Cissp Terms (Fort Gordon Test Prep)

Front 1

Guideline

Back 1

A recommendation, an administrative control

Front 2

Procedure

Back 2

Step by step guide for accomplishing a task, and administrative control

Front 3

Standard

Back 3

Describes the specific use of technology, often applied to hardware and software, an administrative control

Front 4

Policy

Back 4

High level management directives, an administrative control

Front 5

Principle of least privilege

Back 5

Granting subjects the minimum amount of authorization required to do their jobs, also know as minimum necessary access

Front 6

Separation of duties

Back 6

Dividing sensitive transactions among multiple subjects

Front 7

Mandatory vacations (leave)

Back 7

Forcing staff to take vacation or time away from the office, also known as forced vacation

Front 8

Collusion

Back 8

An agreement between two or more individuals to subvert the security of a system.

Front 9

EF Exposure factor

Back 9

The percentage of value an asset lost due to an incident.

Front 10

AV Asset value

Back 10

The value of a protected asset.

Front 11

ARO Annualized rate of occurrence

Back 11

The number of losses suffered per year.

Front 12

Qualitative risk analysis

Back 12

Risk analysis method that uses approximate values.

Front 13

Quantitative risk analysis

Back 13

Risk analysis method that uses hard metrics such as dollars.

Front 14

XOR

Back 14

Exclusive OR Binary operation that is true if one or two inputs (but not both) is true.

Front 15

MD5

Back 15

Message Digest 5 a hash function that creates a 128bit message digest.

Front 16

Symmetric Key Algorithms

Back 16

class of algorithms for cryptography that use the same cryptographic keys for both the encryption of plaintext and decryption of cipher text. The keys may be identical of there may be a simple transformation to go between the two keys. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. This requirement that both parties have access to the secret key is one of the main drawbacks of symmetric key encryption, in comparison to publickey encryption.

Front 17

Asymmetric Algorithms

Back 17

public key cryptography/asymmetric cryptography are a class of cryptographic algorithms which require two separate keys, one of which is secret (or private) and one of which is public. Although different, the two parts of this key pair are mathematically linked. The public key is used to encrypt plain text or to verify a digital signature whereas the private key is used to decrypt cipher text or to create a digital signature.

Front 18

OCSP (Online Certificate Status Protocol)

Back 18

a client server method used for looking up revoked certificates

Front 19

Web of Trust

Back 19

concept used in PGP, GnuPG, and other OpenPGP compatible systems to establish the authenticity of the binding between a public key and its owner. Its decentralized trust model is an alternative to the centralized trust model of a public key infrastructure (PKI), which relies exclusively on a certificate authority (or a hierarchy of such). As with computer networks there are many independent webs of trust, and any user (through their identity certificate) can be a part of, and a link between, multiple webs.

Front 20

GnuPG GNU Privacy Guard

Back 20

or GPG is a GPL licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with RFC 4880, with is the current IETF standards track specification of OpenPGP. Although the basic GnuPg program has a command line interface, there exist various front ends that provide it with a graphical user interface the most popular are for linux desktops. Hybrid encryption software program in that it uses a combination of conventional symmetric key cryptography for speed and public key cryptography (asymmetric) for ease of secure key exchange, typically by using the recipient’s public key to encrypt a session key which is only used once. This mode of operation is part of the OpenPGP standard and has been part of PGP from its first version. By default uses the CAST5 symmetrical algorithm.

Front 21

PGP Pretty Good Privacy

Back 21

Software that integrates symmetric, asymmetric and hash cryptography. Used for signing, encrypting, and decrypting texts, emails, files, directories and whole disk partitions and increase the security of email communications (Phil Zimmermann in 91).

Front 22

OSI Model

Back 22

A network model with seven layers:

Front 23

Physical

Back 23

describes units of data such as bits represented by energy (such as light, electricity, or radio waves) and the medium used to carry them (such as copper or fiber optic cables). WLANs have a physical layer, even though we cannot physically touch it. Cabling standards such as Thinnet, Thicknet, and Unshielded Twisted Pair exist at Layer1. Devices include hubs and repeaters.

Front 24

Data link

Back 24

handles access to the physical layer as well as local area network communication. An Ethernet card and its MAC address are at layer 2, as are switches and bridges. Layer 2 is divided in two sub layers: Media Access Control (MAC) and Logical Link Control (LLC). The MAC layer transfers data to and from the physical layer, and the LLC layer handles LAN communications. MAC touches layer 1 and LLC touches layer 3.

Front 25

Network

Back 25

describes routing: moving data from a system on one LAN to a system on another. IP addresses and routers exist at layer 3. Layer 3 protocols include IPv4 and IPv6, among others.

Front 26

Transport

Back 26

handles packet sequencing, flow control, and error detection. TCP and User Datagram Protocol (UDP) are layer 4 protocols. Layer 4 makes a number of features available, such as resending or re sequencing packets. Taking advantage of these features is a protocol implementation decision. As we will see later, TCP takes advantage of these features, at the expense of speed. Many of these features are not implemented in UDP, which chooses speed over reliability.

Front 27

Session

Back 27

manages sessions, which provide maintenance on connections. Mounting a file share via a network requires a number of maintenance sessions, such as Remote Procedure Calls (RPCs), which exist at the session layer. A good way to remember the function of the Session Layer is “connections between applications.” The Session Layer users simplex, half-duplex, and full-duplex communication.

Front 28

Presentation

Back 28

presents data to the application (and user) in a comprehensible way. Presentation Layer concepts include data conversion, characters sets such as ASCII, and image formats such as Graphics Interchange Format (GIF), Joint Photographic Experts Group (JPEG), and Tagged Image File Format (TIFF).

Front 29

Application

Back 29

where you interface with your computer application. Your web browser, word processor, and instant messaging client exist at layer 7. The protocols Telnet and FTP are application layer protocols.

Front 30

IGMP Internet Group Management Protocol

Back 30

is a communications protocol used by hosts and adjacent routers on IP networks to establish multicast group memberships. It is an integral part of IP multicast. IGMP can be used for one to many networking applications such as online streaming video and gaming, and allows more efficient use of resources when supporting these types of applications. IGMP is used on IPv4 networks. Multicast management on IPv6 networks is handled by Multicast listener Discovery (MLD) which uses ICMPv6 messaging in contrast to IGMPs bare IP encapsulation. IGMP operates between the client computer and the local multicast router.

Front 31

ICMP Internet Control Message Protocol

Back 31

used by network devices, like routers, to send error messages indicating, for example, that a requested service is not available or that a host or router could not be reached. ICMP can also be used to relay query messages. It is assigned protocol number 1. ICMP differs from transport protocols such as TCP and UDP in that it is not typically used to exchange data between systems, not is it regularly employed by end user network application, with the exception of some diagnostic tools like ping an traceroute. Part of the Internet Protocol Suite as defined in RFC 792. Messages are typically used for diagnostic or control purposed or generated in response to errors in IP operations. Errors are directed to the source IP address of the originating packet. IE, every device forwarding an IP datagram first decrements the time to live (TTL) filed in the IP header by one. If the resulting TTL is 0, the packet is discarded and the ICMP time to live exceeded in transit message is sent to the datagram’s source address.

Front 32

Multicast

Back 32

one to many network traffic, where the “many” is preselected. Most common protocol is UDP but that is sometimes unreliable so Pragmatic General Multicast (PGM) have been developed. IGMP is used to route via IPv4 networks and MLD on IPv6 networks

Front 33

EMI External Machine Interface

Back 33

and extension to Universal Computer Protocol (UCP), is a protocol primarily used to connect to short message service centers (SMSCs) for mobile telephones. The protocol was developed by CMG Wireless Data Solutions.

Front 34

EMI/RFI

Back 34

Electromagnetic Interference/Radio Frequency Interferenc

Front 35

RFI Remote File Inclusion

Back 35

altering web URLs to include remote content usually done through a PHP (Hypertext Preprocessor) attack. This is a web attack. Done through a legitimate site attacker will force down a file like something.php to client computer and it will launch stealing info, create a backdoor or other nefarious things.

Front 36

FDDI Fiber Distributed Data Interface

Back 36

Legacy lab technology that uses light. Runs on a logical network ring via a primary and secondary counter-rotating fiber optic ring. Secondary ring was used for fault tolerance. Runs at 100 megabits and uses a “token bus” a different token passing mechanism that token ring. In addition to reliability another advantage of FDDI is light as fiber cable is not affected by electromagnetic interference.

Front 37

DSSS Direct Spread Spectrum Sequence

Back 37

A method for sending wireless traffic via a radio band. Uses the entire wireless band at once. Designed to maximize throughput while minimizing the effects of interference.

Front 38

FHSS Frequency Hopping Spectrum Sequence

Back 38

A method for sending wireless traffic via a radio band. Uses the a number of small frequency channels throughout the band and hops through them in pseudorandom order. Designed to maximize throughput while minimizing the effects of interference.

Front 39

OFDM Orthogonal Frequency-Division Multiplexing

Back 39

is a newer multiplexing method, allowing simultaneous transmission using multiple independent wireless frequencies that do not interfere with each other.

Front 40

CDMA Code Division Multiple Access

Back 40

this is an example of multiple access, which is where several transmitters can send information simultaneously over a single communication channel. This allows several users to a share a band of frequencies. Uses spread spectrum technology and special coding scheme. I would use the term modulation.

Front 41

MPPE Microsoft Point-to-Point Encryption

Back 41

encrypts data in point to point protocol (PPP) based dial up connections or point to point tunneling protocol (PPTP) virtual private network (VPN) connections. 128 bit key (strong), 56 bit key, and 40 bit key (standard) MPPE encryption schemes are supported. Provides data security for the PPTP connection that is between the VPN client and the VPN server. MPPE alone does not compress or expand data, but the protocol is often used in conjunction with Microsoft point to point compression which compresses data across PPP or VPN links.

Front 42

L2F Layer 2 Forwarding

Back 42

Designed to tunnel Point-to-Point Protocol (PPP). Developed by Cisco Systems. Does not provide encryption or confidentiality by itself, it relies on the protocol being tunneled to provide the privacy.

Front 43

L2TP Layer 2 Tunneling Protocol

Back 43

Combines PPTP and L2F. The entire L2TP packet, including payload and L2TP header, is sent within a User Datagram Protocol (UPD) datagram. It is common to carry PPP session within an L2TP tunnel. L2TP does not provide confidentiality or strong authentication by itself. IPsec is often used to secure L2TP packets by providing CIA. The combination of these two protocols is generally known as L2TP/IPsec.

Front 44

PPTP Point-to-Point Tunneling Protocol

Back 44

Uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets.

Front 45

GRE Generic Routing Encapsulation

Back 45

is a tunneling protocol developed by Cisco that can encapsulate a wide variety of network layer protocols inside virtual point to point links over an internet protocol internetwork..

Front 46

IPsec Internet Protocol Security

Back 46

A suite of protocols that provide a cryptographic layer to both IPv4 and IPv6. It uses Authentication Headers (AH) that provide integrity and origin authentication, Encapsulation Security Payloads (ESP) that provides confidentiality, data-origin authentication, connectionless integrity and Security Associations (SA) that provides a framework for authentication and key exchange with actual authenticated keying material provided wither by manual configuration with pre-shared keys, internet keyexhange, kerberixzed internet negotiation of keys or ipseckey dns records.

Front 47

AH Authentication Header

Back 47

guarantees connectionless integrity and data origin authentication of IP packets. Further, it can optionally protect against replay attacks by using the sliding window technique and discarding old packets.

Front 48

Tunnel Mode

Back 48

in IPsec in tunnel mode the entire IP packet is encrypted and or authenticated. It is then encapsulated into a new IP packet with a new IP header. Tunnel mode is used to create a virtual private networks for network to network communication (e.g. between routers to link sites), host to network communications (e.g. remote user access) and host to host communications (e.g. private chat). Tunnel mode support NAT traversal.

Front 49

SOCKS Socket Secure

Back 49

Popular circuit level proxy. Internet protocol that routes network packets between a client and server through a proxy server. SOCKS5 additionally provides authentication so only authorized users may access a server practically, a SAOCKS server proxies TCP connections to an arbitrary IP address, and provides a means for UDP packets to be forwarded. SOCKS performs at Layer 5 of the OSI model (session layer). De facto standard for circuit level gateways.

Front 50

Beacon Frame

Back 50

is one of the management frames in IEEE 802.11 based WLANs. It contains all the information about the network. Beacon frames are transmitted periodically to announce the presence of a Wireless LAN. Beacon frames are transmitted by the Access Point (AP) in an infrastructure basic service set (IBSS). In IBSS network beacon generation is distributed among the stations.

Front 51

PRI Primary Rate Interface

Back 51

Provides 23 64-K digital ISDN channels. It is a standardized telecommunication service level within the ISDN specification for carrying multiple DSO voice and data transmission between a network and a user. PRI is the standard for providing telecommunication services to offices. It is padded on the T-carrier (T1) in the US and Canada, and the E-carrier (E1) line in Europe. The T1 line consists of 24 channels, while and E1 has 32.

