CISSP- Terms

Vendors complete Security Targets (STs)

To describe the controls that exist within their product.

Ping uses ICMP (Internet Control Message Protocol)

To determine whether a system responds and how many hops there are between the originating system and the remote system.

Synchronous communications

Use a timing or clock mechanism to control the data stream. This can permit very fast communication.

Key Risk Indicators (KRIs) (For future attack)

Are often used to monitor risk for organizations that establish an ongoing risk management program.

API keys, or application programming interface keys

Are passed to services and identify the program, developer, or user

Operational investigations

Are performed by internal teams to troubleshoot performance or other technical issues.

Data processors

Are systems used to process data.

Foreign keys

Are the mechanism used to enforce referential integrity.

The two major classifications of covert (סמוי) channels

Are timing and storage

Fuzzers

Are tools that are designed to provide invalid or unexpected input to applications, testing for vulnerabilities

Static program reviews

Are typically performed by an automated tool.

Turnstiles (קרוסלות)

Are unidirectional (חד כיווני) gates that prevent more than a single person from entering a facility at a time

Supervisory control and data acquisition (SCADA) systems

Are used to control and gather data from industrial processes

Relational Database

Contain two- dimensional tables, or relations, of related data. Relational databases require a unique value called the primary key in each tuple in a table

By using the CA's (certificate authority) public key

Individual receives a copy of a digital certificate, he or she verifies the authenticity of that certificate

An attribute (תכונה)-based access control (ABAC) system

Will allow you to specify details about subjects, objects, and access, allowing granular control.

A well-designed set of VLANs based on functional groupings

Will logically separate segments of the network.

Setting the Secure cookie

Will only allow cookies to be sent via HTTPS TLS or SSL sessions, preventing man-in-the-middle attacks that target cookies.

APIPA address (169.254)

Windows systems will assign themselves an APIPA address between 169.254.0.1 and 169.254.255.254 if they cannot contact a DHCP server.

Kerberos

Windows uses Kerberos for authentication

Ad hoc mode

Wireless network structure where devices can communicate directly with each other. (Like 2 laptops )

ITIL (IT infrastructure library)

Is a set of practices for IT service management, and is not typically used for auditing

Source code

Is computer programming language Instructions that are written in text that must be translated into machine code before execution by the CPU.

The final step of a quantitative risk analysis

Is conducting a cost/benefit analysis.

Semantic integrity means that each attribute (column) value

Is consistent with the attribute data type

Remnant data

Is data that is left after attempts have been made to remove or erase

Domain Keys Identified Mail (DKIM)

Is designed to allow assertions of domain identity to validate email

A Content Distribution Network (CDN)

Is designed to provide reliable, low-latency, geographically distributed content distribution.

Interference

Is electrical noise or other disruptions that corrupt the contents of packets.

PAP (Password Authentication Protocol)

Is insecure: a user enters a password and it is sent across the network in clear text.

The comparison of a factor to validate an identity

Is known as authentication.

Client-side input validation

Is not an effective control against any type of attack because the attacker can easily bypass the validation by altering the code on the client.

TCP (Transmission Control Protocol)

Is one of the bundles of Internet protocols commonly used to transmit data across a network

Reviewing security audit logs within an IT system

Is one of the easiest ways to verify that access control mechanisms are performing adequately (כראוי). Reviewing audit logs is primarily a detective control.

When sending attachments User awareness

Is one of the most important tools when dealing with attachments.

Temporal Key Integrity Protocol (TKIP)

Is only used as a means to encrypt transmissions and is not used for data at rest.

Regression Testing

Is performed after developers make changes to an application. It reruns a number of test cases and compares the results to baseline results.

Category 3 UTP cable (Cat 3)

Is primarily used for phone cables and was also used for early Ethernet networks where it provided 10 Mbps of throughput

Example of infrastructure as a service (Iaas)

Is providing servers on a vendor-managed virtualization platform.

Infrastructure as a service

Is providing servers on a vendor-managed virtualization platform.

The business or mission owner's role

Is responsible for making sure systems provide value.

Machine code, also called machine language

Is software that is executed directly by the central processing unit (CPU). it is a series of 1s and 0s that translate to instructions that are understood by the CPU

Closed-source software

Is software that is typically released in executable form, though the source code is kept confidential (Oracle and Microsoft Windows 10)

Personal Health Information (PHI)

Is specifically defined by HIPAA to include information about an individual's medical bills.

The Secure File Transfer Protocol (SFTP)

Is specifically designed for encrypted file transfer

The greatest risk when a device is lost or stolen

Is that sensitive data on the device will fall into the wrong hands. Confidentiality protects against this risk.

The law serves as the basis for privacy rights in the United States

Is the Fourth Amendment

Accreditation (יִפּוּי כֹּחַ)

Is the act of management formally accepting an evaluating system, not evaluating the system itself

The Single Loss Expectancy (SLE)

Is the amount of damage that a risk is expected to cause each time that it occurs

The recovery time objective (RTO)

Is the amount of time expected to return an IT service or component to operation after a failure.

Steganography

Is the art of using cryptographic techniques to embed (לְשַׁבֵּץ) secret messages within other content.

Steganography

Is the art of using cryptographic techniques to embed (להטמיע) secret messages within other content like photo.

XTACACS (Extended TACACS)

Is the authentication, authorization In addition to TACACS it support accounting and auditing

Security Assertion Markup Language (SAML)

Is the best choice for providing authentication and authorization information, particularly for browser-based SSO (Single Sign-on)

EOC (Emergency Operations Center)

Is the command post established during or just after an emergency event.

Assurance

Is the degree of confidence that an organization has that its security controls are correctly implemented.

The last step of the certificate creation process

Is the digital signature, the certificate authority signs the certificate using its own private key.

Deterrence (הרתעה)

Is the first functional goal of physical security mechanisms.

Hypervisor

It is the software that creates a virtual machine from a physical machine. (Called VMM- Virtual Machine Monitor)

The DevOps approach to technology management

Seeks to integrate software development, operations, and quality assurance in a cohesive (מגובש) effort.

Database Normalization

Seeks to make the data in a database table logically concise (תַמצִיתִי), organized, and consistent. Normalization removes redundant data and improves the integrity and availability of the database.

Segments (Transport layer-TCP)

Segment - Transport layer, only a part of a TCP (connection-oriented) connection stream.

TCP ACK

Sends a packet disguised (מְחוּפָּשׂ) as part of active control.

Xmas

Sends a packet with the FIN, PSH, and URG flags set

TCP SYN

Sends a request to open a new connection

The ping flood attack

Sends echo requests at a targeted system.

The parol (שחרור) evidence rule

States that when an agreement between two parties is put into written form, it is assumed to be the entire agreement unless amended (תיקון) in writing.

The parol evidence (ראיות שחרורים) rule

States that when an agreement between two parties is put into written form, it is assumed to be the entire agreement unless amended in writing.

The Simple Integrity Property

States that an individual may not read a file classified at a lower security level than the individual's security clearance.

Transaction identification problems caused by

A shared key are likely to involve a repudiation (דחייה) issue.

Types of structural coverage include

A statement, branch or decision coverage, loop coverage, path coverage, and data flow coverage.

Primary Rate Interface (PRI)

(Fast)Can use between 2 and 23 64 Kbps channels, with a maximum potential bandwidth of 1.544 Mbps

A key-value store is an example of

A NoSQL database, The main types are document, key-value, wide-column, and graph.

Factor to number type:

- A PIN: Type 1. - A token: Type 2. - A fingerprint: Type 3. - A password: Type 1. - A smart card: Type 2.

The three categories of data destruction are

- Clear (overwriting with nonsensitive data) - Purge (removing all data). - Destroy (physical destruction of the media).

The four canons of the (ISC)2 code of ethics are

- To protect society - The common good - Necessary public trust and confidence - The infrastructure

Ethernet uses

A bus topology.

Holistic approach

A concept based upon a balanced and integrated use of technology, people, and processes is the ultimate defensive approach against the complex cybersecurity challenges occurring in the world.

SOC 3 -Public Report

A general use report that reports on controls related to compliance and/or operations.

ASLR- Address Space Layout Randomization

A memory protection methodology that randomizes memory locations, which prevents attackers from using known address spaces.

Polyinstantiation

Allows the storage of multiple different pieces of information in a database at different classification levels to prevent attackers from conducting aggregation or inference attacks.

The Discretionary Security Property

Allows the use of a matrix to determine access permissions

Hashing (integrity control)

Allows you to computationally verify that a file has not been modified between hash evaluations

Tailgating

Also known as piggybacking,

NIPS (network-based intrusion prevention system)it is IPS

Alters the flow of network traffic. provides defense-in-depth protection in addition to a firewall

During software testing

Application programming interfaces (APIs), user interfaces (UIs), and physical interfaces are all important to test.

Data streams are associated with

Application, Presentation, and Session layers

FIdM/IDM (Federated identity management)

Applies SSO at a much wider scale: ranging from cross-organization to Internet scale. may use OpenID or SAML.

Context (הֶקשֵׁר)-dependent access control

Applies additional context before granting access. adds additional factors beyond username and password, such as the time of attempted access.

Mandatory access control (MAC)

Applies labels to subjects and objects and allows subjects to access objects when their labels match.

The information flow model

Applies state machines to the flow of information.

The Bell-LaPadula model

Applies to confidentiality

The Federal Information Security Management Act (FISMA)

Applies to federal government agencies and contractors, like Defense contractors.

Foreign keys

Are used to create relationships between tables in a database.

Congestion Window Reduced (CWR) and ECN-Echo (ECE)

Are used to manage transmission over congested links, and are rarely seen in modern TCP networks.

Mobile sites

Are veritable (מַמָשִׁי) datacenters on wheels in that they are towable trailers that contain racks of computer equipment, as well as HVAC, fire suppression, and physical security.

Vulnerability scanner has continued to incorrectly flag the system as vulnerable after installing a patch

Ask the information security team to flag the system as patched and not vulnerable.

Referential integrity means

Assuring that the connections between tables remain valid. Every foreign key in a secondary table matches a primary key in the parent table.

Organizations should train

At least two individuals on every business continuity plan task.

The three common threat modeling techniques are focused on:

Attackers, software, and assets.

TOC/TOU (Time of check/Time of use)

Attacks are also called race conditions

An audit kickoff meeting

Auditors should never approach an audit with any expectations about what they will discover/finding.

Network Access Control (NAC) systems can be used to

Authenticate users and then validate their system's compliance with a security standard before they are allowed to connect to the network.

EAP (Extensible Authentication Protocol)

Authentication framework, used in network and internet connection. Originally intended to be used on physically isolated network channels and did not include encryption

The three important factors in determining where a signal can be accessed and how usable it is, are:

Antenna placement, antenna design, and power level control.

Context-dependent control (Time-based controls)

Based on certain contextual parameters, such as location, time, sequence of responses, access history

Remediation (טיפול והוראה מתקנת) step of the incident response process

Because the root cause analysis output is necessary to fully remediate affected systems and processes

Closed circuit television (CCTV) systems act as a secondary verification mechanism for physical presence

Because they allow security officials to view the interior of the facility when a motion alarm sounds to determine the current occupants and their activities.

The Common Vulnerability Scoring System (CVSS)

Calculation tools for exploit ability, impact, how mature exploit code is, and how vulnerabilities can be re mediated, score vulnerabilities against users.

TCP headers

Can be 20 to 60 bytes long depending on options that are set

Security vulnerabilities

Can be created by misconfiguration, logical or functional design or implementation issues, or poor programming practices.

ORB (Object Request Brokers)

Can be used to locate objects because they act as object search engines. ORBs are middleware, which connects programs to programs.

RTM (requirements traceability matrix)

Can be used to map customers' requirements to the software testing plan. it traces the requirements and ensures that they are being met.

Buffer Overflows

Can occur when a programmer fails to perform bounds checking

Limiting request rates

Can prevent abuse of APIs.

External auditors

Can provide an unbiased and impartial (אוֹבּיֶקְטִיבִי) view of an organization's controls to third parties.

Decentralized access control

Can result in less consistency

DBMS (Database Management System)

Controls all access to the database and enforces the database security.

Heating, ventilation, and air conditioning (HVAC)

Controls keep the air at a reasonable temperature and humidity

Digital Rights Management (DRM) technology (Intellectual property)

Copyright protection for digital media. Limit use of the PDFs to paying customers.

Bits (Physical Layer)

Data in physical layer consists of stream of bits.

RAM (Random Access Memory)

Data in use is data that is in a temporary storage location while an application or process is using it.

Sanitization process fully ensures that

Data is not remnant (נשאר) on the system before it is reused.

Slack space

Data is stored in specific-sized chunks known as clusters, which are sometimes referred to as sectors or blocks

Transport layer

Datastream is converted into a segment (TCP) or a Datagram (UDP), it transitions from the Session layer to the Transport layer.

The Physical layer

Deals with the electrical impulses or optical pulses that are sent as bits to convey data.

X.509

Define standards for public-key certificates like those used with many smart cards.

NIST SP 800-137 outlines the process for organizations that are establishing, implementing, and maintaining an ISCM as define:

Define, establish, implement, analyze and report, respond, review, and update.

ISTQB (International Software Testing Qualifications Board)

Defines acceptance testing as "a formal testing with respect to user needs, requirements, and business

The waterfall model uses

Develops software , spending quite a bit of time up front on the development and documentation of requirements and design.

SQL injection

Directly attacks a database through a web application.

Callback

Disconnects a remote user after their initial connection and then calls them back at a preauthorized number.

Differential backups

Do not alter the archive bit on a file, whereas incremental and full backups reset the archive bit to 0 after the backup completes.

Hash functions

Do not require a cryptographic key.

VoIP call and VoIP phones are susceptible (רגישים) to

DoS and host OS attacks

Evidence in court

Does not need to be tangible

Reformatting a tape

Does not remove remnant data.

The team conduct a root cause analysis

During Remediation (תיקון) stage

WHOIS (In a penetration test)

During the information gathering and discovery, testers will gather information about the target. Whois can provide information about an organization, including IP ranges, physical addresses, and staff contacts.

Decentralized Access Control

Empowers people closer to the resources to control access but does not provide consistent control.

Cross-site request forgery (זיוף) (XSRF or CSRF) attacks

Exploit the trust that sites have in a user's browser by attempting to force the submission of authenticated requests to third-party sites

Metasploit

Exploitation framework. It is the Framework that modular penetration testing platform that enables you to write, test, and execute exploit code.

The Time of Check to Time of Use (TOC/TOU) attack

Exploits (לְהִשְׁתַמֵשׁ) timing differences between when a system verifies authorization and software uses that authorization to perform an action.

APIPA (Automatic Private IP Addressing) Begin with- 169.254.

Feature in operating systems that enables computers to automatically self-configure an IP address and subnet mask when their DHCP server isn't reachable.

Fuzzing

Feeds invalid input to running software to test error and input handling. Part of dynamic analysis

The Computer Security Act of 1987

Gave the National Institute of Standards and Technology (NIST)

White noise

Generates false emanations that effectively "jam" the true emanations from electronic equipment.

Discretionary (שיקול דעת) access control

Gives owners the right to decide who has access to the objects they own

Business Associates Agreement (BAA)-HIPAA Compliant

HIPAA requires that anyone working with personal health information to compliant with BAA

Custodians

Handling day-to-day tasks by managing and overseeing how data is handled, stored, and protecte

Remediation (תיקון) phase of incident

Handling focuses on conducting a root cause analysis to identify the factors contributing to an incident and implementing new security controls, as needed.

"Bad" blocks/clusters/sectors

Hard disks routinely end up with sectors that cannot be read due to some physical defect.

In classification process

How much the data cost to create, is not a consideration during data classification.

IDE (Integrated Development Environment)

IDE forcing is not a type of code review.

AES (Advanced Encryption Standard)

Implemented in software and hardware throughout the world to encrypt sensitive data, also known by its original name Rijndael. The client in Kerberos logins uses AES to encrypt the username and password prior to sending it to the KDC (Key Distribution Center)

Packet (Network layer)

In the seven-layer OSI model of computer networking, packet strictly refers to a protocol data unit at layer 3, the network layer.

Brute-Force Attack

In this attack, the password is changing by one letter at each attempt.

During the Reporting phase

Incident responders assess their obligations under laws and regulations to report the incident to government agencies and other regulators.

Fagan inspection

Involve both the developer and a team to review the code using a formal process.

Active-passive cluster

Involves devices or systems that are already in place, configured, powered on, and ready to begin processing network traffic should a failure occur on the primary system.

Active-active cluster

Involves multiple systems, all of which are online and actively processing traffic or data

The advantage iris scans have over most other types of biometric factors

Irises don't change as much as other factors.

The maximum allowed length of a Cat 6 cable

Is 100 meters, or 328 feet

Retina scanner

Is a Type 3 factor.

IPT (Integrated Product Team)

Is a customer-focused group that focuses on the entire lifecycle of a project (Agile concept)

Electronic vaulting (Daily transferring)

Is a data backup task that is part of disaster recovery, not business continuity, efforts.

The tail number

Is a database field because it is stored in the database.

Sqlmap

Is a dedicated database vulnerability scanner

Latency

Is a delay in the delivery of packets from their source to their destination.

A Fraggle Attack

Is a denial-of-service (DoS) attack that involves sending a large amount of spoofed UDP traffic to a router's broadcast address within a network.

Biba uses a lattice to control access

Is a form of the mandatory access control (MAC) model

Biba (Integrity) Model

Is a formal state transition system of data security policies designed to express a set of access control rules in order to ensure data integrity

Fortran

Is a functional programming language.

Fortran

Is a functional programming language. Java, C++, and C# are all object-oriented languages.

Data Warehouse

Is a large collection of data

The waterfall model

Is a linear application development model that uses rigid (נוקשה) phases; when one phase ends, the next begins (does not allow developers to go back to previous steps)

OSPF (Open Shortest Path First)

Is a link state protocol.

A database journal

Is a log of all database transactions

The IP address 127.0.0.1

Is a loopback address and will resolve to the local machine

A worm virus

Is a malicious, self-replicating program that can spread in a network without human assistance.

XML (Extensible Markup Language)

Is a markup language designed as a standard way to encode documents and data. (SAML is an XML-based framework for exchanging security information, including authentication data).

An access control mechanism

Is a means of safeguarding the security by detecting and preventing unauthorized access (Phishing is not an attack against an access control mechanism)

A fault

Is a momentary loss of power

A fault

Is a momentary loss of power.

Spike

Is a momentary period of high voltage

IPS (Intrusion Prevention System)

Is a network security/threat prevention technology that examines network traffic flows to detect and prevent vulnerability exploits

netcat

Is a network tool used to send or receive data.

Real user monitoring (RUM)

Is a passive monitoring technique that records user interaction with an application or system to ensure performance and proper application behavior.

Aggregation

Is a security issue that arises when a collection of facts has a higher classification than the classification of any of those facts standing alone.

SSID - Service Set Identifier

Is a sequence of characters that uniquely names a wireless local area network (WLAN)

A baseline

Is a set of security configurations that can be adopted and modified to fit an organization's security

IDS (Intrusion Detection System)

Is a software application or hardware appliance that monitors traffic moving on networks and through systems to search for suspicious activity and known threats, sending up alerts when it finds such items

Primary storage

Is a technical term used to refer to the memory that is directly available to the CPU.

A PBX (private branch exchange)

Is a telephone system within an enterprise that switches calls between enterprise users on local lines

Shoulder surfing (looking from behind)

Is a type of data theft where cybercriminals steal personal information or confidential information by peering over (מציץ) the target's shoulders.

RAID level 5

Is also known as disk striping with parity

Generational fuzzing (תעלול)

Is also known as intelligent fuzzing, bc it relies on the development of data models using an understanding of how the data is used by the program.

RADIUS (Remote Authentication Dial-In User Service) UDP

Is an AAA protocol used to provide authentication and authorization

Service Provisioning Markup Language (SPML)

Is an Extensible Markup Language (XML)-based language that facilitates (מקדם) the exchange of provisioning information among applications and organizations, corporations, or agencies

RSA- Is a public-key encryption technology

Is an asymmetric encryption algorithm that requires only two keys for each user.

Sabotage (חבלה)

Is an attack committed against an organization by an insider, such as an employee

OpenID Connect (adopted by cloud service)

Is an authentication layer that works with OAuth 2.0 as its underlying authorization framework.

Agile sprint phase

Is likely developing code based on user stories

Classified

Is not a level in the U.S. government classification scheme.

HTML (Hypertext Markup Language)

Is primarily used for web pages

The end goal of the disaster recovery process

Is restoring normal business operations in the primary facility.

Use case testing

Is testing for desired functionality

Packet loss

Is the disappearance of packets in transit that requires re-transmission.

EAL7 (Evaluation Assurance Level)

Is the highest level of assurance under the Common Criteria. It applies when a system has been formally verified, designed, and tested.

Enrollment, or registration

Is the initial creation of a user account in the provisioning process

The checklist review

Is the least disruptive type of disaster recovery test.

L2TP (Layer 2 Tunneling Protocol)

Is the only one of the four common VPN protocols that can natively support non-IP protocols

Nonrepudiation

Is the only possible with an asymmetric encryption algorithm. RSA is an asymmetric algorithm.

Tailoring

Is the process of matching a list of security controls to the mission of an organization

Scoping

Is the process of reviewing and selecting security controls based on the system that they will be applied to.

Static analysis

Is the process of reviewing code without running it.

Input validation, also known as data validation,

Is the proper testing of any input supplied by a user or application, as input parameters to an SQL query.

Modulo Function (mod)

Is the remainder value left over after an integer (שלם) division operation takes place

Cohesion (התלכדות)

Is the strength of the relationship between the purposes of methods within the same class.

The biggest threat to data at rest

Is typically a data breach.

XACML (Extensible Access Control Markup Language)

Is used for access control policy markup.

TACACS+ (TCP)

Is used for network devices that wants to log in remotely to AAA server

SSH (Secure Shell) (port 22)

Is used for secure command-line access

Extensible Access Control Markup Language (XACML)

Is used to describe access controls.

Security Assertion Markup Language (SAML)

Is used to exchange user authentication and authorization data.

SPML (Service Provisioning Markup Language)

Is used to exchange user information for SSO (Single sign on)

The Security Content Automation Protocol (SCAP)

Is used to handle vulnerability and security configuration information. The National Vulnerability Database provided by NIST uses SCAP

Data Mining

Is used to search for patterns. Commonly sought patterns include signs of fraud.

The Waiting state

Is used when a process is blocked waiting for an external event.

GFS (grandfather-father-son) backup

Is used with systems that use sequential (רציף) master files. is a common rotation scheme for backup media, in which there are three or more backup cycles, such as daily, weekly, and monthly.

Nikto

Is useful for vulnerability scanning web servers and applications and is the best choice listed for a web server (HTTP)

WEP's implementation of RC4

Is weakened by its use of a static common key and a limited number of initialization vectors.

Double NATing

Isn't possible with the same IP range; the same IP addresses cannot appear inside and outside of a NAT router.

The grant rule

It allows a subject to grant rights that it possesses (לְקַבֵּל בִּירוּשָׁה) on an object to another subject.

EAP-FAST, also known as Flexible Authentication via Secure Tunneling)

It is used in wireless networks and point-to-point connections to perform session authentication

In SOC Type I audits (audits occur in type 2)

It only covers a single point in time and is based upon management descriptions of controls.

Label all media

It prevents sensitive media from not being marked by mistake.

Disintegration (הִתפּוֹרְרוּת)

It's the best method to sanitize a solid-state drive (SSD). The results in very small fragments via a shredding process.

Unit testing

Low-level tests of software components, such as functions, procedures, or objects.

Redundant systems (ie, alternative systems)

Make entire systems available in case of failure of the primary system

The Electronic Communications Privacy Act (ECPA)

Makes it a crime to invade the electronic privacy of an individual.

Maximum Tolerable Downtime (MTD) is comprised of which two metrics

Recovery Time Objective (RTO) and Work Recovery Time (WRT)

RAID-5 array

Recovery control and intended to handle failure of a drive.

Keyboard dynamics

Refer to how hard a person presses each key and the rhythm in which the keys are pressed

The Children's Online Privacy Protection Act (COPPA)

Regulates websites that cater to children or knowingly collect information from children under the age of 13

Generational fuzzing

Relies on models for application input and conducts fuzzing attacks based on that information.

A constrained (מוגבל) user interface

Restricts what users can see or do based on their privileges

A constrained (מוגבל) user interface

Restricts what users can see or do based on their privileges.

Stealth (התגנבות) techniques

Result clean scan, such as intercepting (יירוט) read requests from the antivirus software and returning a correct-looking version of the infected file.

When the value of data changes due to legal, compliance, or business reasons:

Reviewing classifications and reclassifying the data is an appropriate response.

Pass around

Reviews are often done via email or using a central code review system, allowing developers to review code asynchronously.

The formula used to determine risk

Risk = Threat * Vulnerability.

Routing Protocols

Routing Information Protocol (RIP) Open Shortest Path First (OSPF) Border Gateway Protocol (BGP)

Marging two (or more!) IT environments

Running vulnerability scans and performing a risk assessment are both common steps taken when preparing to merge two (or more!) IT environments.

The hypervisor (In Virtualization)

Runs within the virtualization platform and serves as the moderator (מַנחֶה) between virtual resources and physical resources.

PACs (Privilege Attribute Certificates)

SESAME (an SSO syste) uses PAC in place (במקום) of Kerberos' tickets

SOC 1, SOC 2, SOC 3

SOC 1- Provide financial control information SOC 2- Provide detail on the controls and any issues SOC 3- Public report

Egress (יְצִיאָה) filtering

Scans outbound traffic for potential security policy violations like Traffic with a destination address on an external network.

Hand geometry scanners (assess the physical dimensions)

Should not be implemented as the sole authentication factor for secure environments.

Everyone in the organization

Should receive a basic awareness training for the business continuity program.

