GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Security + _Chapter 2 _Introduction to Security Terminology

Kimberly Stover Security+ Certificate English 83 cards

Security + _Chapter 2 _Introduction to Security Terminology

Cards in this deck (83)

  1. 12.01GOALS OF INFORMATION SECURITY
  2. 2Fundamental goals of Information Security:-Confidentiality
    -Integrity (data integrity)
    -Availability (CIA)
  3. 3where only required persons can gain access to information and are able to read the informationConfidentiality
  4. 4used to keep information confidential-Permissions
    -Encryption
  5. 5administrators secure information by implementing permissions on files and folders or by building an access control list (ACL) on the files - you are controlling who can access the files Permissions only ensure that appropriate user accounts can get access to files, but when files are downloaded, you have nothing protecting the file contents from being read while the file is in transit this is where encryption plays its part.Permissions
  6. 6Setting file permissions is not enough to help maintain confidentiality puts the information in an unreadable format until an authorized person decrypts the information (which places it in a readable format)Encryption
  7. 7You can encrypt files at two levels:- in storage
    - in transit from one location to another
  8. 8Benefits of Encrypting-The benefit of encrypting in storage:
    If you encrypt data in storage and hacker circumvents permissions, you will have ensured that the data is unreadable
    -The benefits of encrypting in transit:
    you are encrypting the communication channel between the two systems. By encrypting in transit, you’ve ensured someone who taps into the communication cannot read the information they’ve tapped into
  9. 9another way to conceal information; it’s a method of hiding information such as a text file in a graphic file EX: the information is placed in the graphic file using a program, a password is placed on the file. After sending the graphic to the intended receiver, the intended receiver would use the steganography application to read the text information out of the file.Steganography
  10. 10E X A MOne of the main goals of information security is to keep information confidential. You can accomplish this by implementing encryption of data and communications, and by implementing access control concepts such as permissions.
  11. 11-ensures that data sent from a source to a destination has not been altered in the transition -if you store a file on the drive and open it later you can be certain that data has not been altered while in storageIntegrity
  12. 12Ensures data integrity when communicating over a network, the sending system runs the data through a mathematical algorithmHashing Algorithm
  13. 13sent with the data – the destination system runs the data through the same mathematical algorithm to generate an answerHash Value
  14. 14Info: The destination system calculates its own hash value, then compares it to the hash value sent with the message – the data has not been altered if the hash values are the sameInfo:
    Data integrity is also about data in storage.
    You may want to ensure that after a user stores a file, the file cannot be altered until the user opens the file again
  15. 15To verify the integrity of the file:-use a file integrity program that calculates hash values on the file when the file is saved
    -compare the stored hash value with the calculated hash value when the file is opened again
    -If the file has changed, the hash value will be different
    Notification that file has changed will be sent to user
  16. 16Ensuring integrity by hashing the dataEnsuring integrity by hashing the data
  17. 17Data Integrity Scenario's-Downloading files -
    Performing an integrity check on a downloaded file ensures that the file was not altered
    -Law Enforcement -
    When law enforcement agencies perform an investigation on supsect’s computer, they need to generate a hash value on the data before they look at it so that they can prove later in court that they did not plant the information; if evidence is questioned, the hash values of the data before and after are compared. If the same, then data was not altered.
  18. 18E X A MIntegrity involves ensuring the data that you send is what is received on the other end of the communication. Hashing is a popular technology used to ensure data integrity.
  19. 19Info: Implementing solutions such as permissions can help protect the data integrity of information, because if you control who's allowed to modify data, you can protect it from unauthorized changes
  20. 20Other Integrity Concepts-Digital signature
    -Certificate
    -Non repudiation
  21. 21-created on a message in order to prove the integrity of the sender -created using a person's private key -proves that the sender is who they say they are-Digital signature
  22. 22-an electronic file used to transport keys used to encrypt or digitally sign messages-Certificate
  23. 23-concept of ensuring that someone cannot dispute that they sent a message or made changes -can use digital signatures or auditing as a method to implement-Non repudiation
  24. 24The concept of ensuring that the information is available when the user wants itAvailability
  25. 25Solutions to implement to help maintain availability-Permissions
    -Backup
    -Fault tolerance
    -Clustering
    -Patching
  26. 26Helps ensures availability because if you limit who can delete the data, then chances are high it will still be available when needed-Permissions
  27. 27Ensures you perform regular backups of critical information so that if data becomes corrupt you can restore-Backup
