Security Flashcards by Sam Thomas

Strategies to reduce risk of data confidentiality

Provider ensured data fully destroyed

Multiple encryption keys

Logical isolation of multiple customers

How well did you know this?

Not at all

Perfectly

Federated identity management

Arrangement between two or more trust domains

Use same digital idenity

How well did you know this?

Not at all

Perfectly

Security risks of user identity federation

Less control over use lifecycle

Single point of failure

How well did you know this?

Not at all

Perfectly

____ Identity Server can act as a hub that connects multiple identity providers to authenticate users to a particular service provider

WSO2

How well did you know this?

Not at all

Perfectly

The Google ____ 2.0 system supports server-to-server interactions such
as those between a web application and a Google service

0Auth

How well did you know this?

Not at all

Perfectly

Difference between WSO2 and 0Auth

0Auth supports server to server interactions

WSO2 acts as a hub, “more frontend”

How well did you know this?

Not at all

Perfectly

RACI stands for

Responsible Accountable Consulted Informed Model

How well did you know this?

Not at all

Perfectly

Bussiness COntinuty

Activity performed to ensure bussiness continues in case of disaster

How well did you know this?

Not at all

Perfectly

What is it important contracts define froma bussienss continuity and resilience perspective

Recovery time

Objects

Monetary Penalty if downtime

How well did you know this?

Not at all

Perfectly

BS 259999

Now ISO 22301

International Standard for implementing and maintaining effective business continuity plans

How well did you know this?

Not at all

Perfectly

Usage of data consideration

Personal died used without consent
Data sent across borders
No opt out features
Lack of individual control
Local law

How well did you know this?

Not at all

Perfectly

What can be done to data to make it be used for more general purposes?

De-identification

How well did you know this?

Not at all

Perfectly

Risks of multi-tenancy if managed uncorrectly

Inadequate local seperation
Co-mingled tenant data
Uncoordinated change controls
Performance risks

How well did you know this?

Not at all

Perfectly

Visually descriobe a multi-tenant application

Ref img

How well did you know this?

Not at all

Perfectly

Multi-tennacy - keys

Per Tenant Key management

How well did you know this?

Not at all

Perfectly

What is important to manage risk

Third Party Assessments

How well did you know this?

Not at all

Perfectly

In the event of a security incident, applications and services hosted at a Cloud provider are

difficul to investgate

distributed logging

How well did you know this?

Not at all

Perfectly

Infrastructure Security Architecture- Cloud

Tiered zones

Only allow required access in each zone

How well did you know this?

Not at all

Perfectly

Examples of third party audit lifecycle

Vulnerability identification

Results Analysis

Risk Assessment

Redmediation

How well did you know this?

Not at all

Perfectly

Improving security of network and apps is referred to as

Hardening

How well did you know this?

Not at all

Perfectly

Are non-prod enviroments immune to exposure?

No - even more at risk due to
generic authentication crdes
security flaws
then PIVOTING into production

How well did you know this?

Not at all

Perfectly

Use cloud for secret app?

Study These Flashcards

Security MEtric

Study These Flashcards

Measurable value - how well company doing to reduce cyber security risks

Types of security metrics

Study These Flashcards

Process
Network
Software

What do process security metrics usually refer to?

Measure processes and procedures Compliance/Governance driven Generally support better security Actual impact hard to define

What type of security metric would be associated with the following: No. of policy violations % of systems with formal risk assessments % of system with tested security controls % of weak passwords No. of identified risks and their severity % of systems with contingency plans

Process Security Metric

Network Security Metric - common features

* Driven by products * Readily available * Widely used * Gives sense of control

Examples of network security metrics

* Succesfull/unsucceful logs * No of incidents * No of cirus blocked * No of virus inections * No of port probes * Traffic analysis

What type of security metric is associated with the following: Successful/unsuccessful logons No. of incidents No. of viruses blocked No. of patches applied No. of spam blocked No. of virus infections

Network Security Metric

Charateristics of software security metric

Complex Context sENSITIVE eNVIROMENT dEPENDENT

Levels of software seucrity metric

System Level Design level Code level

Follow are examples of what security metric? Size and complexity Defects over time Cost per defect Layers of security Design Flaws

Software Security Metric

Threat Modelling to do with

Explore vulnerabiles, threats and create strategies for these

Who released Bitcoin

Pen name Satoshi Nakamoto 2008

What type of blockchain is bitcoin

Distributed ledger

Three parts of a chain in a blockchain

Data Hash Previous Hash

What ensures the integrity of a proof of work blockchain?

The number of blocks in chain - to change one piece of data would require to rehash the entire change, impossible

Explain how a blockchain links up

Ref to img

Different blockchain consensus mechanism

Proof of Work Proof of Stake

Disadvantages of proof of work

Lack of speed Poor Scalability Inefficient Energy COnsumption

What consensus mechanism does Ethereum use

Proof of stake

Role of validators in Proof of Stake chain

no energy-intensive computational process to earn the right to validate. Instead of working to solve proofs of work, validators “stake” some of the blockchain’s native tokens to become eligible for selection as a validator node. The prospective validator will essentially stake crypto tokens native to the blockchain to serve as collateral.

Distributed LEdger TEchnology (DLT) is often associated with what type of blochain

Consortium / Private blockchain

Is hashing alone enough to secure a block chain? If not, what else is used?>

No *Consensus Mechanism *Distributed peer-to-peer network

Proof of work conesus mechanism

achieving agreement on Blockchain network to confirm transactions and addnew blocks to the chain solve mathematical problem

How does adding proof of work increase bitcoin security?

Takes alot of time to recalculate each block

Centralized, Decentralized and Distributed Difference

Ref img

To succefully tamper with a proof of work blockchain you would have to

Temper with all blocks Redo proof of work for each block Take control of > 50% of peer-peer network to generate consensur

How can blochcain support confidentiality

encrypt block data

Future component of blocbhain

*Smart Contract - Get rid of need for intermedieries *Blockbhain Cloud Storage *IoT BLockchain

Smart Contract Use Cases

* Supply chain * REal estate * Insurnace * Personal Identity

Describe Blockchain Cloud Storage

1. Shard data 2. Encrypt shards 3. Distributed shards across nodes with synched ledger 4. Record transactions on blockhain ledger

What is this an example of?

Smart Contracts in a supply chain Each level validated it has received product and performed their respective process

Security Flashcards

(53 cards)