Front 52

DOCSIS Data Over Cable Service Interface Specification

Back 52

international telecommunications standard that permits the addition of high-speed data transfer to an existing cable tv (CATV) system. It is employed by many cable television operators to provide internet access over their existing hybrid fiber-coaxial infrastructure.

Front 53

ActiveX

Back 53

The functional equivalent of Java applets, they use digital certificates instead of a sandbox to provide security.

Front 54

Jscript

Back 54

Microsoft’s implantation of Java script in windows. Jscript is implemented as an Active Scripting engine, which means it can be plugged into OLE automation applications that support active scripting, such as Internet Explorer, Active server Pages and Windows Script Host. It also means such applications can use multiple active scripting languages (e.g. Jscript, VBScript, PerlScript,…).

Front 55

Java

Back 55

An object-oriented language used not only to write applets but also as a general-purpose programming language.

Front 56

JavaScript

Back 56

is a dynamic computer programming language, most commonly used as part of web browsers, whose implementations allow client side scripts to interact with the user, control the browser, communicate asynchronously, and alter the document content that is displayed. It is also being used in server side network programing with node.js. Big thing is to place the code into the sandbox to test and it does not affect the rest of the network.

Front 57

Java Applet

Back 57

small application which is written in java and delivered to users in the form of bytecode. The user launches the applet from a web page, and the applet is then executed within the java virtual machine (JVM) in a process separate from the web browser itself. Java applets are executed in a sandbox by most web browsers, preventing them from accessing local data like the clipboard or file system.

Front 58

CMM - Capability Maturity Model

Back 58

A maturity framework for evaluating and improving the software development process. There are five levels of the CMM.

Front 59

1. Initial

Back 59

The software process is characterized as ad hoc and occasionally even chaotic. Few processes are defined, and success depends on individual effort.

Front 60

2. Repeatable

Back 60

Basic project management processes are established to track cost, schedule, and functionality. The necessary process discipline is in place to repeat earlier successes on projects with similar applications.

Front 61

3. Defined

Back 61

The software process for both management and engineering activities is documented, standardized, and integrated into a standard software process for the organization. Projects use an approved, tailored version of the organization’s standard software process for developing and maintaining software.

Front 62

4. Managed

Back 62

Detailed measures of the software process and product quality are collected, analyzed, and used to control the process. Both the software process and products are quantitatively understood and controlled.

Front 63

5. Optimizing

Back 63

Continual process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies.

Front 64

SDLC - System Development Life Cycle

Back 64

This system is broader than other life cycle plans and it focuses on security in every phase.

Front 65

• Prepare a Security Plan

Back 65

Ensure that security is considered during all phases of the IT system life cycle, and that security activities are accomplished during each of the phases.

Front 66

• Initiation

Back 66

the need for a system is expressed and the purpose of the system is documented.

Front 67

o Conduct a Sensitivity Assessment

Back 67

Look at the security sensitivity of the system and the information to be processed.

Front 68

• Development/Acquisition

Back 68

The system is designed, purchased, programmed, or developed.

Front 69

o Determine Security Requirements

Back 69

Determined technical features (e. g., access controls), assurances (e.g., background checks for system developers), or operational practices (e.g., awareness and training).

Front 70

o Incorporate Security Requirements into Specifications

Back 70

Ensure that the previously gathered information is incorporated in the project plan.

Front 71

o Obtain the System and Related Security Activities

Back 71

May include developing the system’s security features, monitoring the development process itself for security problems, responding to changes, and monitoring threats.

Front 72

• Implementation

Back 72

The system is tested and installed.

Front 73

o Install/Turn-On controls

Back 73

a system often comes with security features disabled. These need to be enabled and configured.

Front 74

o Security Testing

Back 74

Used to certify a system; may include testing security management, physical facilities, personnel, procedures, the use of commercial or in-house services (such as networking services), and contingency planning.

Front 75

o Accreditation

Back 75

The formal authorization by the accrediting (management) official for system operation and an explicit acceptance of risk.

Front 76

• Operations/Maintenance

Back 76

The system is modified by the addition of hardware and software and by other events.

Front 77

o Security Operations and Administration

Back 77

Examples include backup, training, managing cryptographic keys, user administration, and patching,

Front 78

o Operational Assurance

Back 78

Examines whether a system is operated according to its current security requirements.

Front 79

o Audits and Monitoring

Back 79

a system audit is a one-time or periodic event to evaluate security. Monitoring refers to an ongoing activity that examines either the system or the users.

Front 80

• Disposal

Back 80

The secure decommission of a system.

Front 81

o Information

Back 81

Information may be moved to another system, archived, discarded, or destroyed.

Front 82

o Media Sanitization

Back 82

There are three general methods of purging media: (1) overwriting, (2) degaussing (for magnetic media only), and (3) destruction.

Front 83

Waterfall Method

Back 83

An application development model that uses rigid phases; when one phase ends, the next begins. It is linear and was first used in manufacturing. Consists of the following 7 phases, system requirements, software requirements, analysis, program design, coding, testing, operations. The modified model allowed a return to the previous phase for verification or validation.

Front 84

Spiral Method

Back 84

Software development model designed to control risk. Boehm created the model. This process repeats steps of a project starting with modest goals and expanding outwards in ever wider spiral called rounds. These round consist of Concept of Operations (COOP), Software Requirements, Software Product Design, Detailed Design and at each of these a risk analysis. When a failure of lack of value was identified earlier it was easier and cheaper to mitigate.

Front 85

Exploratory Model

Back 85

when a domain is not very well understood or open-ended, or it's not clear what algorithms and data structures might be needed for an implementation, it's useful to be able to interactively develop and debug a program without having to go through the usual constraints of the edit-compile-run-debug cycle

Front 86

Method

Back 86

a function performed by an object. Is a subroutine (procedure or function) associated with an object, and which has access to its data, its member variables.

Front 87

Behavior

Back 87

any action of a system that changes to its environment. Behavior provides outputs from the system to the environment.

Front 88

Coupling and Cohesion

Back 88

coupling - Object Oriented Programing concept that connects objects to others; highly coupled objects have low cohesion. Cohesion OOP concept that describes an independent object; objects with high cohesion have low coupling. You could have high cohesion and low coupling.

Front 89

Polymorphism

Back 89

based on the Greek poly and morph meaning many and forms respectively. For instance the ability to overload the plus (+) operator performing different methods depending on the context of the input message number + number or string + string.

Front 90

Polyinstantiation

Back 90

means many instances, two instances with the same names that contain different data. This may be used in different environments to keep top secret and secret data separate, database polyinstantiation means two rows have the same primary key but different data

Front 91

Security Kernel

Back 91

central part of a computer of communications system hardware, firmware, and software that implements the basic security procedures for controlling access to system resources. A self-contained usually small collection of key security-related statements that (a) works as a part of an operating system to prevent unauthorized access to, or use of, the system and (b) contains criteria that must be met before specified programs can be accessed.

