Objective 1 Flashcards
(26 cards)
Process of verifying an identity bound to the person asserting it
Identification and Authentication Process
Act of presenting an identity to a system
Identification
Validation of a claimed identity
Authentication
Use of two or more authentication factors
multi-factor authentication
Most common authenticator factor
Something you know
Hardest authentication factor to trick
Something you are
Closely related to “something you know” authentication factor
Something you do
Grants access based upon identity
Authorization
Magnetization left behind after information has been removed from a piece of magnetic media
Magnetic Remanence
Use of prescribed safeguards and controls taken to prevent reconstruction of magnetic remanence
Remanence Security Methods
Process of eradicating data on media before reused in an environment providing an acceptable level of protection for data
Clearing
Process of recording new data on top of already stored data thus destroying old data
Overwriting
Trained individual (not overwriter) randomly samples 20% of disk
Overwrite Verification
Removes information from media rendering it unrecoverable by technical means
Sanitizing
Process of erasing magnetic media by eliminating any remnant magnetic fields. The preferred method of of sanitizing magnetic media
Degaussing
Act of physically destroying media making it unusable by no exploitation method
Physical Destruction
Methods of physical destruction include…?
Shredding, burning, crushing, acid wash, breaking, and surface scratching
What are the 3D0X2 roles?
Prevent accidental disclosure of processed or stored sensitive information, and must be knowledgeable of clearing, sanitizing, and destruction procedures and have tools available
Systematic procedure for evaluating, describing, testing, and authorizing systems prior to or after a system is in operation
Certification & Accreditation Process
AF C&A program is defined in…?
AFI 33-210
Comprehensive assessment of the management, operational, and technical security controls in an information system
Certification
Official management decision given by senior agency
official authorizing operation of information system and to explicitly accept risk to agency operations, assets, or individuals
Accreditation
Non-regulatory federal agency with mission to promote US innovation and industrial competitiveness
NIST (National Institute of Standards of Technology)
Risk-based approach to selection of security controls
NIST RMF (National Institute of Standards of Technology Risk Management Framework)
