SSCP
networking or system logs that record various events as they occur. Everything that happens on a network—an individual logging in, developing an application, accessing a database, and sending an email—can be recorded
event logs
unknown user is identified as a known user by mistake
false acceptance
known user is not identified and rejected by mistake
false rejection
specifically deals with protecting data in any of its three states: in process, in transit, and at rest
data level access control
an essential line of defense within a network system. They separate networks from each other and specifically separate interior networks from untrusted networks such as the Internet
firewall
access control list tools that compare incoming access requests to a set of rules
firewalls and routers
Subjects with access to information at a certain security level cannot write that information to a lower security level
no write down
access control that is applied to an object. access is granted by the identity of the subject users are able to give one another access, have the 'discretion' to change permissions on a file
discretionary access control
In this mode, the original IP packet, including the payload, is encapsulated into a new packet with a new header. used for network-to-network, gateway-to-gateway, or firewall-to-firewall communication
tunnel mode
a mathematical function that may both encrypt and decrypt a message
two way algorithm
patches provided by third-party individuals or organizations for commercial software
unofficial patch
various cloud providers are providing Infrastructure as a Service (IaaS) disaster recovery sites
virtual site/cloud site
Ports 0-1023
well known ports
targeting of senior executives within an organization, usually through officially appearing emails
whaling
network consisting totally of wireless devices.
wireless network
prevent the writing of any information on the hard drive during an investigation
write block hard disk controller
when doing forensics this device physically blocks the signals from a computer to the storage device that would cause a change to the data on that storage device
write blocker
What is the certificate standard used by PKI?
x.509 v3
access control that is applied to a subject. access is granted by the administrator for each object
nondiscretionary access control
a message in readable format. May also be represented in other code formats, such as binary, Unicode, and ASCII
plaintext or clear text
type of fiber-optic cable uses a plastic core that allows for larger-diameter fibers
plastic optical fibers
a specifically jacketed cable with a fire retardant plastic jacket
plenum cable
detailed steps that provide direction when performing a task
procedures
used to intercept packets flowing along the network. Data that is transmitted across the network may be intercepted by a personal computer with a network interface card set in promiscuous mode
protocol analyzer or packet sniffer
Which of the following is the third canon of the (ISC)2 Code of Ethics?
provide competent and diligent service
Trojan software is loaded by the user, either willingly or through other practices, and once installed, functions as ransomware
rogue software
access control by placing subjects in privilege level groups
role based access control
the number of times an encryption process may be performed inside an algorithm
rounds
authentication factor that includes any information committed to memory or in written form, such as passwords, PINs
something you know
the user or system (actively) requesting access.
subject
When detected, this means that the failure of an application or system was not critical in nature.
syslog 3 error
What are the three possible round counts for the key lengths of AES?
10 , 12 , 14
minimum distance between hq and dr
20 miles
preprocessing processing postprocessing
3 P's of data processing within an application
default port for TLS encrypted SMTP
465
refers to wireless security provided by the WPA2 encryption method.
802.11i
can be implemented on a wireless access point to eliminate the risk of static password-guessing attacks
802.1x
the IEEE standard known as port-based network access control which is used to leverage authentication already present in a network to validate clients connecting over hardware devices, such as wireless access points or VPN concentrators
802.1x
small applications that are downloaded to the client computer during a web session...........can do harm unintentionally due to poor programming or poor design, while others are malicious
Add-ons two kinds of add-ons: java applets ActiveX
controls to regulate actions taken by individuals
Administrative Access Controls
can be established between two firewalls. The first firewall, which is facing a untrusted network such as the Internet, screens unwanted traffic but allows desired traffic to access the demilitarized zone subnetwork. The second firewall protects the internal enterprise network.
DMZ
This service always a logical network topology of a bus
Ethernet
an IEEE 802.3 standard that supports a number of different media standards such as coaxial, fiber-optic, and shielded and unshielded twisted-pair cable....... referred to as a "best effort" communication method
Ethernet
a digital mathematical function that combines ones and zeros from two different sources in a specific pattern to result in a predictable one or zero. It is a simple binary function in which two binary values are added together. the addition of 0+0 or 1+1 always outputs a 0 the addition of 0+1 or 1+0, output will always be a 1
Exclusive or (XOR)
Designates a fully shielded twisted-pair cable where internal twisted pairs are individually shielded and the entire cable bundle is encased by an external shield. The F designates foil, while the S indicates a braided shield.
F/FTP and S/FTP
Designates a twisted-pair cable with foil shielding that encases all of the twisted pairs.
F/UTP
a standard approved by the secretary of commerce as compulsory and a binding standard for federal agencies.
FIPS (Federal Information Processing Standards)
an act responsible for developing information security standards and guidelines.
FISMA (Federal Information Security Management Act)
the most difficult attack. The attacker has little or no information other than the ciphertext. The attacker attempts to use frequency of characters, statistical data, trends, and any other information to assist in placing the ciphertext.
ciphertext-only attack
created by physically connecting to endpoints through a series of wires and mechanical switches where the signal voltage generated at one endpoint is received by the other endpoint.
circuit switched
a threshold of activity established above the baseline that, after crossed, sets off an operator alarm or alert
clipping level
a cloud vulnerability since a number of clients may all be running on the same hardware, issues could come up if one client runs into legal trouble or gets hacked etc
cloud client encroachment
a cloud vulnerability that encompasses not only the financial viability of a cloud provider but also their ability to provide adequate safeguards and security controls on the cloud equipment
cloud vendor reliability
refers to using a combination of servers or systems to reduce the risk associated with a single point of failure
clustering
constructed as a large copper central conductor encased in a nonconductive dielectric material that is then encased within a braided copper shield and covered with a plastic casing.........much less resistant to interference and cross talk................capable of handling much greater current loads and is therefore ideal for radio antenna lead cables....................much more expensive than twisted pair and requires a much wider bend radius
coaxial cable
a method through which the author is authenticated and confirmed as the original provider of the software................accomplished by the software author using a cryptographic hash algorithm to process the software code to obtain a hash value or message digest
code signing
a facility that has power, heating, ventilation and air-conditioning, and little else. It does not have communications or computer equipment
cold site
occurs when two or more entities, such as business partners or service providers, participate in overseeing the activities of a shared or common network or environment.
collaborative monitoring
when two different plaintext documents create the same output hash value
collision
when one or more individuals or companies conspire to create fraud
collusion
This is a type of hacker who may be hired by a third party to infiltrate a target for a specific agenda
commercial hacking
The cloud model in which similar entities or groups of users access a semi-private cloud environment that has been established for their particular purpose.
community cloud
a device, procedure, or mechanism that addresses the inherent weakness of the primary control
compensating control
a secondary control placed into use if the first or primary control is disabled or no longer usable. In this case, a hotel room door has a lock; the chain is a secondary
compensating control
the application of tools that allow for the centralized management of settings, firewall rules, and configuration files that allow networking items to perform their assigned tasks
configuration management consists of identification control accounting auditing
increases the complexity of an encrypted message by modifying the key during the encryption process, thereby increasing the work factor required in cryptanalysis.
confusion
When a storage device is taken in as evidence, what is the first step performed by the forensic personnel after starting the chain of custody form and writing out the evidence collection form
connect the device to a write blocker
involves the policy, process, and technology used to detect risk issues within an organization's IT infrastructure
continuous monitoring
When implementing LAN-based security like traffic management in a software-defined network, where are decisions about where traffic is to be sent made?
control plane
part of the router that is concerned with determining the path that should be used to forward a data packet
control plane
mechanisms utilized during the risk management process to reduce the ability of a threat to exploit a vulnerability, which would result in harm to the organization
controls; 3 types: administrative logical physical
involves the transmission of multimedia and data on the same network
convergence of network communications
a simple example of device authentication that is comprised by a text file used by Web sites
cookies
[ALE1 - ALE2] - CCM
cost benefit equation
a stream cipher that separates the keystream from the data to encrypt several blocks in parallel
counter
Any means of communication other than the standard channel of communication
covert channel
controversial name claimed by both black hat and white hat computer system intruders. White hats claim that only black hats should be called this
cracker
tricks the user's web browser, by issuing unauthorized commands, to perform undesired actions so that they appear as if an authorized user is performing them
cross-site request forgery
based on inserting a client-side script into a genuine website. This is possible due to poor application or website design, such as limited data validation in websites. Scripts are then executed on other hosts that access the same website.
cross-site scripting
The point at which a security system has an equal FRR and FAR
crossover error rate
the study of the techniques used to determine methods to decrypt encrypted messages, including the study of how to defeat encryption algorithms, discover keys, and break passwords
cryptanalysis
a science that deals with the encryption and decryption of plaintext messages using various techniques such as hiding, encryption, disguising, diffusion, and confusion
cryptology
involves everything in the cryptographic process, including the unencrypted message, the key, the initialization vector, the encryption algorithm, the cipher mode, the key origination, and the distribution and key management system as well as the decryption methodology.
cryptosystem
The text produced by a cryptographic algorithm through the use of a key or other method. The ciphertext cannot be read and must be decrypted prior to use
cyphertext or cryptogram
differ greatly from one organization to the next because each generates different types and volumes of data but generally, organizations opt to classify the most sensitive information first and work down to publicly available information
data classification process
a cloud vulnerability where company data may remain on cloud storage devices after a cloud size is reduced.
data clearing and cleansing
data that is currently in use or being acted upon by an application
data in process
data transmitted from one location to another
data in transit
the big data storage location where all of the raw data is housed until it is needed for mining or processing
data lake
estimated percentage of loss should a specific threat exploit the vulnerability of an asset
exposure
the harm or amount of loss that might be experienced by an asset during a risk event.
exposure factor
a condition where a known good user is denied access to the system. This is known as a false negative error
false negative
when no alert takes place, but actual malicious events are occurring
false negative
If an attacker is both identified and authenticated correctly and allowed into the system
false positive
Which term is used when an event triggers an IDS alert, but the event was not malicious?
false positive
designed as a shield to prohibit a device from transmitting or receiving radio signals.
faraday bag
allows users to be identified and authenticated to multiple networks or systems. like SSO but for multiple organizations
federated access or federation
an association of nonrelated third-party organizations that share information based upon single sign-on and one-time authentication of a user
federation
Windows New Technology File System (NTFS) allows filenames to extend up to 235 characters. These extremely long filenames are usually abbreviated on directory displays and in other presentations, thus hiding the fact that there may be a double file extension or other hidden filenames
file extension attack
A type of virus that specifically infects executable files to make them unusable or permanently damaged
file infecting virus
a single string of information collected from a remote computing device for the purpose of identification
fingerprint
a list of statements used to determine how to filter traffic and what can pass between the internal and external networks
firewall rules
known in the software industry as a rapid repair to an identified problem.
fix
a legal requirement for participants of a lawsuit to retain and preserve records and evidence
litigation hold
a technique of utilizing various servers and systems in an array to spread the workload
load-balancing clustering
a script or malware usually installed by a disgruntled employee or insider to cause harm based on a certain event occurring
logic bomb
very typical of the use of JBOD (just a bunch of disks) technology in the hard drive array. It may start small and grow larger as disks are added
loose coupled cluster
a database term that refers to recording transactions and creating a transaction log
journaling
trusted third party authentication
kereberos and certifications
when two different cryptographic keys generate the same ciphertext from the same plaintext.
key clustering
a shared master key that is used to encrypt and exchange session keys between two parties
key encrypting key
A virus created through the use of macro programs usually found in Microsoft Office applications
macro virus
What is the most significant risk when browsing the internet?
malicious mobile code
software specifically intended to cause harm
malware
a malicious actor is inserted into a conversation. At least one side of the conversation believes that they are talking to the appropriate or original party
man-in-the-middle
access control that labels the subject and object permissions are set by the operating system based upon the files classification
mandatory access control
TCP/IP Suite
maps to the OSI model Application maps to application, presentation and session Transport maps to transport Internet maps to network Network Access maps to data link and physical In TCP/IP the IP address provides the packet routing information and TCP provides the guaranteed delivery and request for resend for error correction.
Throughout a computer network there are a number of cache locations. Domain Name System (DNS) name servers and Address Resolution Protocol (ARP) make use of cache memory locations for short-term storage of information. Anytime erroneous information is placed into the cache or if the cache is corrupted
cache poisoning
a type of wireless implementation of a "guest logon page" used by many public wireless networks like a hotel can be quite dangerous because it may actually be the front for a very devious individual who is running a rogue access point
captive portal
refers to the fact that the device is listening to the media at all times. specifically listening for the transmission of other devices
carrier sense
contains a system of radio towers referred to as a cellular base stations and featuring directional radio transceivers and antennas to form of geographic cell. Each cell borders other cells to maintain continuous coverage over a large geographic area
cellular network
the technique of having one central authentication server providing user lookup services and allowing or disallowing access to the data and resources
centralized authentication
all keys are stored in a centralized storage location or key escrow
centralized key management
_____________ always contain the owner's public key
certificate
a trusted entity that obtains and maintains information about the owner of a public key. Issues, manages, and revokes digital certificates.
certificate authority
requires that a valid digital certificate be maintained on a machine or device from which the user authenticates
certificate-based authentication accomplished through a commercial certificate issued by certificate authorities (CAs) such as VeriSign or through internal corporate CAs managed by the organization
refers to a forensic principle whereby each movement or transfer of data must be recorded and logged appropriately. If this is disrupted by any means, evidence may not be presented in court
chain of custody
a system that records a request, processes requests, elicits a denial or authorization, and records the outcome of the change to a configuration item
change management
needs to ensure that any pre-existing interoperability capabilities are maintained or re-established after a change is implemented, especially if that interoperability is used as part of a core business function
change management
How does discretionary access control determine whether a subject has valid permission to access an object?
check for the user identity in the object's ACL
enables individuals to review the continuity plan or disaster recovery plan to ensure that all procedures and critical areas within their responsibility are addressed
checklist test
the process in which keys required to decrypt encrypted data are held in a secure environment in the event that access is required to one or more of the keys
key escrow
the process of securely distributing a key between one communication entity and the other
key exchange
has a direct impact on the amount of processing time required to defeat the cryptosystem the number of bits in the length of a key. So, a 128-bit key has 128 individual digits in its length
key length
the input required by a cryptographic algorithm
key or cryptovariable
Refers to a set of cryptographic keys. Refers to the public and private key in public key infrastructure (PKI) and in a asymmetric cryptosystem
key pairs
the process used to replace an old asymmetric key pair set with a new key pair set
key rotation
the number of keys that can be created based upon the key length in bits A key is a binary number used to control the encryption and decryption processes of symmetric encryption
key space
perform a large number of hashing calculations on the original key or password in an effort to increase the workload required to crack or break the key through brute force.
key stretching
program that usually incorporates a method of transmitting keystrokes to a remote location
keylogger
attacker has access to both the plaintext and the ciphertext. The goal of the attacker is to determine the original key used to encrypt the ciphertext
known plaintext attack
an individual should only have enough access to perform their job effeciently
least priviledge
Original botnets were linked by Internet relay chat (IRC), which was a number of Internet-connected computers communicating with other similar machines.
legal botnet
a disaster that is local in nature and affects only a small part of the operation
level 1
a disaster situation that affects a significant amount of the organization
level 2
a very serious situation requiring the relocation of IT operations to an off-premises alternate site
level 3
an estimate of the maximum time the business process may be down or offline before the organization becomes unable to recover
maximum tolerable downtime
the attacker has access to the encryption mechanism and the public key or the private key and can process ciphertext in an attempt to determine the key or algorithm
chosen ciphertext attack
the attacker has access to the algorithm, the key, or even the machine used to encrypt a message. The attacker processes plaintext through the cryptosystem to determine the cryptographic result.
chosen plaintext attack
a block cipher mode that combines or XORs plaintext messages with the initialization vector block by block
cipher block chaining
a stream cipher that consists of a number of different block sizes to encrypt one character at a time, bit by bit
cipher feedback
a standardized collection of algorithms that include an authentication method, encryption algorithm, message authentication code, and the key exchange algorithm to be used to define the parameters for security and network communication between two parties
cipher suite
Cloud providers, us charging methods that monetize the use of cloud services and assets. Not unsimilar to the charging methods utilized by utility companies, the cloud client pays for exactly what they use.
measured service
each node communicates with all of the other nodes. Mesh networks are redundant and usually very fast. They are referred to as "self-healing" because if one communication path fails, another communication path is immediately available
mesh technology network
every node is connected to every other node provides great redundancy and speed, usually at a very large expense
mesh topology
authentication and integrity verification mechanism similar to a hash code or message digest the sender encrypts a small block of data with a shared secret key
message authentication code
The output of a hashing algorithm that is always an established length based on the output specifications of the hashing algorithm
message digest
features the immediate writing of data to two different locations requires the use of two identical storage devices the most expensive type of backup/restoration system
mirrored backup
a corporate initiative that manages the growing use of Bring Your Own Device (BYOD) policies in the workplace. It addresses both the requirement of the organization for network security and the protection of corporate information as well as recognizing the desire for the organization's members to use their personal devices in the workplace
mobile device management
a site usually based in 18-wheeler trailers
mobile site
alternative processing plan ensures that an organization is split and divided amongst multiple physical locations instead of being housed in a single facility
multi-site
type of fiber-optic cable uses a much larger-diameter core than single mode. Light is allowed to refract and reflect, subsequently increasing the light degradation of signal loss. standard outer jacket color is orange
multimode fiber optic
attacks different parts of the host system, such as a boot sector, executable files, and application files. This type of virus will insert itself into so many places that, even if one instance of the virus is removed, many still remain
multipartite virus
five actions of an incident response plan
prevent, protect, detect, analyze, respond and resolve
activities used to avoid a threat
prevention
Three categories of of security
prevention detection and recovery
A term that describes the confidentiality of information in regards to peoples control over that information
privacy
10.0.0.0-10.255.255.255 172.16.0.0-172.31.255.255 192.168.0.0-192.168.255.255
private IP address ranges
cloud that is hosted within an organization and the general public is restricted from access.
private cloud
means a user or attacker acquires privileges they are not entitled to
privilege escalation
super-users or administrators who have an elevated level of rights, privileges, and access capability to applications and data
privileged account
network card is set in such a way that it accepts any packet that it sees on the network, even if that packet is not addressed to that network interface card.
promiscuous mode
test case, or prototype, is used to prove the veracity of an idea.
proof of concept
By encrypting a message with his private key, Bob has proven that he is the only person who could have sent the message. Logic follows that if Bob's public key can successfully decrypt the message, only Bob using his private key could have encrypted it. Therefore, only Bob could have sent the message
proof of origin
uses increased intelligence and packet inspection methodology to better protect the internal network. A ______ is always described as an intermediary between two systems, hosts, or networks. In effect, a ___________ isolates the internal network from the external untrusted network by intercepting communications
proxy firewall
Modern computers cannot create true random numbers. At some point numbers begin to repeat. Users of cryptographic systems must be very careful about the information source on which to base the random number generator.
pseudorandom number
hosted by cloud service providers and made available either as a free service or as a pay-per-use service
public cloud
consists of software, hardware, organizations, and trust architectures used to validate ownership of a public key by an individual or organization. effective because all of the parties involved trust the issuer of a digital certificate. The ownership of public keys is validated through the trust placed in a certificate authority.
public key infrastructure
this statement identifies a particular policy topic
purpose statement
a subjective valuation system in which asset value is determined based on other factors rather than accounting costs
qualitative risk analysis
a quality team tests how the application interacts with databases and other applications
quality acceptance testing
analyzing cost factors to determine the appropriate cost for protection of the asset, measured in $
quantitative risk analysis
concept takes advantage of the dual nature of light at the quantum level where it both acts as a wave and is a particle
quantum cryptography
a series of precomputed hash values along with the associated plaintext prehashed value Since passwords are stored on systems as hash values, if an attacker obtains access to the list of hashed passwords, they could process them against a _________to obtain the original password
rainbow table attack
pre-computed hash values intended to provide a reverse lookup method for hash values
rainbow tables
________________is the basis of most forms of cryptography. Without _________, most forms of modern cryptography would not be possible and cracking encryption would be significantly simpler. The use of ________________ increases the complexity of the ciphertext output. Thus it makes the act of cryptanalysis or cryptography cracking significantly more difficult. Without ___________, cryptography would be more predictable and thus much easier to break
randomness
malware often delivered through a Trojan attack that disables a system and advises the user to pay to release the system
ransomware
allows the subscriber to purchase additional capability based on user requirements
rapid elasticity
determine if the controls are installed and set up correctly, operating effectively, and meeting the risk mitigation requirements as established by the risk management plan for the system. (RMF)
step 4 assess
Authorization occurs when an acceptable level of risk is achieved based upon the implementation of controls. (RMF)
step 5 authorize
the ongoing assessment of the baseline operation of a control and its risk mitigation effectiveness (RMF)
step 6 monitor
the use of several storage servers managed and interconnected together to increase performance, capacity, or reliability
storage clustering
two major categories of data encryption for data-at-rest in the cloud
storage level encryption volume storage encryption
malicious code software that requires an action to reproduce. Usually attach themselves to executable programs and thereby reproduce and spread every time the executable is launched
virus
Typically email warnings concerning potential attacks. The spread of the email warnings actually creates a denial-of-service attack among many users
virus hoax
access control list that inspects data coming into a network, on a host computer, or currently in storage against a type of list called a signatures list
virus protection software
A specific identifiable string of characters that characterizes it as a virus or family of viruses
virus signature
usually carried out by sending a fake email that instructs the target to call a specific phone number
vishing
a technique of representing complex data in a visual form rather than a tabular form such as a list.
visualization
any flaw or weakness that may be attacked or exploited by a threat
vulnerability
provide the ability to scan a network and search for weaknesses that may be exploited by an attacker.
vulnerability scanner
The marking of symbols to advertise the availability of Wi-Fi networks and to indicate whether they are open
warchalking
The act of searching for wireless communications by driving through an area using antennas, software, and a portable computer
wardriving
a computer facility that is contractually available and has some power, heating, ventilation and air-conditioning, connectivity, and basic networking equipment.
warm site
all members have an equal share in trust relationship
web of trust
only entities such as a source address, a destination address, and a packet type may be allowed access. Anything not on the list is denied
whitelist
each node is immediately available and can forward messages to other nodes. Can be implemented in an ad hoc communication relationship.
wireless mesh network
data that is sitting in storage
data at rest
cryptography concept that is based on trap-door, one-way functions
Asymmetric
information confidentiality. It does this by enforcing security through two rules called no read up and no write down
Bell LaPadula
Uses the initials of the creators, Carlisle Adams and Stafford Tavares, and is available for royalty-free use symmetric algorithm
CAST
The version of Advanced Encryption Standard (AES) that is used by WPA-2
CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol)
paid to infiltrate systems, break applications, and create reports concerning their activities. These individuals conduct penetration tests under strict guidelines and contractual relationships for the benefit of their employer
CEH (certified ethical hacker), aka white hat hacker
involves the communication of a random challenge number from the server to the connecting client. The client then processes the random number along with the hash of the user's password to create a response. The response is sent to the server. The server computes the expected response. If the submitted response from the client matches the expected response exactly, then the user is authenticated
CHAP (challenge handshake authentication protocol)
three main components of a smart lock or an electronic access control (EAC) lock
Credential reader, locking mechanism, door closed sensor
Spreading knowledge and experience across multiple workers to perform mission critical tasks
Cross training
symmetric cryptographic algorithm broken in 1999 replaced by AES in 2002
DES (data encryption standard)
a different logical address is given to a host at each logon
DHCP (Dynamic Host Configuration Protocol)
allows users to apply encryption to individual files, directories, or the entire drive...........only available on hard drives and USB drives formatted with Microsoft New Technology Filesystem
EFS (encrypting file system)
the bulk encryptor of an IPSec VPN. Uses the keys managed by IKE
ESP (Encapsulating Security Payload)
the encryption mechanism in IPsec. It provides for a header and a trailer that encapsulates the packet. Within the header are various fields that include authentication as well as integrity for the packet.
ESP (Encapsulating Security Payload)
a contractual agreement presented when a software application is installed.
EULA (end-user license agreement)
Diffie-Hellman key exchange algorithm could be extended to support an entire public key cryptosystem used for encrypting and decrypting messages Advantage this had over RSA is that it was made freely available to the public
ElGamal
implemented by assigning a job name label to subjects
RBAC
replaced WEP in 2003
WPA
a physical asset
tangible
defines the identification, maintenance, and risk protection of hardware or information assets.
asset management
the cost (in dollars) that can be lost if a risk event happens
single loss expectancy
a technology that was implemented by Microsoft to customize controls, icons, and other features to increases the usability of web-enabled systems prescreened prior to downloading using Authenticode certificates to identify and authenticate the author
ActiveX
a list that specifies the actions that a user or system is granted to perform
ACL (access control list)
Rijndael cipher makes use of a 128-bit block size in three different wavelengths of 128, 192, and 256 bits symmetric algorithm
AES (advanced encryption standard)
responsible for establishing the initial connection and the authentication of end-points. Uses the keys managed by IKE.
AH (authentication header)
supports access control, packet origination authentication, and connectionless integrity.... used with IPsec and provides authentication of the sender as well as an integrity hash of the packet
AH (authentication header)
formula used to calculate the total amount of potential risk calculated for a single asset and a specific threat.
AV * EF * ARO
formula for calculating annualized loss expectancy
AV x EF x ARO = ALE
defines the acceptable use of organizational hardware and information assets
Acceptable use policy
OSI model
Application, Presentation, Session, Transport, Network, Data Link, Physical
What is the new technique of controlling access to the content of big data information collections?
Apply security controls to the output of data-mining operations.
an application that distributes the workload of processing the data across a large number of virtual machines
MapReduce framework
an individual at a certain security level may not read information at a lower level and the individual may not create (write) information at a higher level than their security level
Biba model
Provides good encryption rates with no effective cryptanalysis symmetric algorithm
Blowfish
if a business is providing different services for the same client, each branch or department is isolated from the other with no knowledge of the other departments' activities
Brewer Nash model
a program whereby the organization owns and controls the device while the user may use the device for personal purposes as well as business activities1
COPE
a document crafted and published by certificate authorities (CAs) which detail the standards, process, practices, and algorithms they use in their certificate operations
CPS (certificate practice statement)
evidence from the most volatile to the least volatile
CPU, cache, and register contents Routing tables, ARP cache, process tables, kernel statistics Random access memory (RAM) Temporary file system/swap space/page files Data on hard disk Network archive data/storage area networks/network attached storage Remote-based cloud storage Data contained on archival media, disk-based backup, tape-based backup, USB drives
Certificates that have been compromised or have expired are placed on __________
CRL (certificate revocation list)
a media access control protocol used to announce that a device is wishing to transmit on the media. The device will transmit or broadcast a tone prior to transmission. The tone is referred to as a jamming signal and will be received by all other devices connected to the media. After waiting a brief interval to ensure that all other devices are aware of the device's desire to transmit, the device begins transmitting
CSMA/CA
As in CSMA, a device may begin transmitting at the same time another device transmits. When this happens, two frames will be transmitted simultaneously and a "collision" will occur. Each of the two devices will wait a random period of time and then retransmit. The random timer prohibits each of the two devices from immediately retransmitting and causing a collision once again
CSMA/CD
This model enforces data integrity by checking, screening, or formatting data prior to it being placed in the object, such as a database
Clark Wilson model
levels included in the commercial business/private sector data classification
Confidential Private Sensitive Public
What makes up the CIA triad?
Confidentiality Integrity Availability
incident response information that should be recorded
Date and time of incident Type of incident or incident level Incident summary Incident discovery information Actions taken by individuals Contact information for individuals involved After-action report
The two participants each create two numbers. One number is kept secret while the other number is exchanged in the clear with the other participant. These numbers are used in the mathematical function and will result in both participants arriving at the same final number. The final number will represent a shared secret key.
Diffie Hellmann
a means by which a symmetric key is securely exchanged over an insecure communication medium when both sides of the communication do not have key pair sets
Diffie-Hellmann
based on a series of one-way operations that prevent any middle-man eavesdropping attacks from being able to predict the resultant exchanged symmetric key
Diffie-Hellmann
a program designed to change the risk culture from reactive to proactive and accurately forecast and mitigate the risk on any key programs
Enterprise Risk Management (ERM)
the first action to take during incident response?
Follow the procedures in the incident response plan.
EU law that is the successor to Directive 95/46 EC and is intended to unify the data protection personal information rights within the 28 European Union member states
GDPR (General Data Protection Regulation)
United States federal law concerning banking regulations, banking mergers and acquisitions, and consumer privacy regulations
GLBA (gramm leach bliley act)
a secret key is appended to the original message and then hashed by the sender. The original message and the _____ value are then sent separately to the receiver.
HMAC (keyed-hash message auth code)
Mali uses an authentication token that requires her to push a button each time she wishes to login to a system. What type of token is she using?
HOTP
stores and maintains data in a very large format system
Hadoop distributed file system
encryption progression for wireless products
Here is a simplified summary of the encryption progression for wireless products: Wired Equivalent Privacy (WEP) came first and was ultimately broken by a bad implementation of RC4. The Wi-Fi Alliance introduced Wi-Fi Protected Access (WPA) as an intermediate measure, which uses the Temporal Key Integrity Protocol (TKIP) for security. Wi-Fi Protected Access II (WPA2) replaced WPA and has become the IEEE 802.11i standard, which consists of the AES algorithm operating in counter mode and is referred to as the Cipher Block Chaining Message Authentication Code Protocol (CCMP).
security practitioner can send a ping message to a device to determine if it is working
ICMP (Internet Control Message Protocol)
submitted as a possible replacement for DES. It operates using a 120-bit key on 64 bit blocks. During encryption it performs eight rounds of calculations. It is currently unpatented and free for public use. symmetric algorithm
IDEA (international data encryption algorithm)
The IPsec protocol requires that a symmetric session key be available for encryption purposes.
IKE (internet key exchange)
component of IPSec that handles key generation and distribution
IKE (internet key exchange)
a versatile Internet security protocol that is based on an established connection from host to host in transport mode or network to network in tunnel mode can provide communications between two hosts (transport mode), between two security gateways or routers (tunnel mode), and between gateway and host (network to host) Often used with tunneling protocols like L2TP to provide encryption
IPsec
address space of 32 bits vs an address space of 128 bits
IPv4 vs IPv6 addresses
component of IPSec which provides for the support of multiple simultaneous VPNs
ISAKMP (Internet Security Association Key Management Protocol)
examines products and approves them based on testing
ISO
a group of standards that offers guidance to IT security management organizations
ISO 27000
a security code of practice and guidelines for IT security management
ISO 27002
a framework based upon a broad scope of various factors within the organization
ISO 27005
primarily monitors the organization's applications, databases, websites, servers, and networks
ISOC (information security operations center)
adds to the power of a password or key so that the same text encrypted by the same key will not create the same ciphertext. It creates complexity during the encryption process.
IV (initialization vector)
the cloud provider supplies the capability of creating cloud based networks utilizing standard or virtualized networking components
IaaS
the practice of applying certain policies during the creation and maintenance of information
Information Life Cycle Management
the guarantee that the user or subject has been proven to be who they say they are
assurance of accountability
By design, these are always created in a sandbox in which to execute an __________ on a client machine. This prohibits the _________ from being able to attack either the host machine or an application.
Java Applets
download into a sandbox and execute in a protected environment where they cannot affect the underlying applications or hardware environment
Java Applets
Periodically changing roles to prevent one person from having full control of a critical position
Job rotation
security procedures for every network device
Keep the firmware upgraded Change the default password Use advanced configuration settings Establish a baseline Create configuration backups
allows single sign-on in a distributed environment. An attractive feature is that it does not pass passwords over the network. The design is also unique in that most of the work is provided by the host workstations and not the server. uses a key distribution center (KDC) to maintain the entire access process the KDC authentication server authenticates (steps 1 and 2) the principal (which can be a user, a program, or a system) and provides it with a ticket-granting ticket, or TGT (step 3). After the ticket-granting ticket is issued, it can be presented to the ticket-granting server, or TGS (step 4) to obtain a session ticket to allow access to specific applications or network resources The ticket-granting server sends the user the session ticket granting access to the requested resource (step 5). The user then presents the session ticket to the resource requesting access (step 6). think of the amusement park example; buy a ticket to get in, then buy ticket to ride rides etc.
Kerberos
Microsoft and Cisco have reached an agreement to combine their respective tunneling protocols into one protocol.....a combination of PPTP and L2F.........does not provide security encryption, so it requires the use of such security protocols as IPsec to provide end-to-end or tunneling encryption.........uses UDP and port 1701 for connections.
L2TP (layer 2 tunneling protocol)
a standardized directory protocol that allows queries to be made of a directory database. microsoft implementation is Active Directory (AD). operates at port 389
LDAP (lightweight directory access protocol)
was created by Cisco as a method of creating tunnels that do not require encryption. Used primarily for dial-up connections......provides authentication only.......uses port 1701
LDF (layer 2 forwarding)
TCP/IP aka
Link - physical and data link Internetworking - network Host-to-host - transport Process - session, presentation, application
a perpetrator will bring something to the scene and take something with them when they leave
Locards principle
controls to keep digital threats at bay
Logical Access Control
A term that refers to the minimum amount of people to perform a highly sensitive action.
M of N control multiple agents with the capability (M), and the minimum number of these agents (N) in order to perform the task
determines which objects a subject can access through the use of classification labels
MAC (mandatory access control)
physical address of the directly connected device and consists of a manufacturer's identification as well as a unique number identifying the device
MAC address (media access control)
a method whereby known MAC addresses are allowed and those that are not wanted are not allowed on the network sometimes used as a method of determining which Wi-Fi user may enter a network. Because Mac addresses can be spoofed, it is not 100 percent reliable
MAC filtering
very large geographic network that connects groups of smaller networks or connects directly to end users
MAN
a tool that can scan a system and find missing updates and security misconfigurations. It can be used to determine the security state of a PC in accordance with Microsoft security recommendations and offers specific remediation guidance
MBSA (Microsoft baseline security analyzer)
the transfer of data to, from, and between clouds securely and reliably regardless of data file size
MFT (managed file transfer)
a collection of information stored in a database of network devices such as routers, switches, and servers and can be accessed using SNMP
MIB (management information base)
an agreement between parties as to facts, conditions, parameters, or intents. However, it is not a legally binding contract
MOU (memorandum of understanding)
what is the best security mechanism to minimize risk when browsing the Internet
Minimizing support of mobile code
a technology that uses a set of protocols to enforce a policy for endpoint access to a network
NAC
will quarantine any system that is out of compliance with the baseline established for the network
NAC (network access control)
used to extend the number of usable Internet addresses. primarily performed by a firewall or router at the boundary or outer parameter of the network. The firewall or router translates the extra traffic IP addresses to a nonroutable internal IP address.
NAT (network address translation)
a popular vulnerability scanner that checks for misconfigurations, default passwords, and the possibility of hidden denials of service. In operation, determines which ports are open on the target and then tries various exploits on the open ports.
Nessus
software application for probing computer networks, providing detection and discovery of hosts and services running on ports, and determining operating systems. In operation, sends special packets to target nodes and analyzes the response.
Nmap
Internet protocol used to determine the status of a certificate. At any time a party to a transaction may verify the status of a certificate by issuing a request to a _____ server
OCSP (online certificate status protocol)
provides a variety of services so that the application data can be transmitted across the network. This layer may also provide access control methodology, such as identification, authentication, and availability of remote applications; hashing for integrity; and the checking of digital signatures.
OSI Application Layer 7
addresses traffic to a physical link address......... switches operate here.......data information is formatted as frames.......concerned with directing data to the next physically connected device.
OSI Data Link Layer 2
determines the routing of data across a network utilizing a logical address referred to as an Internet Protocol (IP) address devices such as routers read the destination IP address and make use of a routing table on the router to determine the next device in the network to send the packet....moves data as packets
OSI Network Layer 3
All of the physical connections to the network are found at this layer...........All data is represented by bits; and the 1s (ones) and 0s (zeros) become a voltage or flash of light or maybe even a modulated radio signal............cables, connectors, interface cards, network taps, hubs, fiber-optic cables, and repeaters operate at this level..........where we connect everything together using wires, radio signals, or fiber optics.
OSI Physical Layer 1
sometimes referred to as the translation layer because of the change in data at this layer..........For instance, an IBM application may provide data which is formatted using the Extended Binary Coded Decimal Interchange Code (EBCDIC). The receiving application may require the data to be presented to it in American Standard Code for Information Interchange (ASCII) code
OSI Presentation Layer 6
maintains an open logical communication line between the two host machines. The analogy may be similar to maintaining an open telephone line
OSI Session Layer 5
moves data packaged in segments..........provides end-to-end and reliable communications services and includes error detection and recovery methods. Two primary protocols are utilized at this layer; UDP and TCP.........if one host machine receives a message that it does not understand, it can request for the information to be resent
OSI Transport Layer 4
may also be used to hide the internal network. Where NAT can use a number of public IP addresses, this uses a single external address and shares the port with the entire network. Because it uses only a single port, it is much more limited and typically used only on small and home-based networks
PAT (port address translation)
provides for e-mail confidentiality through random symmetric keys and use of public keys
PGP (pretty good privacy)
supports encapsulation in a single point-to-point environment a favorite protocol for network communications, one of its major weaknesses is that all channel negotiation is done in the clear. After the tunnel is created, the data is encrypted. Developed by Microsoft, it is supported on most of the company's products. It is assigned to port 1723 and uses TCP for connections
PPTP
provides the user with a virtual computer
PaaS
restrict access to physical components
Physical Access Control
A measure of satisfaction of the overall user experience of the computer network or transmission medium refers to the prioritization of some packets over others. This affects the quality and user experience with regard to VoIP and multimedia on a congested network
QoS
What standards-based technology is supported on most platforms and is used as a remote authentication service
RADIUS
a protocol and system that allows user authentication of remote and other network connections
RADIUS (Remote Authentication Dial-In User Service)
a method of storing data across several different hard disks. Using this system, data is written to a series of hard disks in such a manner as to provide either speed or data redundancy
RAID (redundant array of independent disks)
This configuration stripes data across multiple hard drives. The benefit is speed and access. There is no data redundancy
RAID 0
This configuration features writing identical data to two different storage locations such as cloud storage or local hard drives. It offers a simple data redundancy configuration by having identical information written to two different locations
RAID 1
This configuration stripes data across multiple disk drives at the bit level. It is difficult to implement and generally not used.
RAID 2
This configuration stripes data across multiple drives at the bit level and uses a separate disk drive for the parity bit. This RAID level is rarely used.
RAID 3
This configuration is similar to RAID-3, but it stripes data across multiple drives at the block level. It also uses a separate disk for the parity bit. very rarely used in a production environment
RAID 4
Uses a technique of striping data across multiple drives and incorporating the parity bit on each of the drives. If a drive fails, the data may be reconstructed using the data and parity bit contained on the other drives. A minimum of three drives must be used in this implementation.
RAID 5
Using this technique, the system writes data to separate hard disk drives. Requires writing data to two disks at the same time.
RAID mirroring The advantage to mirroring is data redundancy. The disadvantage is that both drives must write at the same time, thus reducing the writing speed
performed by adding a separate bit to the data to provide data integrity
RAID parity
a method of writing information to all disks at the same time
RAID striping The advantage of striping is speed because a part of the information is written to each disk at the same time
very popular software stream cipher was the backbone of several encryption protocols, including SSL/TLS, Wired Equivalent Privacy (WEP), and Wi-Fi Protected Access (WPA). has known weaknesses and major organizations have recommended disabling it symmetric algorithm
RC4
Consists of a variable block size of 32, 64, or 128 bits and a variable key length from 0 to 2040 bits symmetric algorithm
RC5
routing protocol that makes routing and forwarding decisions based on a metric derived from the number of other routes than must be crossed to reach a destination
RIP (routing information protocol)
part of a business continuity plan. It is the date or time of the last known good data that can be used as a backup to restore systems
RPO (recovery point objective)
the amount of data loss that can be experienced before the loss is too great to survive as an organization
RPO (recovery point objective)
the estimated time by which the affected process will be restored. or used to determine the maximum time a data recovery process will take.
RTO (recovery time objective)
What is the best means to restore the most current form of data when a backup strategy is based on starting each week off with a full backup followed by a daily differential?
Restore the initial week's full backup and then the last differential backup before the failure.
a commercially available network security scanner that provides advanced vulnerability scanning across the network, the Web, and virtual and database environments. Used to continually monitor the network environment, it may be used to detect vulnerabilities on a real-time basis and recommend remediation based on risk analysis of critical assets.
Retina
provides end-to-end protection of email messages
S/MIME
provides each party with the symmetric session key. Each party will also agree upon the encryption algorithm to be utilized during the session.
SA (security association)
a security clearance stating you are part of a special program that has highly sensitive information
SAP (special access programs)
a security clearance stating you have been "read on" to a specific information set
SCI (sensitive compartmented information)
refers to the virtualization of networking, which grants more control and flexibility over networking than using the traditional hardware-only means of network management
SDN (software defined network)
a virtualization methodology in which the actual data flow across the network is separated from the underlying hardware infrastructure and allows networks to be defined almost instantaneously in response to consumer requirements.
SDN (software defined networking)
the central operational application that allows network administrators to design the virtualized network system using underlying hardware infrastructure
SDN controller
SHA-224, SHA-256, SHA-384, and SHA-512
SHA-2 family members; each includes the hash digest bit length output in their name, SHA-3 is the same way and with the same bit length numbers
provide real-time logging and analysis of security events
SIEM
software products are combined with hardware monitoring devices to provide real-time analysis of security alerts
SIEM (Security Information and Event Management)
detailed view of the network device(s) monitor network usage and performance, user access, and detect potential or existing network faults
SNMP (simple network management protocol)
when enabled, collects the management information database from the device locally and makes it available to the SNMP manager when it is queried
SNMP agent
a computer that is used to run one or more network management systems
SNMP manager
a document issued by NIST with recommendations and guidance for federal agencies.
SP (special publications)
a unique value assigned to a communication between two parties. It is a tag that identifies preselected encryption rules and algorithms when more than one transmission session is being conducted.
SPI Security Parameter Index
a tunneling protocol that uses encryption to establish a secure connection between two systems........provides an information exchange protocol for such standards as Telnet, FTP.........assigned to port 22 and uses TCP for connections
SSH (Secure Shell)
a form of VPN based on a Transport-layer standard for encryption that is commonly used for Application-layer protocol protection
SSL VPN
utilizes symmetric cryptography after a handshake session during which secure key material (a random number) is sent from the client to the server using the asymmetric public and private keys of the server. The SSL/TLS communication is always set up between the server and the Internet browser on the client.
SSL and TLS (successor to SSL)
makes available a software application that is hosted on a remote server and made available on demand by the user
SaaS
component of the trusted computing base consisting of hardware, software and firmware elements that implements an authorized control list (ACL) database
Security Kernel
Which disaster recovery/emergency management plan testing type is considered the most cost-effective and efficient way to identify areas of overlap in the plan before conducting a more demanding training exercise?
Structured walk-through
4 components of a public key infrastructure implementation
Symmetric encryption, asymmetric encryption, hashing, and digital certificates
operates in a similar manner to RADIUS. It is a central point for user authentication.....widely implemented by Cisco
TACACS+ (Terminal Access Controller Access Control System)
referred to as connection-oriented because it provides guaranteed and reliable communication between devices on the network. requires that the receiving host acknowledge every packet that it receives. Packets may be received out of order and may be re-sequenced by the receiving host
TCP (transmission control protocol)
utilizes a dynamically changing 128-bit key for every packet
TKIP (temporal key integrity protocol)
dedicated microprocessor that is mounted on a device's main circuit board and serves as a cryptoprocessor provide services for: Trusted Boot Protection Encryption Key Storage Password Protection Device Identification
TPM (trusted platform module)
three-way handshake used for a TCP session
The first step of the handshake is where the host sends the server a packet with the SYN, or synchronize, flag turned on or "set." The server responds with a packet that has both the acknowledgment ACK and SYN flags set. Finally, the host responds with a packet that has the ACK flag set. At this point, the TCP session has been established
What is the prime objective of code signing?
To verify the author and integrity of downloadable code that is signed using a private key
Access control which prevents one person from performing an action by separating each task i.e. two people needing to turn a key at same time in order to launch a missile
Two man rule
Uses 128-bit blocks in a key structure of 128, 192, or 256 bits, and is less popular than Blowfish symmetric algorithm
Twofish
referred to as a connectionless protocol. Connectionless refers to sending information without first verifying that the connection exists between the hosts ideal for transmission of voice or media
UDP (user datagram protocol)
may be considered as a network of interconnected hosts that act as if they're connected physically even though there is no such connection between them. differ from subnets in that they do not provide security
VLAN
VLANs that are created through a switch are not natively secure because the data within one VLAN could possibly be exposed to other network segments. Attack that could be the result of this
VLAN hopping
the result of an attack upon a virtual machine whereby the attacker is successful in bouncing out of or escaping the virtual environment and controlling the hypervisor
VM escape
a private network connection that is established through a public network
VPN
a converged network communications concept includes support for real-time chat, video conferencing, voice and video mail, and file exchange
VoIP
used to regulate traffic to and from web servers and specialized web applications. It utilizes specialized rules such as content filtering, access control, and intelligent rulesets that are customized specifically for the web application operates at layer 7 of OSI model protects against content-based attacks such as cross site scripting (XSS), injection attacks, and HTTP forgery attacks.
WAF (web application firewall)
a network node that converts wired network packets into wireless communications. They may be mounted on ceilings, on walls, or on desktop devices.
WAP
used to mitigate the possibility of rogue access points
WIPS (wireless intrusion prevention system)
used to mitigate the possibility of rogue access points in wireless deployments
WIPS (wireless intrusion prevention system)f
utilizes standard short-distance cellular radio transmitters, receivers, and transceivers (cellular telephones, laptops, and cellular-enabled devices) to communicate to wired LANs through access points
WLAN
utilizes radio transmitters and receivers to communicate to wired LANs through access points or directly to wireless endpoints. eliminates the requirement for the leased lines of a MAN
WMAN
uses Advanced Encryption Standard (AES) as the encryption algorithm utilizes AES operating in counter mode with a 48-bit initialization vector. A significant cryptoanalysis Work Factor (WF) is required to brute-force crack the algorithm password release in 2004
WPA2
utilizes standard cellular radio transmitters, receivers, and transceivers (cellular telephones, laptops, and cellular-enabled devices) to communicate to wired LANs through access points or directly to wireless endpoints
WWAN
intended as a much stronger and robust geographically based system covering a much larger physical area than Wi-Fi covers
WiMAX
certificate standard used by PKI
X.509 v3
specifies a standard for the public key infrastructure Certificate revocation lists as well as the structure of a trusted system of certificate authorities are included in _________
X.509 version 3
managed device
a part of the network that requires some form of monitoring and management, such as, for example, routers, switches, servers, workstations, printers, UPSs, and other devices
the main benefit or distinction of symmetric encryption
a single shared key can perform both encryption and decryption operations
determine if the current account access rights and privileges match the current role and requirements of the existing position
account audit
a procedure undertaken immediately upon resignation or termination of an account owner
account deactivation
an organized disassembling of rights and privileges of the user account
account deprovisioning
refers to the access enabled or available for any user account
account entitlement
verifying that the account belongs to the stated individual through the use of various authentication tests and audit techniques
account proofing
verifies that only the authorized person is able to use a specific user account
account/identity proofing
this statement identifies who are responsible for compliance
accountability statement
form of monitoring which involves the injection of packets into communications in order to measure performance of various elements in the network
active monitoring
provides for communication between two or more endpoints where no centralized access point is involved
ad hoc mode
refers to continuous hacking processes often carried out by rogue governments or nation states against other nations, organizations, or large businesses
advanced persistent threat
a type of spyware that, while making an advertising statement or showing a banner, solicits clicks from the end user. When the user clicks the banner, a Trojan or virus is be downloaded immediately, infecting the user's machine
adware
a networking term that describes how an internal network can be totally isolated from the outside world. With no connections in or out of it, there is a complete isolation zone around the network perimeter
air gap
refers to the technique of maintaining a host, network, or electronic storage mechanism that is physically separated from the outside world (Internet) by not having any inbound or outbound connections
air gap
a mathematical function that produces a binary output based on the input of either plaintext or ciphertext
algorithm
constructed in such a manner as to be highly resistant to removal by anti-malware software
armored virus
should be no closer to the original site than 20 miles
alternate site proximity
the total cost (in dollars) for all of the SLEs occurring during the year
annualized loss expectancy
the probability of an event occurring during a year. 100% is equal to one even a year
annualized rate of occurrence
the best answer for the security tool which is used to detect KNOWN examples of malware
anti-virus/anti-malware software
log contains various events logged in real time by applications, databases, or other programs. It is generated by many applications that will be recorded in the application log
application log
utilizes two keys: a public key and a private key. Either key can be used to encrypt or decrypt a message. A message encrypted with the user's public key can be decrypted only by the user's private key and vice versa. This process is very slow
asymmetric algorithm Rivest, Shamir, and Adleman (RSA) Diffie-Hellman ElGamal Elliptic curve cryptography (ECC)
two different but mathematically related keys are used. Each user has both a public key and a private key. The private key can be used to mathematically generate the public key. This is a one-way function. It is mathematically infeasible to determine the private key based only upon the possession of the public key. On many occasions, both keys are referred to as a key pair. It is important for the owner to keep the private key secret
asymmetric key
Digital certificates are based on what type of cryptography?
asymmetric public key
SQL injection
attacker inserts a SQL escape character, a combination of SQL characters, or part of the SQL script into a website form field. If the form field offers limited data validation, the insertion may return database information or an error code, which may be useful to the attacker.
this statement identifies a target group
audience statement
offer crucial information about the actions and activities on an organization's network
audit logs
What security task is performed when a CA issues a certificate?
authentication
represents the source of information presented for either identification or authentication
authentication factor
what mechanism performs identification claims?
authentication factor
makes or defines the determination as to what attributes of a subject or object determine whether access is granted or denied
authorization policy
this statement identifies the individual responsible for the policy
authorization statement
originally allowed the programmer access to the application around the normal access controls Usually delivered by Trojan malware, a Trojan payload installs a malware application that creates the ___________ or access port, for the attacker.
backdoor
term used when LIMITING the amount of network traffic a specific protocol or application is allowed to generate or consume in order to keep the remainder of the network's capacity for other communications
bandwidth throttling
Data transmitted that occupies the entire frequency range of the media. No other data is transmitted concurrently.
baseband
an established criteria for measuring normal events as well as normal activity and traffic on the network
baseline
A baseline may be established as the normal or minimal criteria that must be met by the policy.
baselines
Systems that allow public access and that are hardened against attack
bastion host
IDS and IPS utilize four methods of network monitoring
behavior based detection signature based detection anomaly based detection (similar to behavior based) heuristic based detection
detection mechanism that recognizes various software behaviors and matches them to a library of expected behaviors of known harmful software
behavorial-based detection
primarily against a hash value in that it is easier and faster to determine collisions based on two plaintext messages equaling the same hash value than it is trying to determine the original plaintext for a given hash value. This attack relies on the statistical probability that two events will happen at the same time and that it will be faster to achieve a result using that method rather than having to exploit every possibility such as using brute force
birthday attack
ensures that every bit is recorded correctly during an investigation
bit copy software technique
Prior to analysis, data should be copied from a hard disk utilizing....
bit-by-bit copy software
everything you wish to deny must be listed
blacklist
An algorithm that works on a fixed block of characters. Generally utilize standard block sizes such as 128, 192, 256, or 512 encrypts one entire block at a time
block cipher (block algorithm)
A form of a Bluetooth attack in which the attacker accesses and uses all phone features.
bluebugging
Uses Bluetooth to send unsolicited messages to Bluetooth-enabled devices such as mobile phones, tablets, and laptop computers.
bluejacking
The unauthorized use of Bluetooth to access information from a wireless device.
bluesnarfing
This type of virus infects the storage device's master boot record
boot sector virus
term used in virtualization to describe a networking configuration for guest OSes
bridging
Cloud services, whether private cloud offerings within an organization's IT department, non-fee-based free public clouds, or subscription-based services offered by large cloud providers, all include ease of access and use normal network connections
broad network access
popular with cable television and networking providers, is used to multiplex a very large number of signals on a single media.
broadband
all possible keys are tried until one is found that decrypts the ciphertext
brute-force attack
occurs when more data is placed into a memory location, referred to as a buffer, than the memory location can accept
buffer overflow
one of the earliest and most commonsense designs for local area network layout and design. Featured terminators at each end, and computer hosts as well servers were connected to the wire through what was known as "drops."
bus topology
a set of procedures, programs, and supporting plans that have been established to maintain the operations of the organization in the event of disruption or interruption
business continuity plan
first step in creating a business continuity plan. all assets are identified and possible threats categorized performed to determine the resulting impact to the business of the full or partial loss of an operational functional unit of the business
business impact analysis
the threat evaluation process performed when designing a business continuity plan (BCP) or disaster recovery plan (DRP) evaluates risk in light of work process and is similar in nature to the technique used when designing security policies
business impact analysis
How does IPSec verify that data arrived at the destination without intentional or accidental corruption
by using a randomized hashing operation known as HMAC. Hash-based Message Authentication Code (HMAC)
responsible for the actual transmission of traffic to the next device along the path toward the destination. The ___________ is also known as the forwarding plane. The ____________ is the actual transmission of packets through a router or switch
data plane
If you need to change cloud systems, this allows you to extract your data from one system and import it into another
data portability
every server or application is required to verify the identification and authentication of the user requesting access
decentralized authentication
The end user's private key is always kept private, so they are the only entity in possession of it.
decentralized key management
the art and science of reading various dots and dashes produced by an electromagnetic Morse code receiver or by visually identifying flag signals or flashing signal lights
decoding
Ciphertext is processed through an encryption algorithm using a reverse process, which results in plaintext
decryption
the use of multiple devices from different vendors to enhance security
defense diversity
refers to the use of a number of controls placed in sequence through which a threat must penetrate.
defense in depth or layered security
A term that describes the violation of non-repudiation
deniability
this statement identifies the items and actions directed by the policy
detail statement
activities used to identify a threat
detection
What is the primary benefit of a security camera for physical security
detective
commonly used in a brute-force attack against passwords
dictionary attack
A full backup may be created once a week, then daily backups must be made of the transactions for each day. But this type of backup records all of the transactions since the full backup
differential backup
the study of changes in information as it is processed through a cryptographic system
differential cryptanalysis
increases the complexity of an encrypted message. process of encryption in which the entire hash output for each character modification of the original message is changed
diffusion
created when a subject's public key is signed by a CA's private key
digital certificate
Would you agree with me that if a public-key is public, therefore anyone can access it? Also, if there is a piece of information that everybody can access, doesn't it therefore make sense that someone might be able to fake this piece of information? This is the exact problem that we have in public-key cryptography, which uses both public and private keys. What if Amazon wasn't really Amazon, or Sears wasn't really Sears? The question is, how do I know that you are the real owner of the public key? There must be some way of branding your name on a public key so that absolutely, without a doubt, it links you or "binds" you to that key. There should be no doubt that you own that key
digital certificate these certificates solve this problem A digital certificate is like a notary public of the cryptographic world. A third-party verifies that the public key is yours and that you are in fact you. As long as everyone trusts this third party, the system works.
the primary method of authentication in a typical PKI deployment
digital certificates
widely used to sign messages. Provides both proof of origin (and therefore nonrepudiation) and message integrity does not provide confidentiality
digital signatures
identification data that is covertly included in either image data or audio/video data. May be used to verify the authenticity or integrity of an object file or to indicate the identity of the owners
digital watermark
Designed to force or direct a radio signal in one direction.
directional antenna
a type of web attack using HTTP in which the attacker escalates their privileges to climb to a parent directory, or higher-level directory, out of the original website directory
directory traversal
a documented set of procedures used to recover and restore IT infrastructure, data, applications, and business communications after a disaster event
disaster recovery plan
What is the type of access control in the default access control method found in Microsoft Windows which allows users to share files?
discretionary access control
features two extensions within a filename, but only the final file extension is operative
double file extension attack
attackers have already identified the target and either jam the target with powerful conflicting signals on the 2.4 GHz and 5.0 GHz bands, thus disrupting communications, or attempt to intercept communications
drive-by attack
an access mechanism whereby two individuals must work together to gain access
dual control
contains two network interface cards (NICs), one connected to the external network and one connected to the internal network
dual-homed firewall *dual or multihomed always refers to the use of two or more network interface cards on a device
ensures an activity is performed correctly
due diligance
Ports 49152-65535
dynamic or private ports
dynamically detect malware and are described as an anti-malware protection system...........used to monitor and protect network, email, endpoint, mobile, and content assets
dynamic threat analysis appliance
a legal tool used by opposing counsel to obtain requested information that may contain evidence or other useful information for a lawsuit. It is not the information itself. It is the process of obtaining the information
eDiscovery
the legal process by which law enforcement officials, including attorneys, can make formal requests, sometimes with a search warrant, to obtain digital information in relation to a legal action, investigation, or court proceeding
eDiscovery
a block cipher mode that uses very short messages usually smaller than 64 bits
electronic codebook
another name for transmitting data offsite to either a physical storage location or a cloud storage location
electronic vaulting
detection of potential threat realization (i.e. compromise attempts)
elevated
a method of applying discrete logarithm mathematics in order to obtain stronger encryption from shorter keys using this method an RSA 160-bit key provides the same protection as an RSA 1,024-bit key.
elliptic curve cryptography
the act of placing restricted data inside a larger packet and placing a special destination address on the packet so that it may be routed to the intended receiver
encapsulation
the action of changing a message from one format to another using a coding method. i.e. alphabet represented by 1's and 0's in ASCII or dots and dashes using Morse code
encoding
he process whereby ciphertext is created by processing a plaintext message through an encryption algorithm and utilizing an encryption key and possibly an initialization vector that results in encrypted text
encryption
the most important concern when using a cloud solution as a component of a backup strategy
encryption of transfer and storage
the process of taking a deliberate action to permanently remove or destroy the data stored on a storage device
endpoint data sanitiztion
consists of an endpoint-mounted firewall, host intrusion detection systems (HIDSs), and antivirus software
endpoint defense
this statement identifies the consequences of violating the policy
enforcement statement
a one-time key generated at time of need for a specific use or for use in a short or temporary time frame.
ephemeral key
a data storage and data identification technology used to provide high-availability and data reliability to cloud-stored data. Like RAID but in the cloud
erasure coding
The frequency of these errors (false positive, false negative) is referred to as an error rate
error rate
any observable occurrence in a system or network
event
stores cookie data in several locations the website client can access. Should cookies be cleared by the end user, the data can still be recovered and reused by the website client
evercookie
a rogue Wi-Fi access point that appears to be a legitimate access point that is part of an enterprise network on the premises but has actually has been set up to eavesdrop on wireless communications.
evil twin
part of the router that receives arriving packets and routes them through an output interface to the destination address. Utilizes destination addresses obtained by the control plane and maintained in routing tables
forwarding plane
the study of how often various characters show up in a language
frequency analysis
the contiguous copy of the entire system and data
full backup
a complete power up of an alternate site, switch over and power down of the primary site
full interruption test
features full-time members who respond to incidents on a daily basis. Very large corporations, financial institutions, banks, and other organizations require full-time response teams based on the frequency of incidents
full time incident response team
address specific issues or concerns of the organization. They may be used to define requirements related to particular areas of security, such as access control, acceptable use, change management requirements, hardware and software updates, and other operational concerns. An example of a functional policy is a Bring Your Own Device (BYOD) policy
functional policy
report to other managers and departments throughout the organization and become members of incident response teams when they are required
functional response team
accepted or tolerable risk
guarded
suggested steps for performing a task that leave room for discretionary judgement
guidelines
a broad term that can refer to individuals who only want to disrupt normal operations to terrorists waging a type of cyber war against a target and anything in between
hacker
a person or group that exploits a weakness in technology in order to draw attention to a personal message or agenda
hacktivist
A one-way mathematical algorithm in which a hash value or message digest is a fixed-size output.
hash function
When crafting a digital signature, what are the initial steps in the process performed by the sender
hash the message and then encrypt the digest with the private key
type of cryptography that does not use an encryption algorithm a one-way function cannot be used in a reverse function to derive the original document always produce a fixed-length output regardless of the size of the original document provides message integrity
hashing
A learning and statistical assumption technique used in making very fast decisions with relatively little information.
heuristic-based detection
trust relationship with a top entity and subordinates
hierarchical trust
a method whereby numbers of host machines may be logically or physically connected so that all of their resources (such as CPU, RAM, hard drive, and network communications capability) can be shared among all of the hosted virtual machines
host clustering
a patch that can be applied to piece of hardware or software without the requirement to power down or reboot the product
hot patch
a fix that may be applied to a piece of hardware or software that is currently online and in use
hotfix
a physical location available for immediate switchover of processing operations
hotsite aka backup site
consist of combining two forms of cloud deployments offer a great degree of flexibility to an organization
hybrid cloud
based upon initializing an encrypted session utilizing asymmetric encryption to encrypt and send a symmetric key to the other party both asymmetric cryptography as well as symmetric cryptography are used in the same encrypted session
hybrid cryptography
consists of wireless devices connecting to an access point that then interfaces with a standard wired network.
hybrid wireless network
a means to encapsulate SCSI signaling into an IP packet in order to traverse a standard IP network rather than a traditional SCSI ribbon cable
iSCSI (IP Small Computer System Interface) iSCSI is to SCSI as VoIP is to telephones.
the best means of risk mitigation
implementing safeguards
a type of access rule that states that if a subject is not listed on the access control list, access is denied. This type of rule is usually at the bottom of the rules list in either a router or a firewall. Its purpose is to act as a catchall
implicit deny
the catchall that prohibits the passage of anything that has not been ethically or explicitly authorized.
implicit deny
the most important foundational security concept upon which most other security ideas and solutions are based
implicit deny
refers to anti-malware that has been released onto the Internet. Imagine that this malware is roaming free and is being exchanged through unsuspecting host relationships, indiscriminate clicking email links, and other types of actions that spread the malware through the Internet.
in the wild
refers to transmitting, or sending, a key over the existing communication connection. Eavesdropping and man-in-the-middle are typical attacks on key exchanges
in-band key exchange
an event with the potential to cause harm to the organization. Usually considered an intrusion by an outside force, but it may also be caused by an internal user. May also be intentional or unintentional.
incident
a set of established responsibilities, criteria, and procedures to be initiated upon the discovery of an incident. Involves the IT assets of an organization
incident response plan
defines how an organization will respond to security violations and intrusions
incident response plan
an assortment of multidisciplined individuals from across the organization who aid in the mitigation of harm and the containment of an incident.
incident response team
daily backups are stored in separate files In the event of a restoration, each of the files must be added to the others and finally to the full backup to form a contiguous data file containing not only all of the existing information from Sunday but also the information from the rest of the week.
incremental backup
worse than no countermeasure at all because it provides a false sense of security
ineffective countermeasure
risks to IT hardware, software, and information assets are identified and threats and vulnerabilities are reduced to an acceptable level
information risk management
standard also provides for the communication of numerous wireless devices connecting through network access points (APs)
infrastructure mode
an unencrypted random number that is used to create complexity during the encryption process.
initialization vector
used as common components of encryption algorithms because they increase the chaos in encrypted output
initialization vector (IV)
all of the items that must be considered, such as laws, policy, goals and objectives, availability, costs, and other input
input constraints
may be performed by a disgruntled employee, third-party contractor, or anyone with direct inside access to an organization's network or host workstations
insider attack
a nonphysical asset
intangible
access control list tool that inspects packets on a network, and takes a predetermined action to stop the attack
intrusion prevention system IDS and IPS have become one HIDPS and NIDPS
means that all of the devices on the wire or network are transmitted the same time. has no mediating controller and therefore is called contention-based access and nondeterministic. It is the least effective of any of the transmission protocols because none of the devices have any means of determining when to transmit data.
multiple access
Most often describes multiple virtual machines residing on one host. In cloud hosting, the virtual machines may not be owned or controlled by the same organization. can also refer to several users accessing a single instance of an application or virtual device.
multitenancy
requires both entities to prove themselves to each other simultaneously
mutual authentication
Countries around the world that sponsor cyber terrorism may plant advanced persistent threats (APTs) in foreign government or foreign commercial enterprises for intelligence gathering purposes. Cyberwarfare is a term to describe these activities
nation state
How is granular control of objects and resources implemented within a mandatory access control environment?
need to know
In organizations that enforce _________________, individuals are not automatically given access to sensitive information simply because they possess the appropriate security credentials and clearance. It is based on a case by case basis
need to know
Subjects cannot read information classified at a higher level than theirs
no read up
a method of asserting that the sender of a message cannot deny that they have sent it assertion is created by associating something that only the sender possesses, for example, their private key
non-repudiation
standard benign operations
normal
5 levels of risk
normal - standard benign operations guarded - accepted or tolerable risk elevated - detection of potential threat realization (i.e. compromise attempts) substantial - security violations have occurred, but have not interrupted mission critical functions severe - mission critical functions have been significantly affected or interrupted
Information concerning network operation data volume and other considerations is communicated from the hardware layer to the applications and business logic. This allows operators to monitor network operations.
northbound APIs
"monitor" an attack while it's in progress
not advisable to do this, the organization could face legal consequences. Incident response activities should start immediately after an incident has been discovered
What is the purpose of a baseline in relation to security monitoring?
notices trends away from normal
the (passive) resource or asset of which a subject is requesting access. These roles may change or flip..
object
an object such as a document is labeled (classified) in some manner to illustrate the status of the information. For instance, it may be labeled company confidential, sensitive, or unclassified
object classification
Designed to provide a 360° pattern and provide an even signal in all directions
omnidirectional antenna
When should security training take place
on hire and yearly
Users can subscribe to services by simply selecting from cloud provider menus
on-demand self service
The concept is that a real or virtual paper pad contains codes or keys on each page that are random and do not repeat. Each page of the pad can be used once for a single operation, and then it is discarded—never valid or to be reused again. The one-time use of an encryption key is the most secure form of encryption possible
one time pad
takes the input of a plaintext message and outputs a ciphertext message it is mathematically infeasible to determine the original plaintext message from the ciphertext message. primarily used in hashing or for verifying the integrity of a message
one way algorithm
users in one domain may access resources in a second domain. But since this is a one-way relationship, users in the second domain may not access resources in the first domain.
one way trust
used to clarify and provide a clear direction on operational topics such as access to specific database information, application software, or networking facilities
operational policy sometimes referred to as system-specific policies
established by a person or group with a high level of authority, such as a senior manager or corporate office, and it's usually very broad in nature, impacting the entire organization, corporate division, geographic area, or a country-specific working group
organizational policy
term used to describe the transmission of key material through any other means. This may include notes, handwritten messages, security transfer pouches, or verbal exchange, to name a few
out-of-band key exchange
transmitting a message or date by any means other than through a normal channel of communication normally used to describe a method of exchanging passwords by not sending them over the same channel as the encrypted message.
out-of-band transmission
a stream cipher that allows the keystream to be prepared and stored in advance, prior to the encryption operation
output feedback
contract out network and system monitoring as well as the response to intrusions
outsource response team
firewall that passes data based upon packet addressing information. It does not analyze the data included in a packet but simply forwards the packet based upon an application or port designation
packet filter firewall
Devices such as routers use the destination address and forward the packet to the next router until the packet eventually arrives at its destination.
packet switched
software applications are run in parallel with the actual business environment to test how well they will perform
parallel test
best characterized by a vehicle located within close proximity to a transmission source, such as in the parking lot of an organization. The attacker usually has sophisticated radio monitoring equipment
parking lot attack
also known as a reciprocal site involves an agreement between two companies to share resources in the event of a disaster
partner site/contracted or mutual site
necessary to support file transfer when a client is located behind a firewall that does not allow inbound initiated contact
passive FTP
necessary to support file transfer when a client is located behind a firewall that does not allow inbound initiated contact.
passive ftp
collects data about objects, events, and packets that are natively present in the environment, rather than injecting new elements.
passive monitoring
lock an account after a preset number of password logon attempts. Using this technique prohibits brute-force attacks.
password attacks
specifies how often passwords must be changed, password complexity, how passwords are audited, and other password characteristics.
password policy
a piece of software intended to update an application, operating system, or control program to improve its usability and performance.
patch
should be applied regularly as available from the manufacturer. should be tested on simulated production equipment prior to being distributed to production
patches
the harmful code contained within any malware
payload
a property that states that a session key won't be compromised if one of the long-term keys used to generate it is compromised in the future
perfect forward secrecy
a connection between endpoints where the carrier configures the circuit routes to provide the requested speed and bandwidth through their equipment.
permanent virtual circuit
most important asset in any orginization
personnel
a type of social engineering attack to obtain access credentials, such as usernames and passwords. In practice, it's a type of attack that redirects the user to an unexpected website destination. Can be conducted either by changing the hosts file on a victim's computer or by exploiting a vulnerability in DNS server software
pharming
an attack that attempts to obtain personal information, credit card information, or login information by masquerading as a legitimate entity
phishing
what are the three types of controls
physical logical administrative
similar to a buffer overflow attack. The pointer is used to index the process within a process stack. The attacker attacks the pointer through buffer overflow techniques to change it to point at the malicious code
pointer overflow
changes slightly as it replicates throughout the system. This makes it difficult for scanners to detect this type of virus because of different variations
polymorphic virus
Cloud systems make use of virtualization to allow total hardware usage allocation. This means that rather than have one server with one client that uses the server 60 percent of the time, the same server might have several virtual machines running that use 95 percent of the hardware capability and can be adjusted for workloads very rapidly
pooling of resources
NIST SP 800-37 rev 1, 4 steps in risk assesment
prepare, conduct, communicate and maintain
continuously monitor intrusions based upon a variety of signatures, behavioral characteristics, or heuristics
real time monitoring difference between real-time monitoring and active monitoring is that real-time monitoring is continuously listening to the traffic on the network and automatically sending alerts based upon some criteria
activities used to return operations to normal after an incident
recovery
The abstract machine concept that mediates all access by subjects to objects (part of the TCB)
reference monitor
Ports 1024-49151
registered ports
performs data acquisition and validation services of public key owners on behalf of the certificate authority.
registration authority
when a fix for a current problem creates problems in prior versions of the product
regression
a cloud vulnerability since data stored on a cloud server system based in Spain may come under the jurisdiction of the Spanish legal system
regulations and jurisdiction
created by government or by an industry specific group to control a process
regulatory agency
a position that is responsible for communicates issues, problems, and concerns and coordinates the services of the help desk group to facilitate software deployment.
release coordinator
required when the user is in a remote location from the company network
remote authentication
involves the capture of portions of a message by an attacker who then plays the message back at a later time to convince the host receiver that it is still communicating with the original sender.
replay attack
directly attacks the antivirus program, potentially destroying the virus definition database file. The virus disables the antivirus program yet makes it appear as if it is working, thus providing a false sense of security
retrovirus
not only does the user authenticate to the system when requesting access, they also have knowledge that the system they are contacting is in fact a genuine site.
reverse authentication can be done using images or personal security questions
act of decomposing an item to determine its construction and method of operation
reverse engineering
form of social engineering which tricks a victim into contacting the attacker to ask for technical support
reverse social engineering
provided a solution to the problem of who talks next. When a token was circulated around a closed loop ring, each node could determine exactly when they could transmit next. This was referred to as a deterministic system has been almost totally eliminated and replaced by Ethernet technology
ring topology
the likelihood of a threat exploiting a vulnerability and resulting in a loss.
risk
an organization acknowledges a risk and makes a conscious decision to just live with it,
risk acceptance
analytical method of identifying both threats and asset vulnerabilities and determining the likelihood and impact should the threat event occur and exploit the identified vulnerability
risk analysis
eliminating a risk situation. For instance, if you never climbed a ladder, you would never fall off
risk avoidance
The amount of impact or damage a threat may cause to an asset
risk impact
NIST SP 800-37 Revision 1 offers a six-step process for implementing information security and risk management activities into a cohesive system development life cycle
risk management framework
alters elements throughout the enterprise to minimize the ability of a threat to exploit a vulnerability
risk reduction
the process whereby a control is put in place to reduce risk
risk reduction
lists and categorizes each discovered or encountered risk within a properly implemented enterprise risk management (ERM)
risk register
When the responsibility for the payment of loss is placed on a third party
risk transference; done through outsourcing and insurance
documents the plan for implementing preferred risk mitigation strategies for dealing with identified risks
risk treatment schedule
a very old attack where malicious software allows the attacker to take root control of an operating system..............disguises itself by appearing as authentic operating system software to hide from antivirus/anti-malware software. Grants the attacker high-level authority with the ability to change system parameters and remotely execute files.
rootkit
a networking device used for connectivity between two or more networks.......provide routing based on IP addresses.... communicate with each other to determine the best path for packets.........The hop counter on a packet begins at 15 and decrements each time it crosses a _____. If the hop counter gets to 0, the packet is dropped. This prevents packet loops.
router
access control by limiting access based on set guidelines such as time or attempts
rule based access control
typically a set of conditions that, if applied in good faith, may temporarily or indefinitely protect the organization from legal action or penalties imposed by a new regulation or law.
safe harbor provision
any device, procedure, or action that provides a degree of protection to an asset
safeguard
the process of adding additional bits of data to a cleartext key or password prior to it being hashed
salt
refers to a machine or virtual network that is totally isolated from the production environment
sandbox
A program that has the ability to extract data displayed on a screen or output device.
screen scraper
This type of cable features shielding encasing each of the twisted pairs as well as the outer bundle of twisted pairs. This eliminates EMI between the twisted-pair sets and prevents EMI from entering or exiting the cable bundle
screened shielded twisted pair
Usually an unskilled, inexperienced, immature hacker who utilizes hacking tools and scripts
script kiddie
a software development process proposed by Microsoft to reduce software maintenance costs and increase the reliability and security of software
security development lifecycle (SDL)
records events related to resource use, such as creating, opening, and deleting files or manipulating other objects
security log
usually a form of server product that centrally manages the security settings and security components of network-based endpoint computers
security management software
a specific update to an application, operating system, or control program in response to the identification of a vulnerability.
security patch
must be in alignment with the mission, objectives, nature, and culture of a business. Organizational policies are not based on best practices.
security policy
where one person is required to complete each part of a task. Using the example of key escrow, one person might access the key contained in key escrow while a second person must decrypt the files using the retrieved key. And a third person may verify that each of the other two persons performed their actions correctly
separation of duties
made up of a number of updates, enhancements, fixes, or patches that are delivered by the manufacturer in the form of a single executable file
service pack
encryption keys used for a single communication session. At termination of the communication session, the key is discarded.
session key
restrict or allow actions during a specific communication session. These controls terminate when the session is terminated.
session level access control
mission critical functions have been significantly affected or interrupted
severe
utilizes a common ground shield encasing the twisted strands.
shielded twisted pair
Best practice for restoration of a device after an incident
should include reimaging from a standard image or from a known good backup
an entry in a database describing a violation or exploit which is used to match real-time events in order to detect and record attacks by the continuous monitoring solution
signature
the means of incident or violation detection which is based on a collected sample of the unwanted activity
signature-based detection
patterns of known malware
signature-based malware protection
the user in a trusted domain requests access to a resource in the trusting domain
simple trust relationship
A typical emergency situation may be practiced. Features actual steps that would be taken during an actual emergency or disaster
simulation test
type of fiber-optic cable has a small-diameter glass core that decreases the number of light reflections. This allows for greater transmission distances, up to 80 kilometers (km) standard outer jacket color is yellow most expensive type of cabling
single mode fiber optic
an identification authentication technique whereby the user signs on one time and has access to multiple applications
single sign-on
the virtual environment tool that allows for testing and experimentation within a guest OS while providing a means to roll-back to a previous stable state in just seconds
snapshot
a series of steps in which software is loaded on a server and distributed
software deployment
authentication factor that includes the use of a biometric system to verify the user's physical characteristics such as fingerprints, palm scans, iris or retina scans, facial feature scans
something you are
authentication factor that makes use of various traits exhibited by the individual. These traits include voice patterns, heart rhythms, handwriting analysis, and keyboard typing characteristics.
something you do
authentication factor that includes credit cards, digital proximity cards, radio-frequency identification (RFID) devices, hardware tokens, photo ID badges, and smartphones for SMS/text messages.
something you have
authentication factor that uses a geolocation or geotagging system to physically locate the user by recognizing the user access point or terminal, IP address, satellite triangulation, or cell towers in use.
somewhere you are
Information is sent to the underlying hardware infrastructure with provisioning and deployment instructions.
southbound APIs
receipt of unwanted or unsolicited emails
spam other variations: spim (spam over instant messaging) spit (spam over internet telephony)
directed attack on an individual or group of individuals with the goal of gathering personal or corporate information
spear phishing
a system in which part of a secret is shared among two or more individuals
split knowledge
mishandling of electronically stored information
spoliation of evidence
where the attacker appears to be someone or something else in order to mislead another person or device
spoofing attack
malicious software that is placed on the host computer and monitors actions and activities and often creates a log of some sort
spyware
this statement identifies the regulations or laws that pertain to the policy
standards or mandate statement
each node is connected to a central device such as a switch or router. Although the use of a centralized connection devices inserts a single point of failure, the flexibility of this type of network design allows for shorter cable runs and ease of network deployment most common topology in modern networks
star topology
compares existing conversations with new packets entering the firewall connecting for the first time. The new packets are compared against rulesets for a decision about whether to allow or deny
stateful packet inspection firewall
do not track the continuity of conversations and only make allow or deny decisions based upon simple rulesets
stateless firewall
masks itself as another type of program to avoid detection, usually by changing the filename extension or modifying the filename
stealth virus
simply hiding one message inside another known as hiding in plain sight
steganography
This evaluation is used to determine the asset value and potential risks to the system (risk management framework or RMF)
step 1 categorize
Baseline security controls are selected based on the category of the system. (RMF)
step 2 select
the selected security controls are installed and properly initiated throughout the system (RMF)
step 3 implement
XORs the bits of a plaintext message one at a time with a keystream to create ciphertext an algorithm that performs encryption on a continuous bit-by-bit basis. Used when encryption of voice, music, or video is required. This algorithm is very fast.
stream cipher (stream algorithm)
disaster recovery/emergency management plan testing type is considered the most cost-effective and efficient way to identify areas of overlap in the plan before conducting a more demanding training exercise
structured walk through test
person or system requiring access to the classified object or data. Generally, this technique is referred to as issuing a clearance level
subject labeling
covers up numbers in the address that are not required. When a network is subnetted, it is divided into smaller components, or subnets, with a smaller number of host machines available on each subnet.
subnet mask
This makes the broadcast domain much smaller and have fewer hosts. The advantage to this is much better network performance because you are reducing overall network traffic while also making the network more secure and manageable this can be done for a network logically, topologically, physically within a building, by workgroups, or by a building within a campus
subnetting
security violations have occurred, but have not interrupted mission critical functions
substantial
the process of replacing one letter for another. For instance, when using the Caesar cipher disk, the inner disk is rotated three places, ROT-3, and the corresponding letter can be used as a substitute in the encrypted text
substitution
what kind of cipher is the Caesar Cipher
substitution cipher
backup personnel are available in the event that key personnel are lost or unavailable
succession planning
access control list tool that routes network communications based upon the Media Access Control (MAC) address of a device creates a map table identifying the device with the MAC address in the specific port
switch some combine the ability to switch MAC addresses as well as route IP addresses, these are Layer 3 switches
dynamically configures the circuit routes each time the circuit is used by the end user.
switched virtual circuit
uses a symmetric key and operates at extreme speeds. Both the sender and the recipient require the same secret key. This can create a disadvantage in key distribution and key exchange.
symmetric algorithm
sometimes called private key or secret key cryptography, uses a single shared encryption key to both encrypt and decrypt data. provides very fast encryption
symmetric cryptography
a key used with a symmetric encryption algorithm that must be kept secret. Each party is required to have the same key, which causes key distribution to be difficult with symmetric keys
symmetric key
provides an extra defense within a Windows-based system against password-cracking software makes use of strong encryption techniques that make cracking encrypted account passwords more difficult and time-consuming than cracking non-encrypted account passwords
syskey
This is the highest alert, possibly affecting major sections of the network or applications
syslog 0 emergency
This indicates a major problem, such as the loss of a central application or communication method
syslog 1 alert
This represents the loss of a backup or secondary device.
syslog 2 critical
Warnings are usually set to indicate that a threshold is near. For instance, server utilization is at 90 percent.
syslog 4 warning
These messages indicate potential problems that should be investigated.
syslog 5 notice
These are status messages and no action is usually required.
syslog 6 info
Debug messages are utilized by developers and programmers.
syslog 7 debug
The Value of the Information (this may be different depending on the organization) and the Method of Accessing the Information (This is how the info is made available)
system level access control
individuals assigned to the test being conducted will assemble in a conference room. Here they will review the continuity plan or disaster recovery plan and proceed through the plan step-by-step, outlining their personal responsibilities
tabletop test/structured walkthrough test
event data analysis
the process of taking raw data from numerous sources, assimilating and processing it, and presenting the result in a way that can be easily interpreted and acted upon
the method of placing plaintext horizontally into a grid and then reading the grid virtually. This ______________ the letters and characters.
transposition
any incident or event that represents the probability to harm an organization
threat
the path which a threat takes to cause an action.
threat vector
the pathway to a target or the method used by the attacker to infect a target
threat vector
a drive array that is usually provided by a single manufacturer and features a proprietary physical backplane, which maintains connectivity to both drives and controller nodes
tight coupled cluster
What is the goal of event data analysis?
to interpret collected events and take appropriate action
based upon a one-time password. Because the password is used only once, it is very difficult for a hacker to obtain it. A token, or token device, is usually a small hardware device that displays a number
token-based access control
used to manage the priority of traffic on corporate LANs. a network traffic management technique that prioritizes packets in accordance with a network traffic profile. It is used to optimize or guarantee the delivery of some packets prior to others
traffic shaping
trust relationship that shares info over a middle entity
transitive trust
refers to the encryption of data in transit. IPsec is a very popular use of this
transport encryption
In this mode of IPsec, the packet contents are protected while the original IP header is exposed for internal routing. used for host to host, peer-to-peer, and endpoint-to-endpoint communication
transport mode
similar to several parallel bus structures, each containing networking items, one placed on top of the other. The top-level bus drops to a server. The server then connects below it to another bus, which contains hosts or workstations. This is a layered approach to a bus structure, but it still maintains the same problems as a bus topology
tree topology
used to combine multiple distinct physical network topologies into a single network structure
tree topology
malware that is disguised as a usable program
trojan
when no malicious events are taking place and no alerts are being triggered
true negative
when malicious events are taking place and an alert is triggered to notify the incident response team
true positive
A special, logical and compartmentalized computer that is in charge of enforcing access control
trusted computer base
contains the user requesting access to a resource in another domain. The domain containing the resource "trusts" the domain containing the user. Therefore, the user's domain is referred to as a ____________
trusted domain
otherwise referred to as the resource domain, contains the resource to which access is desired
trusting domain
How is a backup strategy tested to verify that it is a viable tool for recovery after a disaster?
try to use the backup. Restore files from it, if the files are restored properly it is a viable backup
the act of adjusting a device such as an intrusion detection system or intrusion prevention system to detect events, intrusions, and other anomalies that have exceeded the clipping level set for the device
tuning
both domains trust each other and each user in either domain may access the resources of the other
two way trust
used to describe a relationship between two entities where resources from either side can be accessed by users from either side.
two-way trust
This cable features numerous individual copper cable strands twisted together.
unshielded twisted pair
industry slang used to describe the installation of any software that either fixes a vulnerability or increases the usability or functionality of the product
update and upgrade
a team tests the software against specific scenarios
user acceptance testing
the rights and privileges assigned to a user
user entitlement
primarily running an application, database, or operating system that is completely separate from the hardware on which it is running
virtualization
the time and effort that it would take to break a specific encrypted text
work factor
a type of software that replicates itself without assistance infects host computers as well as networks by leaving a copy of itself in each location or host machine. The primary use is to create a denial of service (DOS) attack
worm
consisting of multiple parallel metal rods called dipole elements in a line. As opposed to a simple dipole antenna, this design achieves a high degree of directionality and gain
yagi antenna
a type of attack in which the attacker uses a previously unknown attack technique or exploits a previously unknown vulnerability
zero-day attack
a technique used to completely erase a key from an electronic device or a memory module such as a hard drive, smart card, or USB drive so that magnetic information may not be retrieved by any known method
zeroisation, aka clearing
generally described as a compromised computer that may be controlled under remote control
zombie