Front 92

Security Policy

Back 92

definition of what it means to be secure for a system, organization or other entity. For an organization, it addressed the constraints on behavior of its members as well as constraints imposed on adversaries by mechanisms such as doors, locks, keys and wall. For systems, the security policy addresses constraints on functions and flow among them, constraints on access by external systems and adversaries including programs and access to data by people.

Front 93

Change Management

Back 93

the process of understanding, communicating, and documenting changes.

Front 94

Stealth Virus

Back 94

a virus that hides itself from the OS and other protective software, such as antivirus software.

Front 95

Polymorphic Virus

Back 95

A virus that changes its signatures upon infection of a new system, attempting to evade signature-based antivirus software.

Front 96

Oligomorphic Virus

Back 96

An encrypted virus that has several forms of its decrption code, selecting between them (usually randomly) when writing its decryptor ta new replicant.

Front 97

Candidate Key

Back 97

Any attribute (column) in the table with unique values.

Front 98

Primary Key

Back 98

Unique attribute in a relational database table, used to join tables

Front 99

Attribute

Back 99

A column in a relational database table.

Front 100

Foreign Key

Back 100

A key in a related database table that matches a primary key in the parent database.

Front 101

Concurrency

Back 101

is a property of systems in which several computations are executing simultaneously, and potentially interacting with each other. The computations may be executing on multiple cores in the same chip, preemptively time-shared threads on the same processor, or executed on physically separated processors. A number of mathematical models have been developed for general concurrent computation including Petri nets, process calculi, the parallel random access machine model, the actor model, and the reo coordination language. Because computation in a concurrent system can interact with each other while they are executing, the number of possible execution paths in the system can be extremely large, and the resulting outcome can be indeterminate. Concurrent use of shared resources can be a source of indeterminacy leading to issues such as deadlock and starvation.

Front 102

Deadlocking

Back 102

is a situation in which two or more competing action are each waiting for the other to finish, and thus neither ever does. In a transaction database, a deadlock happens when two processes each within its own transaction updates two rows of information but in the opposite order. For example process A updates row 1 then row 2 in the exact timeframe that process B updates row 2 then row 1. Process A can’t finish updating row 2 until process B is finished, but it cannot finish updating row 1 until process A finishes. No matter how much time is allowed to pass, this situation will never resolve itself and because of this database management systems will typically kill the transaction of the process that has done the least amount of work. In an operation system a deadlock is a situation which occurs when a process or thread enters awaiting state because a resource requested is being held by another waiting process, which in turn is waiting for another resource. If a process is unable to change its state indefinitely because the resources requested by it are being used by another waiting process, then the system is said to be in a deadlock.

Front 103

Inference

Back 103

Deductive attack where a user is able to use lower level access to learn restricted information.

Front 104

ACID Atomicity Consistency Isolation Durability

Back 104

a set of properties that guarantee that database transaction are processed reliably. In the context of databases, a single logical operation on the data is called a transaction. For example, a transfer of funds from on bank account to another, even involving multiple changes such as debiting one account and crediting another, is a single transaction. Atomicity requires that each transaction is all or nothing. If one part of the transaction fails the entire transaction fails and the database state is left unchanged. Consistency property ensure that any transaction will bring the database from one valid state to another. (programing errors will not violate any defined rules). Isolation ensures that the execution of transitions results in a system state that would be obtained if transactions were executed serially, i.e. one after the other. Durability means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors.

Front 105

Rollback

Back 105

restores a database after a failed commit.

Front 106

Two-Phase Commit

Back 106

used during replication of databases to ensure integrity. Before committing the DBMS request a vote. If the DBMSs on each agree then the data is written and ensured, if not the vote fails and changes are not committed and not made permanent.

Front 107

Asynchronous Dynamic Token

Back 107

are not synchronized with the central sever. The most common variety is challenge-response token authentication systems produce a challenge, or input for the token device. The user then manually enters the information into the device along with the user’s PIN and the device produces an output. This output is then sent to the system. The system is assured the user is authenticated because the response is tied to the challenge, a specific token, the encryption algorithm used by the token, and the user’s PIN.

Front 108

Synchronous Dynamic Token

Back 108

use time or counter to synchronize a displayed token code with the code expected by the authentication server; the codes are synchronized. Time-based synchronous dynamic tokens display dynamic token does that change frequently, such as every 60 seconds. The dymanic code is only good during that window. The authentication server know the serial number of each authorized toke, the user it is associated with, and the time, It can predict the dynamic code on each token using these three pieces of information. Counter based are just that they increment by whatever.

Front 109

Biometric Type I Error

Back 109

when the biometric points are increased and authorized personnel are stopped from gaining access this is a False Reject Rate and is called a type I error.

Front 110

Biometric Type II Error

Back 110

when the data point are lowered in the biometric system this cause a False Accept Rate (FAR) allowing unauthorized personnel to gain access. This is a type II error.

Front 111

The Key Distribution center (KDC)

Back 111

a Kerberos service that authenticates principals.

Front 112

Sesame Secure European system for Applications in a Multivendor Environment

Back 112

is a single sign-on system that supports heterogeneous environments. Can be thought of as a sequel of sorts to Kerberos: Sesame add to Kerberos: heterogeneity, sophisticated access control features, scalability of public key systems, better manageability, audit and delegation. Of those improvements, the addition of public key (asymmetric) encryption is the most compelling. It addresses on of the biggest weaknesses in Kerberos: the plaintext storage of symmetric keys. Uses Privilege Attribute Certificates (PACs) in place of Kerberos’ tickets.

Front 113

Kerberos

Back 113

a third-party authentication service that may be used to support SSO (Single Sign On). Authentication, Authorization, and Accountability (AAA). The client, the key distribution center (KDC), and the server. Operational Steps 1. Kerberos principal Alice contact the KDC, which acts as an authentication server, to request authentication. 2. The KDC sends Alice a session key, encrypted with Alice’s secret key. The KDC also sends a TGT, encrypted with TGS secret key. 3. Alice decrypts the session key and uses it to reqest permission to print from the TGS. 4. Seeing Alice has a valid session key (and therefore has proven her identity claim) the TGS sends Alice a C/S session key (second session key) to use to print. The TGS also sends a service ticket, encrypted with the printer’s key. 5. Alice connects to the printer. The printer, seeing a valid C/S session key, knows Alice has permission to print and also knows that Alice is authentic.

Front 114

LDAP Lightweight Directory Access Protocol

Back 114

used for accessing and maintaining distributed directory information service over IP network. Vendor neutral. Uses TCP and UDP port 389.

