Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
844 Cards in this Set
- Front
- Back
The mathematical manipulation of information that prevents the information from being disclosed or altered
|
Cryptography
|
|
The practice of defeating the protective properties of cryptography
|
Cryptanalysis
|
|
The study of cryptography and cryptanalysis
|
Cryptology
|
|
Basic Goals of Cryptography
|
Confidentiality, Integrity, Authenticity, Non-Repudiation, Access Control, Make compromise difficult
|
|
The natural or human-readable form of a message
|
Plaintext/Cleartext
|
|
The enciphered, encrypted, or scrambled form of a message
|
Ciphertext/Cryptogram
|
|
The mathematical function that determines the cryptographic operations
|
Cryptographic Algorithm
|
|
The (often secret) value used in the transformation of the message in a cryptographic operation that controls the operation of the algorithm in a unique, predictable manner
|
Cryptovariable (Key)
|
|
The total number of keys available to the user of a cryptosystem
|
Key Space
|
|
Challenges in developing secure cryptographic algorithms (Claude Shannon)
|
Discernible, redundancies, statistical patterns
|
|
Solutions for developing secure cryptographic algorithms (Claude Shannon)
|
Confusion, Diffusion, Avalanche
|
|
Principle of hiding patterns in the plaintext by substitution
|
Confusion
|
|
Property of transposing the input plaintext throughout the ciphertext so that a character in the ciphertext would not line up directly in the same position in the plaintext
|
Diffusion
|
|
Achieved when the plaintext bits affect the entire cipher text so that even a change of one bit in the plaintext would change half of the entire cipher text
|
Avalanche
|
|
Basic elements of a cryptosystem
|
Plaintext, Key, Algorithm, Ciphertext
|
|
Basic Transformation Techniques
|
Substitution, Transposition or Permutation, Compression, Expansion, Padding, Key Missing, Initialization Vector (IV)
|
|
The replacement of one value for another
|
Substitution
|
|
A change in the relative position of values without replacing them (bit shuffling)
|
Transposition or Permutation
|
|
Decrease redundancy before plaintext is encrypted
|
Compression
|
|
Epanding the plaintext by duplicating values found in the plaintext
|
Expansion
|
|
Adding additional material to the plaintext message before it is encrypted to assist with encryption, address weaknesses in an algorithm when particular messages are encrypted and fail traffic analysis
|
Padding
|
|
Using a portion of the full size of the key (subkey) rather than the full key to help limit exposure of the key
|
Key Mixing (Key Scheduling)
|
|
Randomly-generated value used by many cryptosystems to ensure that a unique ciphertext is generated when there are multiple ciphertexts generated by the same key (helps avoid re-keying)
|
Initialization Vector (IV)
|
|
Scrambling a plaintext message by using an algorithm, usually in conjunction with a key
|
Encipher/Encrypt
|
|
Similar to enciphering or encrypting the message, but it does not use a key (ex. Base 64)
|
Encode
|
|
Descrambling an encrypted message and converting it into plaintext
|
Decipher
|
|
Uneven distribution of key across the key space. A weakness in a cyptographic algorithm that results in two different keys being able to generate the same cipher text.
|
Key Clustering/Key Collision
|
|
An estimate of the effort/time needed to overcome a protective measure by an attacker with specified expertise and resources. Commonly related to brute-force techniques
|
Work Factor
|
|
A basic transformation technique and another name for binary addition. Used in many stream and block ciphers for substitution operations
|
Exclusive-Or (XOR)
|
|
XOR Calculation Results
|
Same = 0, Different = 1
|
|
States that the strength of a cryptosystem is based on the secrecy of the key and not on the secrecy of the algorithm
|
Kerckhoff's Principle
|
|
An algorithm in which the keystream is generated bit-by-bit, in sync with the arrival of the plaintext
|
Synchronous
|
|
An alogorithm in which the keystream is generated based upon the previously received plaintext and the cryptovariable, or key
|
Asynchronous
|
|
A condensed representation of the original message. Concerned with integrity. May or may not use a key in computing the output
|
Hash Function
|
|
Created by signing a digest of a message with the private key of the sender
|
Digital Signature
|
|
Uses the same key for encryption and decryption. Secret Key Cryptography
|
Symmetric
|
|
Uses a key pair. One key is used for encryption and the other half of the key pair must be used for decryption. One public key (shared), one private key (confidential)
|
Asymmetric
|
|
A digitally signed, special block of data that contains a public key and teh identifying information for the entity, or principal that owns the associated private key.
|
Certificate
|
|
What is the format for Certificates?
|
ASN.1 (X.509)
|
|
Trusted entity or third party that issues and signspublic key certificates, thereby attesting to the validity of the public keys. A corporate entity.
|
Certificate Authority
|
|
The primary organization that verifies a Certificate applicant's information and identity. Handles verification, enrollment, registration, issuing and re-issuing credentials, and credential updates, additions and revocation as the local agent on behalf of the CA.
|
Registration Authority
|
|
Historical Cryptographic Techniques
|
Manual, Mechanical, Electro-Mechanical, Electronic, Quantum Cryptography
|
|
A keystream (sequence of bits used as a key) is generated and combined with the plaintext using an XOR
|
Stream Cipher
|
|
Generated by the cryptosystem in a pseudo random sequence and applied to plain text in a stream cipher. Must be unpredictable, unbiased, operates on individual bits
|
Keystream
|
|
Stream Cipher Uses
|
Wireless, Audio/Video Streaming
|
|
A series of methematical operations that must be performed in sequence on an algorithm.
|
Rounds
|
|
Block Cipher Uses
|
Data Transport, Data Storage
|
|
Shift Alphabet, Scramble Alphabet, Polyalphabetic Cipher, Vigenere Cipher
|
Simple Substitution Ciphers
|
|
Grid share and reading/writing direction, Scytale Rod
|
Simple Tansposition/Permutation Ciphers
|
|
This form of encryption is done by using the numerical value of letters in the plaintext and is coded and decoded by using a copy of the text in a book as the key.
|
Running Key Cipher
|
|
Encryption technique where the keys are the same length as the plaintext message and the keys are randomly generated. Only unbreakable algorithm. Also known as Vernam ciphers.
|
One-Time Pad
|
|
Art pf hiding information in an image or datafile.
|
Steganography
|
|
Modes of Symmetric Block Ciphers
|
Electronic Code Book, Cipher Block Chaining, Cipher Feed Back, Output Feed Back, Counter
|
|
Symmetric Block Cipher Mode where each block of plaintext is encrypted independently using the same key.
|
Electronic Code Book
|
|
Symmetric Block Cipher Mode where the first plaintext block is XOR'ed with an initialization vector. The resulting ciphertext result is chained into the next plaintext block
|
Cipher Block Chaining
|
|
A stream cipher mode where Initialization Vector is encrypted and then XOR'ed with the first plaintext block.
|
Cipher Feed Back
|
|
A stream cipher mode where only the result of encrypting the IV is fed back to the next operation.
|
Output Feed Back
|
|
A stream cipher mode where a counter value is used instead of an IV
|
Counter
|
|
A symmetric key-block cipher that combines the Counter and Cipher Block Chaninig-Message Authentication Code
|
Counter with CBC-MAC
|
|
The detection of accidental single-bit errors
|
Parity
|
|
Examples of Stream Ciphers
|
RC4
|
|
Examples of Block Ciphers
|
DES, AES, CAST, Safer, RC5, RC6, Blowfish, Twofish, Serpent
|
|
Types of DES
|
DES, Double DES, and Triple DES (DES-EEE3, DES-EDE3)
|
|
Most popular block cipher that leverages different block and key sizes.
|
AES (Rijndael)
|
|
Weaknesses of symmetric-key cryptography
|
Key negotiation/exchange distribution, poor scalability, repudiation
|
|
The first public-key algorithm that allows two entities to negotiate a session key that can be used to exchange secret information without ever revealing their private keys
|
Diffie and Hellman
|
|
Assure confidentiality and proof of origin.
|
Public Key Algorithms
|
|
Highly flexible set of encryption protocols (algorithm) used for encryption, digital signatures, and key distribution
|
RSA
|
|
List of asymmetric algorithms
|
Diffie Hellman, Elgamal, Elliptical Curve, Knapsack
|
|
Weakness of Asymmetric Key Cryptography
|
Very Slow compared to symmetric
|
|
Cipher that takes advantage of both symmetric and asymmetric cryptographic techniques
|
Hybrid System Operation
|
|
These detect accidental and intentional alterations to an encrypted message during transmission. Accidental checks include checksum, parity and Hash. Intentional checks include HMAC, Digital Signature, and CBC-MAC
|
Message Integrity Controls
|
|
Common Hash Functions
|
Message Digest, Secure Hash Algorithm, HAVAL, RIPEMD, Tiger, WHIRLPOOL
|
|
Types of Message Authentication Codes
|
HMAC, CBC-MAC, CMAC
|
|
Uses include non-repudiation of origin, integrity of message, software distribution, email and secure document distribution
|
Digital Signature
|
|
The processes and procedures for the creation, distribution, protected storage, use, recovery, and destruction of keys
|
Key Management
|
|
Key Management Operations
|
Dual Control, Split Knowledge
|
|
Key Distribution Methods
|
Out-of-Band, Public Key Encryption, Key Distribution Center, Certificates
|
|
The platform to enable the secure transport of documents, e-commerce and email over an insecure network through the implementation of Public Key Cryptography in an organization
|
Public Key Infrastructure
|
|
Basic Concepts of PKI
|
Binds a person to their public key, Digital signatures are certified by a CA, CA's cross-certify each other for trust, Certificate revocation lists identify canceled certs, X.509 standard for the revocation list layout
|
|
PKI Trust Models
|
Web of Trust, Hierarchical Trust
|
|
The art and science of breaking codes
|
Cryptanalysis
|
|
Type of cipher attack that involves trying all possible keys until finding the one that results in the correct cleartext
|
Brute Force
|
|
Types of ciphertext attacks
|
Brute Force, Known Plaintext, Adaptive Chosen Plaintext, Ciphertext Only, Chosen Ciphertext, Adaptive Chosen Ciphertext
|
|
Ciphertext attack where the attacker has both the plaintext and teh ciphertext
|
Know-Plaintext
|
|
Ciphertext attack, sometimes called batch or indifferent, where the attacker is able to run plaintext through the cryptosystem and obtain the result, thereby being able to analyze the results and determine statistical information about the key
|
Chosen Plaintext
|
|
Ciphertext attack that modifies the chosen plaintext based on the results of previously chosen plaintext
|
Adaptive Chosen Plaintext
|
|
Ciphertext attack where attacker has samples of the encrypted text, but may not know the the algorithm, key or the system. Most difficult
|
Ciphertext Only
|
|
Ciphertext attack where the attacker has access to ciphertext and the system that was used to generate it
|
Chosen Ciphertext Attack
|
|
Ciphertext attack where attacker has access to the system and can run pieces of ciphertext through and modify the ciphertext to see what the effect of the modification ison the resulting plaintext
|
Adaptive Chosen Ciphertext
|
|
Stream Cipher Attacks
|
Frequency Analysis and IV or Keystream Analysis
|
|
Block Cipher Attacks
|
Linear Cryptanalysis, Differential Cryptanalysis, Linear-Differential Cryptanalysis, Algebraic Attacks, Frequency Analysis
|
|
Attacks Against Hash Functions
|
Dictionary Attack, Birthday Attack, Rainbow Table Attack
|
|
Attack based on known lists of common words
|
Dictionary Attack
|
|
Attacks the hash value and the initialization vector. Based on the Birthday paradox
|
Birthday Attack
|
|
A mathematical analysis that attacks a problem from both ends and attempts to find the solutin by working towards the center of the operation from both sides
|
Meet in the Middle Attack
|
|
An attack where the attacker intercepts and modifes teh data being transmitted
|
Man in the Middle
|
|
Common Email Cryptosystems
|
Privacy Enhanced Email (PEM), Pretty Good Privacy (PGP), Secure Multipurpose Internet Mail Extensions (S/MIME)
|
|
Tools for secure internet Transmissions
|
IPSEC, SSL/TLS, S-HTTP
|
|
A term from the ISO/IEC 27002 which describes the methodical planning, developing and maintenance of business processes that include the data and processing of the data
|
Information Security Management System
|
|
A term from the ISO/IEC 27002. A high level description of how security requirements are structured.