  28. 28Implements data redundancy solutions to ensure the data is available so that if hard drive fails, the other drive have a copy-Fault tolerance
  29. 29-Ensures availability of services such as email or database servers; -Allows you to have multiple servers acting as one unit, so that if one fails you have the other server to take over-Clustering
  30. 30A system of applying service packs and security hot fixes helps reduce vulnerabilities in the system and reduces chances of attack-Patching
  31. 31E X A MAn overlooked function of Information Security is ensuring availability of data or service. Popular techniques to ensure availability are data backup and high-availability solutions such as RAID (Redundancy Array of Independent Disks) and clustering.
  32. 32Ensuring that employees are accountable for their actionsAccountability
  33. 33Info: The concept of accountability is if you log the activity and are able to identify who caused a certain event to occur, then you can hold that person accountable for their actions.
  34. 34Ways to implement Accountability:-Audit Files
    -Log Files
    -Firewalls and Proxy Servers
    -Application Logging
  35. 35-Most network services either implement logging by default or configure to log activity to log files -enable logging for all core services so that if an incident arises you can view logged data-Log Files
  36. 36Most operating systems have a security feature that allows you to review the security-related events that occur In Windows the security log is in Event ViewerAudit Files
  37. 37logs outbound user activity such as web sites that are visited and applications used for outbound communicationFirewalls and proxy servers
  38. 38Important for applications to log activity within the application; for critical applications, find out what levels of logging are available; this will help keep users accountable for their actions within the softwareApplication logging
  39. 39E X A MUnderstand CIA and different methods of implementing confidentiality, integrity and availability
  40. 402.02UNDERSTANDING AUTHENTICATION AND AUTHORIZATION
  41. 41Info: -Identification happens before authentication and is the process of having users identify themselves to the system -The most popular method used to identify individual users is to give each a unique username.Info:
    -The users type their username into the system to identify themselves
    After the user inputs the username and password for that account, the information is sent to an authentication system that’s responsible for verifying that username and password are valid.
  42. 42Methods used for identification and authentication*Username
    *Smartcard
    *Token
    *Biometrics
  43. 43*Most popular for identifying users on the network *To be authenticated they would type a password*Username
  44. 44A card the size of a credit card and has a microchip that contains data used by a system; once inserted into the system, user will need to type a PIN in order to authenticate the system*Smartcard
  45. 45A small device used to identify an individual and used in the authentication process displays a random number for 30/60 seconds Random number, username and password used to log on*Token
  46. 46The concept of using parts of your physical self to authenticate the system; you can scan a fingerprint or retina to authenticate the system*Biometrics
  47. 47—Smartcard used for authenticationSmartcard used for authentication
  48. 48—SecureID token used for authenticationSecureID token used for authentication
  49. 49Once user has been authenticated, they are given access to resourcesAuthorization
    **One of the most popular methods to authorization is to give the user permissions to a file/folder
  50. 50E X A MKnow that before you can be given access to resources, you must first identify yourself to the system.
    Your identification information is then verified against an authentication database to verify that you can gain access to the system or facility (this is known as authentication)
  51. 51Authorization*Permissions
    *Router ACLs
    *Proxy Servers
    *Facility
  52. 52You may authorize individuals to access a file. What is this called?*Permissions
  53. 53Example of implementing authorization by configuring access control lists; this determines whether the router is allowed to accept certain traffic and route to different networks*Router ACLs
  54. 54Example of authorization is allowing or denying access to different web content. A server on the network that all traffic headed out to the Internet passes through this can control what web sites can be visited or even what types of Internet applications can be used*Proxy Servers
  55. 55Example of authorization to control access to different areas of the building*Facility
  56. 56INSIDE THE EXAMIdentification is how you identify yourself in the system – such as username
    The verification of that identity is done by the specification of a password – which is the authentication process
    Once authenticated, you can access the system
    Once authenticated, the systems administrator can control what you can access on the system.
    EXAMPLE of authorization – is configuring the modify permission on a folder so that you are authorized to make changes to files in a folder
  57. 572.03UNDERSTANDING
    SECURITY PRINCIPLES AND TERMINOLOGY
  58. 58Types of SecurityPhysical
    Communication
    Computer
    Network
  59. 59Concept of being able to control who has physical access to the assets within an organization. Deals with controlling who gains entry to the premises by placing a fence around the perimeters Ex: most companies control access to servers by placing servers in the server roomPhysical Security