Front 115

MS-Chap

Back 115

is used a one authentication option in Microsoft’s implementation of the PPTP protocol for VPNs. It also uses an authentication with RADIUS servers which are used for Wi-Fi security. It is further used as the main authentication option of the Protected Extensible Authentication Protocol (PEAP)

Front 116

MAC - Mandatory Access Control

Back 116

System enforced access control based on subjects’ clearances and objects’ labels.

Front 117

DAC - Discretionary Access Control

Back 117

Gives subjects full control of object they have been given access to, including sharing the objects with other subjects.

Front 118

RBAC Role-Based Access Control

Back 118

subjects are grouped into roles and each defined role has access permission based on the role, not the individual.

Front 119

Rule-Based Access Control

Back 119

Uses a series of defined rules, restrictions, and filters for accessing objects within a system. Made in the form of if/then statements.

Front 120

IDS in Passive Mode NIDS

Back 120

Network Intrusion Detection System Detects malicious traffic on a network. Usually require promiscuous network access in order to analyze all traffic including al unicast traffic.

Front 121

Anomaly Detection

Back 121

is the identification of items, events or observation which do not conform to an expected patern or other items in a dataset.

Front 122

Signature-Based Detection

Back 122

uses samples of code to identify the virus or malware. If this is not contained in the dictionary then it is not effective.

Front 123

4 Types of IDS Events

Back 123

False Positive User surf the web to an allowed site, and NIDS alerts. False Negative Conficker worm is spreading on a trusted network, and NIDS is silent. True Positive Conficker worm is spreading on trusted network, and the NIDS alerts. True Negative User surfs the Web to an allowed site, and NIDS is silent.

Front 124

Forking Proxy

Back 124

A Session Initiation Protocol (SIP) proxy servers that route messages to more than one destination are called forking proxies. Example of this would to have your desk phone and your cell phone ring at the same time so you could take the call at either device.

Front 125

Volatile Memory

Back 125

Ram is volatile memory used to hold instruction and data of currently running programs. It loses integrity after loss of power.

Front 126

Non-Volatile Memory

Back 126

Read-only memory (ROM) is nonvolatile: Data stored in ROM maintains integrity after loss of power. The basic input/output system (BIOS) firmware is stored in ROM.

Front 127

SAM - Sequential Memory

Back 127

is a class of data storage devices that read their data in sequence. This is in contrast to random access memory (RAM) where data can be accessed in any order. Sequential access devices are usually a for of magnetic memory. Examples of SAM devise still in use include hard disks, cd-roms and magnetic tapes.

Front 128

Secondary Memory

Back 128

flash memory, optical discs, magnetic disk, magnetic tapes.

Front 129

Supervisor State Supervisor Mode

Back 129

is a hardware mediated flag which can be changed by code running in system level software. System tasks or threads will have this flag set while they are running, whereas user space application will not. This flag determines whether it would be possible to execute machine code operations such as modifying registers for various descriptor tables, or performing operations such as disabling interrupts. The idea aof having two different modes to operate in comes from with more control comes more responsibility a program in supervisor mode is trusted never to fail, since a failure may cause the whole computer system to crash.

Front 130

Dedicated

Back 130

Dedicated mode of operation means that the system contains objects of one classification label (e.g., secret) only. All subjects must possess a clearance equal to or greater than the label of the objects (a secret or higher clearance, using the previous example). Each subject must have the appropriate clearance, formal access approval, and need to know for all the information stored and processed on the system.

Front 131

System High

Back 131

In a system high mode of operation, the system contains objects of mixed labels (e.g. confidential, secret, and top secret). All subjects must possess a clearance equal to the system’s highest object (top secret, using the previous example).

Front 132

Compartmented

Back 132

In a compartmented mode of operation system, all subjects accessing the system have the necessary clearance but do not have the appropriate formal access approval, nor do they need to know for all the information found on the system. Objects are placed into “compartments” and require a formal (system-enforced) need to know to access. Compartmented mode systems use technical controls to enforce need to know (as opposed to a policy-based need to know).

Front 133

Multi-Level

Back 133

Multilevel mode of operation stores objects of differing sensitivity labels and allows system access by subjects with differing clearances. The reference monitor mediates access between subjects and objects: If a top secret subject (with a need to know) accesses a top secret object, access is granted. If a secret subject attempts to access a top secret object, access is denied.

Front 134

Bell-LaPadula Model

Back 134

It was developed for the U.S. Department of Defense. It is focused on maintaining the confidentiality of objects. Protecting confidentiality means not allowing users at a lower security level to access objects at a higher security lever. Bell-LaPadula operates by observing two rules: the Simple Security Property and the * Security Property.

Front 135

Simple Security Property

Back 135

States that there is no read up; that is, a subject at a specific classification level cannot read an object a a higher classification level. Subjects with a secret clearance cannot access top secret objects, for example.

Front 136

* Security Property

Back 136

States that there is no write down; that is, a subject at a higher classification level cannot write to a lower classification level. Subjects who are logged into a top secret system cannot send emails to a secret system, for example.

Front 137

Biba Model

Back 137

is the model of choice when integrity protection is vital. The Biba model has two primary rules: the simple Integrity axiom and the * Integrity Axiom.

Front 138

Simple Integrity Axiom

Back 138

is “no read down”; that is, a subject at a specific classification level cannot read data at a lower classification. This prevents subjects from accessing information at a lower integrity level. This protects integrity by preventing bad information from moving up from lower integrity levels.

Front 139

* Integrity Axiom

Back 139

is “no write up”; that is, a subject at a specific classification level cannot write to data at a higher classification. This prevents subjects from passing information up to a higher integrity level that they have clearance to change. This protects integrity by preventing bad information from moving up t higher integrity levels.

Front 140

Clark-Wilson Model

Back 140

is a real world integrity model that protects integrity by requiring subjects to access objects via programs. Because the programs have specific limitations to what they can and cannot do to objects, Clark-Wilson effectively limits the capabilities of the subject. Clark-Wilson uses two primary concepts to ensure that security policy is enforced: well-formed transactions and separation of duties.

Front 141

Chinese Wall Model/ Brewer and Nash

Back 141

is designed to avoid conflicts of interests by prohibiting one person, such as a consultant, from accessing multiple conflict of interest categories (CoIs). It is also called Brewer and Nash designed to address the risks inherent with employing consultants working within banking and financial institutions.

Front 142

Graham Denning Model

Back 142

has three parts: objects, subjects and rules. It provide a more granular approach for interactions between subjects and objects. There are eight rules: R1 Transfer Access, R2 Grant Access, R3 Delete Access, R4 Read Object, R5 Create Object, R6 Destroy Object, R7 Create Subject, R8 Destroy Subject.