|
Information Security Architecture
|
|
A well-recognized and accepted approach to designing, developing, managing/monitoring and enhancing process, often codified into a standard
|
Best Practice
|
|
A high level perspective of how business requirements are to be structured and aligned with technology and processes in a comprehensive and manageable way
|
Architecture
|
|
Functional definition for the integration and development of technology infrastructure into the business process
|
Blueprint
|
|
A defined approach to the process used to achieve the goals of an architecture based on policy and reflecting the requirements and expectations of the various stakeholders
|
Framework
|
|
The integrated building blocks that support the goals of the architecture
|
Infrastructure
|
|
Characteristics of a Good Security Architecture
|
Strategic - meets long term goals,
Holistic - fits into culture, Multiple Implementations - flexible. |
|
What are the Enterprise Architecture Frameworks?
|
Zachman Framework (standard), SABSA, ISO 7498-2, ISO/IEC 42010:2007, Open Group Architecture Framework (TOGAF), DoD Architecture Framework
|
|
What are the CPU and Processor Privilege States?
|
Supervisor (privileged), Problem (user)
|
|
CPU Process States
|
Running, Ready, Blocked, Masked/Interruptible
|
|
Common Computer Architecture Layers
|
Application Programs, Utilities, Operating System, Hardware
|
|
Basic OS Functionality
|
Program execution, Access to I/O devices, Controlled access to files and data, error detection and response, Accounting and tracking, Access for maintenance and troubleshooting
|
|
Responsible for moving data in and out of memory
|
I/O Controller
|
|
Software that is permanently embedded in hardware and typically provides low level services and control of hardware
|
Firmware
|
|
Concurrent performance/interleaved execution of two or more tasks
|
Multitasking
|
|
Interleaved execution of two or more programs by a processor
|
Multiprogramming
|
|
Simultaneous execution of two or more more programs by a computer
|
Multiprocessing
|
|
Computer with two or more processors having common access to main storage
|
Multiprocessor
|
|
To processors on a single chip
|
Multi Core
|
|
System designed to track all the possible ways that a business communicates with a customer (touchpoints) so that the relationship can be as interactive as possible
|
Customer Relationship Management System
|
|
System Architecture Approaches
|
Open, Closed, Dedicated, Single-Level, Multi-Level, Embedded
|
|
Software-based architecture that provides translation or communication services for applications. Examples are COBRA, DCOM, EJB.
|
Middleware
|
|
Very high speed storage structures bulit into the CPU chip set and are often used to store timing and state information for the CPU to maintain control over process
|
Registers
|
|
Very fast memory directly on the CPU chip body.
|
Cache
|
|
Requirements for Memory Management
|
Relocation, Protection, Sharing
|
|
Types of Memory Addressing
|
Logical, Relative, Physical
|
|
Extends apparent memory in a system to accommodate larger program execution space than is possible using only physical memory and involves paging and swapping operations
|
Virtual Memory
|
|
Virtual memory paging includes?
|
Splitting physical memory into Page Frames, Splitting Processes into Pages, Allocating the required number of page frames
|
|
The act of dynamically transferring pages between physical memory and the swap space on the disk as needed for efficient program execution
|
Swapping
|
|
A global mesh of collaborative services. The services offered are independent of each other but have well defined interfaces designed for reuse
|
Service Oriented Architecture
|
|
Ring Protection Layers
|
Kernel/OS, I/O, Utilities, Applications
|
|
Includes all the components and their operating process and procedures that ensure that the security policy of the organization is enforced
|
Trusted Computing Base
|
|
An abstract machine that mediates all access subjects have to objects, toth to ensure that the subjects have the necessary access rights and to protect the objects from unautorized access
|
Reference Monitor
|
|
The hardware, firmware and software elements of a TCB that implement the reference monitor
|
Security Kernel
|
|
Active entities - include users, programs processes, logon identifieers
|
Subjects
|
|
Passive entities, include files programs instructions, data, hardware
|
Objects
|
|
Security architecture model that addresses confidentiality and allows subjects to read down and write up
|
Bell-LaPadula Model
|
|
Bell-LaPudula property that states that if you have Read capabilty you can read data at your level of secrecy and the level below it, but you can't read data at a higher level
|
Simple Security Property
|
|
Bell-LaPudula property that states that if you have Write capability you can write data at your level or a higher level, but not a lower level
|
Star Property
|
|
Bell-LaPadula property that states if you have both Read and Write capabilities you're resricted to read and write at your level
|
Strong Star Property
|
|
Security architecture model that addresses integrity. Read up, write down
|
Biba Model
|
|
Biba model property that states that if you have read capability you can read data at your level of accracy as well as at a higher level, but not a lower level
|
Simple Integrity Property
|
|
Biba model property that states that if you have write capability you can write data at your level or lower, but not higher
|
Integrity Star Property
|
|
Biba model property that restricts the avility of a user to request a service or execure a proces which resides at a higher level of integrity than the user
|
Invocation Property
|
|
Security architecture integrity model that addresses all three integrity goals, defines well-formed transactions, and provides separation of duties
|
Clark Wilson Model
|
|
Security architecture integrity model property that defines teh subject, program, and object relationship
|
Access Triple
|
|
Security architecture confidentiality model, also called the Chinese Wall, that defines the rules for separation to prevent conflict of interests
|
Brewer and Nash Model
|
|
List of Certification bodies for secure acquisition of products
|
TCSEC (Orange Book), ITSEC (EU), Common Criteria (current body)
|
|
the common criteria method of measuring the confidentiality, integrity, and availability that a system provides
|
Evaluation Assurance Level (EAL 1-7)
|
|
The EAL used by corporate entities
|
EAL 3
|
|
The EAL used by the military
|
EAL 4 and 5
|
|
The EAL used by nobody, too complex
|
EAL 6 and 7
|
|
A set of software, firmware, and hardware to be evaluated defined in the common criteria context
|
Target of Evaluation (TOE)
|
|
A general set of security requirementes for a category of products which meet similar consumer needs for security defined in the common criteria context
|
Protection Profile
|
|
Contains the IT security objectives of a specific TOE and defines the functional and assurance measures offered by that TOE in common criteria context
|
Security Target (ST)
|
|
Popular Security Management Frameworks
|
ISO 27001, ITIL, COSO, CMMI
|
|
Security Management Framework that focuses on IT services
|
ITIL
|
|
Security Management Framework that describes a unified approach for evaluation of internal control systems that management has designed to provide reasonable assurance of achieving goals
|
Committee of Sponsoring Organizations (COSO)
|
|
Security Management Framework developed by SEI that is based on TQM concepts and a continuous improvement
|
Capability Maturity Model
|
|
List of organizations that provide info for software vendors and the public that is intended to create secuire environments for software development
|
Systems Security Engineering-Compatibility Maturity Model Integration (SSE-CMMI), Web Application Consortium (WASC), Build Security In (BSI), ISO-IEC 27034
|
|
The process of controlling software by managing the versions of all components and the relations between them
|
Software Configuration Management (SCM)
|
|
Stages of the SLC
|
Requirements, Design, Development, Test, Production, Decommissioning, Disposal
|
|
Waterfall, Spiral Method, Clean Room, Structured Programming Development, Iterative Development, Join Analysis Development, Prototyping
|
Software Development Methods
|
|
Interpreted (Platform Independent) Programming Languages
|
REXX, Postscript, Perl, Ruby, Python
|
|
Compiled (Platform Specific) Programming Languages
|
COBOL, Fortran, Basic, Pascal, C, ADA, C++, Java, C#, Visual Basic
|
|
A program that translates an assembly language programinto machine language
|
Assembler
|
|
Translates a high level language into machine language
|
Compiler
|
|
Translates a program statement by statement
|
Interpreter
|
|
A weakness or attack that puts more data than is expected in a buffer which spills into another buffer
|
Buffer Overflow
|
|
An attack that inserts a series of SQL statements into a query by manipulating data input into an application
|
SQL Injection
|
|
An attack or flaw that occurs whenever an application takes user supplied data and sends it to a web browser without first validating or encoding that content. Allows attackers to execute script in the victim's browser that can hijack user sessions, deface web sites, and introduce worms
|
Cross Site Scripting
|
|
An error in software code that points to an object that has been deleted
|
Dangling Pointer
|
|
An Forced Browsing attack where a user can guess a link and gan access to hidden or special URL's
|
Invalid Hyperlink
|
|
Attacks that reveal the network address translation ID and allow an attacker to peruse network addresses located inside the local network
|
Javascript Attacks
|
|
Attack - Javascript runnning in the user's browser steals the webs surfing history, allowing the attacker to create look alike spoofed sites containing malware or infecting the sites the user is visiting
|
History Stealing
|
|
Attack - Javascript can force the browser to make certain types of requests to the internal IP addresses even if the browsers Javascript has been disabled
|
Intranet Port Scans
|
|
A contract between a caller (programmer) and a call-ee (pre-existing application). Allows caller to send requests to an operating system, library or service
|
Application Programming Interface (API)
|
|
Software where the source code is available to the public
|
Open Source
|
|
Two types of publishing policies for API's
|
Freely available, Controlled
|
|
Application security principle that states that should anything fail in a way that is secure and not leave everything open
|
Fail Secure
|
|
Application security principle that requires that the faileure of part of a system will not result in the failure of teh rest of the system. A system failing open is good for availability, but not for confidentiality
|
Fail Safe
|
|
Programming method that reuses code and reduced development time. C++ is an example
|
Object Oriented Programming (OOP)
|
|
In OOP, templates for objects
|
Classes
|
|
In OOP, Instances of classes
|
Objects
|
|
In OOP, an object that is called by another object or program derives its data and functionality from the calling object
|
Inheritance
|
|
In OOP, when different objects respond to the same command, input, or message in different ways
|
Polymorphism
|
|
In OOP, creating a new version of an object by changing it's attributes. A technique used to prevent inference violations by allowing different versions of the same info to exist at different classification levels
|
Polyinstantiation
|
|
The four major protocols used for distributed programming
|
DCOM, SOAP, CORBA, EJB
|
|
List of Transaction Integrity Controls
|
Edit Checks, Balancing, Data/Input Validation, Error Handling/Information Leakage, Logging/Auditing, Cryptography, Secure Code Environment, Session Management
|
|
Transaction Integrity - ensuring input data is within acceptable ranges or meet criteria
|
Edit Checks
|
|
Transaction Integrity - ensuring the transactions completed properly by matching input and output
|
Balancing
|
|
Transaction Integrity - confirmation that action rerquested by the user was intentional, the "are you sure?" box
|
Data Input Validation
|
|
Transaction Integrity - ensuring that errors are handled correctly and that errors do not provide an attacker wtih infor on the operatin of the system
|
Error Handling/Information Leakage
|
|
Transaction Integrity - all access to sensitive data or changes to daga should be logged to the user or process that initated the request
|
Logging/Auditing
|
|
Transaction Integrity - ensures copies of source and object code are preserved and protected
|
Secure Code Environment
|
|
Transaction Integrity - login/logout, problems of unauthorized acces can arise when a user leaves a session open or closes a browser without logging out first
|
Session Management
|
|
Malware and Attack Types
|
Injection Flaws, Input Manipulation/Malicious File Execution, Broken Authentication and Session Management, Crptographic, Denial of Service, Hijacking, Informatin insecure communications, infrastructure, misconfiguration, race condition
|
|
Application attack type - occurs when user supplied data is sent to an intrpreter as part of a command, query, or data. SQL injection is an example
|
Injection Flaw
|
|
Application attack type - Code is vulnerable to remote file inclusion that allows attacker to include hostile code and data
|
Input Manipulatin/Malicoius File Execution
|
|
Application attack type - Attackers compromise passwords, keys or authentication tokens to assume other users identities
|
Broken Authentication and session Management
|
|
Application attack type - Web applications rarely properly use cryptographic functions to protect data and credientidals, Attacker can use poorly protected data to conduct id theft and other crimes such as credit card fraud
|
Cryptographic Attack
|
|
Application attack type - Consuming the resources on the system and thus limiteing the resources for the use of others. This is an attack against availability
|
Denial of Service
|
|
Application attack type - A post session setup and typically post authentication attack wherein the aattcker assumes someone elses valid credientials. A cross site request forgery is an example
|
Hijack
|
|
Application attack type - forces a logged on victims browser to send a preauthenticated request to a vulnerable web application which thn forces the victim's browser to perform a hostile action to the benefit of the attacker
|
Cross Site Request Forgery
|
|
Application attack type - when sensitive info is sent unencrypted over insecure channels, attackers will be able to read it. Information disclusure or info leakage and improper error handling can disclose sensitive info
|
Information insecure Communications
|
|
Application attack type - these are protocol flaws such as lack of authentication in IP or DNS
|
Infrastructure
|
|
Application attack type - A zero or low security posture due to a setup error by administrator
|
Misconfiguration
|
|
Application attack type - when processes carry out their tasks on a shared resource in an incorrect order. Time of Check/Time of Use (TOC/TOU) is an example.
