Flashcards
sec + midterm
Flashcards do conjunto (49)
- 1a concept that indicates exposure to the chance of damage or lossRisk
- 2Which algorithm is a hashing encryption algorithm?Secure Hash Algorithm (SHA)
- 3Personal info, company info, and info about intellectual property must be protectedPrevention
- 4CIA triad includes:Confidentiality
Integrity
Availability - 5A system in which objects are assigned security labels of varying levels, depending on the object's sensitivityMandatory Access Control (MAC)
- 6physical or virtual objects, such as smart cards, ID badges, or data packets, that store authentication informationTokens
- 7a type of authentication that relies on detailed info that describes exactly when a keyboard key is pressed and released as someone types info into a computerKeystroke Authentication
- 8this algorithm is modeled after MD5 and is considered the stronger of the twoSecure Hash Algorithm (SHA)
- 9an email-based or web-based attack that is intended to trick the user into performing undesired actions, such as deleting files in an attempt to remove a virusHoax
- 10an increasingly popular variety of malware in which an attacker infects a victim's computer with code that restricts the victim's access to their computer or the data on itRansomware
- 11a formalized statement that defines how security will be implanted within a particular organizationSecurity Policy
- 12a virus that is able to alter its decryption module each time it infects a new filePolymorphic malware
- 13they attempt to trick or shield themselves from antivirus software and security professionalsArmored viruses
- 14an attack that occurs when the security level of a system is at its lowest, immediately after the discovery of a vulnerabilityZero day exploit
- 15a type of network attack in which an attacker attempts to disrupt or disable systems that provide network services by various meansDenial Of Service (DOS) attack
- 16Data security must be applied at every level of an organization including :The physical environment : All devices and systems : All mobile devices used for business
- 17refers to gaining access to data through unintentional user methods such as email and instant messaging, and the use of mobile devicesData Leakage
- 18the practice of monitoring for, obtaining, evaluating, testing, and deploying software patches and updatesPatch management
- 19an attacker takes advantage of the trust established between an authorized user of a website and the website itself. It exploits a web browser's trust in a user's unexpired cookiesCross-site request forgery (XSRF)
- 20For relational databases, security measures include:-Role-based security config parameters
-Encrypted comms
-Access control
-User-level permissions for stored procedures - 21a hardware, firmware, and software component of a computer system that is responsible for ensuring that the security policy is implemented and the system is secureTrusted Computing Base (TCB)
- 22the screen lock option on all mobile devices should be enabled with strict requirements on when the device will be lockedEnable screen lock
- 23the process of actively adding geographical identification metadata to an app or its dataRestrict geo-tagging
- 24You may need to re-evaluate the openness of certain rooms and systems in order to control for this threatControl for on-board camera, microphone, and video use
- 25a network device that manages the info of any applications that interface with it. This info includes the state of apps and the resources they require to designate resources across the networkApplication aware device
- 26Organizations can exercise greater control over the privacy and security of their services. This method is geared more toward banking and gov't services that require strict access controlPrivate cloud services
- 27refers to using the cloud to provide access to any or all infrastructure needs a client may haveInfrastructure as a Service (IaaS)
- 28self-allocates addresses randomly from a small range of 169.254.0.1 to 169.254.255.254Automatic Private IP Addressing (APIPA)
- 29-disabling unnecessary services -closing unused ports -regularly applying the appropriate patches -hiding responses from ports that indicate their status and allow access pre-configured ports onlyPort Security measures
- 30use the principle of implicit deny so that the firewall blocks any traffic it does not requireImplicit Deny
- 31symmetric algorithmsDES, 3DES
AES, Blowfish
Twofish, RC 4,5,6 - 32any type of attack in which the attacker attempts to obtain and make use of passwords illegitimatelyPassword attack
- 33software attacks that are targeted at web-based and other client-server applicationsApplication attacks
- 34access points on a network that fool users into believing they are legitimateEvil twins
- 35it is important to always consider what is happening inside an organization, especially when physical security is concernedInternal
- 36physical threats that can be internal or external, intentional or accidentalMan-Made
- 37an approach to securing systems and their data against attack that incorporates many different avenues of defense is called...Layered security
- 38a cryptoprocessor device that can be attached to servers and comps to provide digital key security. The modules can provide a number of security functionsHSM
- 39a password that meets the complexity requirements that are set by a system admin and documented in a security or password policyStrong password
- 40has the monitoring capability of an IDS, but actively works to block any detected threatsIntrusion Prevention System (IPS)
- 41a general term for the collected protocols, policies, and hardware that govern access on device network interconnections, provides an additional layer of securityNetwork Access Control (NAC)
- 42a point to point logical network that is created by grouping selected hosts together using a switch or routerVirtual Local Area Network (VLAN)
- 43directory access protocol that runs over TCP/IP networks. The schema is extensible, which means you can make changes or add on to itLightweight Directory Access Protocol (LDAP)
- 44Directory service vulnerabilitiesDoS/DDoS
Unencrypted transmission of data
MATM
Packet sniffing/Capture attacks
Buffer overflow
Security or user/admin accounts - 45a data transport technique that can be used to provide remote access in which a data packet is encrypted and encapsulated in another data packet in order to conceal the info of the packet insideTunneling
- 46internet protocol combo of PPTP and Layer 2 Forwarding (L2F) that enables the tunneling of PPP sessions across a variety of network protocolsLayer Two Tunneling Protocol (L2TP)
- 47an authentication protocol that sends user IDs and passwords as plaintext. Generally used when a remote client is connecting to a non-windows server that does not support strong password encryptionPassword Authentication Protocol (PAP)
- 48publicly available email security and authentication utility that uses a variation of public key cryptography to encrypt emails.Pretty Good Privacy (PGP)
- 49an area of info security that is used to identify individuals within a comp system or networkIdentity Management
Informações
- Descrição
- FlashCards sobre sec + midterm, criado por maxwell3254 em 29-03-2015.
- Criado por
- maxwell3254
- Visualizações
- 910
- Avaliação