uni cyber security Flashcards
(26 cards)
Security Controls - Directive
Encourages users to adopt less risky behaviours. Security training, codes of conduct. Punishment to discourage hacking etc.
Security Control - Preventative
Stopping risky actions. Requiring passwords, locked doors. Prevent unauthorized access.
What is an attack vector
The means by which a threat actor gains access to a system. Could be malware, phishing, social engineering.
Security Control - Compensating / alternative
Implemented in place of those security controls that are too difficult or impractical to implement.
Security Control - Detective
Identify an attack. Monitor unsuccessful login attempts.
Security Control - Corrective
Minimise risk when it occurs. Backup power supply ect.
Security Control - Recovery
Attempt to recover after an incident. Backups to restore data.
Security Control Considerations
1, Are they appropriate?
2, Implemented correctly?
3, Are processes in place to determine if controls are effective?
4, Have they introduced new vulnerabilities?
Legislation that requires organisations to protect data at all times.
Data Protection Act 2018
NCSC stands for
National Cyber Security Centre
Reduce the risk of legacy systems by…
1, Regularly erasing and rebuilding obsolete systems to remove any malicious software.
2, Treating obsolete systems as unmanaged or untrusted – such systems should have only very limited access to other systems. Should not store sensitive information.
3, Intensive monitoring and logging.
When systems are completely isolated from the outside world, this is called….
Air-gapping
What is an attack vector?
An attack vector is a pathway or method used by a hacker to illegally access a network or computer in an attempt to exploit system vulnerabilities
What does the acronym AAA stand for?
Authentication, Authorization, Accounting
Possible techniques to ensure confidentiality
Cryptography, access control
What is non-repudiation
In general, non-repudiation is agreeing to adhere to an obligation. In the context of cyber security, it refers to a property that a sender of a message cannot deny that the message was originated by them.
Interception
Stopping something or someone from reaching the intended destination
Attack vector - Interception
The threat actor intercepts and then modifies the information. This is a breach of integrity.
Attack vector - Interruption
The threat actor interrupts the transfer of data. Breaches integrity and availability.
Attack vector - Replay
Threat actor sends the same message again to try to solicit a response from the receiver.
Attack vector - Fabrication
The threat actor fabricates a message after observing message exchanges.
Attack vector - Interception- What part of CIA is breached?
Confidentiality
Attack vector - Modification - What part of CIA is breached?
Confidentiality, integrity
Attack vector - Interruption - What part of CIA is breached?
Integrity and availability. Confidentiality may also be breached.