|
Race Condition
|
|
List of Malware
|
Keystroke Logging, adware and spyware, spam, phishing, botnets, remote access trajan, url manipulation, maintenance hooks, privileged programs
|
|
A software of hardware tool for capturing data entry
|
key logger
|
|
Generates unwanted or irrelevant advertising or reports on user activities. Installed with other sofware as a separate function. Intended as marketing not malice
|
Adware/Spyware
|
|
Unwanted email solicitation
|
Spam
|
|
Attempts to trick a uset into divulging personal info for the purposes of fraud or id theft. Counterfeit messages or websites mimicking banks
|
Phishing
|
|
Large numbers of compromised machines used as a resource to perform DDoS attacks
|
Botnet
|
|
Inappropriate over the network control of a host
|
Remote Access Trojan
|
|
Used to redirect users to an unintended site
|
URL Manipulation
|
|
Backdoors or Trapdoors coded into softwre that enables programmers to re-enter the system and perform admin functions
|
Maintenance Hooks
|
|
The oldest database model that allows data to be stored in a manner that groups all related data. Stores records in a single table, parent/child relationships, single tree
|
Hiearchical DBMS
|
|
DB model that represents is records in teh form of a netwrk of records and sets that are related to each other, forming a network of links
|
Network DBMS
|
|
Most popular DB model. Data is structured into mutlple tables
|
Relational Database
|
|
In a relational db, a column contains?
|
Variables (attributes)
|
|
In a relational db, the rows contain?
|
Records (tuples)
|
|
In a relational database table, this column must exist, must be unique, and must not be empty
|
Primary Key
|
|
An attribute in one table that is also the primary key in another table is called a?
|
Foreign Key
|
|
Combines all the data from vartious databases into one large data container
|
Data warehouse
|
|
A database or collection of databases designed to help managers make strategic decisions about heir business. Smaller than data warehouses
|
Data Mart
|
|
List of Knowledge Discovery Methods in Databases
|
Probabilistic Model, Statistical Approach, Classificatoin Approach, Deviatin and Trend Analysis, Nerual Networks, Expert System Approach, Hybrid Approach
|
|
Database Discovery Method - useful for applications involving uncertainty such as those used in planning and control systems
|
Probabilistic Model
|
|
Database Discovery Method - used to generalize patterns in the data and to contstruct rules from the noted patterns. Example: On-line Analytical Processing (OLAP)
|
Statistical Approach
|
|
Database Discovery Method - Uses pattern discovery and data cleaning and may reduce a large database to only a few specific records
|
Classification Approach
|
|
Database Discovery Method - example: an IDS that filters a large volume of data so that only the pertinent data is analyzed
|
Deviation and Trend Analysis
|
|
A system that is able to learn from examples and have the capability to generalize.. Susceptible to supersititious learning
|
Neural Network
|
|
Uses a knowledge base and an algorithm based ont he operation of of a human expert
|
Expert System
|
|
The ability of a user with limited access to deduce info from observing authorized info in a database
|
Inference
|
|
The ability to combine data classified at a lower level in a db in order to learn something classified at a higher level
|
Aggregation
|
|
Describes the characteristics or semantics of data. Contains info about a data element such as the content, location and physical attributes of the data
|
Metadata
|
|
Searching the database in a round about manner rather than simply and directly...queries that would otherwise be restricted via permitted access
|
Query Attack
|
|
Attack that takes advantage of multiple paths ro the info. The application may be secured by access controls, but the data file is stored on the disk and accessible via system utilities
|
Bypass Attack
|
|
A control used to protect multi-level databases from inference and affregation by allowing for two values to exist for a single field that correspond to two different user clearances
|
Polyinstantiation
|
|
The analysis of data in a db that reveals hidden values int he data
|
Data Mining
|
|
A form of db access control wherein each user is given access to specific data objects. Object priviliges, System privileges and role security
|
Grants
|
|
If grantor's permissions are removed so are the permissions of eeryone below them. Pyramid scheme
|
Cascading Permissions
|
|
Used to control read and write access to specific rows of data in relational systems or objects in object oriented systems
|
Lock Controls
|
|
A db control that will filter the data available to a user according to their access permissions.
|
Constrained View
|
|
Allows db admins to specify access control policy based on object features and attributes. Uses an arbiter program. Example: web filter
|
Content Based Access Controls
|
|
This writes any and all changes that have occured to the data during the current transaction to the database and releases any locks that have been put on data so that changes are now availabel for other transactions
|
Commit Statement
|
|
A transaction that is only allowed after a the client requests permission to make change, database approves change, but does not make change until the client returns a reply indicating transaction completed correctly
|
Three Phase Commit Protocol
|
|
A database cleanly returning to a previous state or last commit point if a transaction does not complete successfully
|
DB Rollback
|
|
A transaction by transactin listing of what has occurred in teh database. Critical to the rollback process
|
Journals/Logs
|
|
Elements of the ACID test
|
Atomicity, Consistency, Isolation, Durability
|
|
ACID test mnemonic
|
All Changes are Invisible until Done
|
|
List of Database Interface Languages
|
SQL, ODBC, XML, OLE, Active X Data Object
|
|
An executible file that contains a function that can be called from multiple programs
|
Dynamic Link Library (DLL)
|
|
Methodology of an attack, Common steps
|
Target Acquisition, Target Analysis, Target Access, Target Appropriation
|
|
Open System Interconnect (OSI) Reference Model mnemonic
|
People (Physical), Don't (Data Link), Need (Network), To (Transport), Smoke (Session), Pot (Presentation), Anymore (Application)
|
|
The process of wrapping data using headers and sometimes tralers before sending it on to the next lower protocol on the stack
|
Encapsulation
|
|
Layers of the TCP/IP Model
|
Network Interface, Internetworking, Host to Host, Application
|
|
OSI layer that describes the networking hardware, the format of the communcications as electrical signals and bits, bytes or optical pulses, as well as network interfaces and caling
|
Physical Layer
|
|
What type of waves to analog and digital communciations produce?
|
Sine and Square
|
|
Two properties of an analog signal
|
Frequency and Amplitude
|
|
Two states of Digital communication
|
0 = off, 1 = on
|
|
5 types of Network Topologies
|
Bus, Star, Ring, Mesh, Tree
|
|
Topology that has a single point of failure, is scalable, and node failure will not affect the network. Communications are Probabalistic. One station speaks, all stations hear
|
Bus Topology
|
|
Network topology where a failure will split the network, is scalable, and a node failure does not affect network. Devices connect to a branch on the network
|
Tree Topology
|
|
Network topology that has a single point of failure unless dual rings (FDDI) are used for failover. Stable and time predictable. Data is transmitted in one direction on simple rings. Upstream to downstream traffic only
|
Ring Topology
|
|
Network topology requiring a lot of cable, is complex, and not scalable. Provides high level of redundancy. Every node in network is connected to every other node
|
Mesh Topology
|
|
Network Topology where hubs have full mesh and remotes have direct connect
|
Partial Mesh Topology
|
|
Network topology if central device fails, network fails. Failure of node will not affect network, scalable and flexible. Each node connected directly to a central device such as hub, switch, router. Most popular
|
Star Topology
|
|
Two star networks connected
|
Distributed Star
|
|
Rate of data transmission. Fiber optic cables provide the best
|
Throughput
|
|
Throughput, Distance between devices, data sensitivity, environment, cost
|
Cable Selection Considerations
|
|
One of the simplest and cheapest cabling options. Easy to tap, and susceptible to enviromnental stress
|
Twisted Pair
|
|
Two types or twisted pair cabling
|
Shielded and Unshielded
|
|
Cable type that uses a central conductor that is surrounded by an insulator and then a groupding braid of wire
|
Coaxial Cable
|
|
Three components that make up a fiber optic cable
|
Light source, Light detector, optical cable
|
|
Two types of light sources in fiber optic cable
|
Light Emitting Diode (LED) and Diode Lasers
|
|
2 types of optic cable in fiber optic cables
|
Multimode Fiber, Single Mode Fiber
|
|
Which type of optical fiber cable transmits better over long distances
|
Single Mode Fiber
|
|
Optical, MIcrowave, IRDA, Bluetooth, Satellite, 802.16, and 802.11 are examples of what?
|
Wireless Transmission Technologies
|
|
802.11a/h, Phones transmit at what frequency?
|
5Ghz
|
|
802.11b/g, Bluetooth, Phones transmit at what frequency?
|
2.4GHz
|
|
Cordless Phones, Baby Monitors, and Toys transmit at what frequency?
|
900MHz
|
|
Provide centralized management and provide a physical cross-connect point for devices
|
Patch Panel
|
|
These physical layer devices convert a digital signal to analog, modulate and demodulate, to be carried over phone lines. Provide little security. Susceptible to war dialing
|
Modems
|
|
Which DSL implementatoin is most popular?
|
ADSL because the downstream has more bandwidth than upstream
|
|
Physical device used to implement a physical star/logical bus topology. All devices can read and moaybe modify traffic of other devices
|
Hub
|
|
Physical device that boosts signal. Can be used in all types of networkds
|
Repeaters
|
|
Physical layer device, converts wireless signals into wired signals and signals are converted from one physical media type (radio waves) to another (copper)
|
Wireless Access Point (WAP)
|
|
The following are examples of what? Rj-11, RJ-45, BNC, RS-232
|
Cable Connectors
|
|
The Telecommunications Industry Association (TIA) and Electronic Industires Association (EIA) define what?
|
Cabling Standards
|
|
A device used to block or contain readio and electromagnetic signals consisting of a thin sheet or mesh of conducting material enclosing a particular space
|
Faraday Cage
|
|
This OSI layer connects compouters to physical networks and passes info between physically adjacent devices. Converts data from a signal into a frame and transmits frames to devices
|
Data Link Layer
|
|
This encryption only protects info between two connected devices and must encrypt and decrypt to encrypt information between end nodes on a network. Applied at the Data Link layer
|
Link Layer Encryption
|
|
Two sublayers of the Data Link Layer
|
Logical Link Control (LLC) and Media Access Control (MAC)
|
|
Sublayer of the Data Link layer that manages connections between two peers, provides error and flow control and cntrol bit sequencing. Faces back towards computer
|
Logical Link Control (LLC)
|
|
Sublayer of the data link layer that tramsmits and recieves frames between peers. Logical topologies and hardware addresses are defined here. This sublayer inrefaces with the physical media
|
Media Access Control (MAC)
|
|
Type of data link layer communication that is best for high-speed, high volume data, provides robust error checking through cyclical redundancy checks (CRC), and uses a timing mechanisms to synchronize the transmission of data.
|
Synchronous Communication
|
|
Type of data link layer communication that is used by modems and dumb terminals, has high overhead due to stop, end, and parity bits. No clocking mechanism used
|
Asynchronous
|
|
A transmission that is sent from one host to one receiving host. ISDN is an example
|
Unicast
|
|
A transmission that is sent from one host to several defined recipients. Uses IGMP protocol. Videoconference is an example.