Front 143

Process Isolation

Back 143

Process can’t interfere with other processes logical control

Front 144

Common Criteria

Back 144

The common Criteria uses specific terms when defining specific portions of the testing process.

Front 145

Target of evaluation (ToE)

Back 145

the system or product that is being evaluated.

Front 146

Security Target (ST)

Back 146

the documentation describing the ToE, including the security reqirements and operational environment.

Front 147

Protection Profile (PP)

Back 147

an independent set of security requirements and objectives for a specific category of products or systems, such as firewalls or intrusion detection systems.

Front 148

Evaluation Assurance Level (EAL)

Back 148

The evaluation score of the tested product or system. EAL1 Functionally tested. EAL2 Structurally tested. EAL3 Methodically tested and checked. EAL4 Methodically tested and checked and reviewed. EAL5 Semi-formally designed, and tested. EAL6 Semi-formally verified and designed, and tested. EAL7 Formally verified, designed and tested

Front 149

TCSEC - Trusted Computer System Evaluation Criteria

Back 149

Also known as The Orange Book. One of the first security standards implemented, and major portions of those standard are still used today in the form of U.S. government Protection Profiles within the International Common Criteria framework. Division D is the lowest form of security and A is the highest. The orange book was the first significant attempt to define differing levels of security and access control implementation within an IT system.

Front 150

ITSEC

Back 150

the European Information Technology Security Evaluation Criteria (ITSEC) was the first successful international evaluation model. It refers to TCSEC orange book levels, separating functionality from assurance. There are two types of assurance: effectiveness (Q) and correctness (E).

Front 151

PCI-DSS Payment Card Industry Data Security Standard

Back 151

is a security standard created by the payment card industry security standards council (PCI-SSC). The council is comprised of the four large credit card companies and others. They seek to protect credit cards by requiring vendors using them to take specific security precautions

Front 152

Fault Tolerance

Back 152

In order for systems and solution within an organization to be able to continually provide operational availability, they must be implemented with fault tolerance in mind. Availability is not solely focused on system uptime requirements but also requires that data be accessible in a timely fashion. Both system and data fault tolerance will be attended to within this section.

Front 153

Full Backup

Back 153

Is the easiest type of backup to understand; it simply is a replica of all allocated data on a hard disk. Most costly shortest amount of time to restore in catastrophe.

Front 154

Incremental Backup

Back 154

Only files that have changed since the last backup of any kind was performed.

Front 155

Differential Backup

Back 155

Only files that have changed since the last full backup has been performed.

Front 156

RAID

Back 156

Redundant Array of Inexpensive Disks

Front 157

RAID0

Back 157

employs striping to increase the performance of read and write. Offers no data redundancy.

Front 158

RAID1

Back 158

mirrored set, write performance decreased, read performance increased, half disks are dedicated to redundancy, cost is high.

Front 159

RAID2

Back 159

is not considered commercially viable for hard disks and is not used.

Front 160

RAID3

Back 160

striped set with dedicated parity, data at they byte level is striped across multiple disks, an additional disk is leveraged for storage of parity information in the event of a failure.

Front 161

RAID4

Back 161

stripped set with dedicated parity at the block level just like level 3 but at block level.

Front 162

RAID5

Back 162

striped set with distributed parity, one of the most popular configurations, block level striping, parity is spread across multiple disks.

Front 163

RAID6

Back 163

stripped set with dual distributed parity, unlike raid 5, raid 6 allows for 2 disks to fail and still function. This redundancy is achieved by writing the same parity information to two different disks.

Front 164

RAID10

Back 164

is just raid0 and raid1 together. This makes it stripped and mirrored and encapsulated together.

Front 165

Blackout

Back 165

Total loss of electrical power.

Front 166

Brownout

Back 166

A perceptible reduction in the electrical line voltage supplied is usually caused by an excessive electrical demand on the electric utility or by an insufficient power-generation capability. This is also known as a brown down.

Front 167

Sag

Back 167

A temporary, usually very fast, drop in electrical voltage. It is usually associated with the supply voltage to the computer, not inside the computer. Sags are the opposite of spikes and are sometimes called brown downs when the sag is not momentary. They are very often damaging to computer equipment.

Front 168

Static Electricity

Back 168

A form of electrical voltage and current generated in usually an accidental action. This in not electricity from a battery or the normal house or office electrical supply. It is more like lightning in that it is a quick but substantial discharge that can do great damage. It is the same type of charge that happens when clothes have been dried in a dryer and they cling to themselves upon removal. It occurs more frequently in cold weather, often whil waling on carpet. It can destroy electrical components, disks, diskettes, tapes and other forms of magnetic storage media. It usually does this by demagnetizing the data and formatting markers on the media, and by over-charging electrical components capabilities.

Front 169

BCP - Business Continuity Plan

Back 169

provides long term continuity planning to ensure that in the wake of a disruption that the business can still perform the critical business functions.

Front 170

DRP - Disaster Recovery Plan

Back 170

Focuses on efficiently attempting to mitigate the impact of a disaster and the immediate response and recovery of a critical IT systems in the face of a significant disruptive event.

Front 171

MTD - Maximum Tolerable Downtime

Back 171

the total time a system can be inoperable before an organization is severely impacted. Also called Maximum Allowable Downtime (MAD), Maximum Tolerable Outage (MTO), and Maximum Acceptable Outage (MAO). RTO + WRT = MTD

Front 172

RTO Recovery Time Objective

Back 172

describes the maximum time allowed to recover business or IT systems. Is also called Systems Recovery Time.

Front 173

WRT Work Recovery Time

Back 173

describes the time required to configure a recovered system.

Front 174

RPO - Recovery Point Objective

Back 174

is the amount of data loss or system inaccessibility (measured in time) that an organization can withstand. NASDAQs RPO is the point when someone can make a trade. So that is almost never to be down. Some places may be a week of data.

Front 175

Hot Site

Back 175

Will have all necessary hardware and critical applications data mirrored in real time. A hot site will have the capability to allow the organization to resume critical operations within a very short period of time, sometimes in less than an hour.

Front 176

Cold Site

Back 176

Least expensive. Usually can be up within weeks and has a raised floor, power, utilities, and physical security but not much beyond that.

Front 177

Warm Site

Back 177

Can be up in some instances of 24 to 48 hours. Has some aspects of a hot site with readily accessible hardware and connectivity but will have to run backups in order to reconstitute a system

Front 178

Mobile Site

Back 178

this is just as it sounds. Provide power and network and it works.

