Risks, Threats, and Vulnerabilities Flashcards
is a possible danger which may exploit a
vulnerability?
Threat
is any circumstance or event with the potential to adversely affect a system through
unauthorized access, destruction, disclosure, modification of data, or denial of service
Threat
What Threats does the STRIDE Model try to prevent?
Spoofing
Tampering
Repudiation
Information disclosure
denial of service
elevation of privilege
Pretending to be something or someone other than yourself
Spoofing
Modifying something in memory
Tampering
Claiming you didn’t do something or were not responsible; can be honest or false
Repudiation
Providing information to someone not authorized to access it.
Information Disclosure
Exhausting resources needed to provide service.
Denial of service
Allowing someone to do something they are not authorized to do.
Elevation of privilege
An Attack initiated by an insider, which have authorization to access a system but use it in a way that is not approved by the party that granted authorization. an entity inside of a security perimeter
Insider Attack
An attack initiated by an outsider, an entity outside of a security perimeter. threats gain unauthorized or illegitimate access to a system.
Outside attack.
are utilized in outside attacks. they are focal points from collecting stolen information that launched automated attacks and distribute spam. is an aggregation of compromised computers, turning them into robots and used by attackers. communicate through a central control server and activate by attackers via chat rooms.
Botnet
is a flaw or weakness in a system’s design, implementation, or operation and management, which could be exploited to violate the system’s security policy. It MAY be exploited by a threat, but not every threat always results in an actual attack to the system.
Vulnerability
the degree of Vulnerability, strength of attack, or effectiveness of countermeasures will determine an…
Attack Success
Targeted resources may include data stored in an information system; services provided to the user; system processing power; and hardware; firmware; software; or physical design of the facility. is example of what kind of attack?
Network Attack