|
Multicast
|
|
A transmission that is sent from one host to all.
|
Broadcast
|
|
T, E, and OC are all types of what?
|
Carriers
|
|
Type of network that is used by the Plain Old Telephone Service (POTS), ISDN and PPP leased lines.. Establishes a dedicated circuit between endpoints. Endpoints have exclusive use of the circuit
|
Circuit-Switched Network
|
|
Type of network is ideal for bursty transmissions. It is the most popular for networks. Data is deivided into packets and transmitted on a shared network
|
Packet-Switched Network
|
|
Type of circuit that provides a connection between endpoints over high bandwidth, multi-user networks which causes the network to act like a circuit-switched network
|
Virtual Circuits (Permanent and Switched)
|
|
Contention-based architecture. Form of control that must be established to determine which device may transmit
|
Carrier Sense Multiple Access (CSMA)
|
|
Type of Carrier Sense Multiple Access (CSMA) that requires devices to announce their intention to transmit by broadcasting a jamming signal to avoid collisions. Device waits to ensure all devices receive jamming signal then broadcasts
|
Carrier Sense Multiple Access with Collision Avoidance (CSAM/CA)
|
|
Type of Carrier Sense Multiple Access (CSMA) that requires devices to listen for a carrier before transmitting data. If collision occurs each device will wait for a randomly generated interval of time
|
Carrier Sense Multiple Access with Collision Detection (CSAM/CD)
|
|
An alternative to Carrier Sense Multiple Access that avoids collisions by allowing a device (slave) to transmit on the network only when it is asked by a master device. Used mostly in mainframe protocols
|
Polling
|
|
An alternative to Carrier Sense Multiple Access that only allows one device on LAN to transmit at a time to avoid collisions. Device must posses token to transmit
|
Token Passing
|
|
Layer 2 devices that gileter traffic between segments based on MAC addresses. Can connect LANs with unlike media types (cabling). Does not reformat frames (only connect identical architectures ie. ethernet to ethernet
|
Bridge
|
|
Type of bridge that allows network admins to connect two different kinds of Layer 2 architectures. ex. Ethernet to Data Link
|
Encapsulating Bridges
|
|
Multiport layer 2 devices that connect LAN devices. Forwards frames onlyl to specified MAC addresses.
|
Switches
|
|
Combining several signals into a single data stream
|
Multiplexing
|
|
The most popular LAN architecture that supports bus, star and point to point topoloties. Currnetly supports speeds up to 1000Mbps.
|
Ethernet
|
|
What CSMA type does ethernet use?
|
CSMA/CD
|
|
Layer 2 protocol used to resolve Layer 3 IP addresses with the Layer 2 MAC address
|
Address Resolution Protocol (ARP)
|
|
Layer 2 protocol used to resolve Layer 2 MAC address with the Layer 3 IP address. Reverse of ARP.
|
Reverse Address Resolution Protocol (RARP)
|
|
Provides a standard method of encapsulating Network Layer protocol info over point to point links. Defines an extensible link protocol which allows authentication protocol for authenticating its peer before allowing network layer protocols to transmit over the link. PAP and CHAP are two authentication protocols
|
Point to Point Protocol
|
|
Layer 2 authentication protocol that transmits password in the clear, but password db is encrypted and implementaiton is cheap. User's login credentials are transmiited and begining of call and validated by receiving device
|
Password Authentication Protocol (PAP)
|
|
Layer 2 authentication protocol that periodically revalidates user to reduce session-hijacking. Password db is unencrypted. Password is sent as a one-way hash coupled with nonce (salt)
|
Challenge Handshake Authentication Protocol (CHAP)
|
|
Difference between CHAP and MSCHAP?
|
MSCHAP stores password as hash with nonce
|
|
Layer 2 authentication protocol used with wireless networks and PPP connections. Used by WPA, WPA2
|
Extensible Authentication Protocol (EAP)
|
|
Proprietary version of Extensible Authentication Protocol developed by MS, CISCO, and RSA that provides better security
|
Protected Extensible Authentication Protocol (EAP)
|
|
OSI layer that moves info between two hosts that are not physically connected. Uses logical addressing
|
Network Layer
|
|
An attack that allows maliscious users to see traffic from other VLANs
|
VLAN hopping
|
|
This type of LAN is established to help devices that communicate ofter, communicate faster
|
VLAN
|
|
A cloud of switches on the carrier providers premises that customers use for connectivity. Customers share the resources and it provides better error protection than x.25
|
Frame Relay
|
|
A connection-oriented suite of protocols designed to transmit data, voice, and video over the same network at high speeds. Uses virtual circuits. Guarantees QOS, but not delivery of all cells
|
Asynchronous Transfer Mode (ATM)
|
|
Virtual Circuit classification - The circuit's cells are transmitted at a contstant rate
|
Constant Bit Rate
|
|
Virtual Circuit classification - The circuit's cells are transmitted within a specified range, bursty
|
Variable Bit Rate
|
|
Virtual Circuit classification - The circuit's cells steal bandwidth that is not being used by other circuits
|
Unspecified Bit Rate
|
|
Virtual Circuit classification - The circuit's throughput is adjusted based on feedback achieved by monitoring the available network bandwidth
|
Available Bit Rate
|
|
The use of tags by Layer 3 switches to allow for faster routing and address service requirements for the differnt packet types. Diffrent priority info is placed into the tags to help ensure that the time sensitive traffic has a higher priority providing QOS
|
Multiprotocol Label Switching (MPLS)
|
|
A dedicated path through a network
|
Tunnel
|
|
A tunnel between two hosts that allows them to communicate securely over an untrusted network, usually encrypted
|
Virtual Private Network (VPN)
|
|
Used to prioritize traffic. Datastreams such as VIOP and streaming media benefit from this
|
Qaulity of Service (QOS)
|
|
Devices that live on Layer 3 and move info across a network from a source to a destination. Use protocols to find the best route
|
Routers
|
|
Layer 3 devices that change the address of traffic from an internal IP to an external IP and vice versa, usually at the external router or firewall
|
Network Address Translation (NAT)
|
|
Translates the source port number in the packet to a diffrent unique value. Maps communications to a unique port to extend NAT capability. Many to one.
|
Part Address Translation (PAT)
|
|
A Network Address Translation that is one to one
|
Static NAT
|
|
A NAT that is many to few
|
Dynamic NAT
|
|
Layer 3 device that filters traffic based on rule sets
|
Firewall
|
|
2 types of filters that firewalls apply
|
Address, Service, Static Packet, Stateful Inspection/Dynamic Packet Filtering
|
|
Firewall filtering that examines each packet without regard to the packet's context in a session. Signifigant disadvantage is ports are either open or closed
|
Static Packet Filtering
|
|
Firewall filtering that examines each packet in the context of a session allowing it to make adjustments to the rules to accomodate legiitmate traffic
|
Stateful Inspection/Dynamic Packet Filtering
|
|
5 types of firewall rules
|
Stealth, Cleanup, Silent, Negate, Implied
|
|
A type of firewall rule that is used to protect the firewall itself from being attacked
|
Stealth Rule
|
|
A firewall rule used as the last rule in the rulebase. Used to drop and log any traffic that does not met the rules preceding it
|
Cleanup Rules
|
|
A firewall rule used to drop Noisy traffic without logging it. Reduces volume of data in logs and reduces response packets
|
Silent Rules
|
|
A firewall rule used instead of an * rule that would permit excessive access
|
Negate Rules
|
|
A firewall rule that is the first rule and supersedes all rules below it. Typically allowing specific services
|
Implied Rules
|
|
Type of server placed at internet gateways to hide the internalnetwork behind a single IP address and prevent direct communication betwen internal and external hosts
|
Proxy Server (Firewall)
|
|
Two Kinds of Proxies
|
Circuit-Level and Application Level
|
|
Type of proxy that creates a conduit through which a trusted host can communicate with an untrusted host to eliminate traffic inspection and overhead
|
Circuit Level Proxy
|
|
Type of proxy that relays traffic from a trusted host running a specific app to an untrusted server. Adds overhead. Web proxy (web application firewall) servers are common. Supports only one protocol
|
Application Level Proxy
|
|
Segmenting (screening) networks into domains of trust to enforce security policies
|
Network Partitioning
|
|
Routers that connect networks at their perimeter points. Prevent IP spoofing attacks
|
Boundary Routers
|
|
A device, commonly a firewall, that has two interfaces, one facing the external and the other facing the internal network
|
Dual Homed Host
|
|
A computer system that is usually located in a place on the network that is vulnerable to attack, perimeter connector
|
Bastion Host
|
|
A screened subnet that allows an organization to give external hosts limited acces to public resources such as the company website
|
DMZ
|
|
A type of DMZ configuration wherethe firewall is configured with a third network interface for the DMZ. Not good for security, single point of failure
|
Three-Legged Firewall
|
|
Network layer protocol that has teh ability to route info globally, send packets over a network by subdividing them, is unreliable
|
Internet Protocol (IP)
|
|
What are the two parts of an IP address
|
network and host
|
|
How many bits are used in IPv4 and IPvv6
|
32 bits and 128 bits
|
|
IP addresses are grouped into?
|
Classes and subnets
|
|
What are the classes of IP?
|
Class A - Class E
|
|
The logical division of large network address ranges into small logical networks
|
Subnetting
|
|
The logical aggregation of several small newtork addresses
|
Supernetting (classless inter-domain routing (CIDR)
|
|
Protocol that dynamically assigns IP's to workstations
|
Dynamic Host Configuration Protocol (DHCP)
|
|
Workflow of the DHCP request and lease process
|
DHCPDiscover, DHCPOffer, DHCPRequest, DHCPAck
|
|
Advantages of IPv6
|
Larger address space, IPsec offering confidentiality and integrity, QOS, faster throughput
|
|
Protocol used for the exchange of control messages between hosts and gateways and is used for diagnostic tools such as ping and traceroute.
|
Internet Control Message Protocol (ICMP)
|
|
An attacker telling a host to to use the attacker's machine as the default route and then forwarding the traffic to the router is an example of what two types of attacks?
|
ICMP Redirect Attack and Man in the Middle
|
|
A diagnostic tool that displays the path a packet traverses between the source and distination hosts
|
Traceroute
|
|
A basic network mapping technique which helps narrow the scope of a planned attack
|
Ping Scanning
|
|
Protocol used to manage multicasting groups. Hosts send these to multicast agents to join and leave groups
|
Internet Group Management Protocol (IGMP)
|
|
Protocol that allows users to securely access resources on remote compouters over an encrypted tunnel. Services include remote logon, file transfer, and command execution
|
Secure Shell (SSH)
|
|
Key advantage that SOCKS and SSL VPN's have over other VPN's?
|
Use of Proxy Servers
|
|
A suite of protocols for communicating security with IP by providing mechanisms for authentication and encryption
|
IP Security (IPSec)
|
|
List of features that make up IPSec
|
Authentication Header (AH), Encapsulating Security Payload (ESP), Security Parameter Index (SPI), Security Associations, Transport Mode/Tunnel Mode, Internet Key Exchange (IKE)
|
|
Part of IPSec that is used to guarantee the id of the sending node and ensure that the transmitted data has not been tampered with. Uses a hash. Provides integrity.
|
Authentication Header (AH)
|
|
Part of IPSec that encypts IP packts for confidentiality and ensures packets's integrity. Provides confidentiality and integrity
|
Encapsulating Security Payload (ESP)
|
|
What are the four parts of Encapsulation Security Payload in the IPSec process?
