Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cyber Security > Threats and Vunerabilities > Flashcards

Threats and Vunerabilities Flashcards

(73 cards)

Start Studying
1
Q

Risk

A

Anything that can impact the confidentiality, integrity or availability of an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Asset

A

an item perceived as having value to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Threat

A

any circumstances or event that can negatively impact assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Vulnerability

A

a weakness that can be exploited by a threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Asset management

A

the process of tracking assets and risk that affect them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

asset inventory

A

a catalog of assets that need to be protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

asset classification

A

the practice of labeling assets based on sensitivity and importance to organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

level of asset classification

A
  1. Public
  2. Internal
  3. Confidential
    4.Restricted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Data

A

is information that is translated, processed, or stored by a computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

States of data

A
  1. in use
  2. In transit
  3. At rest
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

data in use

A

is data being accessed by one or more user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

data in transit

A

data traveling from one point to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

data at rest

A

data not currently being accessed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

information security (infoSec)

A

The practice of keeping data in all states away from unauthorized users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Type of risk categories

A
  1. Damage
  2. Disclose
  3. Loss of information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Elements of a security plan

A

1.Polices
2. Standards
3. Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Policy

A

a set of rules that reduce risk and protect information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Standards

A

references that inform how to set policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

procedures

A

step by step instructions to perform a specific security task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Ccompliance

A

the process of adhering to internal standards and external regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

regulations

A

rules set by a government or other authority to control the way something is done.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

NIST Cybersecurity Framework (CSF)

A

a voluntary framework that consist of standards, guidelines and best practices to manage cybersecurity risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

NIST CSF frameowkrs

A
  1. Core
  2. Tiers
  3. Profiles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Five functions of the NIST CSF

A
  1. Identify
    2.Protect
  2. Detect
  3. Respond
  4. Recover
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Security controls
safeguards designed to reduce specific security risk.
26
Type of security controls
1. Technical 2. Operational 3.Managerial
27
Information Privacy
the protection of unauthorized access and the distribution of data.
28
principle of least privilege
the concept of granting only the minimal access and authorization required to complete a task or function.
29
data owner
The person who decides who can access, edit, use or destroy their information.
30
Data Life Cycle
1. Collect 2. Store 3. Use 4. Archive 5. Destroy
31
Information privacy
refers to the protection of unauthorized access and distribution of data.
32
Information security (InfoSec)
refers to the practice of keeping data in all states away from unauthorized users.
33
Personally identifiable information (Pii)
Any information that can be used to infer and individual identity
34
Cryptography
the process of transforming information into a form that unintended readers cant understand
35
algorithm
a set of rules used to solve problems.
36
cipher
an algorithm that encrypts information
37
cryptographic key
a mechanism that decrypts cipher text
38
Brute force attack
a trial and error process of discovering private information.
39
Public Key Infrastructure (PKI)
an encryption framework that secures the exchange of information online
40
Public key infrastructure process
1.exchange of encrypted information 2. establishing trust by using a system of digital certificates.
41
asymmetric encryption
The use of public and private key pair for encryption and decryption of data
42
symmetric encryption
the use of a single secret key to exchange information.
43
digital certificates
a file that verifies the identity of a public key holder.
44
hash function
an algorithm that produces a code that cant be decrypted
45
non- repudiation
the concept that the authenticity of information can't be denied.
46
access controls
security controls that manage access, authorization, and accountability of information.
47
AAA framework
1. Authentication 2. Authorization 3. Accounting
48
Factors of authentication
1.Knowledge:something the user knows 2.Ownership: something the user possesses 3.Characteristic: something the user is
49
Single sign-on (SSO)
a technology that combines several different logins into one.
50
Multi Factor Authentication
A security measure which requires a user to verify their identity in two or more ways to access a system or network
51
Separation Of Duties
The principle that users should not be given levels of authorization that would allow them to misuse a system
52
basic auth
The technology used to establish a user's request to access a server.
53
OAuth
An open standard authorization protocol that shares designated access between applications
54
API Token
A small block of encrypted code that contains information about a user.
55
session
A sequence of network HTTP basic auth requests and responses associated with the same user.
56
session ID
a unique token that identifies a user and device while accessing the system
57
session cookie
a token that websites use to validate a session and determine how long that session should last
58
session hijacking
An event when attackers obtain a legitimate user's session ID
59
Exploit
A way of taking advantage of a vulnerability.
60
Vulnerability Management
The process of finding and patching vulnerabilities
61
What are the 4 steps of Vulnerability Management?
1. Identify Vulnerability 2. Consider potential exploits 3. Prepare defense against threats 4. Evaluate those defenses.
62
Zero day exploit
An exploit that was previously unknown.
63
Defense in depth
a layer approach to vulnerability management that reduce risk.
64
defense in depth strategy
1. Perimeter layer 2. Network Layer 3. Endpoint Layer 4. Application Layer 5. Data Layer
65
exposure
a mistake that can be exploited by a threat
66
Common Vulnerabilities and Exposure List (CVE List)
An openly accessible dictionary of known vulnerabilities and exposure
67
MITRE
A collection of non profit research and development centers.
68
CVE numbering authority (CNA)
An organization that volunteers to analyze and distribute information on eligible CVEs
69
CVE list criteria
1. Independent of other issues 2. Recognized as a potential security risk 3. Submitted with supporting evidence 4. Only effect one codebase
70
Common Vulnerability Scoring system (CVSS)
A measurement system that scores the severity of a vulnerability
71
Vulnerability Assessment
The internal review process of an organizations security system.
72
Vulnerability assessment process
1. Identification 2. Vulnerability analysis 3.Risk assessments 4.Remediation
73
What is a vulnerability scanner?
A vulnerability scanner is software that automatically compares known vulnerabilities and exposures against the technologies on the network. In general, these tools scan systems to find misconfigurations or programming flaws.

Cyber Security (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions