Cissp Domain 2 - Asset Security (Steve)

Front 1

According to ISC2, without an appropriate classification scheme, there is no ____________

Back 1

Data Security

Front 2

What is the first step to a classification scheme?

Back 2

Security Classification Guide (SCG)

Front 3

What are the commercial classification levels order (highest to lowest)?
Sensitive, Private, Public, Confidential

Back 3

Highest to lowest:
Confidential
Private
Sensitive
Public

Front 4

The __________ is the subject responsible for classifying and labeling objects and for protecting and storing data on any system. (They protect CIA)

Back 4

Owner (or Data Owner)

Front 5

The data owner is responsible for classifying and labeling objects and for protecting and storing data on any system. Do they personally do all of the work mentioned?

Back 5

No. They hire others to do it. (sys admin?)

Front 6

Categorize the information system and the information processed, stored, and transmitted by that system based on an _____________.

Back 6

impact analysis

Front 7

FIPS 199 establishes 3 potential levels of impact (______,_______,______) on CIA.

Back 7

- Low (Limited Adverse Effect)

- Moderate (Serious Adverse Effect)

- High (Severe/Catastrophic Adverse Effect)

Front 8

What is the term that defines the range you will be working with?

Back 8

Scope

Front 9

After the scope is defined, the next step is to zoom in and determine what your specific assets are and how they can be properly protected. This allows you to perform ___________.

Back 9

Tailoring, or customization

Front 10

What are the Scoping and Tailoring metrics?

(Hint: KGI KPI)

Back 10

Key Goal Indicators

Key Performance Indicators

Front 11

Data ownership is a ________ process that details an organization's legal ownership of enterprise-wide data

Back 11

Governance

Front 12

What is FIPPS?

Back 12

Fair Information Practice Principles

- Open framework defining privacy principles

- Considers the privacy implications as part of cybersecurity

Front 13

What level are data owners, data custodians, and data processors?

Back 13

Upper Mgmnt

Administrators

Users

Front 14

What is the 2nd step in the NIST RMF?

Back 14

Select an initial set of security controls for the information system, based on the security categorization.

Front 15

What is the use of anti-spam filtering software to allow only specified e-mail addresses to get through.

Back 15

Whitelisting

Front 16

What is the difference between need-to-know and least privilege?

Back 16

Need-to-know is only human beings

Least Privilege can be users and/or processes (users only get those access they need to perform official duties)

Front 17

What is an agreement between two or more parties to subvert security?

Back 17

Collusion

Front 18

If data is sensitive, it is appropriate to keep it in a locked area (physical) called a ___________.

Back 18

Vault

Front 19

What is the residual information remaining on storage media?

Back 19

Data Remanence

Front 20

What are the two Data Remanence Countermeasures?

Back 20

- Clearing (sanitizing through deleting/rewriting)

- Purging (physical or logical techniques that render data unrecoverable even in a state-of-the art laboratory)

Front 21

What are 4 purging operations?

Back 21

Overwriting (7 times)

Encryption (encrypt then destroy key)

Degaussing (magnetic fluctuation)

Physical destruction (pow)

Front 22

2 types of encryption for data at rest?

Back 22

- Whole Drive (decrypted to access)

- File/folder level encryption (copied with encryption)

Front 23

What are the two original common hash functions?

Back 23

SHA1 and MD5

Front 24

What replaced SHA1 and MD5?

Back 24

SHA2 (or SH256) - (longer, more collision resistant)

Note: MD5 is no longer secure

Front 25

How many bits is the MD5 hash?

SHA1?

SHA2?

Back 25

MD5: 128 Bits

SHA1: 160 Bits

SHA2: 256 Bits

Front 26

What is hashing collision?

Back 26

Two different binary files creating the same hash

Front 27

What are the two primary uses of hashes?

Back 27

1: Verify file has not been altered (especially those sent over the Internet)

2: Storing passwords

Front 28

What adds padding to passwords before they are hashed?

Back 28

Salting (padding, or initial vector)

Front 29

What are the Asymmetric Algorithms (A REED)

Back 29

RSA (PKI) , ECC, ElGamal, Diffie Hellman - A REED

Front 30

What are the Symmetric Algorithms?

Back 30

RC4, AES, IDEA, DES, Triple DES, Blowfish

Front 31

What is a string of bits used by an algorithm for encryption? (typically shown to humans as a hex string)

Back 31

Cryptographic Key

Front 32

What is the speed difference between symmetric and asymmetric encryption?

Back 32

Sym = fast

Asym = slow(er)

Front 33

Most common Asymmetric Algorithms?

Back 33

RSA, ECC

(PKI is not an algorithm. It is an infrastructure based on public key cryptography).

Front 34

Most common Symmetric Algorithm(s)?

Back 34

AES, (also RC4, only in early WiFi)

Front 35

What are the AES encryption key bit length?

Back 35

128 to 256 bit keys

Front 36

What block cipher, that divides a message into64-bit blocks and employs S-box-type functions, was replaced by AES.

Back 36

Data Encryption Standard (DES)

Front 37

In AES, why use 128 bit key?

What abut 256?

Back 37

128: Session Key (doesn't need to be as secure)

256: Data at rest (needs more security)

Front 38

When utilizing encryption of data-at-rest on an entire hard drive, what is the module you would use with BitLocker?

(Hint: TPM)

Back 38

TPM (Trusted Platform Module) Chip

Front 39

What does AES stand for and what type of encryption is it?

Back 39

Advanced Encryption Standard - Symmetric

Front 40

What is the De facto asymmetric algorithm?

Back 40

RSA (Named for Rivest, Shamir, and Adleman

Front 41

What is the federal Asymmetric digital signature standard adopted by most companies/modern PKI processes?

Back 41

Asymmetric DSS

Front 42

What crypto method uses both Asymmetric and Symmetric encryption?

Back 42

Hybrid

Front 43

Who is the trusted third party that creates digital certificates and creates public/private key pairs, manages security credentials, and publishes CRLs?

Back 43

Certificate Authority

Front 44

What is X.509?

Back 44

A format for digital certificates

Front 45

Who is a licensed certificate distributor or middleman, regarding PKI?

Back 45

Registration Authority (RA)

Front 46

What are the two types of Certificate Authorities?

Back 46

Public (outside) - Internet CA's sell digital certs

- Good on Internet

Private (inside) - Create your own CA

- Not valid on Internet (not trusted)

Front 47

What is a trust relationship that exists between two or more CAs through a third CA they both trust?

Back 47

A Bridge Trust

Front 48

Which Certificate Authority vouches for themselves?

Back 48

Root CA

Front 49

Who vouches for Subordinate Certificate Authorities?

Back 49

Root CA

Front 50

Difference between key suspension and revocation

Back 50

suspension - put on hold (Maternity Leave)

revocation - revoked before expiration

Front 51

PKI key revocation includes Expiration, Renewal, and Destruction. Define Each.

Back 51

Expiration: self explanatory

Renewal: Losing a CAC

Destruction: end of life cycle or compromise

Front 52

The CA can store a copy of a private key offline. What is this called?

Back 52

Escrow (Only Key Recovery Agents (KRA) can pull them from "storage".)

Front 53

________________ is a list (file) of revoked or suspended certificate serial numbers.

Back 53

CRL (Certificate Revocation List)

Front 54

What is a more modern CRL name?

(Hint: OCSP)

Back 54

OCSP (Online Certification Status Protocol)

Front 55

What digital certificate is primarily used to prove identity (authentication)

Back 55

X.509

Front 56

What is a popular numbered set of PKI standards that have been defined by the RSA corporation?

(Hint: PKCS)

Back 56

Public-Key Cryptography Standards

Front 57

What PKI Standards (other than PKCS) exist?

Back 57

FIPS (Federal Information Processing)

Front 58

How are public keys stored?

Back 58

Embedded within digital certificates

Front 59

What cryptography method exchanges keys between smartphones?

Back 59

ECC (Elliptical Curve Cryptography)

Front 60

What is the key exchange protocol used for secure VPN?

Back 60

IPSec (Internet Protocol Security)

Front 61

Where can private keys be stored?

Back 61

On a CAC or on the local user's system

Front 62

What protocols provide email security?

Back 62

PGP (Pretty Good Privacy)
SMIME/Exchange(allows MIME to encrypt and digitally sign email messages and encrypt attachments

Front 63

Which is considered the weaker system?

Link or End-to-End encryption and why?

Back 63

Link, because the packets are decrypted at each hop.

Front 64

Within IPSec, what are the two primary features for:

1. Encryption

2. Integrity

Back 64

1. Encapsulating Security Payload (ESP)

2. Authentication Header (AH)

Front 65

What protocol uses the Diffie-Hellman technique to establish session keys?

Back 65

OAKLEY

Front 66

IPSec uses ________, the de facto standard, exchange keys

Back 66

IKE = Hybrid (ISAKMP + OAKLEY)

Front 67

List 3 main secure Point-to-Point Tunneling Protocols?

Back 67

HTTPS

SSL (Secure Socket Layer)

TLS (Transport Layer Security)

Front 68

What are 2 protocols that replaced FTP, allowing secure file transfer?

Back 68

SSH (Secure Socket Host)

S-FTP (S-FTP uses SSH)

Front 69

In cryptanalytic attacks, what is a Frequency Analysis?

Back 69

e.g. Looking for frequency of a or e in English...

Front 70

In cryptanalytic attacks, what is an algorithm error?

Back 70

Exploiting known weaknesses in program (engineers built without crypto in mind)

Front 71

In cryptanalytic attacks,what is a dictionary attack?

Back 71

List of common passwords using dictionary files (lists)

Front 72

What is a rubber hose attack?

Back 72

Extortion, bribery, or threats of violence

Front 73

What is a birthday attack?

Back 73

Trying to force a collision against hash passwords - (reverse hash matching)

Front 74

What is a legitimate use to hide copyright information called?

Back 74

Digital Watermarking (a photographer protecting their images)

Front 75

What is an attack in which Messages usually start with the same type of beginning and close with the same type of ending, allowing an attacker to "brute force" the rest of a message?

Back 75

Known Plaintext

Front 76

What is the attack called when an attacker has only several cyphertext messages?

Back 76

Cipher-text only

Front 77

In this attack, the attacker has the plaintext and ciphertext, but can choose the plaintext that gets encrypted to see the corresponding ciphertext

Back 77

Chosen Plain-text (goal is to figure out the key)

Front 78

In this attack, the attacker can choose the ciphertext to be decrypted and has access to the resulting decrypted plaintext. Again, the goal is to figure out the key.This is a harder attack to carry out compared to the previously mentioned attacks, andthe attacker may need to have control of the system that contains the cryptosystem.

Back 78

Chosen cipher-text (goal is to figure out the key)

Front 79

Digital signatures have to do with what type of cryptography?

Back 79

Asymmetric

Front 80

What are the 2 main things Asymmetric crypto provides?

Back 80

Confidentiality and Authentication

Front 81

What key do you use to encrypt keys for confidentiality mode? (sending symmetric session key)

Back 81

Recipients Public Key

Front 82

What key do you use to encrypt hashes for Authentication mode (proving your identity)

Back 82

Sender's private key

Front 83

____________ is an encrypted hash generated by a sender of data to provide origin authentication (proof of sender ID)

Back 83

Digital Signature

Front 84

Digital signatures provide confidentiality.

T/F

Back 84

False! Only authentication!

Front 85

A message digest is another name for a ____?

Back 85

Hash

Front 86

What are the 2 main Asymmetric Algorithms?

Back 86

RSA and ECC

Front 87

How long are RSA keys?

Back 87

1024 Bit (largely obsolete)

2048 Bit (Norm)

Front 88

What is RSA mainly used for?

Back 88

To transfer and protect keys

Front 89

1. How long are ECC keys?

2. Are they public and private?

3. How are they used?

Back 89

1. 256 Bit (smaller, but with same strength as RSA) (mystery 160 bit)
2. Yes!

3. Smartphones and tablets

Front 90

What cryptography algorithm streams one bit at a time?

Back 90

RS4 (stream cipher)

Front 91

What is El Gamal?

Back 91

Asymmetric encryption algorithm based on Diffie-Hellman

Front 92

What are the 3 levels of Certificate Authorities?

Back 92

Top: Root CA

Middle: CA

Lower: RA

Front 93

What type of encryption is used on removable media?

Back 93

File/folder encryption

Front 94

What type of encryption is used for data in motion?

Back 94

AES (Symmetric)

Front 95

PKI uses what algorithm?

Back 95

RSA

Front 96

How are Public Private keys initially created?

Back 96

Multiplying two large prime numbers

Front 97

What is the protocol used for session communication (client to client or client to server)?

Back 97

TLS (Transport Layer Security) or SSL (Secure Socket Layer)

Front 98

The session key can also be called the __________.

Back 98

secret key

Front 99

What is a one-time pad?

Back 99

A one-time use encryption method. Use the key, then throw it away.

(First unbreakable paper cipher)