|
ESP Header, ESP Payload, ESP Trailor, Authentication
|
|
Part of the IPSec ESP that contains info showing which security association to use and the packet sequence number
|
ESP Header
|
|
Part of the IPSec ESP that contains the encrpted part of the packet. Typcially uses a symmetric algorithm for little overhead
|
ESP Payload
|
|
Part of thte IPSec ESP that includes paddding (filler bytes) to align fields
|
ESP Trailor
|
|
Part of the IPSec ESP that contains the hash of the ESP packet
|
Authentication
|
|
An arbitrary number assigned to an IPSec connection by the administrator to identify the connection
|
Security Parameter Index (SPI)
|
|
In IPSec, establishes the credentials of the two communicationg parties and defines the mechanisms that will be used to communicate
|
Security Association
|
|
IPSec communication mode used for end-to-end protection between a client and server. IP payload is protected
|
Transport Mode
|
|
IPSec communication mode used for network connections (ex. firewall to firewall) where the IP payload and header are protected
|
Tunnel Mode
|
|
Protocol IPSec uses to negotiate and establish quhtenticated keying materials for security associations
|
Internet Key Exchange
|
|
A VPN protocol that urns over other protocols. Relies on generic routing encapsulation (GRE) to build the tunnel. Somewhat insecure
|
Point to Point Tunneling Protocol
|
|
VPN protocol that allows callers over a serial line using PPP to connect to a remote network over the internet. Does not provide encryption but can be encrypted using IPSec tunnel mode
|
Layer 2 Tunneling Protocol
|
|
These operate at Layer 3 and use algorithms to help routers determine the best path for traffic through networks. They populate the routing table on the routers
|
Routing Protocols
|
|
List of Routing Protocols
|
Routing Information Protocol (RIP), Virtual Router Redundancy Protocol (VRRP), Open SHortest Path First (OSPF), Exterior Gateway Protocol (EGP), Border Gateway Protocol (BGP), INtermediate System to INtermediate System (ISIS), Interior Gateway Routing Protocol (IGRP), Enhanced IGRP (EIGRP)
|
|
Key shortcoming in IP
|
Lack of authentication (allows spoofing)
|
|
Types of IP Fragmentation Attacks
|
Teardrop, Overlapping Fragment Attacks
|
|
Are IP Fragmentation Attacks a risk to patched systems?
|
No
|
|
What category of attack are IP Fragmentation Attacks intended to cause
|
Denial of Service
|
|
Type of attack, when the target host attempts to reconstuct the packet it calculates a negative number for the fragment length causing it to crash
|
Teardrop
|
|
Attack used to subvert packet filters that only inspect the first fragment of a fragmented packet. Involves sending a harmless first fragment and then sending other packses that oeverwrite the first fragment with malicious data, bypassing the packet filter
|
Overlapping Fragment Attack
|
|
Attack where packets are sent with a bogus source address (IP). Causes multiple open handshakes left on the server and clogs server
|
IP Address Spoofing
|
|
Exploit where attacker specifies the path rather than the router. Fix by blocking sour-routed packets and disable source routing from hosts.
|
Source-Routing Exploit
|
|
Attack where the attacker sends an ICMP Echo Rerquest with a spoofed source address of teh victim to a network's broadcast address. Victim is overloaded with ICMP Echo Replies
|
Smurf Attack
|
|
Attack where the attacker sends a UDP Echo Rerquest with a spoofed source address of teh victim to a network's broadcast address. Victim is overloaded with UDP Echo Replies
|
Fraggle Attack
|
|
Attack that is based on a misconfigured ICMP packet that is 64K. Crashes system
|
Ping of Death
|
|
Network layer that provides data communication between hosts and is concerned with the information payload. Information delivery is guaranteed and flow control and error recovery are provided
|
Transport Layer
|
|
A transport layer protocol - connection oriented mode where info delivery is guaranteed and flow control and error recovery are provided
|
Transmission Control Protocol (TCP)
|
|
A transport layer protocol - connectionless mode where due to concerns such as performance no delivery or eror recovery is guaranteed
|
User Datagram Protocol (UDP)
|
|
What does SYN stand for?
|
Synchronize
|
|
What does ACK stand for?
|
Acknowledge
|
|
What does FIN stand for?
|
Finish
|
|
What does RST stand for?
|
Reset
|
|
What is a SYN, a SYN/ACK and and ACK called?
|
Three-way Handshake
|
|
Total number of port options
|
65,536
|
|
Ports 0 - 1023. Can only be used by privileged processes and users
|
Well Known Ports
|
|
Ports 1024 - 49151
|
Registered Ports
|
|
Ports 49152 - 65536. Can be used freely by applications
|
Dynamic/Private Ports
|
|
Version of SSL that provides mutual authentication, encryption, integrity through the use of hashed message authentication codes
|
Transport Layer Security (TLS)
|
|
A DoS attack where the attacker sends a large number of initial packets with the SYN option but doesn't reply to the SYN/ACK resulting in the victim hot reaching limit on half open three way handshakes
|
SYN Flood
|
|
The act of probing for TCP services on a machine
|
Port Scanning
|
|
Also called TCP half scanning. No complete connection is opened; instead only the initial stpes of the handshake are performed. A stealth scan
|
SYN Scan
|
|
The unauthorized insertion of packets into a data stream. Normally based on sequence number attacks.
|
Session Hijacking
|
|
A safeguard against SYN attacks. Limits the number of open and abandoned connections to a host by interceptning the initial 3 way handshake and then only passes successful handshakes
|
SYN Proxy
|
|
These draw malicious traffic to them and away from the legitimate system
|
Honeypot/Honeynet
|
|
These entice attackers by presenting leginitate looking systems that attackers waste time on
|
Tarpits
|
|
List of port scanning techniques
|
FIN, Null, Xmas, SYN, Session Hijacking, TCP Sequence Number Attack
|
|
List of transport layer controls to mitigate attacks
|
Honeypot/Honeynet/ Tarpit, SYN Proxy, Continuous or Periodic Authentication
|
|
OSI Layer that provides a logical, presistnt connection between peer hosts. Provides directory services.
|
Session Layer
|
|
Session implementation - spreads the session among many machines and in some cases across many networkds
|
Client Server Model
|
|
Session implementation - designed to spread the workload of a complex process to specialized computers within a larger newrok of computers
|
Middleware and three-tierd architecture
|
|
Session implementation - keeps the session local unless remote terminals are implemented
|
Mainframe
|
|
Session implementation - allow for control of the session. TACACS+ and Radius protocols enable remote connection through which a session can be established with the local server
|
Centralized Systems
|
|
List of Session implementations
|
Client-Server Model, Middleware and three-tiered architecture, maninframe, cnetrailized systems
|
|
List of Session Layer protocols
|
Real Time protocol (RTP), RTP Control Protocol (RTCP), Remote Procedure Calls
|
|
Session layer protocol that provides end to end delivery services for data with real time characteristics such as interactive audio and video. Applications typically run this on top of UDP
|
Real Time Protocol (RTP)
|
|
Session layer protocol that is used to monitor the QoS and to communicate info about the users during a session
|
Real Time Control Protocol (RTCP)
|
|
List of RPC Threats
|
Unauthorized sessions, Invalid RPC Exchanges
|
|
List of RPC threat controls
|
Patch, Block at firewall, disable unnecesary protocols
|
|
OSI Layer that ensures that the peer applications use a common format when representing data between hosts and provides encryption and compression services. DRM lives here.
|
Presentation Layer
|
|
MPEG-1 Layer 3 (MP3), MPEG-1 Layer 1 & 2, AAC, HE-ACC v2, aacPlus v2
|
ISO/IEC Audio Compression
|
|
G.711...
|
ITU-T Audio Ccompression
|
|
MJPEG, MPEG-1&2, MPEG-4 ASP &AVC
|
ISO/IEC Video Compression
|
|
H.261 - H.264
|
ITU-T Video Compression
|
|
Common problem with the wide range of compression protocols that will not work together
|
Availability, Lack of interoperability
|
|
OSI layer that is the applications portal to network based services
|
Application Layer
|
|
List of Application Layer implementations
|
Client/Server, Peer to Peer, Multi-user
|
|
List of Applicatin Layer client/server implementations
|
Telephony, video, instant messaging, email, www, file transferq
|
|
List of Applicatin Layer peer to peer implementations
|
sharing
|
|
List of Applicatin Layer multi-user implementations
|
web front-end, database backend, web 2.0
|
|
List of Application Layer protocols
|
FTP, IRC, IMAP, HTTP, MIME, POP3, Rlogin, SOAP, SSH, Telnet
|
|
OSI layer with the most identified threats
|
Application Layer
|
|
Two traditional types of networks
|
Telephony and Network
|
|
Types of cellular service
|
Analog, Digital, Data
|
|
List of Mobile Multiplexing technologies
|
Frequency Division Multiple Access (FDMA), Time Divisin Multiple Access (TDMA), Code Division Multiple Access (CDMA)
|
|
Mobile Multiplexing Technology - Principle: Diveide Frequency into sub bands. Objective: Open several low bandwidth channels
|
Frequency Division Multiplexing Acccess (FDMA)
|
|
Mobile Multiplexing Technology - Principle: Split transmission by time slices. Objective: Multiplexing between participants
|
Time Divisoin Multiplexing Access (TDMA)
|
|
Mobile Multiplexing Technology - Principle: Mutliplex several singals into one signal. Objective: Mltiplexing is performed on a digital level
|
Code Division Multiplexing Access (CDMA)
|
|
List of VOIP protocols
|
H.323, Session Intitiation Protocol (SIP), Proprietary Appliatins and Services
|
|
VOIP protocol developed by the ITU as original VOIP protocol. Largely replaced by SIP
|
h.323
|
|
VOIP protocol desinged to managem multimedia connnections. Provides MD% hashing and TLS encyrption
|
Session INtitiation Protocol (SIP)
|
|
Mobil telephony protocol for use by applications that use wireless communcatins such as web surfing
|
Wireless Application Protocol (WAP)
|
|
List of directory services
|
Domain Name Service (DNS), Lightweight Directory Acccess Protocol (LDAP), Network Basic INup output System (NETBIOS), Network INformation Service
|
|
List of synchronous messaging protocols
|
IM, IRC
|
|
List of asynchrounous messaging protocols
|
SMTP, POP, IMAP, NNTP
|
|
Key concepts of media management
|
Storage, Encryption, Retrieval, Disposal
|
|
Reassigning of a storage medium that once contained data belonging to another process to a new subject
|
Object Reuse
|
|
Ensuring no residual data is available with object reuse
|
Securely Reassigned
|
|
Reducing integrity below acceptable levels
|
Contamination
|
|
List of methods for clearing magnetic media
|
Overwriting, Deagaussing, Physical Destruction
|
|
List of Media Management Practices
|
Marking, Labeling, Handling, Storing, Declassifying, Destoying
|
|
Countermeasures for the misuse of media - Personal User
|
Appropriate Use Policy, workstation controls, web and email filter
|
|
Countermeasures for the misuse of media - Theft of media
|
Media controls
|
|
Countermeasures for the misuse of media - Fraud
|
Balancing of input/output reports, separation of duties, verification of info
|
|
Countermeasures for the misuse of media - Sniffers
|
Encryption
|
|
A group of dis drives connected to a separae optical switched network for the use of servers
|
Storage Area Networ (SAN)
|
|
A group of disk drives connected to the same network used by all clients and servers
|
Network attached Storage
|
|
Backup type where everything is backed up
|
Full Backup
|
|
Backup type - everything since last full. Longer create backup, shorter to restore
|
Differential Backup
|
|
Backup Type - Everything since last backup
|
Incremental Backup
|
|
Backups should ensure the adequate backup of the following:
|
Data, Operating systems, applications, transactions, configurations, reports
|
|
A system desinted to keep running after an error has occured. Failover
|
Fault Tolerant System
|
|
Used for speeding up the read/write operation for data stored on disk drives and/or provide backup capabililty to recover data in the event of a disk drive failure
|
Redundant Array of Independent Disks (RAID)
|
|
A preinstalled drive that can immediately replace a failed drive
|
Hot Spare
|
|
Raid level - Stirpes the data across several disks allowingg for a faster read/srite speed. Does not provide backup or redudancy.
|
RAID 0
|
|
RAID Level - Two or more disks to mirror. Provides 100% redundancy. Usable disk storage is equal to the smallest disk
|
RAID 1
|
|
RAID Level - Creates a hamming code for error correction, designed for systems that require very high data transfer rates. Not used. Not commercially viable
|
RAID 2
|
|
RAID Level - Byte level strips. 1 drive for parity the rest for data. Bottleneck. Never implemented.
