GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Introduction to cyber security

Hannah Kelly Cyber Sec English 81 cards

Cards in this deck (81)

  1. 1What is intrinsic assurance?Processes applies by the business/organisation which provides confidence during production of product/service/system.
    E.g. checking certifications of 3rd parties
  2. 2What is Extrinsic assurance?Security by design within products/systems/services. Independent of the developing environment that provides a level of trust.
  3. 3What is Operational Assurance?Processes that are already up and running to support and maintain product/system/service
  4. 4What is implementation assurance?Systems that are yet to be put in place.
  5. 5What is supply chain assurance?Ensuring 3rd parties are qualified and trusted to access sensitive information if they are needed too-e.g. Suppliers, professional services, outsources, customers, partners.
  6. 6What are the 6 steps to the information value & risk processes?1-Identify & classify information
    2-Map where information travels/goes to
    3-Assess risks
    4-Control risks
    5-Audit
    6-Monitor and evaluate
  7. 7Name some assurance processesvetting, audits, security control validators, background checking (open source intelligence), staff training, certification checks
  8. 8Name some assurance standards-Cyber essentials
    -NIST SP800
    -ISO2700
  9. 9Cyber Essentials is..-UK Government standard,
    -Holds 5 key control areas for IT system configuration
    -Certifies organisations & accredits certific bodies
    -Organisations declare use w/ independent validation of evidence
  10. 10What are the 5 control areas for IT system configuration enforced by Cyber Essentials?1- Implement boundary firewalls &Internet gateways
    2-Secure configuration
    3-User access controls
    4-malware protection
    5- Patch management
  11. 11ISO 27001 is..-An international standard for implementing Information Security Management Systems (ISMS)
    -UKAS is responsible for accreditation
    -Renewal every 3 years
  12. 12Common Criteria is...-Standardised as ISO 15408, 3.1 Jan 2017
    -International standard for technology security verification
    -Framework of independently verified products
    -Developed by 3 previous standards
  13. 13Common Criteria: Target of Evaluation 1st Key Concept-Thing that is being evaluated (e.g. SW, HW, IT product, part of an IT product/s
    -TOE should not misinterpreted as evaluation of the whole entity
  14. 14Common Criteria: Protection Profile 2nd Key Concept-Intended to describe a TOE e.g. firewall. The same PP can be recycled for multiple security targets.
    -Describes TOE requirements, determines type of conformance
  15. 15Common Criteria: Security Target 3rd Key Concept-InfoSec assurance & functional requirements for product/TOE
    -Description of security problems/threats
    -Refers to one or more PP
  16. 16Common Criteria: Security Requirements 4th Key Concept-Security functional requirements & assurance requirements
  17. 17Common Criteria: Evaluation Assurance Levels 5th Key ConceptEAL1-Functionally tested
    EAL2-Structurally tested
    EAL3-Methodically tested & checked
    EAL4-Methodically designed,tested,review
    EAL5-Semi-formally designed & tested
    EAL6-Semi-formally verified design &".."
    EAL7-Formally verified design & tested
  18. 18Trustworthy Software Framework 5 points1-Safety; operate without causing harm
    2-Reliability; operate correctly
    3-Availability; when required
    4-Resilience; recover from errors quickly
    5-Security; protected against hazards
  19. 19EQ- "What security assurance model could not be evaluated by existing security evaluation criteria?"Intrinsic assurance (internal processes). It can not be evaluated by existing security evaluation criteria as it does not cover independent security evaluation
  20. 20EQ- in ISO 27001, what is the main link between the risk assessment, treatment and controls selected?Statement of applicability- Its a matrix of suggested controls & their status (e.g. NA, implemented, and to be implemented)
  21. 21What 2 main reports are produced with ISO 27001 based on the risk assessment, for audit & certification processes?-Statement of Applicability
    -Risk Treatment Plan
  22. 22EQ- Assurance that the process of specification, implementation & evaluation of a computer security product has been conducted in a rigorous, repeatable standard and is internationalCommon Criteria
  23. 23WWW pages that are not indexed by dark web pages are?..Darknets
  24. 24Information assurance is gained through what 4 topics?Confidentiality, Availability, Integrity, Non-Repudiation
  25. 253rd party streams that help improve an organisations threat awareness and responses?Threat intelligence feed is an ongoing stream of data related to potential or current threats to an organisations security
  26. 26A technique used by risk managers to forecast future events e.g. accidental and business lossesTreno Analysis
  27. 27A DNS technique used by botnets to hide phishing & malware sites behind proxiesFast Flux
  28. 28How is SSL v3.0 beter than SSL v2.0?A man-in-the-middle adversary can influence the cryptographic suite in SSL v2.0
  29. 29What isn't significant in developing new attack techniques?Failure to patch old systems & failure of users to create complex passwords
  30. 30Describe a scenario that might allow cross-site request forgery to occur?When a post parameter preforms an operation on behalf of a user without validation
    -XS request forgery forces a user to execute unwanted actions on a web app in which is currently authenticated.
  31. 31What does a thick client do?Does the bulk of processing rather than the server.
  32. 32Common Criteria is standardises as what?ISO 15408
  33. 33What 3 standards was Common Criteria developed from?-TCSEC -a US DoD "orange book"
    -ITSEC -European standard
    -CTCPEC- Canadian Standard
  34. 34What is the Trustworthy Software Foundation?-The TSFdn is trustworthy framework for trust levels and control sets
    -UK based
    -Successor to the Trustworthy Software Initiative 2016
  35. 35What are the 5 facets that give software the TSFdn?Safety-Operate without causing harm
    Reliability-Software to operate correctly
    Availability-Operate when required
    Resilience-Recover from errors quickly & completely
    Security-Remain protected against the hazards posed by malware, hackers or accidental misuse
  36. 36What is the trustworthiness level?-The TSFdn states software only requires a level of trustworthiness commensurate to the purpose for which it is used
    -A risk based approach to determine the trustworthiness level of the software- there are 4 assignable levels
  37. 37What 4 TSFdn levels are there?TL1- Essential practices -software T. in due diligence manner
    TL2- Assessed practises- Software trustworthiness in managed processes
    TL3- Software T. delivered by established processes
    TL4- Software T. delivered by predictable/optimising processes
  38. 38What are the controls set for trustworthy software?-Formalised through the British standards institution as PAS754:2014 as a specification for software trustworthiness.
    -Defined under 4 concepts
  39. 39What are the 4 concepts of PAS754:2014?-Governance
    -Risk
    -Controls (personnel, physical, procedural, technical)
    -Compliance
    Covering 30 principles & a further 150 techniques
  40. 40What is the Baseline Control Set?A comprehensive set of controls; SCUDA
    Scope for use, Coding practices, Use tools effectively, Detect management and Artefact management
    -Suitable for software assets with trustworthiness level 1 or 2
  41. 41Threat Intelligence is..Cyber attacks are constantly evolving ti counter security controls, exploit new technologies and vulnerabilities
  42. 42Penetration Testing is..Ethically finding as many security vulnerabilities as they can through hacking. This c an be automated or manual and shows where a system can be exploited.
  43. 43Red Teaming is...Trying to gain data anyway they can and as quietly as they can in order t test response and recovery. Takes longer than pen testing
  44. 44A logic time bomb is..Malicious code that executes when certain trigger conditions are met- date and time . are usually the main triggers,
  45. 45Fast flux is...DNS technique. Botnets hide phishing/malware delivery sites behind a changing network of compromised hosts acting as proxies
  46. 46Thick Client is..hardware that does a bulk of the processing activity rather than the server
  47. 47What are the 2 main reports for an ISO 27001 Risk Assessments1-Statement of applicability
    2-Risk treatment plan
  48. 48What are the 5 steps to an ISO risk assessment?-Establish a risk management framework
    -Identify risks
    -Analyse risks
    -Evaluate risks
    -Select risk treatment options.
  49. 49A hazard is a...Potential threat
  50. 50Risk is..An uncertain event that could negatively impact an organisations mission.
  51. 51What is the risk equation?Risk= impact x probability
  52. 52A vulnerability is a..Weakness that could be exploited by a threat source
  53. 53Security is..The establishment and maintenance of protective measures
  54. 54Impact areas in risk management are...-Financial, legal, H & S, productivity, user defined
  55. 55Threat scenarios come in what order?..Actor - Motive - Means- Outcome
  56. 56Attack methods includeMalware, malicious websites, DDos, social engineering, web app attacks, network interception
  57. 57Virus' need ..A host file & user activation
  58. 58Worms need..System processes to spread itself. Does not need host file. Does not need user activation
  59. 59Trojans need ..Genuine looking links within a trusting looking email/webpage. Does not self replicate, hopes to stay unnoticed.
  60. 60Rootkits do what?Modifies the OS in order to hide itself & other malware from detection. Can hide itself from AV if it manages to gain access to the Kernal.
  61. 61Spyware does what?Gathers information about an entity without them knowing
  62. 62How does rogueware operate?Tricks users into thinking malware is already on their computer in order to panic them into clicking a clink- this will download the malware
  63. 63DDoS is a newtork layer attack. Give examples of results of a DDoS-Protocol Exploitation
    -Malformed Packets
    -Flooding
    -Spoofing
  64. 64What do the following class as? -weak passwords, unpatched clients, legacy sw/hw, backdoors, default auth settingsNetwork & system vulnerabilities
  65. 65what are the 3 steps of social engineering?Research, develop, exploit.
  66. 66What is the purpose of security standards such as ISO 27001, Cyber Essentials, SANS 20 etc.Deter, Protect, Detect and React
    - or-
    Preventative, directive, detective, corrective
    -or-
    Physical, procedural, technical
  67. 67Example of PreventativeStop "it" happening.
    Firewalls, IPS, AV
  68. 68Example of DirectiveRestrict/contain attack
    Sandboxing
  69. 69Example of DetectiveIdentify attack/vulnerability & trigger review
    IDS, SIEM
  70. 70Example of CorrectiveRecover lost/damaged/stolen data
    Patches & back-ups
  71. 71Example of physicalPhysical barriers- Locks, bio-metrics, guards, boundary wall
  72. 72Example of proceduralVisitors policy, AUP, Visitor log book
  73. 73Example of technicalNetwork design & config, VLAN, protective software
  74. 74What is the kill chain?Step by step processes of a typical cyber attack
  75. 75What are the steps of the cyber kill chain?Reconnaissance, weaponisation, delivery, exploitation, installation, control, intent
  76. 76What direct laws are there and what relevance do they hold?Official secrets act- Privacy
    GDPR- Network & operational Security
    Computer misuse act- Data Theft
    Privacy & Electronic Communications act
  77. 77What is the cap for a GDPR/ICO fine?17m or 14% of annual turnover
  78. 78What are Information Security risk impact areas?Reputation, financial, productivity, safety and health
  79. 79What is integrity?A security objective
  80. 80An acceptable use policy is what kind of control?Protective and procedural
  81. 81an example of a network controlClosed loop through communication network

Information

Description
Module 1 of BCS intro to cyber security at lvl4 2 year course.
Created by
Hannah Kelly
Views
8
History
  • Created by Hannah Kelly · Feb 1, 2019
  • Copied by Hannah Kelly · Feb 1, 2019
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?