Front 179

CMP - Crisis Management Plan

Back 179

is designed to provide effective coordination among the managers of the organization in the event of an emergency or disruptive event. The CMP details the actions management must take to ensure that life and safety of personnel and property are immediately protected in case of a disaster.

Front 180

Real Evidence

Back 180

the first and most basic category of evidence which consists of tangible or physical objects. Hard drives, DVDs, USB storage devices, or printed business records.

Front 181

Best Evidence Rule

Back 181

Courts prfer the best evidence possible. Original documents are preferred over copies; conclusive tangible objects are preferred over oral testimony. Recall that the five desirable criteria for evidence suggest that, where possible, evidence should be relevant, authentic, accurate, complete and convincing.

Front 182

Secondary Evidence

Back 182

class of evidence common in cases involving computers. Consists of copies of original documents and oral descriptions. Computer generated logs and documents might also constitute secondary rather than best evidence; however, Rule 1001 of the US federal rules of evidence can allow readable reports of data contained on a computer to be considered original as opposed to secondary evidence.

Front 183

Direct Evidence

Back 183

is testimony provided by a witness regarding what the witness actually experienced with his or her five senses. Witnesses must have experienced what they are testifying to, rather than having gained the knowledge indirectly through another person (hearsay).

Front 184

Chain of Custody

Back 184

requires that once evidence is acquired, who, what, when , and where with regard to the handling of evidence must be fully documented. Initials and/or signatures on the chain of custody form indicate that the signers attest to the accuracy of the information concerning their role noted on the chain of custody form.

Front 185

Recovery

Back 185

means that they system must be recovered (e.g. reinstalled from OS media or image, dat restored from backups).

Front 186

Detective

Back 186

controls that alert during or after a successful attack. Intrusion detection systems alerting after a successful attack, closed circuit television cameras (CCTV) that alert guards to an intruder, and a building alarm system that is triggered by an intruder are all examples of detective controls.

Front 187

Corrective

Back 187

Work by correcting a damaged system or process. Works hand in hand with the detective controls.

Front 188

Deterrent

Back 188

deter users from performing actions on a system. Examples include a beware of dog sign. A thief facing two building, one with a guard dogs one without he breaks into the one without.

Front 189

Fiduciary Responsibility

Back 189

have a trust and confidence to manage and protect property and or money or assets of business to the consumer or shareholder.

Front 190

Due Diligence

Back 190

is the investigation of a business or person prior to signing a contract, or an act with a certain standard of care. It can be a legal oblication, but the term will more commonly apply to voluntary investigations.

Front 191

Due Care

Back 191

The conduct that a reasonable man or woman will exercise in a particular situation, in looking out for the safety of others.

Front 192

Liability

Back 192

describes the condition of being actually or potentially subject to a legal obligation.

Front 193

Locard’s Principle

Back 193

holds that the perpetrator of a crime will bring something into the crime scene and leave with something from it, and that both can be used as forensic evidence.

Front 194

Heisenberg’s Principle

Back 194

has to do with disturbing cryptographic tapping and of encryption and the fact that it will cause a disturbance. His uncertainty principle applied to this.

Front 195

Running State

Back 195

Process being executed by the CPU. Page 263

Front 196

Waiting State

Back 196

the processor needs to access external memory, it starts placing the address of the requested information on the address bus. It then must wait for the answer, Each of the cycles spent waiting is called a wait state.

Front 197

Stopped State

Back 197

processor or service has stopped execution of the code.

Front 198

Ready State

Back 198

Process waiting to be executed by the CPU. Page 263

Front 199

Pre-Emptive Multi-Tasking

Back 199

a computer operating system uses some criteria to decide how long to allocate to any one task before giving another task a turn to use the operating system.

Front 200

Cooperative Multi-Tasking

Back 200

a method where multiple tasks are performed during the same period of time they are executed concurrently (in overlapping time periods, new tasks starting before others have ended) instead of sequentially (one completing before the next starts). The tasks share common processing resources, such as a CPU and main memory.

Front 201

Multi-Threading

Back 201

the ability of a program or an operating system process to manage its use by more than one user at a time and to even manage multiple requests by the same user without having to have multiple copies of the programming running in the computer.

Front 202

Static Token

Back 202

the device which does the authentication does not compute anything, it has a set value stored on the device.

Front 203

Cost/Benefit risk analysis

Back 203

ALE (before safeguard)-ALE (after safeguard)-Annual cost of safeguard = value of safeguard. Is it worth it to mitigate threat?

Front 204

Job rotation

Back 204

rotation of responsibilities, build skill redundancy, administrative control

Front 205

Project Initiation

Back 205

Systems development life cycle, first phase.

Front 206

Message

Back 206

how objects communicate

Front 207

Damage Assessment Team

Back 207

perform damage assessment as prescribed in the operations briefing and in accordance with the teams’ prioritized list of sites.

Front 208

Backup Activation Team

Back 208

Emergency Response Team: retrieve offsite records and recovery information from offsite storage, report to the alt site execute the business recovery procedures in prioritized order, communicate status, identify issues and establish shifts, identify replacement equipment/software needed for recovery.

Front 209

Common Law

Back 209

Criminal Law “protect people”, Civil Law (Tort Law) “wrongs inflicted on people or business

Front 210

Patents

Back 210

Good for 20 years, invention must be new, useful. Inventor granted exclusive rights during patent period. It is an intellectual property right granted by the Government of the United States of America to an inventor “to exclude others from making, using, offering for sale, or selling the invention throughout the United States or importing the invention into the United States” for a limited time in exchange for public disclosure of the invention when the patent is granted.

Front 211

Trade Secrets

Back 211

Intellectual property that is absolutely critical to a business. Protection is solely the responsibility of the business. Commonly protected by non-compete or non-disclosure agreements. Lasts forever or until it becomes public knowledge by legal means.

Front 212

Safe harbor

Back 212

allows US companies to pass data without prosecution as long as they comply with regulations. EU citizen personal data can not be transmitted, even with permission of the individual, outside the EU.

Front 213

Negligence

Back 213

opposite of due care. Can be legally found if the due care was not performed.

Front 214

Legal Responsibility

Back 214

requirements by law, legal obligation

Front 215

Prudent Man Rule

Back 215

directs trustees "to observe how men of prudence, discretion and intelligence manage their own affairs, not in regard to speculation, but in regard to the permanent disposition of their funds, considering the probable income, as well as the probable safety of the capital to be invested."

Front 216

Evidence To Be Admissible

Back 216

must be legally obtained to be considered in court of law.

Front 217

Corrosion

Back 217

the gradual destruction of materials (usually metals) by chemical reaction with its environment.

Front 218

Smoke/Fire Detectors

Back 218

heat, flame and smoke detectors. Ionization (smoke), Heat (rate of rise), Photoelectric (Smoke), Ultaviolet//Infared (flame).