|
RAID 3
|
|
RAID Level - Block level strips. 1 drive for parity the rest for data. Bottleneck. Never implemented.
|
RAID 4
|
|
RAID Level - Block Level stripes. Data and parity interleaved amongst all drives. Solved bottleneck. Most popular
|
RAID 5
|
|
RAID Level - Block Level stripes. All drives used for data and parity. 2 parity types. High cost. Very fault tolerant
|
RAID 6
|
|
RAID Level - Used for mirror and stiping. Minimum of 4 disks required. High performance but not maximum reliability
|
RAID 0+1
|
|
RAID Level - Mirroring and striping. High cost and high speed. Usable disk space equal to the sum of individual RAID 1 sets
|
RAID 10
|
|
Real time mirroring using tapes not disks
|
Redundant Array of Independent Tapes (RAIT)
|
|
A hot spare that is a backup for any phyiscal disk in the array that fails
|
Global Hot Spare
|
|
Hot spare that is a backupfor a specific disk in the array
|
Dedicated Hot Spare
|
|
List of Backup Types
|
File image, system image, data mirroring, electronic vaulting, remote journaling, database shadowning, redundant servers, standby services
|
|
Backup Type - backup software tha creates disk image fiels with exact byte by byte copies of a hard drive, partiotion or logical disk
|
File Image
|
|
Backup Type - the contents of the hard disk including the OS and installed applications
|
System Image
|
|
Backup Type - the replication of data on separate disk in real time to ensure continuous availability, currency and accuracy (RAID 1)
|
Data Mirroring
|
|
Backup Type - the bulk transfer of backup data over communications facilities. HOst to host or channel extension connection
|
Electronic Vaulting
|
|
Backup Type - delivers real time db data integrity by capturing and transmitting the journal and trasaction log data offsite as they are created.
|
Remote Journaling
|
|
Backup Type - reduces recovery time from a db failure by using a db restore and roll-forward process, usinga backup and the jourbals to enable recovery without data loss
|
Database Shadowing
|
|
Backup Type - keep a redundant idle server available for failover in case of a failure of the primary servier.
|
Redundant Servers
|
|
Backup Type - provide recovery of most critical applications in a matter of minutres through guaranteed acces to an alternate processor
|
Standby Services
|
|
3 general categories of OS responses to failures
|
System Reboot, Emergency System Restart, Cold Start
|
|
Type of trusted recovery - performed after shutting down the system in a controlled manner in response to a TCB failure
|
System Reboot
|
|
Type of trusted recovery - done after a system fails in an uncontrolled manner in response to a TCB or media failure
|
Emergency Restart
|
|
Type of trusted recovery - takes place when unexpected TCB or media failures take place and the recovery procedures cannot bring the system to a consistent state. Requires intervention of admin to bing system back to consistent state
|
Cold Start
|
|
An event that has the potential to do harm
|
Incident
|
|
Change Control Procedures
|
request, impact analysis, approval, build/test, implement, monitor
|
|
To maintain the system integrity with respect to teh approved settings
|
Configuration Management
|
|
The methodical application of vendor-related updates and security nehancements
|
Patch Management
|
|
The core element of the Clark Wilson Model
|
Separation of Duties
|
|
Key Concepts of Access Control
|
Separation of Duties, Least Privilege, Need to know
|
|
Info that requires a special authorization beyone the normal classification system
|
Compartmentalized Information
|
|
Responsible for assigning the intitial creation and periodic review of info classification
|
Information Owners
|
|
Three types of Access Control
|
Physical, Technical/Logical, Administrative
|
|
List of Access Control Categories (7)
|
Directive, Deterrent, Preventative, Detective, Recovery, Corrective, Compensating
|
|
List of Access Control Threats (9)
|
Denial of Service, Password Cracking, Keylogging, Sniffing, TOC/TOU, Spoofing/Masquerading, Shoulder Surfing/Swiping, Dumpster Diving, Emanations
|
|
Lookup tables containing pre-hashed passwords used to speed up password cracking
|
Rainbow Tables
|
|
Use this to protect passwords agains rainbow table attacks
|
Salt
|
|
An attempt to gain access to a system by posting as an authorized user
|
Masquerading
|
|
What a point of sale terminal or AT is modified to capture PIN as well as recording card details
|
Swiping
|
|
Time of Check/Time of Use is and example of this
|
Race Condition
|
|
4 steps of access control
|
Identification, Authentication, Authorization, Accountability
|
|
Knowledge Authentication Types
|
Passwords, Passphrases, Personal History, Graphical
|
|
Minimum requirments of password
|
At least 6 characters, have special characters, not be a dictionary word, not be related to user ID
|
|
Types of Authentication by Ownership
|
Smart Cards, Tokens, RFID Cards, Memory Cards, One-Time Passwords
|
|
Credit card shaped devices or key fobs that generate dynamic passwords and come in asynchronous or synchrounous version.s
|
Tokens
|
|
Tokens are hardware or software?
|
Both
|
|
USB toeksn use PKI Technology or one-time passwords
|
PKI Technology
|
|
Type of ownership authentication that changes every minute or after every use. Not subject to shoulder sufing, replay attacks or password sharing
|
One-Time Password
|
|
Credit card shaped devices that contain one of more microprocessor chips that accept, store and send info through a readwer and are used for authentication
|
Smart Cards
|
|
Significant benefit of smart cards
|
Authentiation happens at the reader
|
|
Magenetic stripe cards that provide indentification/authentiation, usually oreiented toward physical access control of restricted areas
|
Memory Cards
|
|
Authentication method that uses a numberic keyboard for challenge reponse technology and a PIN.
|
Asynchrounous Token
|
|
Two types of synchrounous tokens
|
Event based and Time based
|
|
Synchronous token that increments a counter. Good for proximity
|
Event Based Synchronization
|
|
Synchronous token where the token and server time must be synched with 3 or 4 minutes accuracy. No entry on token required
|
Time-Based Synchronization
|
|
Two types of Smart Cards
|
Contact and Contactless
|
|
Two types of Biometrics
|
Static (Physiological) and Dynamic (Behavioral)
|
|
List of Biometric Selection Criteria (5)
|
Accuracy, Acceptability, Reaction/Processing Time, Population Coverage/Scalability, Data Protection
|
|
Biometric Accuracy - Authenitaction fails when it should not. Authorized person is denied
|
False Rejection Rate (FRR) Type 1 Error
|
|
Biometric Accuracy - Auhtenciation is successful when it should not be. Unauthorized person is granted access. More serious
|
False Acceptance Rate (FAR) Type 2
|
|
Biometric Accuracy - The point at which the FAR and FRR intersect
|
Crossover Error Rate (CER)
|
|
List of STatic Biometric Types (6)
|
Fingerprint/Palm Print, Hand geometry, Palm Vein Structure, Retina Scan, Iris Scan, Facial Recognition
|
|
Accuracy and Reaction time and acceptability for Fingerprint/Palm Print Biometrics
|
Highly accurate for authentication. 5-7 seconds. Accepted.
|
|
Accuracy and Reaction time and acceptability for Hand Geometry
|
Highly accurate for authentication. 3-5 seconds. Accepted.
|
|
Accuracy and Reaction time and acceptability for Palm Vein Structure
|
Highly accurate. Accepted.
|
|
Accuracy and Reaction time and acceptability for Retina Scan
|
Very accurate for Identification and Authentication. 4 - 7 seconds. Not well accepted. Susceptible to changing physical variations
|
|
Accuracy and Reaction time and acceptability for Iris Scan
|
Accurate for I and A. 1-2 seconds. Accepted.
|
|
Accuracy and Reaction time and acceptability for facial recongnition
|
Accurate for authentication, less for identification. Not well accepted.
|
|
List of Dynamic biometric Types (3)
|
Voice Pattern, Keytroke Dynamics, Signature Dynamics
|
|
Accuracy and Reaction time and acceptability for Voice Pattern
|
Not very accurate. 10-14 seconds. Well accepted.
|
|
Accuracy and Reaction time and acceptability for Keystroke Dynamics
|
Very accurate for authentication. Well accepted. Works well with 2-factor authentication.
|
|
Accuracy and Reaction time and acceptability for Signature Dynamics
|
Accurate for authentication. Well Accepted.
|
|
A set of technologies used to manage info abou the access rights of authrized users
|
Identity Managment
|
|
The hierarchical parent system that tracks users, their accounts, and their authorization chains
|
Authoritative System of Record (ASOR)
|
|
List of Identity Management Challenges (5)
|
Consistency, Reliability, Usability, Efficiency, Scalability
|
|
Two types of ID Management Principals
|
Insiders and outsiders
|
|
Account Provisioning Lifecycle
|
Initial setup, Change and Maintenance, Tear Down
|
|
List of ID Management Benefits (3)
|
Headcount Reduction, Productivity Increase, Risk Management
|
|
List of ID Management Technologies (4)
|
Web Access Management (WAM), Password Management, Account Managment, Profile Update
|
|
Mechanisms that can adminuser Id, authentication and authorization data concurrently for multiple web based applications. SSO capable.
|
Web Access Management
|
|
Mechanisms that enforce password criteria, synchronization and serlf service resets
|
Password Management
|
|
Automate the admin of user id's.
|
Account Management
|
|
Mechanisms that allow user to update non-critical personal data.
|
Profile Update
|
|
A centralized authentication database that admins acces to multiple resources
|
Single Sign on
|
|
An SSO open standards protocol for authentication in a singel security domain that uses symmetric key encryption in three pairs.
|
Kerberos
|
|
A protocol developed by the EU that addresses multiple or disparate security domains. SSO.
|
Secure European System for Applications in a Multi Vendor Environment (SESAME)
|
|
Acts as the authentication server and ticket granting server in Kerberos.
|
Key Distribution Center (KDC)
|
|
Kerberos uses symmetric or assymetric encryption
|
symmetric
|
|
Provides a coninuous means of obtaining additional tickets for the same or other appliccatins after the intitial authentication in Kerberos
|
Ticket Granting Server (TGS)
|
|
SESAME uses symmedtric or asymmetric keys?
|
Both
|
|
The SESME equivalents of a ticket granting ticket and a ticket granting server in Kerberos
|
Privileged Attributes Certificate (PAC) and Privileged Atributes Server (PAS)
|
|
Applications that provide the means to hiearchically organize and manage info about network users and resources and retrieve info by name association
|
Directory Services
|
|
List of Directory Services (3)
|
Lightweight Directory Access Protocol (LDAP), Network Information Services (NIS), Domain Name system (DNS)
|
|
Defines the set of objects that a subject in an info system is allwoed to access. Based on truest between the subject and object
|
security domains
|
|
Security Domain - Subjects are allowd to access objects at or lower than their access level. Bell Lapudula.
|
Hiearchical Domain Relationship
|
|
List of Access Control Languages (3)
|
Service Provisioning Markup Language (SPML), Security Assertion Markup Language (SAML), Extensible Access Control Markup Language (XACML)
|
|
List of Access COntrol MOdels (7)
|
Mandatory, Temporal, Discretionary, Role, Rule, Content, Privacy
|
|
Access Control Model - Operating system makes the final decision based on security labels. Enforces Confidentiality
|
Mandatory Access Control (MAC)
|
|
Access Control Model - time based acccess control (hours of operation)
|
Temporal Isolation
|
|
Access Control Model - enables the owner of the resource to specify twhich subjects can access specific resources. Uses ACL's
|
Dicretionary Access Control (DAC)
|
|
Most OS' use which Access Control Model
|
DAC
|
|
Access Control Model - bases access control on the users job functions at the owners discretion.
|
Role Based Access Control
|
|
Access Control Model - access is based on a list or rules created by system owners.
|
Rule Based Access Control
|
|
Access Control Model - based on the actual content of the data record. Requires arbiter program and more overhead.