  60. 60Protects the information that is traveling between the source and destination by encrypting the communication EX: If user who has permission to file accessed the file from across the network, the file is downloaded to client computer, its possible for untrusted parties to tap into that communicationCommunication Security
  61. 61One of the most popular types of security Secures computer system by implementing a number of practices such as authentication, access control, data redundancy, malware protection, and system hardening techniquesComputer Security
  62. 62Controls who gains access to the network (switch security) and what type of traffic enters the network (firewalls) This is complemented by monitoring network traffic for suspicious activity (an intrusion detection system)Network Security
  63. 63Security PrinciplesLeast Privilege
    Separation of Duties
    Rotation of Duties
    Layered Security
    Diversity of Defense
    Due Care
    Due Diligence
  64. 64First principle of security you should follow when giving users and administrators access to resources such as systems or files Ensures that you always give a user the minimal permissions You don’t want to give more permissions than needed because user can then do more than expectedLeast Privilege
  65. 65Ensures that all critical tasks are broken down into different processes and that each process is performed by a different employee Keeps everyone honest and prevents fraudulent activity This will not protect you from collusion Ex: when the company decides to do a security assessment; the assessment should be done by a security professional and not a network administratorSeparation of Duties
  66. 66Benefits of Separation of DutiesEnsures accountability for employees actions
    EX: if Bob misuse his privileges; Sue will notice the following month and report it.
    The business does not depend on one person being the only person able to perform a job role
  67. 67When parties conspire together to commit a fraudulent actCollusion
  68. 68E X A MWhen multiple persons involved in a task get together and take part in fraudulent activity.
  69. 69Multiple employees rotating through different job rolesRotation of Duties
  70. 70the concept of not relying on one type of security solution to create a secure environment you will rely on many different types of security controls also known as defense in depth EX: Although firewalls are a critical part of security, if someone brings a flash drive that is infected, the firewall is not going to help protect the systemLayered Security
  71. 71the concept that you should use different products to increase the level of security although all products have vulnerabilities, the vulnerabilities are different for each of the products, and the hackers will have to work hard to get through EX: when designing firewall strategy, you will have multiple layers of firewalls, and its important to not use the same firewall product at each layerDiversity of Defense
  72. 72You give employees access only to information that they need to know about EX: Instead of giving all managers access to the accounting data, you ensure that only the accounting manager gets it and not the marketing managerConcept of Need to Know
  73. 73the concepts to ensure that the business is taking action to do the right thing to protect its employees and assetsDue Care
    &
    Due Diligence
  74. 74concept of doing the right thing its about implementing the correct security controls to ensure the protection of company assets EX: the creation of security policy, performing regular backups, and performing regular virus scans its about implementing an actionDue Care
  75. 75identifying your risk in order to know the security controls to put in place involves performing regular assessments and analyzing assessment results to identify security issuesDue Diligence
  76. 76a weakness in a piece of software/hardware created by manufacturer by accident once the hackers find weakness, they work on a way to exploit the weakness and compromise the systemVulnerability
  77. 77someone with knowledge to compromise a system, network or facilityHacker
  78. 78Type of hackerswhite hat hacker
    black hat hacker
    Script kiddie
  79. 79Security RolesOwner
    Custodian
    User
    Security Officer
  80. 80the person who decides how valuable the asset is and what types of security should be put in place to protect the asset decides the sensitivity of the information top secret upper level management and holds the ultimate responsibility of securing the asset and securityOwner
  81. 81the person who implements the security control based on the value of the asset determined by owner is the IT administrator who performs tasks such as backups, configuring permissions and firewalls, and hardening systemsCustodian
  82. 82the person who accesses the resources within the business and is considered a user of the asset is affected by security controls put in place by the custodian that was determined by the ownerUser
  83. 83the liaison between management (the owner) and the IT Staff (custodian) person responsible for making sure that policies are being followed by educating everyone on their role helps management understand the value of security put in place by ensuring they understand their legal responsibility and financial benefitSecurity Officer

Information

Description
CompTIA Security+ Certification Study Guide
Views
3
History
  • Created by Kimberly Stover · Jun 29, 2016
  • Copied by Kimberly Stover · Sep 15, 2016
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?