Security Basics Chpt 1 Flashcards
(20 cards)
What are examples of Confidentiality Controls?
Encryption, Access Control, Stegonagraphy, Least privilege, Need to know, separation of duties
What are examples of Integrity Controls?
Hashing, Digital Signatures, Backups, Version Control
What are examples of Availability Controls
Redundancy, Fault Tolerance, Patch Management
Fault Tolerance
Systems that continue functioning after components fail
Patch management
Application of software updates with minimal service disruption
Redundancy
Multiple or backup systems designed for immediate or quick recovery
Digital signatures
Hashing and encryption used to prove a file’s origin
Hashing
Digital fingerprints used to detect file alteration
Steganography
Secret messages concealed inside of ordinary ones
What is the Layer Security/Defense Depth
Policies, Procedures & Awareness -> Physical -> Perimeter ->Network -> Host -> App -> Data
What is the Basic Risk Concept Order
Risk -> Threat -> Vulnerability -> Loss/Impact
Risk
the likelihood that a threat will exploit a vulnerability
Risk mitigation
Reduces the chances that a threat will exploit a vulnerability by implementing controls
How do you calculate risk?
threat * vulnerability * Loss(Impact)
What is Attack Surface?
Points where ama attacker can discover/exploit vulnerabilities in a network or application
Examples of Attack Vectors
Direct Access, Email, Removable Media, Remote and wireless, Supply Chain, Web, and social media, cloud
Lowers costs, high level of flexibility, used to test security controls, updates, and patches
Virtualization
What are Virtualization Concepts?
Hypervisor, Host, Guest, Snapshots, Sandboxing, Host availability, patch compatibility
Used to create an authenticated and encrypted area of an employees phone
containers
What are the functions of CASB?
Scan for malware and rogue device ass, monitor and audit user and resource activity, enable single-sign-on authentication, and enforce access controls and authorizations from the enterprise network to the cloud provider, mitigate data exfiltration by preventing access to unauthorized cloud services from managed devices