|
Content-Dependent Access Control
|
|
RBAC basedon Organization for Economic Co-operation and Development
|
Privacy Aware - Role based access control
|
|
The most common implemenation of DAC. Easy way to specify which sujbects are allowed access to which objects
|
Access Control Lists (ACL)
|
|
A collection of access control lists implemented by comparing the column of users or subjects to their rights of acces to protected objects
|
Object Based Access Control Matrix
|
|
A collection of access control lists implemented by comparing the colum of column of objects to the rows of subjects
|
Subject Oreinted Copapbility Table
|
|
Access control where rules are closeley managed by the sys admin rather tahn by the system or object Owner
|
Non-Discretionary Access Control (NDAC)
|
|
NDAC or DAC is more secure?
|
NDAC
|
|
An interface where users are only allowed access to specific funtions, files or other resources.
|
Constrained User Interface
|
|
One entity makes network access decisions implemetend through authentication, authorization, and accounting (AAA) servers.
|
Centralized Access Control
|
|
List of centralized AAA servers (3)
|
Radius, TACACS+, Diamter
|
|
Most popular Centralized AAA service?
|
Radius
|
|
Most secure Centralized AAA service
|
Diameter
|
|
Provide real time monitoring of events as tehy happen in a computer system or network
|
Intrusion Detection System
|
|
List of IDS's (3)
|
Network ID's, Host-Based IDS, Application ID's.
|
|
Harware or software mecahnisim that has the ability to detect and stop attackes
|
Intrusion Prevention System (IPS)
|
|
List of IPS's (2)
|
HIPS, NIPS
|
|
List of types of NIPS's
|
Content based, Rate-based
|
|
measures the number of false positives in an IDS. A way of measuring accuracy
|
Key Performance INdicators (KPI)
|
|
List of IDS analysis Engine Methods (3)
|
Pattern/Signature Based, Anomaly-Based, Heristic
|
|
List of Pattern/Signature-Based IDS Analysis Methods (2)
|
Pattern Matching, Stateful Matching
|
|
List of Anomaly based IDS Analysis Methods (3)
|
Statistical, Traffic, Protocol
|
|
IDS Analysis Method - identtifies and matches curren activity with stored patterns to detect a potential intrusion
|
Pattern/Signature-Based
|
|
IDS Analysis Method - Scans packets to determine if speciifc byte sequences match the signature of the know attack
|
Pattern Matching
|
|
IDS Analysis Method - Looks for specific sequensces appreaing accross several packages in a traffic stream rather than just the individual packet
|
Stateful Matching
|
|
IDS Analysis Method - Compares current activitity with stored profiels of normal activity
|
Anomaly Based
|
|
IDS Analysis Method - baselines of normal traffic and throughput are developed and deviations result in alerts
|
Statistical
|
|
IDS Analysis Method - identifies any unacceptable deviations from expected behavior based on traffic and signals an alert
|
Traffic
|
|
IDS Analysis Method - deviations from well defined protocols identify signature-less attacks
|
Protocol
|
|
Another term for audit trail reduction
|
Clipping Level
|
|
Penetration Testing Method - refers to attacks on teh organizations network perimeter.
|
External
|
|
Penetration Testing Method - Pen team has no inside knowledge about the target and would operate as hacker would.
|
Zero Knowledge (blind)
|
|
Penetration Testing Method - Pen team has some inside knowledge about the target
|
Partial Knowledge
|
|
Penetration Testing Method - Pen team has intimate knowledge about target
|
Full Knowledge
|
|
Penetration Testing Method - Pen team is focused on a particular system/funciton
|
Targeted
|
|
Penetration Testing Method - Pen team is provided with little info concerning the orgs sys config. internal test
|
Blind
|
|
Penetration Testing Method - no one in organization is informed that test is happening
|
Double Blind
|
|
List of Pen testing steps (4)
|
Discovery, Enumeration, Vulnerability Mapping, Exploitation
|
|
List of threats to physical systems (3)
|
Natural/environmental, utility systems, human made/political events
|
|
The first line of defense in physical security
|
Perimeter controls
|
|
Perimeter controls should be near or far from the buliding?
|
As far as possible
|
|
Types of protective barriers (2)
|
Natural and structural
|
|
Fence Height - 1 meter/3-4 feet
|
Will deter casual trespassers
|
|
Fence Height - 2 meters/6-7 feet
|
Too high to climb easily
|
|
Fence Height - 2.5meters/8 feet
|
Will delay the determined intruder
|
|
Average height that top-guards add to fences
|
2-3 feet
|
|
Access points through fences
|
Gates
|
|
Permanent or retractable posts used to deter vehicle based attacks.
|
Bollards
|
|
List of key concepts of physical security (5)
|
Deter, Detect, Delay, Assess, Respond Appropriately
|
|
List of physical IDS device types (5)
|
Photoelectric, Ultrasonic, microwave, passive infrared, pressure snsitive
|
|
Physical IDS device type - active infrared beam that triggers an alarm when the beam is broken
|
Photoelectiric
|
|
Physical IDS device type - detects foreign signal change caused by intruder based off ultrasound energy
|
Ultrasonic
|
|
Physical IDS device type - picks up transmitted energy waves. Disruptions sound alarm
|
Microwave
|
|
Physical IDS device type - Tipped by a change in temperature (body heat)
|
Passive Infrared
|
|
Physical IDS device type - detects pressure on the sensor
|
Pressure Sensitive
|
|
List of Types of Lighting (5)
|
Continous Lighting, Trip Lighting, Standby Lighting, Emergency Exit Lighting, Emergency Egress Lighting
|
|
Physical Lighting - most common. Fixed Lights
|
Continous Lighting
|
|
Physical Lighting - Activated by a sensor
|
Trip Lighting
|
|
Physical Lighting - Automatically turns on when power goes out
|
Stanby Lighting
|
|
Physical Lighting - Shows location of exits. Always on
|
Emergency Exit Lighting
|
|
Shows teh way out and hazards along the way. Always on
|
Emergency Egress Lighting
|
|
Lighting that is always left on?
|
Continous Lighting, Emergency Exit Lighting, Emengerncy Egress Lighting
|
|
List of CCTV requirements (3)
|
Detection, Recognition, Identification
|
|
What are virtual CCTV systems?
|
Fake systems
|
|
Technical CCTV considterations
|
P, T, Z - Pan, Tilt, Zoom
|
|
Normal aspect ration of CCTV cameras
|
4:3 (horizontal:vertical)
|
|
Can be used to check the CCTV monitors ability to reporduce good contrast
|
Grey Scale
|
|
Provide an intelligent, decsion making factor to physical security
|
Guards
|
|
Key element of facility security - CPTED
|
Crime Prevention through Environmental Design
|
|
Singal if a door is blocked open
|
Contact Alarms
|
|
Allow for the remote control of doors
|
Contact Devices
|
|
Most secure door
|
Solid Core Door
|
|
Doors should open in or out
|
In
|
|
How many hinges per door?
|
3
|
|
Two physical access solutions that limit traffic flow and don't need human supervision
|
Turnstile and Mantraps
|
|
List of Lock components (5)
|
body, strike, strike plate, key, cylinder
|
|
Main benefit and drawback of keyed cards
|
key management. cost
|
|
List of lock attackes (2)
|
Lock picking, lock bumping
|
|
List of types of glass for windows (4)
|
Standard Plate Glass, Tempered Glass, Acrylic Materials, Polycarbonate windows
|
|
List of physical security IDS's (2)
|
CCTV, sensors/monitors
|
|
List of key threats to support systems (6)
|
HVAC Failure, Sewage, power loss, water, gas leaks, fire
|
|
Ideal humidity and temperature for the data center
|
40-60% humidity. 70-74 degress
|
|
Key concepts of Fire Protection (3)
|
Prevention, Detection, Suppression
|
|
Fire suppression mechanism where the water is held back by a valve and is released when teh sensor activeates
|
Pre-Action/Dry Pipe System
|
|
Combustible materials and suppression agents mnemonic for Classes
|
Ash, Boil, Current, Drive, Kitchen
|
|
Combustible materials and suppression agents - Class A
|
Common combustible materials (wood, paper, rubber, plastics etc.). Water, Myltipuopose Dry Checmical, Halon Replacement
|
|
Combustible materials and suppression agents - Class A
|
Flammable combustible liquids (oil, greases, tars, etc.). Carbon Dioxide, Multipurpose Dry Chemicals, Halon Replacement
|
|
Combustible materials and suppression agents - Class C
|
Enrgized Elecrical equipment. Carbon Dioxide, Multipurpose Dry Chemicals, Halon Replacement
|
|
Combulstible materials and suppression agents - Class D
|
Combustible metals (magnesioum, thorium, patassium, etc.). Dry Powders.
|
|
Combulstible materials and suppression agents - Class K
|
Cooking media sucah as vegetable and animal oils and fats. Wet Chemicals.
|
|
Three legs of a fire
|
Heat, Oxygen, Fuel
|
|
The primary fire extinguishing agen for all business environments
|
Water
|
|
A dry powder used by the fire department that binds with solid objects at the point of combustion to limt the fire's acces to fuel
|
Purple K
|
|
List of components of a sprinkler system (3)
|
Pipes, Heads, Source
|
|
List of best practices for fire suppression systems (4)
|
Zones of coverage, Timed release, HVAC off before activation, Sprinklers
|
|
Portable extinguishers should be placed at what distance from equipment and exits
|
Within 50 feet
|
|
List of complete losses of power (2)
|
Blackout, Fault
|
|
List of Power Degradations (6)
|
Brownout, Sag/Dip, Surge, Transients, In Rush Current, Electrostatic Charge
|
|
List of electical power intereference (noise) (2)
|
EMI, RFI
|
|
A prologned loss of total power
|
Blackout
|
|
A momentary loss of all power
|
Fault
|
|
A reduction of voltage by the utuilty company for a prolonged period of time
|
Brownout
|
|
A short period of low voltage
|
Sag/Dip
|
|
A sudden rise in voltage in the power supply
|
Surge
|
|
Line noise that is superimposed on the supply circuit typically caused by a fluctioation in power
|
Transients
|
|
The initial surge of current rquired when there is an increase in poser demand. Can trip breakers
|
In Rush Current
|
|
A power surge generated by a person or device contactinganother deivde and dranserring a high voltage shock
|
Electrostatic Charge
|
|
Electrical power interference caused by motors, lightning, low humidity, etc
|
EMI
|
|
Electrical power interference caused by components of electrical systems and transmissions
|
RFI
|
|
Solution for many power problems
|
Grounding
|
|
Alternate power supplies
|
UPS, Generators, Batteries
|
|
List of HVAC control considerations (3)
|
Location, Positive Pressure (fans), Maintenance
|
|
Key concepts of CPTED (3)
|
Surveillance, Access Control, Territoriality
|
|
Does not happen unless you break the law in both jurisdictions
|
Extradition
|
|
Where does jurisdiction end?
|
At your borders
|
|
United Nations common body overseeing intellectual property related complaints and enforcement
|
World Intellectual Property Organization
|
|
An intangible asset that is derived from the operation of a human mind
|
Intellectual Property
|
|
List of ways to protect intellectual property (4)
|
Copyright, Trademark, Patent, Trade Secret
|
|
This protects an idea. Novel, useful and non obvious inventions
|
Patent
|
|
This protects teh expression of an idea rather than the idea iteself
|
Copyright
|
|
This protects a symbol that represents an idea.
|
Trademark
|
|
This protects a proprietary process or procedure
|
Trade Secret
|
|
The strongest form of intellectual property protection
|
Patent
|
|
How long do patents typically last?
|
20 years
|
|
What is the average length of time for trade secrets to expire?
