Overview Flashcards

(52 cards)

1
Q

What is Encapsulation

A

Encapsulation refers to the process of protocol information being added to data as it moves through each layer of the OSI Model.

This is done in the form of a header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

What is a Firewall

A

A firewall is a security device that can be applied to a network.

Generally this is placed at the perimeter of the network and is used to filter inbound and outbound traffic by using a set of predefined rules.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Spoofing

A

When a device pretends to be another device on a network.

This can be done through actions such as an attacker spoofing an IP or MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is ACPO

A

Association of Chief of Police Officers

Created a set of guidelines for forensic investigators to ensure that they are being compliant and following a forensically sound process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is De-Capsulation

A

De-capsulation process removes this information once the data is received at the corresponding layer on the destination computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Proxy

A

Device that can be added to the perimeter of a network which handles requests from clients, disguising the address/identity of the client on the internal network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a DDOS Attack

A

Distributed Denial of Service attack is an attack where a large amount of packets are sent to a single device where the intention is to render the device inoperable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the Digital Forensics Process

A

Incident Response

Managing Digital Evidence

Preparing Forensic Documentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a Switch

A

A networking device that is used in a Local Area Network to direct internal traffic.

Traditionally works at layer 2.

Helps to break up collision domains

Utilises physical (MAC) addresses in order to direct and forward traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Authentication

A

Ensuring that an individual or device is in fact who they claim to be

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the Ethical Hacking Methodology

A

Reconnaissance

Scanning

Gaining Access

Maintaining Access

Covering Tracks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the Incident Response

A

Including Securing the Crime Scene

Identifying Evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a Router

A

A layer 3 device that carries out path determination and packet forwarding of network packets.

Traffic can not move to an external network without passing through a router first.

Uses IP addressing in order to direct traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Biometrics

A

A method of identifying a user due to a physical characteristic that they have:

Fingerprint
Iris
Face
Voice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Social Engineering

A

A technique used by attackers to trick users into giving out information that can assist in an attack on a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Managing Digital Evidence

A

Acquiring Digital Evidence
Chain of Custody
Processing Evidence
Analysing Evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the OSI Model

A

Application
Presentation
Session
Transport
Network
Data-Link
Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Encryption

A

The process of changing data from plain text to cypher text so as unauthorised individuals cannot read the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Reconnaissance

A

Consists of gathering information relating to the target system.

Can be done passively or actively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Preparing Forensic Documentation

A

A report documenting all actions, findings and justifications

Contemporaneous notes, as well as documentation regarding the chain of custody.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Simplex

A

Refers to one way communication

21
Q

What is the CIA Triad

A

Confidentiality: Data is only accessible to those who have permission to access it

Integrity: Data should remain intact and not be manipulated

Availability: Data should be secure, but should also be available to those who have permission to access it whenever required

22
Q

What is Scanning

A

Involves an attacker scanning a system for live hosts, open ports and vulnerabilities in order to assist in the exploitation of a target

23
Q

What is Evidence Integrity

A

Important that the integrity of evidence remains intact, as well as proof of this being presented throughout an investigation.

This is to demonstrate that evidence is admissible in a court of law

24
What is Full-Duplex
Refers to communication that is bi-directional. Furthermore, it can travel in both directions at the same time.
25
What is AAA
Authentication: Ensuring that a person or device is who they claim to be. Authorization: Identifying that the authenticated person has permission to access the data that they request. Accounting: Ensures that a log of the actions carried out by an authenticated user is created.
26
What is Gaining Access
This is the phase where a hacker will exploit a vulnerability that is found in the system.
27
What is Forensic Soundness
A forensically sound investigation, ensures that it has been carried out in a scientific, repeatable and verifiable manner.
28
What are IP Address
An IP (Internet Protocol) address is an address that is used across IP networks so that the location of a destination device is identifiable. Each IP address is made up of 2 portions, a host portion and a network portion. IPv4 is currently the dominant IP version that is used and is a 32 bit address.
29
What is Symmetric Encryption
Symmetric encryption uses a single private key in order to encrypt and decrypt data. Both the sender and recipient must have access to the private key
30
What is Covering Tracks
It is necessary for them to attempt to cover their tracks to ensure that the attack goes undetected. This can include actions such as deleting logs
31
What is Contemporaneous Notes
Notes that are taken at the time so that the information is recorded as soon as possible and is as accurate as possible
32
What is Half Duplex
Half-Duplex refers to communication that is bi-directional, however, traffic can only move in one direction at any onetime. An example of this is Walkie-Talkie
33
What is Asymmetric Encryption
Asymmetric encryption utilises 2 keys , a private and a public key to encrypt and decrypt data
34
What is Maintaining Access
Attacker attempts to remain persistent in the target system. Actions carried out to achieve this can include escalating privileges to an administrative user
35
What is Continuity of Evidence
Refers to ensuring that the collection and actions carried out in regard to evidence is recorded. It also ensures that any person that is in contact with the evidence is also recorded as well as the physical location of the evidence.
36
What is the Broadcast Address
The last address within an addressing scheme is reserved as the broadcast address. This address cannot be given to a host on the network, and any traffic that is sent to it will be received by all devices on the network.
37
What is a Public Key
During the encryption/decryption process, a public key is a key that can be known by anybody
38
What is Phishing
Attacker attempts to trick a user into surrendering confidential information by sending an email or link that appears to be from a legitimate source.
39
What is Non – Volatile Data
Non-Volatile data refers to persistent data. This is data that is not lost when power to the system is removed. Common sources of non-volatile data include data stored on a HDD or USB
40
What is a Network Address
The first address in the addressing scheme on an IP network is reserved as the network address. This address cannot be given to individual hosts on the network. It is the address that layer 3 devices such as routers use in order to identify the location of a network.
41
What is a Private Key
During the encryption/decryption process, a private key is known only to the recipient and is used to decrypt data
42
What is Whaling
An attack similar to phishing, although it targets individuals in an organisations that are in a senior position.
43
What is Volatile Data
Volatile data refers to data that is lost once power has been removed from a computer system. An example of volatile data, is data that is stored in RAM. This data should be collected first during a forensic investigation.
44
What is a Subnet Mask
A subnet mask is a mask that accompanies an IP address. It is split into 2 portions, the host portion and network portion and allows us to identify how many bits in an IP address belong to each.
45
What is a Cyber Security Policies
It is important for an organisation to ensure that they have a number of policies in place when storing data . Some of these policies include: Cyber Security Policy Access Control Policy Disaster Recovery Policy Incident Response Policy
46
What is a Worm
A form of malware that can spread or “worm” itself through a computer system without any interaction from the user or any other application.
47
What is Live Forensics
Live Forensics is the term that is given when a investigation is taking place within a live system.
48
What is a VLAN
Virtual Local Area Network. A way in which a network can be segregated by configuring VLANS within a LAN, from a device such as a switch. Reduces the broadcast domain of the network, allowing for greater network efficiency, increased security, and easier network management. Each VLAN is treated as a separate network, therefor in order for there to be inter-VLAN communication, a layer 3 device must be used.
49
What is the ICO
Information Commissioners Office It is the responsibility of the ICO to uphold information rights. In the event of a data breach, an organisation has up to 72 hours to report this to the ICO
50
What is a Virus
A type of malware can self replicate in the same way that a human virus can, in order to infect a system.
51
What is CIDR
Classless Inter Domain Routing Replacement for the originally used Classful IP addressing system. Removes the restrictions presented from the Classful system, by allowing the number of networks and hosts to be chosen by an administrator.