Individuals with specific business continuity roles

Should receive training on at least an annual basis

Gantt chart

Showing the proposed start and end dates for different activities.

nmap

Port scanning.

Allocated space

Portions of a disk partition that are marked as actively containing data.

Unallocated space

Portions of a disk partition that do not contain active data

Ports (Total 65,535)

Ports 0 through 1023 are defined as well-known ports Ports 1024 to 49151 are defined as Registered ports Ports 49152 to 65535 Private/Dynamic ports (IANA) Suggest this addresses.

Intrusion detection systems (IDSs)

Provide only passive responses, such as alerting administrators to a suspected attack.

The Common Platform Enumeration (CPE) component of SCAP

Provides a consistent way to refer to operating systems and other system components.

Vulnerabilities and Exposures (CVE) component

Provides a consistent way to refer to security vulnerabilities.

Request control

Provides a framework for user requests

Change control

Provides an organized framework within which multiple developers can create and test solutions prior to rolling them out into a production environment

Identity as a Service (IDaaS)

Provides capabilities such as account provisioning, management, authentication, authorization, reporting, and monitoring.

Remediation (תיקון)

Provides critical information for repairing systems so that the incident does not recur (לחזור)

RAID technology

Provides fault tolerance for hard drive failures and is an example of a business continuity action.

A full-knowledge test (also called crystal-box test)

Provides internal information to the penetration tester, including network diagrams, policies and procedures, and sometimes reports from previous penetration testers

802.1x authentication

Provides port-based authentication and can be used with technologies like EAP

OEP (Occupant Emergency Plan)

Provides the "response procedures for occupants of a facility in the event of a situation posing a potential threat to the health and safety of personnel, the environment, or property.

Group Policy

Provides the ability to monitor and apply settings in a security baseline

SOC 1, Type 2 - Financial results

Provides the risk of financial statement assertions and the service tests of the controls and the results.

Crystal box penetration testing, (called white-box penetration testing)

Provides the tester with information about networks, systems, and configurations, allowing highly effective testing

The change control process

Providing an organized framework when multiple developers can create and test.

Modification (שינוי) attacks

Occur when captured packets are modified and replayed to a system to attempt to perform an action.

Privilege escalation

Occurs during the attack phase of a penetration test

"Blue Screen of Death" (Blue screen on the computer)

Occurs when a Windows system experiences a dangerous failure and enters a fail secure state

Full disk encryption

Only protects data at rest.

For web applications in a well-designed environment

Passwords are never stored

Electronic discovery, or eDiscovery,

Pertains (שייך) to legal counsel gaining access to pertinent electronic information during the pretrial discovery phase of civil legal proceedings.

Operating Level Agreements (OLAs)

Specify (לפרט) the parameters of service that a vendor provides to a customer.

STRIDE is an acronym that stands for 6 categories of security risks:

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privileges.

Microsoft's STRIDE threat assessment model places threats into one of six categories:

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

Common types of structural coverage include

Statement, branch or decision coverage, loop coverage, path coverage, and data flow coverage.

Modification of audit logs

Will allow repudiation because the data cannot be trusted, and thus actions can be provably denied.

IEEE 802.11 (Used for Wi-Fi)

Wireless Ethernet standard for Wi-Fi. 802.11a - 5 GHZ 802.11b - 2.4 GHZ 802.11g- 2.4 GHZ 802.11n- 2.4/5 GHZ 802.11 ac - 5GHZ

aircrack-ng

Wireless encryption assessment.

Bytecode,

Such as Java bytecode, is also interpreted code

Aggregate functions

Summarize large amounts of data and provide only summary information as a result

TACACS, XTACACS, TACACS+ (Old to new triple AAA methods)

TACACS- Provide authentication and authorization XTACACS- Provide authentication, authorization accounting, and auditing. TACACS+ - Adds encryption & Administative control

Cross-site request forgery (XSRF)

The anti-forgery state token exchanged during OAuth sessions is intended to prevent cross-site request forgery (זיוף)

In a land attack,

The attacker sends a packet that has identical source and destination IP addresses in an attempt to crash systems that are not able to handle this out-of-specification traffic

Inference attack (הסקה/ להסיק)

The attacker uses several pieces of generic nonsensitive information to determine a specific sensitive value

When operating system patches are no longer available for mobile devices

The best option is typically to retire or replace the device

To monitor traffic between systems in a VMWare environment

The best way is to set up a virtual span port and capture data using a VM IDS.

If the (ISC)2 peer review board finds that a certified violated

The board may revoke their certification.

In the private cloud computing model,

The cloud computing environment is dedicated to a single organization.

Accreditation (יִפּוּי כֹּחַ)

The formal authorization by the accrediting (management) official for system operation and an explicit acceptance of risk.

Hierarchical databases form a tree

The global domain name service (DNS) servers form a global tree.

Recovery Time Objective (RTO)

The goal of business continuity planning exercises is to reduce the amount of time required to restore operations. This is done by minimizing the RTO.

De-encapsulation (in the OSI model)

The process of removing a header (and possibly a footer) from the data received from a previous layer in the OSI model is known as de-encapsulation.

BIA (Business Impact Analysis)

The process to establish business continuity requirements by identifying time-sensitive activities in an organization, based on the impact stemming from a disruption (שִׁבּוּשׁ)

Organization media downgraded

The purging (טיהור) process should be followed, and then the media should be relabeled.

Ticket-Granting Ticket (TGT)

Ticket Granting Ticket, It contains the session key, its expiration date, and the user's IP address.

The goal of the business continuity planning process is:

To ensure that your recovery time objectives (RTO)are all less than your maximum tolerable downtimes (MTD)

Key Risk Indicators (KRIs) are often used (Forward looking indicator)

To monitor risk for organizations that establish an ongoing risk management program

sqlmap is designed

To perform automated detection and testing of SQL injection flaws and does not provide OS detection.

The purpose of a digital certificate is

To provide the general public with an authenticated copy of the certificate subject's public key.

Kerberos uses realms (תחומים), and the proper type of trust

To set up for an Active Directory environment that needs to connect to a K5 domain is a realm trust.

The military classification scheme contains three major levels:

Top Secret, Secret, and Confidential. Unclassified is a default, and not a classification

Top Secret, Secret, Confidential, Unclassified

Top Secret- Could cause exceptionally grave harm. Secret- Could cause serious harm to national security. Confidential- could be expected to cause less harm. Unclassified- is not an actual classification (may be released to unclassified individuals)

Dynamic testing of software

Typically occurs in a black box environment where the tester does not have access to the source code.

Firewalls

Use rule-based access control.

Criminal investigations

Use the strictest standard of evidence of all investigations: beyond a reasonable doubt.

Degaussing

Used for destroying media with magnetic

The Point-to-Point Protocol (PPP)

Used for dial-up connections for modems, IDSN, Frame Relay, and other technologies.

Port Address Translation (PAT)

Used to allow a network to use any IP address set inside without causing a conflict with the public Internet.

Key performance indicators (KPIs)

Used to assess how an organization is performing

PSH is a TCP flag

Used to clear the buffer resulting in immediately sending data, and URG is the TCP urgent flag.

The DARPA TCP/IP model

Used to create and design the OSI model made sure to map the OSI model layers to it. (Application, Presentation, and Session.)

A watermark

Used to digitally label data and can be used to indicate (לְהַצְבִּיעַ) ownership

The RST flag (Reset)

Used to reset or disconnect a session.

Compensation controls are

Used when controls like the locks in this example are not sufficient (לא מספיק)

Database shadowing

Uses two or more identical databases that are updated simultaneously. The goal of database shadowing is to greatly reduce the recovery time for a database implementation.

Designing an assessment following NIST SP 800-53A

Using Specifications is generally include policies, procedures, requirements, and designs

If a business need requires messaging

Using a local messaging server is the best option.

Kerberos encrypts messages .

Using secret keys, providing protection for authentication traffic

Nikto

Web vulnerability scanning

SCADA devices- A computer system for gathering and analyzing real time data

Were never designed to be exposed to a network, and adding them to a potentially insecure network can create significant risks.

False Acceptance Rate (FAR), False Rejection Rate (FRR)

When FRR is higher than FAR it show that security is more important than usability to the organization.

What format does the Data link Layer use to format messages received from higher up the stack?

When a message reaches the Data Link layer, it is called a frame

Frame (Data layer)

When a message reaches the Data Link layer, it is called a frame.

TCP connect scan can be used.

When tester does not have raw packet creation privileges, such as when they have not escalated privileges on a compromised host.

Discretionary (לפי שיקול דעת) access control

When the owner of a file makes the decisions about who has rights or access privileges to it.

Nonrepudiation occurs

When the recipient of a message is able to demonstrate to a third party that the message came.

EAL2 (Evaluation Assurance Level) assurance applies

When the system has been structurally tested. It is the second-to-lowest level of assurance under the Common Criteria

Race conditions occur

When two or more processes need to access the same resource in the right order.

Excessive (מוּפרָז) privileges

When users have more rights than they need to accomplish their job

Passive scanning

can help identify rogue devices by capturing MAC address vendor IDs

Clipping part of methods of choosing records from a large pool

clipping uses threshold values to select those records that exceed a predefined threshold because they may be of most interest to analysts.

The United States Code (USC)

contains the text of all federal criminal and civil laws passed by the legislative branch and signed by the President

Database query languages have at least two subsets of commands:

data definition language (DDL) and data manipulation language (DML). DDL is used to create, modify, and delete tables, while DML is used to query and update data stored in the tables.

System logs (In windows)

include reboots, shutdowns, and service state changes.

COBIT

is an IT management framework developed by the ISACA to help businesses develop, organize and implement strategies around information management and governance.

Criminal forensic investigations

Typically have the highest standards for evidence.

The cable lengths:

1. Category 5e: B. 300 feet. 2. Coaxial (RG-58): A. 500 feet. 3. Fiber optic: C. 1+ Kilometers.

SW-CMM 5 stages

1. Initial 2. Repeatable (Basic life-cycle) 3. Defined 4. Managed 5. Optimizing

The Agile (זָרִיז/ קַל תְנוּעָה) approach to software development embraces (כולל) four principles.

1. It values individuals and interactions over processes and tools 2. Working software over comprehensive documentation 3. Customer collaboration over contract negotiation. 4. Responding to change over following a plan.

The three components of the DevOps model are

1. Software development 2. operations 3. quality assurance

Loopback address is

127.0.0.1

APIPA addresses are assigned between

169.254.0.0 to 169.254.255.254

GLBA Is (The Gramm-Leach-Bliley Act)

A U.S. law that requires covered financial institutions.

SOX (Sarbanes-Oxley Act)

A U.S. law that requires internal controls assessments including IT transaction flows for publicly traded companies.

Honeynet

A network set up with intentional vulnerabilities

Misuse (שימוש לרעה) case analysis

A process that tests code based on how it would perform if it was misused instead of used properly.

Cold site:

A rented space with power, cooling, and connectivity that can accept equipment as part of a recovery effort.

Cognitive Password

A series of questions that the user has previously provided the answer, and the user should knows the answers.

In order to fully test code

A white box test is required.

API keys

API developers commonly use API keys to limit access to authorized users and applications

Diameter (Is RADIUS' successor מַמשִׁיך דָרכּוֹ)

Designed to provide an improved AAA framework. Diameter, is more flexible than Radius.

Parity

Achieves data redundancy without incurring the same degree of cost as that of mirroring in terms of disk usage and write performance.

Mirroring in RAID

Achieves full data redundancy by writing the same data to multiple hard disks.

A rainbow table

Acts as a database that contains the precomputed hashed output for most or all possible passwords

Proportionality (מידתיות)

Additional discovery must be proportional to the additional costs that they will require

Content (תוֹכֶן)-dependent access control

Adds additional criteria beyond identification and authentication. They may be added as an additional control, typically to DAC systems

Nessus, OpenVAS, and SAINT

All examples of Vulnerability scanners tool

Frequency Hopping Spread Spectrum (FHSS), Direct Sequence Spread Spectrum (DSSS) Orthogonal Frequency-Division Multiplexing (OFDM)

All use spread-spectrum techniques to transmit on more than one frequency at the same time

Repudiation (הכחשה) threats

Allow an attacker to deny having performed an action or activity without the other party being able to prove differently.

Repudiation threats

Allow an attacker to deny having performed an action or activity without the other party being able to prove differently.

Database query languages

Allow the creation of database tables, read/write access to those tables, and many other functions

Database replication mirrors a live database

Allowing simultaneous reads and writes to multiple replicated databases by clients.

Covert channel (ערוץ סמוי)

Allowing the transport of data between security zones. Cut and paste between virtual machines can cause Covert channel concerns.

XACML

An access control markup language used to describe and process access control policies in an XML format

The ping of death attack is most similar to

Buffer overflow

Netflow Records contain (In case of botnet)

An entry for every network communication session that took place on a network and can be compared to a list of known malicious hosts.

Psuedoflaw

An intentionally designed vulnerability used to lure (לפתות) in an attacker

Web applications communicate with web browsers via:

An interface (ממשק)

Service bureau

An organization that can provide onsite or offsite IT services in the event of a disaster

Telnet is (Port 23)

An unencrypted command-line and login protocol that use to access remote server.

During the Lessons Learned phase

Analysts close out an incident by conducting a review of the entire incident response process.

Implicit denial states (מצבי הכחשה משתמעים)

Any action that is not explicitly allowed (מותרת במפורש) is denied.

Software that released into the public domain

Anyone may use it for any purpose, without restriction

A hybrid attack

Appends(מוסיף), prepends (תלוי), or changes characters in words from a dictionary before hashing in order to attempt the fastest crack of complex passwords.replaces each letter "o" with the number "0

SQL injection attacks are

Application attacks

Sandboxing

Application developers may test the code in a virtualized environment

PEAP (Protected Extensible Authentication Protocol)

Authentication protocol used in wireless networks and Point-to-Point connections, provide more secure authentication for 802.11 WLANs. Encapsulate EAP in TLS tunnel

The Authentication Header provides

Authentication, integrity, and nonrepudiation for IPsec connections.

Electronic vaulting approach (Transferring data every day)

Automated technology moves database backups from the primary database server to a remote site on a scheduled basis

Bluesnarfing targets the data on Bluetooth-enabled devices.

Bluejacking occurs when attackers send unsolicited messages via Bluetooth.

In TLS (Transport Layer Security)

Both the server and the client first communicate using an ephemeral (ארעי) symmetric session key

BitLocker and Microsoft's Encrypting File System (EFS)

Both use AES (Advanced Encryption Standard), which is the NIST-approved replacement for DES (Data Encryption Standard).

Certificates may only be added to a Certificate Revocation List

By the certificate authority that created the digital certificate

CVE (Common Vulnerabilities and Exposures)

It is a public database list of the last cybersecurity vulnerabilities.

A database failure in the middle of a transaction

Causes the rollback of the entire transaction.

IP Addresses class

Class A- 1.0.0.1 to 126.255.255.254 Class B- 128.1.0.1 to 191.255.255.254 Class C- 192.0.1.1 to 223.255.254.254 Class D- 224.0.0.0 to 239.255.255.255

In a Mandatory Access Control (MAC) system

Classifications do not have to include rights to lower levels, This means that the only label we can be sure we have rights to is Secret.

Code review (Part of SDLC)

Code review may use a combination of manual and automated techniques, should be a peer-driven process, and complete the review of around 300 lines per hour, on average.

TCP Connect

Completes a three-way handshake

MITRE

Conducts research and development for the U.S. government.

The commercial classification scheme discussed by (ISC)2 includes four primary classification levels:

Confidential, private, sensitive, and public. Secret is a part of the military classification scheme.

Site survey

Determine wireless network is accessible in organization's

Certificate Revocation List (CRL)

It is a list of digital certificates that have been revoked by the issuing certificate authority (CA)

A foreign key (In SQL)

Create relationships between tables in a database

The Linux tool dd

Creates a bit-by-bit copy of the target drive that is well suited to forensic use.

The Linux tool dd

Creates a bit-by-bit copy of the target drive.

Encapsulation

Creates both the benefits and potential issues with multilayer protocols.

The TEMPEST program

Creates technology that is not susceptible to Van Eck (form of eavesdropping) phreaking (מפזר) attacks.

DNS, HTTPS, SSH, RDP, MSSQL Ports

DNS - UDP port 53 HTTPS -TCP port 443 SSH - TCP port 22 RDP - TCP port 3389 MSSQL - TCP port 1433

Digital Rights Management solution (DRM)

DRM solutions are designed to protect intellectual property.

Record retention policies

Describe how long the organization should retain data.

Record retention policies (מדיניות שמירת רשומות)

Describe how long the organization should retain data.

MOR (Minimum Operating Requirement)

Describe the minimum environmental and connectivity requirements in order to operate computer equipment.

Data remanence

Describes data that is still on media after an attempt has been made to remove it.

Data permanence (קביעות)

Describes how long data lasts

MTTR (mean time to repair)

Describes how long it will take to recover a specific failed system.

Wave pattern motion

Detectors transmit ultrasonic or microwave signals into the monitor area

NIDS (Network-based intrusion detection system) it is IDS

Detects malicious traffic on a network.

NIST SP 800-18 Describes system owner responsibilities that include

Helping to develop system security plans, maintaining the plan, ensuring training, and identifying.

Wireshark is a protocol analyzer and may be used to eavesdrop on network connections.

Eavesdropping is an attack against confidentiality.

The Online Certificate Status Protocol (OCSP)

Eliminates the latency inherent in the use of certificate revocation lists by providing a means for real-time certificate verification.

Code review process contains:

Email pass-around code reviews, Pair programming, Over-the-shoulder reviews

The best way to ensure email confidentiality in motion

Encrypt the email content.

Parameter checking, or input validation,

Ensure that input provided by users to an application matches the expected parameters for the application

BCP (Business Continuity Plan)

Ensure that the business will continue to operate before, throughout, and after a disaster event is experienced

Regression testing

Ensures proper functionality of an application or system after it has been changed.

Process isolation

Ensures that any behavior will affect only the memory and resources associated with a process, additionally ensures that the operating system allocates a separate area of memory for each process.

Configuration control

Ensures that changes to software versions are made in accordance (בהתאם) with the change control and configuration management process.

Configuration control

Ensures that changes to software versions are made in accordance with the change and configuration management policies

Record retention

Ensures that data is kept and maintained as long as it is needed and that it is purged (טיהור) when it is no longer necessary.

Atomicity (in the database ACID model)

Ensures that database transactions either execute completely or not at all

Integrity

Ensures that unauthorized changes are not made to data while stored or in transit.

NIST SP 800-137 outlines the process for organizations that are

Establishing, implementing, and maintaining an ISCM as define, establish, implement, analyze and report, respond, review, and update.

Carrier-Sense Multiple Access with Collision Detection (CSMA/CD) technology.

Ethernet networks use it. When a collision is detected and a jam signal is sent, hosts wait a random period of time before attempting re-transmission.

NIST SP800-53 describes three processes:

Examination, Interviews, Testing.

NIST SP800-53 describes three processes:

Examination, Interviews, Testing. (It is a baseline control)

NIST SP800-53 describes three processes:

Examination- which is reviewing or analyzing assessment objects like specifications, mechanisms, or activities Interviews- which are conducted with individuals or groups of individuals Testing- which involves evaluating activities or mechanisms for expected behavior when used or exercised

BC-5F-F4-7B-4B-7D

Example of MAC address, the network interface card's manufacturer

Photoelectric sensors work in a similar fashion,

Except that they contain an LED (light-emitting diode) and a photoelectric sensor that generates a small charge while receiving light

The Common Weaknesses Enumeration (CWE) component

Helps describe the root causes of software flaws (פגמים).

The Digital Millennium Copyright Act

Extends common carrier protection to Internet service providers.

FAR (false acceptance rate), FRR (false reject rate)

FARs (Type II errors) are worse than FRRs (Type I errors).

FTP, SSH, Telnet, SMTP

FTP (TCP port 21) SSH (Port 22) Telnet (TCP port 23) SMTP uses port 25

Cellular networks

Have the same issues that any public network have, Should use the same requirements as data transferring over any public network.

The log entries

Firewall log show the allow/deny status for inbound and outbound TCP and UDP sessions.

Network Forensics

Focus on gathering evidence via a process that will support admission into a court of law.

ISO/IEC-27031

Focuses on BCP (Business Continuity Plan)

DRP (Disaster Recovery Plan)

Focuses on efficiently attempting to mitigate the impact of a disaster by preparing the immediate response and recovery of critical IT systems

Misuse (שימוש לרעה) testing

Focuses on how code handles examples of misuse

Striping

Focuses on increasing read and write performance by spreading data across multiple hard disks.

AS serves (Authentication serve)

Forwards the username to the KDC (Key Distribution Center)

Sanitization process

Fully ensures that data is not remnant on the system before it is reused. (Removing hard drive from PC)

When an individual receives a copy of a digital certificate:

He or she verifies the authenticity of that certificate by using the CA's public key to validate the digital signature contained on the certificate.

Heuristic-based anti-malware software

Has a higher likelihood of detecting a zero-day exploit than signature-based methods

WEP (Wired Equivalent Privacy)

Has a very weak security model that relies on a single, predefined, shared static key.

The Sashimi Model (sashimi waterfall model)

Has highly overlapping steps.

Tables in Database

Have rows and columns; A row is a database record, called a tuple. A Column is called an attribute.

Administrators

Have the right to assign permissions to access and handle data.

Ephemeral (חוֹלֵף) symmetric session key.

In TLS, both the server and the client first communicate using an ephemeral symmetric session key.

In differential Backup scenario

In differential backup must achieve a system baseline (Full backup) then will do the last differential backup.

Types of structural coverage

Include a statement, branch or decision coverage, loop coverage, path coverage, and data flow coverage.

SDLC approaches (System Development Life Cycle)

Include steps to provide operational training for support staff as well as end-user training. The SDLC may use one of many development models, including the waterfall and spiral models.

PHI (Protected Health Information)

Includes a variety of data in multiple formats.

Release control

Includes acceptance testing to ensure that any alterations (שינויים) to end-user work tasks are understood and functional.

Release control

Includes acceptance testing to ensure that any alterations to end-user work tasks are understood and functional.

The Physical layer

Includes electrical specifications, protocols, and standards that allow control of throughput, handling line noise, and a variety of other electrical interface and signaling requirements

Project scope and planning phase of business continuity planning

Includes four actions: 1. A structured analysis of the organization. 2. The creation of a BCP team. 3. An assessment of available resources. 4. An analysis of the legal and regulatory landscape.

Data Subject

Individual human associate with a particular set of personally identifier information (PII)

Regression testing (בדיקות רגרסיה)

Intended to prevent the recurrence (הִשָׁנוּת) of issues

Encapsulation

It is a process that adds a header and possibly a footer to data received at each layer before hand-off to the next layer.

Risk transference

Insurance is a common example of Risk transference.

The DevOps approach to technology management seeks to

Integrate software development, operations, and quality assurance in a cohesive (מגובש) effort.

The Gramm-Leach-Bliley Act (GLBA)

It applies specifically to financial institutions. Provide customers a privacy notice on a yearly basis

Network Time Protocol (NTP)

It can ensure that systems are using the same time, allowing time sequencing for logs throughout a centralized logging infrastructure.

OpenID provider

It could allow a phishing attack by directing clients to a fake OpenID provider that can capture valid credentials.

HTTP TRACE or TRACK methods

It could be used to steal a user's cookies via cross-site scripting (XSS). Cross-site tracing (XST) leverages the HTTP TRACE or TRACK

A honeypot

It is a decoy (מַלכּוֹדֶת) computer system used to bait intruders into attacking.

Fagan testing

It is a detailed code review that steps through planning, overview, preparation, inspection, rework, and follow-up phases.

A network that supports IPv6 but needs to connect it to an IPv4 network

It is a gateway solution (NAT64) that can translate traffic between the networks.

KPI & KRI

KPI is a backward-looking indicator, and a KRI is a forward-looking indicator.

TGS (Ticket-Granting Service)

Kerberos service generates a new ticket and session keys and sends them to the client. Receives a TGT from the client.

KPI's (Key Performance Indicator) are (Backward looking indicator)

Key performance indicators, which are used to assess how an organization is performing.

RAID 1

Known as disk mirroring, systems contain two physical disks.Each disk contains copies of the same data.

Stateful packet inspection firewalls,

Known as dynamic packet filtering firewalls, track the state of a conversation and can allow a response from a remote system.

LEAP (The Lightweight Extensible Authentication Protocol)

LAN authentication, designed to handle problems with TKIP, has a feature of mutual authentication.

The disaster recovery test types, listed in order of their potential impact on the business from the least impactful to the most impactful, are as follows:

Least impactful (בר - השפעה): Checklist review Tabletop exercise Parallel (מקביל) test Most Impactful: Full interruption test

Discretionary (שיקול דעת) access control.

Linux filesystem allows the owners of objects to determine the access rights that subjects have to them.

Cross-site tracing (XST)

Leverages the HTTP TRACE or TRACK methods and could be used to steal a user's cookies via cross-site scripting (XSS).

MD5, SHA1, SHA2

MD5- 128-bit hash value SHA1- 160-bit hash (20 bytes) SHA2 (SHA 256)- 256-bits, or 64 hexadecimal digits

Release control

Manages the deployment of code into production

Resource-based access controls

Match permissions to resources like a storage volume. Common in cloud-based infrastructure.

A host-based intrusion detection system (HIDS)

May be able to detect unauthorized processes running on a system.

Anomaly (חריגה)-based intrusion detection systems

May identify a zero-day vulnerability because it deviates from normal patterns of activity

Spare sectors, bad sectors, and space provided for wear leveling on SSDs (overprovisioned space)

May may not be cleared, and will contain data, resulting in data remanence.

Non-IP protocols

May not be able to be filtered by firewall devices.

The contents of RAM are volatile (נָדִיף)

Meaning that they are only available while power is applied to the memory chips

Mutation (מוטציה) testing

Modifies a program in small ways and then tests that mutant to determine if it behaves as it should or if it fails.

A modem (MOdulator/DEModulator)

Modulates between an analog carrier like a phone line and digital communications.

Capacitance motion Detectors

Monitor the electromagnetic field in a monitored area, sensing disturbances that correspond to motion

Security Controls Assessment (SCA)

Most often refers to a formal U.S. government

Deter fraud inside company

Most security professionals recommend at least one, and preferably two, weeks of vacation to.

The three common ways of categorizing the causes for disasters are derived from whether the threat agent is

Natural, human, or environmental in nature.

QualysGuard

Network vulnerability scanning.

RSA ((Rivest-Shamir-Adleman) is an asymmetric algorithm to encrypt and decrypt messages

Nonrepudiation is only possible with an asymmetric encryption algorithm.

The assignment of endpoint systems to VLAN's

Normally performed by a network switch.

The EU-U.S. Privacy Shield principles are

Notice Choice Accountability for Onward transfer Security Data Integrity and Purpose Limitation Access Recourse, Enforcement, and Liability

Directive (הוֹרָאָה) access controls

Notifications and procedures like the signs posted are examples of directive access controls

Directive access controls.

Notifications and procedures like the signs posted at the company.

Baseline configurations

Serve as the starting point for configuring secure systems and applications.

ARP (Address Resolution Protocol) and RARP (Reverse Address Resolution Protocol)

Operate at the Data Link layer- Layer 2

TCP, UDP, and other transport layer protocols like SSL and TLS

Operate at the Transport layer

Separation-of-duties principle

Organizations divide critical tasks into discrete components and ensure that no one individual has the ability to perform both actions.

Sampling

Should be done randomly to avoid human bias

IP protocols

PPTP, L2F, and IPsec

VPN protocols

PPTP, L2F, and IPsec (support IP protocols) L2TP (support non-IP protocols)

PSH (PUSH flag) URG

PSH is a TCP flag used to clear the buffer, resulting in immediately sending data, and URG is the TCP urgent flag.

DNS (Port 53)

Performs translations between FQDNs and IP addresses. A fully qualified domain name (FQDN) is the complete domain name for a specific computer.

ARP

Performs translations between MAC addresses and IP addresses

Tapes that are leaving their normal storage facility

Should be handled according to the organization's classification schemes and handling requirements

Software Escrow agreements

Place a copy of the source code for a software package, It is also a protection against a software vendor going out of business.

Open-source software

Publishes source code publicly (Ubuntu Linux and the Apache web server)

Clearing describes

Preparing media for reuse

Open Web Application Security Project (OWASP)

Produces an annual list of the top ten web application security issues.

Mobile Device Management (MDM)

Products provide a consistent, centralized interface for applying security configuration settings to mobile devices.

The Digital Millennium Copyright Act (DMCA)

Prohibits attempts to circumvent (לעקוף) copyright protection mechanisms placed on a protected work.

Encrypting data on SSD drives

Protect against wear leveling (increase the lifetime of the memory)

IPSec (Internet Protocol Security)

Protect communications over Internet Protocol (IP) networks. Could be used to create a tunnel to transfer the data.

The Family Educational Rights and Privacy Act (FERPA)

Protects the privacy of students in any educational.

MTBF (Mean Time Between Failures)

Quantifies (לִקְבּוֹעַ כָּמוּת) how long a new or repaired system will run before failing

Quantitative and Qualitative risk assessment

Quantitative risk assessment excels at analyzing financial risk(tangible risks), while a qualitative risk assessment is a good tool for intangible risks

Application banner information

Recorded during Discovery penetration testing phase. Banner information is typically gathered as part of discovery to provide information about what version and type of service is being provided.

A commonly recommended set point temperature

Range for a data center is 68-77 F (20-25°C).

RAD (Rapid Application Development)

Rapidly develops software via the use of prototypes, "dummy" GUIs, back-end databases, and more. The goal of RAD is quickly meeting the business need of the system.

Patents

Require public disclosure and have expiration dates

Mandatory vacation programs

Require that employees take continuous periods of time off each year and revoke their system privileges during that time.

RAID 0 (disk striping)

Requires at least two disks to implement. It improves performance of the storage system but does not provide fault toleranc

The Communications Assistance to Law Enforcement Act (CALEA)

Requires that all communications carriers make wiretaps (האזנות סתר) possible for law enforcement officials who have an appropriate court order.

The California Online Privacy Protection Act

Requires that commercial websites that collect personal information from users in California conspicuously post a privacy policy

Durability (עמיד)

Requires that once a transaction is committed to the database it must be preserved.

Durability (עמידות)

Requires that once a transaction is committed to the database it must be preserved.

Isolation

Requires that transactions operate separately from each other.

Children's Online Privacy Protection Act (COPPA).

Requires that websites obtain advance parental consent for the collection of personal information from children under the age of 13.

SCP

Secure Copy is a secure file transfer method

Skip should use SCP

Secure Copy is a secure file transfer method

Forensic imaging

Should be used during the incident response process

Senior managers play several business continuity planning roles

Setting priorities, obtaining resources, and arbitrating (בורר) disputes among team members

A Shadow Databas

Shadow database mirrors all changes made to a primary database, but clients do not access the shadow

Annualized Loss Expectancy (ALE) =

Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO)

Web application firewalls (WAFs)

Sit in front of web applications and watch for potentially malicious web attacks, including cross-site scripting.

CAC (Common Access Card)

Smart card used by US Government.

Advanced Encryption Standard (AES)

Supports encryption with 128-bit keys, 192-bit keys, and 256-bit keys.

Frame Relay

Supports multiple private virtual circuits (PVCs), unlike X.25. A minimum bandwidth guarantee provided by the service provider to customers.

A Preaction fire

Suppression (דיכוי) system activates in two steps.

Active monitoring is also known as

Synthetic monitoring and relies on prerecorded or generated traffic to test systems for performance.

Syslog (Uses UDP port 514)

Syslog is a way for network devices to send event messages to a logging server - usually known as a Syslog server.

In a manual recovery approach,

System does not fail into a secure state, requires an administrator to manually restore operations.

Configuration management practices associated with

System security will involve tasks such as disabling unnecessary services; removing extraneous programs; enabling security capabilities such as firewalls, antivirus, and intrusion detection or prevention systems; and configuring security and audit logs.

Traditional private branch exchange (PBX)

Systems are vulnerable to eavesdropping (ציתות) because voice communications are carried directly over copper wires. Physically securing access to the lines

Data loss prevention (DLP)

Systems may identify sensitive information stored on endpoint systems or in transit over a network

TGS (Ticket-Granting Service)

TGS then issues a ticket and Kerberos service generates keys to the client.

During Kerberos process

TGT (Ticket Granting Tickets) sent to TGS (Ticket Granting Server)

Compilers (מְקַבֵּץ נְתוּנִים)

Take source code, such as C or Basic, and compile (לְלַקֵט) it into machine code.

Degaussing Tapes

Tapes can be erased by degaussing, but degaussing is not always fully effective, Data remanence is a becoming a concern.

Time of check to time of use (TOC/TOU) attacks

Target situations where there is a race condition, meaning that a dependence on the timing of actions allows impermissible actions to take place.

Mirai

Targeted "Internet of Things" devices

During a tabletop exercise

Team members come together and walk through a scenario without making any changes to information systems

During a Tabletop exercise

Team members come together and walk through a scenario without making any changes to information.

When Nikito flag the (/TEST) directory

Test directories often include scripts that may have poor protections or may have other data that can be misused.

Integration testing

Testing multiple software components as they are combined into a working system. Subsets may be tested, or Big Bang integration testing is used for all integrated software components.

Installation Testing

Testing software as it is installed and first operated.

Dynamic testing

Tests software in a running environment

Use case testing

Tests valid use cases

The *-Integrity Property states

That a subject cannot modify an object at a higher integrity level than that possessed by the subject.

Business impact analysis (BIA)

The BIA identifies critical business or mission requirements and includes elements such as Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs), but it doesn't identify solutions.

CMP (Crisis Management Plan)

The CMP is designed to provide effective coordination among the managers of the organization in the event of an emergency or disruptive event.

The law serves as the basis for privacy rights in the United States is:

The Fourth Amendment directly prohibits government agents from searching private property without a warrant and probable cause.

HITECH- Health Information Technology for Economic and Clinical Health Act

The HITECH Act was created to motivate the implementation of electronic health records (EHR) and supporting technology in the US.

System A should send an ACK to end the three-way handshake.

The TCP three-way handshake is SYN, SYN/ACK, ACK.

The U.S. Department of Commerce oversees Privacy Shield.

The U.S. government agency oversees compliance with the Privacy Shield framework for organizations wishing to use the personal data of EU citizens.

Fault Tolerance (סבלנות לתקלות)

The ability for a system to respond to unexpected failures or system crashes as the backup system immediately and automatically takes over with no loss of service.

Recovery Time Objective (RTO)

The length of time it will take to recover.

Baselines provide

The minimum level of security that every system throughout the organization must meet.

Scrum

The most common framework for Agile Development.

Initiation

The need for a system is expressed and the purpose of the system is documented.

The GDPR does include the need to collect information for specified, explicit, and legitimate purposes:

The need to ensure that collection is limited to the information necessary to achieve the stated purpose; and the need to protect data against accidental destruction.

After detection of a security incident

The next step in the process is responsd

After detection of a security incident

The next step in the process is response

Data Hiding

The object provides encapsulation, we do not know, from the outside, how the object performs its function.

Data loss prevention (DLP) systems

specialize in the identification of sensitive information

Disposal (הִפָּטְרוּת)

The secure decommission (פירוק) of a system

When using symmetric cryptography

The sender encrypts a message using a shared secret key and the recipient then decrypts the message with that same key.

When using symmetric cryptography,

The sender encrypts a message using a shared secret key and the recipient then decrypts the message with that same key.

Assurance

The software is free from vulnerabilities and functions in an intended manner (דרך מיועדת)

When the system owner that responsible for the system have significant change.

The system owner should update the system security plan

Linux system (During scanning)

The system shows X11, as well as login, shell, and nfs ports, all of which are more commonly found on Linux systems.

Dynamic Host Configuration Protocol (DHCP).

This protocol assigns a specific IP address to each device that is connected to the network.

During a parallel test

The team activates the disaster recovery site for testing but the primary site remains operational.

During a parallel test

The team actually activates the disaster recovery site for testing but the primary site remains operational.

During a parallel test:

The team actually activates the disaster recovery site for testing, but the primary site remains operational.

During a full interruption test

The team takes down the primary site and confirms that the disaster recovery site is capable of handling regular operations.

In a gray box test

The tester evaluates the software from a user perspective but has access to the source code as the test is conducted.

Self-service password reset tools

Typically have a significant impact on the number of password reset contacts that a help desk has.

EMI (electromagnetic interference)

This includes circuits, power cables, network cables, and many others.

Slack Space

This leftover space, it may contain old data, or it can be used intentionally by attackers to hide information.

Third-party organization that processes data (In the EU)

Under EU regulations, both the organization sharing data and the third-party data processor bear (לָשֵׂאת) responsibility for maintaining the privacy and security of personal information.

Abstraction (הפשטה)

Uses a black box approach to hide the implementation details of an object from the users of that object. Is the process of hiding the operational complexty of the system from te system user.

The meet-in-the-middle attack (2DES vulnerable)

Uses a known-plaintext message and uses both encryptions of the plaintext and decryption.

Skip

Use SCP—Secure Copy is a secure file transfer method.

Data at rest encryption

Use Symmetric encryption like AES

Authenticated scans

Use a read-only account to access configuration files, allowing more accurate testing of vulnerabilities

Class C fire extinguishers (מטף)

Use carbon dioxide or halon suppressants and are useful against electrical fires.

Class B fire extinguishers (liquid-based fires)

Use carbon dioxide, halon, or soda acid as their suppression material and are useful against liquid-based fires

Misuse case diagrams

Use language beyond typical use case diagrams, including threatens and mitigates.

Multipartite viruses

Use multiple propagation mechanisms to defeat system security controls but do not necessarily include techniques designed to hide the malware from antivirus software.

Multipartite (רב-חלקי) viruses

Use multiple propagation mechanisms to spread between systems.

PERT charts- Used to schedule, organize, and coordinate tasks within a project

Use nodes to represent milestones or deliverables and then show the estimated time to move between milestones.

Proximity card

Use of an eletcromagnetic coil inside the card

The Simple Integrity Property

User can't write data to a higher integrity level than their own

Before granting any user access to information, should verify:

User has an appropriate security clearance, as well as a business, need to know the information in question.

The *-Security Property

Users can't write data to a lower security level than their own

Verification

Validates security controls.

Once a vulnerability scanner identifies a potential problem

Validation is necessary to verify that the issue exists.

Statement coverage tests

Verify that every line of code was executed during the test

Identity proofing.

Verifying information that an individual should know about themselves using third-party factual information (a Type 1 authentication factor).

A master boot record (MBR)

Virus redirects the boot process to load malware during the operating system loading process.

EAP (Extensible Authentication Protocol)

Was originally intended to be used on physically isolated network channels and did not include encryption

The Rijndael block cipher

Was selected as the winner and is the cryptographic algorithm underlying the Advanced Encryption Standard (AES).

Directory traversal (מעבר) attack

Where the attacker attempts to force the web application to navigate up the file hierarchy and retrieve a file that should not normally be provided to a web user.

Rings 0-2 run in privileged mode

Whereas Ring 3 runs in user mode

Static analysis

Which analyzes non running code.

Static Analysis

Which analyzes non-running code.

Parameterization

Which can help avoid SQL injection

Penetration testers often use penetration testing tools,

Which include the open-source Metasploit, closed-source Core Impact, Immunity Canvas.

TDL (top level domain)

Which is part of the global DNS

Bridge

Workstation or other device is connected simultaneously to both a secure and a non-secure network like the Internet. Can cause bypassing.

Integrity verification software

Would protect against this attack by identifying unexpected changes in protected data.

Out-of-band identity proofing

Would use to contacting the user, like a text message or phone call, and password verification requires a password.

Directional antenna

Yagis, panel antennas, cantennas, and parabolic antennas are all types of

If the CER does not fit the needs of the organization

You should assess other biometric systems.

FIFO (first in, first out) (also called round robin)

You will use each tape in order and cycle back to the first tape.

RAID- Redundant (גודש) Array (מַעֲרָך) of Independent Disks

level 0 is also known as disk striping. RAID 1 is called disk mirroring. RAID 5 is called disk striping with parity (Redundancy (גודש) check). RAID 10 combines disk mirroring and disk striping to protect data

The formula for determining the number of encryption keys required by a symmetric algorithm

six users and would like to use symmetric: Encryption algorithm ((n*(n-1))/2). With six users, you will need ((6*5)/2), or 15 keys

Here is a summary of common circuits, T Carriers (United States) and E Carriers (Europe)

• A T1 is a dedicated 1.544-megabit circuit that carries 24.64 kbit/s DS0 (Digital Signal 0) channels. • A T3 is 28 bundled T1s, forming a 44.736-megabit circuit. • An E1 is a dedicated 2.048-megabit circuit that carries 30 channels. • An E3 is 16 bundled E1s, forming a 34.368-megabit circuit.

Recommended replacements for Halon:

• Argon • FE-13 • FM-200 • Inergen

The following are common types of electrical faults:

• Blackout: prolonged (מְמוּשָׁך) loss of power • Fault: short loss of power • Surge: prolonged high voltage • Spike: temporary high voltage • Sag: temporary low voltage • Brownout: prolonged low voltage

The five modes of DES are:

• Electronic Code Book (ECB) • Cipher Block Chaining (CBC) • Cipher Feedback (CFB) • Output Feedback (OFB) • Counter (CTR) Mode

The Time of Check to Time of Use (TOC/TOU) attack

Exploits timing differences between when a system verifies authorization and software uses that authorization to perform an action.

Kerberos

Relies on properly synchronized time on each end of a connection to function. out of sync if the local system time is more than five minutes.

Asynchronous communications

Rely on a built-in stop and start flag or bit.

Spoofing attacks

Rely on falsifying (זיוף) an identity like an IP address or hostname without credentials.

Pair programming

Requires two programmers to work together, with one writing code and the other reviewing and tracking progress.

Two-person control

Requiring simultaneous action by two separate authorized individuals to gain access to the encryption keys.

NIST SP 800-60 diagram

Security categorization and determine controls.

SSH (Secure Shell)

Is a secure command-line and login protocol,

WEP (Wired Equivalent Privacy)

Is a security algorithm for IEEE 802.11 wireless networks.

SSAE 18

Is a series of enhancements aimed to increase the usefulness and quality of SOC reports (Soc 1/2/3)

Firewalls type:

- Packet-filtering firewalls - Circuit-level gateways - Stateful inspection firewalls - Application-level gateways (a.k.a. proxy firewalls) - Next-gen firewalls - Software firewalls - Hardware firewalls - Cloud firewalls

Information share data, Internal business data, Trade secret data:

-Information shared data with customers it's public - An internal business could be sensitive or private - Trade secrets data are proprietary (קנייני)

Kerberos infrastructure contain

-Key distribution center (KDC) provides authentication services -Ticket-granting tickets (TGTs) provide proof that a subject has authenticated and can request tickets to access objects, -Authentication services (ASs) are part of the KDC

EU-U.S. Privacy Shield Principles

-Notice -Choice -Accountability for Onward Transfer -Security -Data Integrity and Purpose Limitation -Access -Recourse, Enforcement, and Liability

There are four types of passwords to consider when implementing access controls:

-Static passwords are reusable passwords that may or may not expire. -Passphrases (סיסמאות) are long static passwords, comprised of words in a phrase or sentence (replacing CISSP with "XYZZY") -One-time passwords may be used for a single authentication. - Dynamic passwords change at regular intervals (מרווחים) as Token.

Risks are the combination of a threat and a vulnerability.

-Threats are the external forces seeking to undermine security, such as the hacker in this case. -Vulnerabilities are the internal weaknesses that might allow a threat to succeed.

Incident Response Process

1. Preparation (training, writing incident response policies and procedures) 2. Detection (identification) 3. Response (containment) 4. Mitigation (eradication (עֲקִירָה)) 5. Reporting 6. Recovery 7. Remediation (תיקון) 8. Lessons learned (postincident activity, postmortem, or reporting)

The SDLC (Software Development Life Cycle) consists of seven phases , in the following order:

1. conceptual definition 2. functional requirements determination 3. control specifications development 4. design review, code review 5. system test review 6. maintenance 7. change management

Private IP address ranges

10.0.0.0 - 10.255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.255

RFC 1918 addresses are in the ranges

10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, 192.168.0.0 to 192.168.255.255.

CSIRT

A Computer Security Incident Response Team

CWE (Common Weakness Enumeration)

A dictionary of software vulnerabilities by MITRE

Dictionary attacks use (Like Orange1, OrangeD5d, Orange 546, Orangecoun)

A dictionary or list of common passwords. This attack shows a variety of passwords based on a similar base word.

Expert systems have two components:

A knowledge bank that contains the collected wisdom of human experts and an inference engine that allows the expert systems to draw conclusions.

Darknet

A monitored network without any hosts.

Warm site

A site that relies shared storage and backups for recovery.

Hot site:

A site with dedicated storage and real-time data replication, often with shared equipment that allows restoration of service in a very short time.

Security baselines provide

A starting point to scope and tailor security controls to your organization's needs.

According to NIST SP 800-18

A system owner should update the system security plan when the system they are responsible for undergoes a significant change.

According to NIST SP 800-18, (System Owner)

A system owner should update the system security plan when the system they are responsible for undergoes a significant change.

Honeypot

A system set up with intentional (מכוון) vulnerabilities

Salt

A unique salt should be created for each user using a secure generation method and stored in that user's record.

Fiber Channel over Ethernet (FCoE)

Allows Fiber Channel communications over Ethernet networks, allowing existing high-speed networks to be used to carry storage traffic

Decentralized access control allows IT administration to occur closer to the mission and operations of the organization.

Allows IT administration to occur closer to the mission and operations of the organization.

Nonrepudiation

Allows a recipient to prove to a third party that a message came from a purported source.

Take rule

Allows a subject to take the rights belonging to another object.

OpenID

Allows a user to use a single account to log into multiple sites, and Google accounts are frequently.

The Brewer-Nash model

Allows access controls to change dynamically based upon a user's actions.

API (Application Programming Interface)

Allows an application to communicate with another application or an operating system, database, network, etc

An application programming interface (API)

Allows external users to directly call routines within code.

The Diffie-Hellman algorithm

Allows for the secure exchange of symmetric encryption keys over a public network

Expert opinion evidence in court

Allows individuals to offer their opinion based upon the facts in evidence and their personal knowledge.

Identity as a service (IDaaS), or cloud identity

Allows organizations to leverage cloud service for IdM (identity management)

Information that is modifiable between a client and a server in STRIDE threat assessment

Also means that it is accessible, pointing to both tampering (לְהִשׁתַמֵשׁ לְרָעָה) and information disclosure

Polymorphic viruses

Alter their code on each system they infect to defeat signature detection.

The Federal Information Security Management Act (FISMA)

Applies to federal government agencies and contractors.

Fair Cryptosystem

Approach to key escrow, the secret keys used in communications are divided into two or more pieces.

Smart cards

Are a Type II authentication factor and include both a microprocessor and at least one certificate

Smart cards

Are a Type II authentication factor and include both a microprocessor and at least one certificate.

Reciprocal (הֲדָדִי) agreements

Are a bidirectional (דו - כיווני) agreement between two organizations in which one organization promises another organization that it can move in and share space if it experiences a disaster.

Security assessments

Are a holistic approach to assessing the effectiveness of access control. security assessments have a broader scope

Replay attacks

Are a more specific type of masquerading (לְהַעֲמִיד פָּנִים) attack that relies on captured network traffic to reestablish authorized connections

Limit checks

Are a special form of input validation that ensure the value remains within an expected range

Subjects

Are active entities that can access a passive object to retrieve information from or about an object.

ISDN, cable modems, DSL

Are all examples of broadband (פס רחב) technology that can support multiple simultaneous signals.

Routing Information Protocol (RIP), Open Shortest Path First (OSPF), and Border Gateway Protocol (BGP)

Are all routing protocols and are associated with routers.

Kerberos, KryptoKnight, and SESAME

Are all single sign-on, or SSO

Yagis, panel antennas, cantennas, and parabolic antennas

Are all types of directional antenna

Interviews, surveys, and audits

Are all useful for assessing awareness.

Usernames

Are an identification tool

Candidate keys

Are any attribute (column) in the table with unique values (SSN and name)

Electronic backups

Are archives that are stored electronically and can be retrieved in case of a disruptive event or disaster.

Mandatory access control systems

Are based on a lattice-based model. Lattice-based models use a matrix of classification labels to compartmentalize (למדר) data.

Trusted paths that secure network traffic from capture and link encryption

Are both ways to help prevent man-in-the-middle attacks

Fuzz testers

Are capable of automatically generating input sequences to test an application

Flows logging (also often called network flows)

Are captured to provide insight into network traffic for security, troubleshooting, and performance management.

UPS's (Uninterruptible (ללא הפרעה) Power System)

Are designed to protect against short-term power losses. UPS's have limited-life batteries and are not able to maintain sustained (ממושך) blackout.

Specifications (מפרט)

Are document-based artifacts (ממצאים) like policies or designs.

Machine languages

Are examples of first-generation programming languages

Machine languages

Are examples of first-generation programming languages.

Software tokens

Are flexible, with delivery options including mobile applications, SMS, and phone delivery.

Procedures

Are formal, mandatory documents that provide detailed, step-by-step actions required from individuals performing a task.

SMTP servers that don't authenticate users before relaying their messages

Are known as open relays

Macro viruses

Are most commonly found in office productivity documents such as Microsoft Word documents as .doc or .docx extension.

Business logic errors

Are most likely to be missed by automated functional testing.

Written works, such as website content.

Are normally protected by copyright law.

Erase commands in SSD (It is store and retrieve (לאחזר) data)

Are not consistently effective across multiple SSD brands.

Masquerading תחפושת(or impersonation) התחזות

Attacks use stolen or falsified credentials to bypass authentication mechanisms

Cross-Site Scripting (XSS) attacks

Attacks where the malicious user tricks the victim's web browser into executing a script through the use of a third-party site.

Session hijacking attacks

Attempt to steal previously authenticated sessions.

Neural (עצביים) networks

Attempt to use complex computational techniques to model the behavior of the human mind.

A disassembler

Attempts (לְנַסוֹת) to convert machine language into assembly

Root-cause analysis

Attempts to determine the underlying weakness or vulnerability that allowed the incident to be realized.

The Service Organizations Control

Audit program includes business continuity controls in a SOC 2

Requiring authentication

Can help provide accountability by ensuring that any action taken can be tracked back to a specific user.

CallerID

Can help with this but can be spoofed, making callback a better solution.

X.500

Is a series of standards defining directory services.

KRI- Key Risk Indicators

Can provide useful information for organizational planning and a deeper understanding of how organizations view risk, KRIs are not a great way to handle a real-time security response

A Captive Portal

Can require those who want to connect to and use Wi-Fi to provide an email address to connect.

Device fingerprinting via a web portal

Can require user authentication and can gather data like operating systems, versions, software information, that can uniquely identify systems.

Signature detection

It is the most effective technique to combat known malware.

Iris scans have a longer useful life than many other types of biometric factors:

Because they don't change throughout a person's lifespan (unless the eye itself is damaged.

Black box testing

Begins with no prior knowledge of the system

. Bind (In LDAP)

Bind operations are used to authenticate clients to the directory server, to establish an authorization identity

Retina scans

Can reveal additional information, including high blood pressure and pregnancy, causing privacy concerns.

Attribute-based information controls like those described in NIST SP 800-162

Can take many details about the user, actions, and objects into consideration before allowing access to occur.

L2TP (Layer 2 Tunneling Protocol)

Can use IPsec to provide encryption of traffic, ensuring confidentiality of the traffic carried via an L2TP VPN

Ionization-based smoke detectors

Contain a small radioactive source that creates a small electric charge.

Hybrid cloud and local authentication system

Can ensure that Internet or server outages are handled, allowing authentication to work regardless to the employee location.

Supply chain management

Can help ensure the security of hardware, software, and services that an organization acquires.

Unencrypted sessions to websites

Can be easily captured with a packet sniffer.

Network Access Control (NAC) systems

Can be used to authenticate users and then validate their system's compliance with a security standard before they are allowed to connect to the network.

Centralized access control

Can be used to provide single sign-on (SSO). where a subject may authenticate once, then access multiple systems.

Patents and trade secrets

Can both protect intellectual property in the form of a process. Trade secrets remain in force for as long as they remain secret.

Bluetooth active scans

Can determine both the strength of the PIN and what security mode the device is operating in

SOC 1, Type 1 -Financial statements

Contain financial statements and the opinion on the presentation of the service organization's system

Stand-alone mode,

Connects clients using a wireless access point but not to wired resources like a central network

Infrastructure mode

Connects endpoints (Like laptops) to a central network (Router), not directly to each other (2 laptops).

Object-based storage

Considered IaaS because it is a core infrastructure service, especially when the vendor providing it.

Warm sites

Contain the hardware necessary to restore operations but do not have a current copy of data.

Netflow data

Contains information on the source, destination, and size of all network communications.

Each incremental backup

Contains only the information changed since the most recent full or incremental backup.

Backup tape rotation scheme

Contains the Grandfather/Father/Son, Tower of Hanoi, and Six Cartridge Weekly schemes

The certificate revocation list

Contains the serial numbers of digital certificates issued

The Code of Federal Regulations (CFR)

Contains the text of all administrative laws promulgated by federal agencies.

NIST SP 800-34 (For business continuity and disaster recovery)

Contingency (חירום) Planning Guide for Federal Information System

In SOC Type II audits (audits occur in type 2)

Cover a period of time and do include an assessment of operating effectiveness.

Change management

Typically requires sign-off from a manager or supervisor before changes are made.

Someplace/somwhre you are

Describes location-based access control using technologies such as the global positioning system (GPS), IP address-based geolocation, or the physical location

Disclosure

Describes the actions taken by a security researcher after discovering a software vulnerability

Throughput (תפוקה)

Describes the process of authenticating to a biometric system.

X.509

Defines standards for public key certificates like those used with many smart cards.

System Center Configuration Manager (SCCM)

Designed to allow administrators to evaluate the configuration status of Windows workstations and servers.

A Security Information and Event Management (SIEM)

Designed to centralize logs from many locations in many formats and to ensure that logs are read and analyzed despite differences between different systems and devices.

LEAP, the Lightweight Extensible Authentication Protocol

Designed to handle problems with TKIP. Any modern hardware should support WPA2 and technologies like PEAP or EAP-TLS

BRP (Business recovery plan)/ Business Resumption Plan

Details the steps required to restore normal business operations after recovering from a disruptive event.

Incipient (התחלתי) stage (In case of fire)

During this stage, air ionization takes place, and specialized incipient fire detection systems can identify these changes to provide early warning of a fire.

The exposure factor calculated

Dy dividing the amount of damage by the asset value. For instance: $750,000 in damage divided by the $2 million facility value, or 37.5%.

PEAP (Protected Extensible Authentication Protocol)

Encapsulates EAP in a TLS tunnel, providing strong encryption.

Minimum security requirements for email

Encrypt sensitive email should be the focus of the organization's efforts for minimum security.

An individual creates a digital signature by

Encrypting the message digest with his or her own private key.

ESP's Transport mode

Encrypts IP packet data but leaves the packet header unencrypted

ESP's Transport mode

Encrypts IP packet data but leaves the packet header unencrypted.

All stateful inspection firewalls

Enforce an implicit deny (הכחשה מרומזת) rule as the final rule of the rulebase.

Group Policy

Enforced by Active Directory can ensure consistent logging settings and can provide regular enforcement of policy on systems

Fagan inspections

Follow a rigorous (קפדני), highly structured process to perform code review, using a planning, overview, preparation, inspection, rework, and follow-up cycle

When an individual receives a copy of a digital certificate

He or she verifies the authenticity of that certificate by using the CA's public key to validate the digital signature contained on the certificate.

System owner responsibilities that include

Helping to develop system security plans, maintaining the plan, ensuring training, and identifying.

Load balancing

Helps to ensure that a failed server will not take a website or service offline.

The U.S. Trusted Foundry program

Helps to protect the supply chain for components and devices by ensuring that the companies that produce and supply them are secure.

MAC (Mandatory access control) systems can be

Hierarchical- each domain is ordered and related to other domains above and below it. Compartmentalized (מחולק)- where there is no relationship between each domain. Hybrid- where both hierarchy and compartments are used

The recovery point objective (RPO)

Identifies the maximum amount of data, measured in time, that may be lost during a recovery effort.

Test or code coverage analysis

Identify the degree to which code testing applies to the entire application. The goal is to ensure that there are no significant gaps where a lack of testing.

Federation links

Identity information between multiple organizations

Biometric systems can face major usability challenges

If the time to enroll is long (over a couple of minutes) and if the speed at which the biometric system is able to scan and accept or reject the user is too slow.

Windows systems will assign themselves an APIPA address between 169.254.0.1 and 169.254.255.254

If they cannot contact a DHCP server (automatically provides and assigns IP addresses, default gateways and other network parameters to client devices.)

Static code analysis

Involves reviewing the code itself for flaws rather than testing the live software.

Segregation (הַפרָדָה) of Duties (SOD)

Is a basic building block of sustainable risk management and internal controls for a business

Fuzzing

Is a black-box testing method that does not require access to source code.

Combinatorial software testing

Is a black-box testing method that seeks to identify and test all unique combinations of software inputs

Lightweight Directory Access Protocol (LDAP)

Is a client/server protocol used to access and manage directory information.

Privilege creep

Is a common problem when employees change roles over time and their privileges and permissions are not properly modified to reflect their new roles.

SMTP (Simple Mail Transfer Protocol)

Is a communication protocol for electronic mail transmission, (Uses Port 25 TCP)

Software-Defined Networking (SDN)

Is a converged protocol that allows virtualization concepts and practices to be applied to networks

Radio Frequency IDentification (RFID) technology

Is a cost-effective way to track items around a facility

Meet-in-the-middle

Is a cryptographic attack against 2DES encryption

Coupling (צימוד)

Is a description of the level of interaction between objects.

The Smurf attack

Is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets.

Pseudoflaws

Is a false vulnerability in a system that may attract an attack

A pseudo flaw

Is a false vulnerability in a system that may attract an attacker

Fagan inspection

Is a highly formalized review and testing process that uses planning, overview, preparation, inspection, rework, and follow-up steps

Fagan inspection

Is a highly formalized review and testing process that uses planning, overview, preparation, inspection, rework, and follow-up steps.

A foreign key

Is a key in a related database table that matches a primary key in a parent database table.

Assembly language

Is a low-level computer programming language. Assembly language instructions are short mnemonics (זִכרוֹנִיוּת), such as "ADD," "SUB" (subtract), and "JMP" (jump), An assembler converts assembly language into machine language.

A Power spike

Is a momentary period of high voltage.

TLS (Transport Layer Security)

Is a network encryption protocol that may be used to protect sensitive information,

Wireshark

Is a network monitoring tool that can capture and replay communications sent over a data network, including Voice over IP (VoIP) communications.

Encapsulation

Is a process that adds a header and possibly a footer to data received at each layer before handoff to the next layer

Encapsulation

Is a process that adds a header and possibly a footer to data received at each layer before handoff to the next layer.

The spiral model

Is a software development model designed to control risk. The spiral model repeats steps of a project, starting with modest goals, and expanding outwards in ever-wider spirals called rounds.

Loopback address 127.0. 0.1

Is a special IP number (127.0.0.1) primarily used to validate that the locally connected physical network card is working properly and the TCP/IP stack installed.

AES (Advanced Encryption Standard)

Is a strong symmetric cipher that is appropriate for use with data at rest (As USB)

Blowfish

Is a symmetric block cipher that can be used as a drop-in replacement for DES or IDEA.

3 DES, officially the Triple Data Encryption Algorithm,

Is a symmetric-key block cipher, which applies the DES cipher algorithm three times to each data block

SLDC (Systems Development Life Cycle)

Is a system development model, SDLC is used across the IT industry.

A security audit

Is a test against a published standard, as PCI DSS standard.

Kerberos

Is a third-party authentication service that may be used to support SSO.

Jitter

Is a variation (שִׁנוּי) in the latency for different packets

Jitter

Is a variation in the latency for different packets

Vulnerability scanning

Is a way to discover poor configurations and missing patches in an environment.

OpenID

Is a widely supported standard that allows a user to use a single account to log into multiple sites, and Google accounts are frequently used with OpenID.

Active monitoring

Is also known as synthetic monitoring and relies on prerecorded or generated traffic to test systems for performance and other issues.

Service Provisioning Markup Language (SPML)

Is an OASIS developed markup language designed to provide service, user, and resource provisioning between organizations.

SAMPL

Is an algebraic modeling language

Clipping

Is an analysis technique that only reports alerts after they exceed (חורגים) a set threshold ( סף מוגדר ).

CHAP (Challenge-Handshake Authentication Protocol)

Is an authentication scheme used by Point-to-Point Protocol (PPP) servers to validate the identity of remote clients.

TKIP (Temporal Key Integrity Protocol)

Is an encryption protocol included as part of the IEEE 802.11i standard for wireless LANs, (replace WEP )

A redundant site

Is an exact production duplicate of a system that has the capability to seamlessly operate all necessary IT operations without loss of services to the end user of the system.

A callback to a landline phone number

Is an example of a "somewhere you are" factor bc of the fixed physical location of a wired phone.

The Low Orbit Ion Cannon (LOIC) attack

Is an example of a distributed denial-of-service attack.

Awareness training

Is an example of an administrative control

The Gramm Leach Bliley Act (GLBA)

Is an example of civil law.

Confinement (כליאה, Sand box)

Is an example of the use of a sandbox, the system restricts the access of a process to limit its ability to affect other processes running on the same system.

Metasploit -

Is an exploitation package that is designed to assist penetration testers. A tester using Metasploit can exploit (exploit) known vulnerabilities for which an exploit has been created or can create their own exploits using the tool

Developing a business impact assessment

Is an integral part of the business continuity planning effort.

ISO 27002

Is an international standard focused on information security, recommends security controls based on the industry best practices.

JavaScript

Is an interpreted (מפורש) language so the code is not compiled prior to execution, allowing owner to inspect the contents of the code.

OpenVAS (Can use it remotely)

Is an open source vulnerability scanning tool that will provide a report of the vulnerabilities that it can identify from a remote.

SAML - Security Assertion Markup Language(pronounced SAM-el)

Is an open standard for exchanging authentication and authorization data between parties.

Hardcopy data

Is any data that are accessed through reading or writing on paper rather than processing through a computer system.

A disaster

Is any event that can disrupt normal IT operations and can be either natural or man-made. Including Hacking, terrorism,flooding and fire.

An input validation attack

Is any malicious action against a computer system that involves manually entering strange information into a normal user input field.

Bcrypt

Is based on Blowfish , it is a replacement for the DES. Blowfish is a symmetric block cipher that uses a variable-length key, from 32 bits to 448 bits

The stored sample of a biometric factor

Is called a reference profile or a reference template.

Interpreted (פירוש) languages

Is compiled on the fly each time the program is run.

Test coverage

Is computed using the formula test coverage = number of use cases tested/total number of use cases.

The use of a probability/impact matrix

Is the hallmark (סימן ההיכר) of a qualitative risk assessment

SDD- Solid State Drive

Is the hardware component in a computer that stores data. (replace Hard Disk Drives (HDD)) In terms of destroying SSD, there is a problem with the built-in erase commands are not completely effective on some SSDs.

A cluster

Is the minimum size that can be allocated by a file system.

TEMPEST (a U.S. National Security Agency referring to spying on information systems through leaking emanations, including unintentional radio or electrical signals)

Is the name for a program aimed at capturing data from electronic emissions (פליטות אלקטרוניות)

The annualized rate of occurrence (ARO)

Is the number of times that risk analysts expect a risk to happen in any given year. Once every 200 years (1/200 years= 0.005%)

L2TP

Is the only one of the four common VPN protocols that can natively support non-IP protocols

The exposure (חשיפה) factor

Is the percentage of the facility that risk managers expect will be damaged if a risk materializes. (Dividing the amount of damage by the asset value)

Watermarking

Is the process of hiding digital information in a carrier signal.

The goal of the business continuity planning process

Is to ensure that your recovery time objectives are less than maximum tolerable downtimes (RTO<MTD)

The goal of a redundant array of inexpensive disks (RAID)

Is to help mitigate the risk associated with hard disk failures

Port Address Translation (PAT)

Is used to allow a network to use any IP address set inside without causing a conflict with the public Internet.

SDLC Waterfall

It is a sequential (רצף) model that divides software development into pre-defined phases.

The Trusted Computing Base (TCB)

It is a small subset of the system contained within the kernel that carries out critical system activities

Fiber Distributed Data Interface (FDDI)

It is a token-passing network that uses a pair of rings with traffic flowing in opposite directions.

A Mantrap

It is a type of preventive access control, although its implementation is a physical control.

Service Provisioning Markup Language (SPML)

It is an XML-based language designed to allow platforms to generate and respond to provisioning requests.

SSAE-18 (Service Organizations (often referred to SOC)

It is an attestation (תְעוּדָה) standard, used for external audits, and forms part of the underlying framework for SOC 1, 2, and 3 reports

During developing an object-oriented model

It is desirable to have high cohesion and low coupling

Write blocker

It is forensic drive controller.

Declassification rarely chosen as an option for media reuse

It is more expensive than new media and may still fail

Entity integrity

Means each tuple has a unique primary key that is not null.

Dynamic signatures

Measure the process by which someone signs his/her name.

B. The five COBIT principles are:

Meeting stakeholder needs, covering the enterprise end-to-end, applying a single integrated framework, enabling a holistic approach, and separating governance from management.

The five COBIT (IT management framework) principles are:

Meeting stakeholder needs. Covering the enterprise end-to-end. Applying a single integrated framework. Enabling a holistic approach. Separating governance from management.

Crosstalk

Occurs when data transmitted on one set of wires is picked up on another set of wires.

The feedback model of composition theory

Occurs when one system provides input for a second system and then the second system provides input for the first system.

Privilege creep

Occurs when users retain from roles they held previously rights they do not need to accomplish their current job.

Credential management systems

Offer features like password management, multifactor authentication to retrieve passwords, logging, audit, and password rotation capabilities

Test directories

Often include scripts that may have poor protections or may have other data that can be misused

Network-enabled printers (Ports 515 and 9100)

Often provided services via TCP 515 and 9100, and have both nonsecure and secure web-enabled management interfaces on TCP 80 and 443.

In a zero-knowledge proof:

One individual demonstrates to another that they can achieve a result that requires sensitive information without actually disclosing the sensitive information.

The analysis of application logs is

One of the core tasks of software analysis.

Embedded (משובץ) Device Forensics

One of the greatest challenges facing the field of digital forensics is the proliferation (הִתרַבּוּת) of consumer-grade electronic hardware and embedded devices.

General Data Protection Regulation (GDPR)

Organizations only exchange personal information with other organizations bound by the EU.

On every business continuity plan task:

Organizations should train at least two individuals.

Parameterization

Prevent SQL inquiry attack.

Polyinstantiation

Prevent attackers from conducting aggregation or inference attacks.

The Simple Security Property

Prevents an individual from reading information at a higher security level than his or her clearance allows

The Simple Security Property (In Bell-LaPadula mode)

Prevents an individual from reading information at a higher security level than his or her clearance allows.

The Bell-LaPadula model

Prevents an individual from reading information that is classified at a level higher than the individual's security clearance

The two important risk elements that should weigh most heavily in your analysis of risk are

Probability and impact

Electronic signatures

Prove that the signature was provided by the intended signer.

Supervisory Control and Data Acquisition Systems (SCADA)

Provide a graphical interface to monitor industrial control systems (ICS)

Guidelines

Provide advice based on best practices developed throughout industry and organizations, but they are not compulsory. Compliance with guidelines is optional

Maintenance hooks

Provide developers with easy access to a system, but it is known as a backdoor bypassing normal security controls.

Credential management systems

Provide features designed to make using and storing credentials in a secure and controllable way.

Discretionary (שיקול דעת) Access Control (DAC)

Provide scalability by leveraging many administrators, and those administrators can add flexibility by making decisions about access to their objects.

The Transport layer

Provides logical connections between devices, including end-to-end transport services to ensure that data is delivered. Transport layer protocols include TCP, UDP, SSL, and TLS.

SOC 2- Technical audit, Controls assurance of customers data

Provides predefined, standard benchmarks for controls involving confidentiality, availability, integrity.

CHAP (The challenge-handshake authentication protocol)

Provides protection against playback attacks. It uses a central location that challenges remote users. used by Point-to-Point Protocol (PPP) servers to validate the identity of remote clients.

DMCA (Digital Millennium Copyright Act)

Provides safe harbor protection for the operators of Internet service providers

(SASL) The Simple Authentication and Security Layer for LDAP

Provides support for a range of authentication types, including secure methods.

BCI (Business Continuity Institute)

Published a six step Good Practice Guidelines (GPG). They represent current global thinking in good Business Continuity (BC) practice.

Mission owner's role

Responsible for making sure systems provide value.

Ring 0,1,2,3

Ring 0 is the kernel, rings 1 and 2 are used for device drivers, and ring 3 is user application space.

Data center humidity

Should be maintained between 40% and 60%

Input validation

Should be performed on the web application server. Ensures that the data provided to a program as input matches the expected parameters.

Self-signed digital certificates

Should be used only for internal-facing applications, where the user base trusts the internally generated digital certificate.

An organization pursuing a vital (חיוני) records management program

Should begin by identifying all of the documentation that qualifies as a vital (חיוני) business record.

Sending logs to a secure log server

Sometimes called a bastion(חוֹמַת מָגֵן) host, is the most effective way to ensure that logs survive a breach.

Protection Profiles (PPs)

Specify the security requirements and protections that must be in place for a product to be accepted under the Common Criteria.

The Open Vulnerability and Assessment Language (OVAL)

Standardizes steps of the vulnerability assessment process.

Layer 6 - Presentation Layer

Standards like JPEG, ASCII, and MIDI are used at the Presentation layer for data

OpenLDAP

Stores the user Password attribute (תכונה) in the clear.

The due care principle states

That an individual should react in a situation using the same level of care that would be expected from any reasonable person.

XP )is an Agile development method)

That uses pairs of programmers who work off a detailed specification

When a system is configured to use shadowed passwords.

The /etc/passwd file contains only the character x in the place of a password.

False Acceptance Rate (FAR)

The Method to deal with FAR is adding a second factor.

IaaS (Infrastructure as a Service)

The core capabilities of Iaas is providing servers on a vendor-managed virtualization platform.

In an IaaS server environment

The customer retains responsibility for most server security operations.

In a Paas (Platform as a Service Solution)

The customer supplies application code that the vendor then executes on its own infrastructure

In a platform as a service solution (Paas)

The customer supplies application code that the vendor then executes on its own infrastructure

Port 636

The default port for LDAP-S provides LDAP over SSL or TLS. The server supports encrypted connections

The last step of the certificate creation process is

The digital signature. The certificate authority signs the certificate using its own private key.

XOR is a binary operation (1's and 0's), it stands for "exclusive or"

The exclusive or (XOR) operation is true when one and only one of the input values is true.

During the preservation (אַכְסָנָה) phase

The organization ensures that information related to the matter at hand is protected against intentional or unintentional alteration (שינוי) or deletion (מחיקה)

Remote journaling urly

Transfers transaction logs to a remote site on a more frequent basis than electronic vaulting, hourly.

Remote Journaling (Transferring Data every hour)

Transfers transaction logs to a remote site on a more frequent basis than electronic vaulting, typically hourly.

Layer 6 -Presentation layer

Transforms data from the Application layer into formats that other systems can understand by formatting and standardizing the data

Network Address Translation (NAT)

Translates the IP addresses of computers in a local network to a single IP address.

TCP

Transports data over a network in a connection-oriented fashion

UDP

Transports data over a network in a connectionless fashion.

In reduction analysis, the security professional breaks the system down into five key elements:

Trust boundaries, data flow paths, input points, privileged operations, and details about security controls

In the community cloud computing model

Two or more organizations pool their resources to create a cloud environment that they then share

Type 1/2/3 authentication

Type 1 authentication (something you know) Type 2 (something you have) Type 3 (something you are)

Type 1 and Type 2 Errors

Type 1 errors occur when a valid subject is not authenticated. Type 2 errors occur when an invalid subject is incorrectly authenticated.

Team reviews

Typically done in a group

Asynchronous tokens

Use a challenge/response process in which the system sends a challenge and the user responds with a PIN and a calculated response to the challenge

Interface testing

Used to ensure that software modules properly meet interface specifications and thus will properly exchange data

Encryption is often

Used to protect traffic. Like bank transactions from sniffing.

The Waiting state

Used when a process is blocked waiting for an external event.

Compensation controls

Used when controls like the locks are not sufficient (מספיק)

War dialing

Uses a modem to dial a series of phone numbers, looking for an answering modem carrier tone. The penetration tester then attempts to access the answering system.

Passive monitoring

Uses a network tap or span (Switched Port Analyzer) port to capture traffic to analyze it without impacting the network or devices that it is used to monitor.

Direct inward (פְּנִימִי) system access (DISA)

Uses access codes assigned to users to add a control layer for external access and control of the PBX

Redundant Array of Independent Disks (RAID)

Uses additional hard drives to protect the server against the failure of a single device.

OOP (Object Oriented Programming)

Uses an object metaphor to design and write computer programs. An object is a "black box" that is able to perform functions

Manual testing

Uses human understanding of business logic to assess program flow and responses.

A high-availability cluster (also called a failover cluster)

Uses multiple systems that are already installed, configured, and plugged in, so that if a failure causes one of the systems to fail, another can be seamlessly leveraged to maintain the availability of the service or application being provided.

Multiprotocol Label Switching (MPLS)

Uses path labels instead of network addresses

Computer-aided software engineering (CASE)

Uses programs to assist in the creation and maintenance of other computer programs.

An application-level gateway firewall

Uses proxies for each service it filters

An application-level gateway firewall

Uses proxies for each service it filters.

Proactive monitoring, aka synthetic monitoring

Uses recorded or generated traffic to test systems and software

Proactive monitoring, aka synthetic monitoring.

Uses recorded or generated traffic to test systems and software.

Pattern testing

Uses records of past software bugs to inform the analysis.

Cross-site scripting

Uses reflected input to trick a user's browser into executing untrusted code from a trusted site.

Static code analysis

Uses techniques like control flow graphs, lexical analysis, and data flow analysis to assess code without running it.

The PGP email system

Uses the "web of trust" approach to secure email. It used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions.

The S/MIME secure email format

Uses the P7S format for encrypted email message.

The S/MIME secure email format

Uses the P7S format for encrypted email messages.

The whitelist approach

Uses the reverse philosophy and only allows approved software.

Provisioned

When a user's role changes, they should be provisioned based on their role and other access entitlements.

DNS poisoning occurs

When an attacker changes the domain name to IP address mappings of a system to redirect traffic to alternate systems.

Type 2 errors occur in biometric systems

When an invalid subject is incorrectly authenticated as a valid user.

Top Secret (The U.S. government's highest classification)

When data is stored in a mixed classification environment, it is typically classified based on the highest classification of data included.

Datagrams (Transport layer-UDP).

When data reaches the Transport layer, it is sent as segments (TCP) or datagrams (UDP)

Dirty reads occur

When one transaction reads a value from a database that was written by another transaction that did not commit.

Lost updates occur

When one transaction writes a value to the database that overwrites a value, causing those transactions to read an incorrect value

Regression testing

Which is a type of functional or unit testing, tests to ensure that changes have not introduced new issues.

Mantrap

Which is composed of a pair of doors with an access mechanism that allows only one door to open at a time

ESI (electronically stored information)

Which is typically acquired via a forensic investigation.

Call Tree/ Crisis Communications Plan

Which is used to quickly communicate news throughout an organization without overburdening any specific person.

Both TCP and UDP port numbers are a 16-digit binary number

Which means there can be 216 ports, or 65,536 ports, numbered from 0 to 65,535

Passive monitoring

Which uses a network tap or span port to capture traffic to analyze it without impacting the network or devices that it is used to monitor.

Here are the four classes of gates:

• Class I: Residential (home use) • Class II: Commercial/General Access (parking garage) • Class III: Industrial/Limited Access (loading dock for 18-wheeler trucks) • Class IV: Restricted Access (airport or prison)

The Common Criteria levels are:

• EAL1: Functionally tested • EAL2: Structurally tested • EAL3: Methodically tested and checked • EAL4: Methodically designed, tested, and reviewed • * EAL5: Semiformally designed, and tested • EAL6: Semiformally verified, designed, and tested • EAL7: Formally verified, designed, and tested

Agile software development evolved (התפתח) as a reaction to rigid (נוקשה) software development models such as the waterfall model (scrum and XP).

• Individuals and interactions over processes and tools • Working software over comprehensive documentation • Customer collaboration over contract negotiation • Responding to change over following a plan

Kerberos has the following components:

• Principal: Client (user) or service. • Realm (תְחוּם): A logical Kerberos network. • Ticket: Data that authenticates a principal's identity. • Credentials: A ticket and a service key. • KDC: Key Distribution Center, which authenticates principals. • TGS: Ticket Granting Service. • TGT: Ticket Granting Ticket. • C/S: Client Server, regarding communications between the two.