|
Never
|
|
Acting without care or failing to act as a reasonable person would under similar circumstances
|
Negligence
|
|
The care a reasonable person with the same training and experience would use
|
Due Care
|
|
The act of management that makes sure staff is acting w/ due care
|
Due Diligence
|
|
A group of 30 member countries sharing a commitment to privacy, democratic gov, and market economy
|
Oraganization for Economic Cooperation and Development (OECD)
|
|
The practice of detecting a problem, determing the cause, mimizing the damage and resolving the problem
|
Incident Reponse
|
|
Three main elements of Incident Response
|
Detection, Triage, Response
|
|
In forensic evidence collection, what evidence is most volatile
|
RAM
|
|
Chain of Custody documenation should track ((5)
|
Who, What, Where, When, How
|
|
Evidence that is based on what the witness was told rather than on his or her personal knowledge. An out of courts statement offered as proof of assertion
|
Hearsay
|
|
acaptures every sector on the drive from 0 until the last sector
|
Forensic Bit Stream
|
|
List of forensic evidence procedures (5)
|
Receive media, disk write blocker, bit for bit image, cryptographic checksum, store the source drive
|
|
List of Forensic evidence analysis procedures (4)
|
Recent activity, search with keywords, check slack space, document results
|
|
List of types of forensic analysis (3)
|
media, network, software
|
|
Financial Requlatory Requirements (3)
|
SOX, GLBA, Basel
|
|
The Business Continuity Plan should be integrated into what process.
|
Change/Configuration Management Process
|
|
5 steps of the Business Continuity Life Cycle
|
Analyze the Business, Assess the Risks, Develop the BC Strategy, Develop the BC Plan , Rehearse the Plan
|
|
The process of identifying the organizations key products and services and defining the time-criticality of the activities that support them.
|
Business Impact Analysis
|
|
How long a business function can be down before unacceptable impacts accumulate
|
Maximum tolerable downtime
|
|
The point to which info must be restored in order to enable the organization to function without unacceptable loss of data. This drives the backup strategy
|
Revovery Point Objective
|
|
What is the risk equation
|
Risk = threat impact * probability
|
|
Must be less than the maxiumum tolerable period of disruption. Planned recovery time.
|
Recovery Time Objective (RTO)
|
|
TIme between point of failure and restoration of critical services
|
Interruption Window
|
|
DR processing agreement - an a agreement with a a company that has similar technology
|
Reciprocal/Mutual Aid
|
|
DR processing agreement - contract with carriers for backup communcations or contingenct suppliers
|
Contingency
|
|
DR processing agreement - an appllication service provider that has extra capacity (Sunguard)
|
Service Bureau
|
|
CP test - low cost. Participants review plan content and check info such as phone numbers.
|
Desk Check/Checklist
|
|
CP test - low cost. Team members meet and sicuss each plan element and procedure acress several meetings.
|
Structured Walk Through/Classroom
|
|
CP test - typically include a mock disaster and all teams exercise their training and judgement.
|
Simulation/Functional Test/War Games
|
|
CP test - takes advantage of test time and actual recovery site. Does not impact operations. Proves critial systems can run at alternate site
|
Parallel
|
|
CP test - highest cost and complexity. Primary operations are shut down and continutity relies solely on recovery procedure. Should only be considered after succesful parallel testing with Steering committee authorizaiton
|
Full Interruption
|
|
3 steps of a quantitative risk analysis
|
Estimate potential loses, conduct a threat likelihood analysis, calculate annual loss expectancy
|
|
The estimate of the amount of damage that an asset will suffer due to a single incident
|
Single Loss Expectancy (SLE)
|
|
Expressed as a percentage of the asset value. If loss can be limted to one type, you can determine the impact o the asset by percentable of teh asset value lost.
|
Exposure Factor
|
|
The number of times per year tha an incident is likely to occur.
|
Annual Rate of Occurrence (ARO)
|
|
Provides an estimate of the yearly financial impact to the organization from a particular risk
|
Annual Loss Expectancy (ALE)
|
|
What is the ALE equation?
|
ALE = SLE x ARO
|
|
What is the purpose of the ALE?
|
To justify countermeasures.
|
|
FMEA and FTA are both inputs into which kind of risk analyis?
|
Quantitative Analysis
|
|
A risk assessment effor originally concerned with manufacting defects and focuses on the upstream and downstream impact of a failure
|
Faule Modes and Effects Analysis (FMEA)
|
|
An analytical technique for system safety. It is used to consider all possible thereat and then trim down to the most relevant risks
|
Fault Tree Analysis (FTA)
|
|
4 risk mitigation options
|
Acceptance, Avoidance, Reduction, Transference
|
|
A type of ethical theory based on outcomes. Try to provide the greatest good for the greatest number of individuals. Utilitarianism
|
Teleology
|
|
Ethical theory that subscribes to the belief that each person has pre-existing requirements to be good. Their duty to be good.
|
Deontology
|
|
The things most often thought aobut when considering security solutions. They should meet a specific security requirement
|
Functional Requirements
|
|
These confirm that security solutions are slected appropriately, performing as intended, and are having the desired effect
|
Assurance Requirements
|
|
3 Level of security planning
|
strategic, tactical, operational
|
|
Type of security planning that focuses on high level, long range rquirments of a company long term plan. Overarching security policy and alignment of security program are examples
|
Strategic planning
|
|
Type of security planning - more a mid-term focus on eventsthat will affect the entire organization. Functional plans fit into this category. Network redesing, installation of new equipment and controls and trcking of incident over a period of time
|
Tactical Planning
|
|
Type of security planning - focuses on fighting fires. Planning for near term. Concerned with dtecting, responding and recovering from incidents and compliance and monitoring of systems
|
Operational Level Planning
|
|
Type of algorythm used on small, non repeating key strings such as session keys
|
Electronic Code Book
|
|
Type of algorythm used on documents, programs and media. Data at rest.
|
Cipher Block Chaining
|
|
Type of algorythm used on low volume streams
|
Cipher Feed Back
|
|
Type of algorythm used on medium volume streams although rarely used. Error propagate
|
Output Feed Back
|
|
Type of algorythm used on high volume streams. Pay per view, WPA2
|
Counter
|
|
Type of algorithm - fast, weak, same plaintext gives same ciphertext
|
Electronic Code Book
|
|
Type of algorithm - adds security via IV and key propagation
|
Cihper Block Chaining
|
|
Type of algorithm - can catch integriy errors
|
Cipher Feed Back
|
|
Type of algorithm - keystream can be partially pregenerated
|
Output Feed Back
|
|
Type of algorithm - keystream can be precompouted or generated in parallel
|
Counter
|
|
What physical goal? - Barriers
|
Deter
|
|
What physical goal? - Entry and search controls
|
Delay
|
|
What physical goal? - Physical intrusion detection
|
Detect
|
|
What physical goal? - Alarm response, testing and maintenance
|
Assses
|
|
What physical goal? - appropriate action in the face of unauthorized entry
|
Respond
|
|
Type of fire suppression - water under pressure, heat causes discharge, freezing is a problem
|
Wet Pipe
|
|
Type of fire suppression - aripressure holds valve shut, protects gainst freeze ups
|
Dry Pipe
|
|
Type of fire suppression - air pressure like dry pipe, ion/smoke detector opens valve, heat releases water
|
Pre-Action
|
|
EAL Level - Functionally Tested
|
1
|
|
EAL Level - structually tested
|
2
|
|
EAL Level - methodically tested
|
3
|
|
EAL Level - (3) + One Time Review
|
4
|
|
EAL Level - semi-formal testing
|
5
|
|
EAL Level - semi-formal review
|
6
|
|
EAL Level - semi-formal testing and verification
|
7
|
|
Single Loss Expectancy (SLE) equation
|
Asset Value (AV) x Exposure Factor (EF)
|
|
Managing Design - What security functionality do we need to support the design decisions we've made?
|
Conceptual
|
|
Managing Design - How are we going to deliver the functionality?
|
Functional
|
|
Managing Design - A measure of how well the functional implementation matched the conceptual design
|
Operational Evaluations
|
|
Exposure Factor as expressed as what?
|
A percent
|
|
Minimum permissions to do the job
|
Least privilege
|
|
Minimum knowledge to do the job
|
Need to Know
|
|
Ensures that users can securely access the TCB for login and other confidential functions
|
Trusted Path
|
|
Assureance that sensitive data is destroyed before the resource is reissued
|
Object Reuse
|
|
A record of security related transactions
|
Audit
|
|
Security models that provide confidentiality
|
Bell Lapadula, Biba,
|
|
5 identity management challenges
|
Consistency, Efficiency, Usability, Reliabilty, Scalability
|
|
Security Framework - About planning
|
TQM
|
|
Security Framework - About managing quality
|
ITIL
|
|
Security Framework - about managing risks
|
COSO
|
|
Security Framework - about control points
|
COBIT
|
|
Security Framework - about the skills and disciplines
|
Six Sigma
|
|
Security Framework - about maturing these processes
|
CMM/CMMI
|
|
Security Framework - financial stability standards
|
Basel II
|
|
Security Framework - the outermost perspective
|
ISO Standards
|
|
A function without which a business will ceast to operate
|
Critical Business Function
|
|
An event tha will cause a CBF to be unavailable for longer than the MTD
|
Disaster
|
|
The amount of time needed to recover a cbf
|
Recovery Time Objective
|
|
The amount of data that has to be recovered to meet the needs of a CBF
|
Recovery Point Objective
|
|
A set of previously decided actions to take when faced with a distaster. Includes everything form declaration of disaster to recovery and return to primary
|
Disaster Recovery Plan
|
|
The location from which the disaster recovery will be managerd
|
Emergency Operations Center (EOC)
|
|
Process of automating the factors that go into decision making
|
Knowledge Management
|
|
Knowledge Management type - based on probabilities and data interdependencies
|
Probabilitstic Approach
|
|
Knowledge Management type - observe and generalize patterns and construct rules based on them
|
Statistical Approach
|
|
Knowledge Management type - pattern discovery and data cleaning model that reduces large database to a few representative examples
|
Classfication Approach
|
|
Knowledge Management type - uses giltering techniques to detect patterns
|
Trend Analysis
|
|
Knowledge Management type - detects associations among input pattern. Organized data into nodes, arranges them into layers, and discovers the links between them
|
Nerual Networks
|
|
Knowledge Management type - uses a knowledge base and a set of rules that an infer new facts from existing knowldge plus incoming data
|
Expert System Approach
|
|
WEP and WPA use what algorithm?
|
RC4
|
|
What type of integrity for WEP?
|
CRC
|
|
What type of integrity for WPA?
|
Michael
|
|
What type of integrity for WPA2?
|
CBC-MAC
|
|
What type of IV for WEP?
|
Static
|
|
What type of IV for WPA?
|
Random
|
|
Tunneling Protocol - Created by Cisco, not dependent on IP, allows multiple endpoints, unencrypted
|
Layer 2 Forwarding (L2F)
|
|
Tunneling Protocol - windows only, useses PPP authentication, two factor possible (EAP), weak encryption
|
Point to Point Tunneling (PPTP)
|
|
Tunneling Protocol - joint effort of Cisco and Microsoft, supports 2 factor authentication, supports FR/ATM tunnels, supports IPSEC over IP
|
Layer 2 Tunneling Protocol (L2TP)
|
|
Tunneling Protocol - Only true VPN/Tunneling protocol
|
IPSEC
|
|
Lock Controls - All parts of a transaction complete or none do (rollback if necessary)
|
Atomicity
|
|
Lock Controls - A change is allowed only when it makes internal and external consistency
|
Consistency
|
|
Lock Controls - results of a transaction are invisible until complete
|
Isolation
|
|
Lock Controls - a completed transaction is persistent even in the event of a system failure
|
Durability
|
|
Can it be cross-examined?
|
Hearsay
|
|
Testimony that will cause the witness to be arrested, tried and probably convicted. Unlikely to be false
|
Statement against penal interest
|
|
Records created in the ordinary course of business, relied on by the businees, testified to by someone with knowledge of the contents and the collection procedures
|
Business Records
|
|
5 rules of evidence
|
Admissable, Authentic, Complete, Reliable, Believable
|
|
Types of Computer Crimes - Virus, Worm, Denial of Service
|
Crimes Against Computers
|
|
Types of Computer Crimes - Email, Fraud, Embezzlement
|
Crimes Using Computers
|
|
Types of Computer Crimes - Suicide Note, Checklist
|
Crimes Where a Computer is Incidental
|
|
4 elements of a tort
|
Duty, Breach, Proximate Cause, Damage
|
|
3 elements of a crime
|
Means, Opportunity, Motive
|