - verifies identity
Authorization - granted access based on proven identity
Accountability - held accountable for actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Administrative access controls

A

Refers to institutional policies and procedures
Things like hiring, supervision, personnel controls and testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Physical controls

A

Methods to prevent, monitor or detect direct contact with systems or areas in a facility
Such as guards, fences, motion detection, locked doors, sealed windows etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Logical/Technical controls

A

Refers to hardware/software mechanisms used
Such as authentication systems, encryption, protocols, firewalls etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security protocols: need to know

A

Only allowed access to what is needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security protocols: Least privilege

A

Ensure only granted privileges needed to operate as intended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Security protocols: separation of duties

A

Sensitive functions split between individuals, preventing fraud and errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Discretionary access control

A

Access based on identity membership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Non-discretionary access control

A

Controls for whole systems controlled by an administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Rule based access control

A

Set of rules, filters or restrictions controlling access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Lattice based access control

A

Objects are given security labels and users are assigned a clearance level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Centralised access control

A

All access controlled by a single entity:
- Lower admin overheads
- Easier for a small team
- Easier to maintain consistency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Decentralised access control

A

Various entities within the system perform access control:
- Requires more work to maintain integrity
- Sustainable for large systems
- Joins can be hidden from user with security bridges and single sign on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Signatures:

A

Means of recording who has created or modified a file or piece of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Checksums

A

Determine whether a file has been modified
Hash functions allow for verification of a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Auditability

A

Logging by OS, router or firewall, intrusion detection system or packet capture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Non-repudiation
Ensure party cannot deny they initiation a transaction
26
Attack avoidance includes
Physical security, distribution of load, defensive code, SQL injection avoidance code, treating user input as potentially hostile
27
First thing to be sure of with regard to availability is
The ability to recover data if things go wrong
28
How is Identification and Authentication proven
Identification usually by entering usernames. Authentication usually by password.
29
Authentication:
Is the process of determining that someone is who they say they are
30
Risks of password reuse:
Hackers breaking into secure systems Systems having insecure, readable password stores. Systems allowing the password store to be linked to your personal data This data being leaked These passwords being leaked with the data
31
Additional authentication methods:
2FA: Knowledge, Possession, Biometrics, Mobile, Combination
32
What do authenticator apps use
Time based one time pad algorithm (TOTP) - every 30 seconds a new code is generated
33
Alternatives for passwords:
Smart cards, token devices, biometrics
34
Password management for individuals involves managing various risks:
Risk of account being hacked Risk of password loss due to personal error Risk of password loss due to hacking of a third party
35
Rainbow tables
Rainbow tables are pre-computed hashes of known passwords.
36
Password crackers and rippers
Try a lot of educated guesses, they look at dictionary words and previously cracked passwords
37
Brute force
Try all combinations of letters, numbers and characters
37
What is password entropy
How long it will take to crack a password Entropy = log^2(R^L) R is the size of the pool and L is the number of characters in your password
37
Salting passwords:
Makes every password look different Adds entropy to the storage functions Include a work factor to slow down brute force
38
Peppering passwords:
A pepper is a secret value—a random string of characters—added to a password before hashing Same for every password Are not stored in the database
39
Herckhoff’s principle
A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
40
Security by obscurity
If people don’t know a message is there, then they’re not going to find it.
41
A code
Is a mapping from one semantic concept to another. This usually makes transmission easier, it doesn’t necessarily imply that the meaning is hidden. Codes are stored in codebooks or look up tables.
42
A cipher
A cipher is a mechanical or algorithmic means of manipulating symbols. Ciphers are stored in algorithms.
43
Cryptography:
Process of using encryption
44
Cryptanalysis
Process of studying encryption with the goal of reading messages
45
An encryption algorithm is breakable if:
it is possible to decipher messages without the key in a reasonable amount of time.
46
Caesar cipher
A substitution cipher where each letter in the plaintext is shifted by a fixed number of positions in the alphabet.
47
Keyed Caesar Cipher?
A Caesar Cipher with a keyword used to generate a shifted alphabet, followed by the rest of the unused letters.
48
Polyalphabetic Cipher
A cipher that uses multiple Caesar ciphers based on a repeating keyword, such as the Vigenère Cipher.
49
What is the One-Time Pad Cipher
A cipher that uses a random key as long as the plaintext, used only once, to encrypt data.
50
Steganography
Steganography is the practice of hiding messages within other files Digitally this can be done through methods such as making the text the same colour as the background
51
Information assurance:
Measures to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.
52
Security Controls:
Preventive: stop incidents Detective: identify incidents Corrective: limit damage
53
Physical controls
fences, doors, locks
54
Procedural controls
incident response
55
Technical controls
firewalls
56
Legal compliance
privacy laws
57
Risk analysis
Identify risks, prioritize based on likelihood and impact, treat through cost effective controls
58
Risk treatment options
Apply controls Transfer risk Avoid risk Accept risk
59
Assets in risk analysis
Hardware, software, information, infrastructure, people, outsourced services Risks assessed using Asset-Threat-Vulnerability model
60
Component driven risk assessment
Focuses on individual technical elements, threats and vulnerabilities Uses tools like vulnerability scanning
61
System driven risk assessment
Looks at the system as a whole: its functions and how it serves its purpose Identifies emergent risks from component interactions
62

Information Security (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions