GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Chapter 1: Mastering Security Basics

Callie Smith English 102 cards

Cards in this deck (102)

  1. 1Security Triad: What are the 4 security goals?1) Confidentiality
    2) Integrity
    3) Availability
    4) Safety
  2. 2prevents the unauthorized disclosure of data (prevents authorized personnel from accessing the data)confidentiality
  3. 3what are the three ways to ensure confidentiality?1) encryption
    2) access controls
    3) steganography
  4. 4scrambles data to make it unreadable to unauthorized personnelencryption
  5. 5What is a good way to ensure confidentiality when using PII, data in databases, and data on mobile devicesencryption
  6. 6identification, authentication and authorization combined provide access and help ensure that only authorized personnel can access dataaccess controls
  7. 7what are the three key elements of access controls?1) identification
    2) authentication
    3) authorization
  8. 8users claim this with a unique user nameidentification
  9. 9users provide identity with this (password)authentication
  10. 10granting or restricting access to resources using this method, such as permissionsauthorization
  11. 11hiding data within data (ex: hiding txt files in an image)steganography
  12. 12provides assurance that data has not changed (ex: no one has modified, tampered with, or corrupted the data)integrity
  13. 13what are the three ways to ensure integrity?1) hashing
    2) digital signatures, certificates
    3) non-repudiation
  14. 14number created by executing an algorithm against data such as a file or message (can be created at source and destination or at two different times)hashing
  15. 15if hashes are the same then, if hashes are different then,integrity is maintained,
    integrity has been lost
  16. 16used for emails to distinguish user from attackerdigital signatures
  17. 17provided through digital signatures where someone cannot later deny sending an email because the signature proves they didnon-repudiation
  18. 18signatures require the use of what two things?1) certificates
    2) Public Key Infrastructure (PKI)
  19. 19data and services are available when needed (systems are up to date and operation to ensure bugs dont affect this)availability
  20. 20what are the two ways to ensure availability?1) redundancy and fault tolerance
    2) patching
  21. 21adds duplication to critical systems and provides fault toleranceredundancy
  22. 22a system with _______ ________ can suffer a fault thanks to duplicate redundancies, but tolerate it and continue to operationfault tolerance
  23. 236 examples of fault tolerance1) disk redundancies (RAID)
    2) server redundancies (failover cluster)
    3) load balancing
    4) backups
    5) alt power
    6) cooling system
  24. 24software vendors that fix bugs and release code that fixes these problemspatching
  25. 25individuals and an orgs assetssafety
  26. 26security practice of implementing several layers of protection (if one fails, you have several layers to protect you)layered security
  27. 27three examples of layered security1) firewalls
    2) intrusion detection system (IDS)
    3) proxy servers (for content filtering)
  28. 28any circumstance or event that has the potential to compromise confidentiality, integrity, or availabilitythreat
  29. 29a weakness (in HW, SW, the configuration, or even the users OS)vulnerability
  30. 30three examples of threats1) outside threats
    2) inside threats
    3) natural threats
  31. 31three examples of what threats can beman-made threats (malware)
    intentional threats (attackers)
    accidental threats (employee mistakes)
  32. 32reduces the chances that a threat will exploit a vulnerabilityrisk mitigation
  33. 33reduce risks by implementing?controls (countermeasures and safeguards)
  34. 34what are the two entities of user credentials for authentication?1) claimed identity (user presents credentials)
    2) authentication mechanism (authenticator verifies credentials)
  35. 35process of verifying that people are who they claim to be prior to issuing them credentialsidentity proofing
  36. 362nd form of identity proofing, where something such as a bank re verifies identity when a user transfers money across accts (ex: security questions)issuing credentials
  37. 37self service system that uses identity proofing to automate the process ex: forgot passwork links, phone based password resetspassword reset/password recovery system
  38. 38when admins can combine two factors of authenticationdual authentication
  39. 39when admins can combine multiple factors of authenticationmultifactor authentication
  40. 405 factors of authentication are1) something you know
    2) something you have
    3) something you are
    4) somewhere you are
    5) something you do
  41. 41example of something you knowpassword or PIN
  42. 42example of something you havesmart card or USB token
  43. 43example of something you arefingerprint, biometric identity
  44. 44example of somewhere you arelocation
  45. 45example of something you dogestures on a touch screen
  46. 46how can you create strong passwords?uppercase, lowercase, numbers, and special characters
  47. 47how often should you change passwords?regularly (65 to 90 days)
  48. 48what should you do before resetting a password?verify users identity
  49. 495 rules to keep passwords safe1) dont reuse same password
    2) implement acct lock out policies
    3) change default passwords
    4) dont write down
    5) dont share passwords
  50. 50keyspace formulaC^N (C to the Nth power)
    C: # of possible character uses
    N: length of password
  51. 51string of characters that has meaning to the userpassphrase
  52. 52max # of times user can enter passwordacct lockout threshold
  53. 53how long an acct remains lockedacct lockout duration
  54. 54credit-card sized cards that have embedded microchip and a certificate **provides confidentiality, integrity, authentication, and non-repudiationsmart cards
  55. 55requirements for a smart card are:1) embedded certificate (private and public key)
    2) public key infrastructure (PKI) (supports issuing and managing certificates)
  56. 56smart card key in an embedded certificate that is only accessed by userprivate key
  57. 57smart card key in an embedded certificate that is publicly available to otherspublic key
  58. 586 examples of something you have1) smart cards
    2) CAC
    3) PIV
    4) token or key fob
    5) HOTP
    6) TOTP
  59. 59what two exmaples in something you have provide dual factor authentication?CACs and PIV
  60. 60electronic device that contains a LCD that displays a number periodically ex: RSA IDstoken or key fob
  61. 61password that are valid for an unknown amount of timeHOTP (HMAC One time Password)
  62. 62password that keeps changing and are only valid for a short period of timeTOTP
  63. 63Something You Are: 5 Biometric Methods include:1) fingerprint and thumbprint
    2) handprint
    3) palm
    4) retina
    5) iris
  64. 64Biometric errors: 1) system identifies unauthorized user as an authorized user 2) system incorrectly rejects authorized user1) false acceptance
    2) false rejection
  65. 65group of technologies used to identify a users location; what can you use for this?geolocation
    a computer name or MAC address
  66. 66authentication system uses what for geolocationinternet proocol
  67. 67time a key is presseddwell time
  68. 682 examples of something you do1) dwell time
    2) flight time
  69. 69time between releasing one key and pressing the nextflight time
  70. 703 examples of dual factor authentication1) smart card and PIN
    2) USB token and PIN
    3) smart card and password
  71. 713 examples of Authentication Services1) Kerberos
    2) LDAP and Secure LDAP
    3) Single Sign-On
  72. 72provides mutual authentication that can help prevent the man-in-the-middle attacks and uses tickets to help prevent replay attacksKerberos
  73. 733 requirements for Kerberos1) method of issuing tickets used for authentication
    2) time sychronization
    3) db of subjects of users
  74. 74single key for encryption and decryption of datasymmetric encryption
  75. 75uses two keys, one to encrypt one to decrypt (PKI public and private key)asymmetric encryption
  76. 76accesses directory services that contains objects related to users, groups, computers, printers, specifically X.500-based directory servicesLightweight Directory Access Protocol (LDAP)
  77. 77db of objects that provides a central access point to manage users, computers, and other objects (LDAP gives you query methods to add, update, remove objects within this)directory
  78. 78directory of objects (computers, users) that provides a single location for object managementActive Directory
  79. 79Example of an LDAP string: a user named Homer in the users container within the GetCertifiedAhead.com is identified with this string: identify the acronyms LDAP://CN=Homer, CN = Users, DC=GetCertifiedAhead.com,DC=comCN=Homer: common name
    CN=Users: container
    DC=GetCertifiedAhead.com:domain component
    DC=com: 2nd domain component
  80. 80uses encryption to protect LDAP transmissions --what encrypts this data before transmission?Secure LDAP
    Transport Layer Security (TLS)
  81. 81the ability of a user to log on or access multiple servers within a network to perform normal work **user only needs to log on to a network onceSingle Sign-On
  82. 82creates an indirect trust relationshipSSO & Transitive Trusts
  83. 83Example of?: Homers user account is the training domain. Within this, it is possible to grant Homer access to the Cosington server in the blog domain with out creating another trust relationship between the 2 childrenLDAP Transitive Trust used for SSO
    (parent domain speaks to children, but children only speak to parents and not to each other)
  84. 84system can connect authentication mechanisms from different environments, such as different operating systems and different networksSSO and a Federation
  85. 85Example Of?: joining a power plant and school system network where the power plant can sign on to the school systems network once to use itSSO and a Federation
  86. 86an Extensible Markup Language (XML)-based data format used for SSO on web browsersSecurity Assertion Markup Language (SAML)
  87. 87Example of?: two websites hosted by two different organizations: if orgs trust each other they can use this as a federated identity management systemSSO and SAML
  88. 88Roles of SAML are: 1) users log on once, sometimes asks for identity 2) creates, maintains, and manages identity information for principals 3) entity that provides services to principals1) principal
    2) identity provider
    3) service provider
  89. 89provides access to an internal network from an outside sourceRemote Access Server (RAS)
  90. 90allows a client to access a private network over a public network, such as the InternetVIrtual Private Network (VPN)
  91. 91Remote Access Authentication Mechanisms are: (8):1) PAP
    2) CHAP
    3) Microsoft-CHAP
    4) MS-CHAP v2
    5) RADIUS
    6) Diameter
    7) XTACACS
    8) TACACS+
  92. 92a more efficient method of connecting to remote servers such as Internet Service Providers (ISP) using Point-to-Point Protocol (PPP)Password Access Protocol (PAP)
    significant security risk
  93. 93authenticates remote users and uses PPP, but more secure than PAPChallenge Handshake Authentication Protocol (CHAP)
  94. 94Example of a remote access authentication mechanism: client can pass credentials over a public network (such as a phone or internet) without allowing attackers to intercept dataChallenge Handshake Authentication Protocol (CHAP)
  95. 95created by Microsoft, has the ability to perform mutual authentication (assures servers identity before client transmits data)Microsoft-CHAP & Microsoft-CHAP v2
  96. 96centralized authentication service (instead of each individual needing a separate database to identify who can authenticate, authentication requests are forwarded to a central ______ server)Remote Authentication Dial In User Service (RADIUS)
  97. 97Example of?: Clients that user AOL servers located in different cities can speak to this one centralized serverRADIUS
  98. 98upgrade of RADIUS and uses Extensible Authentication Protocol (EAP) which enhances securityDiameter
  99. 99Cisco alternative to RADIUSTACACS+
  100. 100What are the two benefits to TACACS+?1) encrypts entire authentication process (RADIUS only encrypts password)
    2) uses multiple challenges and responses between client and server (you can authenticate users before they have access to a router or switch)
  101. 101provides authentication, authorization, and accounting (tracks user access with logs)AAA protocols
  102. 102examples of AAA protocols?RADIUS and TACACS+

Information

Description
Flashcards on Chapter 1: Mastering Security Basics, created by Callie Smith on 31/03/2017.
Created by
Callie Smith
Views
0
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?