Front 219

Fire Extiguisher classes

Back 219

A : common comustibles, B: Liquids, C: Electrical, D: Metal, K: Kitchen Fires.

Front 220

Turnstile

Back 220

personnel entries, one at a time. Designed to prevent tailgating.

Front 221

Gate

Back 221

vehicular gates: Class I - residential, Class II - commercial, Class III - Industrial, Class IV - restricted access requiring security personnel (prison, airport)

Front 222

Bollard

Back 222

pillars placed to prevent vehicular access

Front 223

Mantrap

Back 223

a double-door single-person access control space, first door must close and lock prior to the second opening. Each door requires different form of authentication to open.

Front 224

Pan/Tilt/Zoom

Back 224

closed circuit television, change view of camera

Front 225

Drill frequency

Back 225

how often procedures are practiced

Front 226

Security Requirements Profile

Back 226

a document used as part of the certification process. a combination of threats, security objectives, assumptions, security functional requirements (SFRs), security assurance requirements (SARs) and rationales.

Front 227

Crime Prevention Through Environmental Design

Back 227

a multi-disciplinary approach to deterring criminal behavior through environmental design. the ability to influence offender decisions that precede criminal acts.

Front 228

Data Center/Server Room

Back 228

physically secured room which houses servers and data storage devices. Located in core area of facility, not directly accessible from public areas, not located on top floors, on a different electrical grid from building.

Front 229

Timing and Storage Covert Channels

Back 229

the two types of covert channels The Orange book requires protection against

Front 230

Change Control Process

Back 230

One of the key security aspects of revision control and configuration management is the capability to track changes. If problems occur, administrators can examine the system in the context of the software and other installed components to see what might have caused the problem. The first step in creating these traces is to have a policy that mandates a formal change control procedure for all hardware and software systems. This policy should provide for written requests to perform system changes that can include a review for security. Using the policy as the base, the standards and procedures can be written to support the processes that log every change to any information component.

Front 231

Problem Management

Back 231

process of tracking an event back to its root cause to discover and address the underlying cause

Front 232

Archive Bit

Back 232

Used to mark a backup state - ALL data is backed up and saved - the archive bit is cleared; The differential does not change the archive bit value; an incremental backup changes the archive bit to ZERO

Front 233

Vulnerability Scanner

Back 233

A process to discover poor configurations and missing patches in an environment (use a vulnerability scanner to determine vulnerabilities)

Front 234

Port Scanner

Back 234

A port scan is a method used by hackers to determine what ports are open or in use on a system or network. By using various tools a hacker can send data to TCP or UDP ports one at a time. Based on the response received the port scan utility can determine if that port is in use. Using this information the hacker can then focus their attack on the ports that are open and try to exploit any weaknesses to gain access.

Front 235

Packet Sniffer

Back 235

Packet sniffing is the act of capturing packets of data flowing across a computer network. The software or device used to do this is called a packet sniffer. Packet sniffing is to computer networks what wire tapping is to a telephone network. Packet sniffing has legitimate uses to monitor network performance or troubleshoot problems with network communications. However, it is also widely used by hackers and crackers to gather information illegally about networks they intend to break into. Using a packet sniffer it is possible to capture data like passwords, IP addresses, protocols being used on the network and other information that will help the attacker infiltrate the network.

Front 236

Conclusive Evidence

Back 236

nonrefutable evidance aka.. the smoking gun

Front 237

European Union Privacy

Back 237

The 1995 Directive was established to provide a regulatory framework to guarantee secure and free movement of personal data across the national borders of the EU member countries, in addition to setting a baseline of security around personal information wherever it is stored, transmitted or processed.

Front 238

Backup Operations Team

Back 238

Team that takes over the more routine operations of the processes while restoration proceedures are initated.

Front 239

Joint Application Development Model

Back 239

Collective activity involving users and top management IT professionals. Centers on a structured workshop. Results in a final document containing definitions for data elements, work flows, screens, reports, and general system specifications.

Front 240

The Delphi technique

Back 240

a group process that anonymously generates ideas or judgments from physically dispersed experts. Brainstorming

Front 241

Plan Test Methods

Back 241

???

Front 242

Guideline

Back 242

a recommendation, administrative control

Front 243

Procedure

Back 243

a step by step guide for accomplishing a task, administrative control

Front 244

Standard

Back 244

describes the specific us of technology, often applied to hardware and software, administrative control

Front 245

Policy

Back 245

high-level management directives, administrative control

Front 246

Job rotation

Back 246

rotation of responsibilities, build skill redundancy, administrative control

Front 247

Principle of least privilege

Back 247

only has privileges needed for job, administrative control

Front 248

Separation of duties

Back 248

critical functions are broken up among multiple subjects, prevents authorized subjects from making improper modifications to objects, administrative control

Front 249

Mandatory vacations

Back 249

forced vacations or time away from the office, usually suspected of abuse of authority, administrative control.

Front 250

Collusion

Back 250

an agreement between two or more individuals to subvert the security of a system

Front 251

Exposure factor

Back 251

the percentage of value an asset lost due to an incident

Front 252

Asset value

Back 252

the value of a protected asset

Front 253

Annualized rate of occurrence

Back 253

the number of losses suffered per year

Front 254

Qualitative risk analysis

Back 254

Risk analysis method which uses approximate values. Brainstorming, storyboarding, focus groups, Delphi technique, surveys/questions, checklists, interviews, 1-on-1 meetings

Front 255

Quantitative risk analysis

Back 255

RA method which uses hard metrics such as dollars. 6 steps or phases, Asset valuation, threat identification, threat analysis, derive overall loss potential, research countermeasures, perform cost/benefit analysis

Front 256

Cost/benefit risk analysis

Back 256

ALE (before safeguard) - ALE (after safeguard) - Annual cost of safeguard = value of safeguard. Is it worth it to mitigate threat?

Front 257

Delphi technique

Back 257

anonymous feedback & response process, elicits honest and uninfluenced responses, virtual meetings

Front 258

XOR

Back 258

binary mathematical operation which adds 2 bits together. If values are same, result is 0, if values are different, result is 1

Front 259

MD5

Back 259

hashing algorithm, 512 bit blocks, digest size: 128 bits, 4 rounds, 32 character output

Front 260

Symmetric algorithms

Back 260

1 shared key, n*(n-1)/2, stream cipher, block cipher, DES, Triple DES, blowfish, twofish, IDEA, AES, CAST, SAFER, RC4, RC5, RC6

Front 261

Asymmetric algorithms

Back 261

uses different key for encryption and decryption, 2 key pair, public and private, RSA, Diffie-Hellman, Elliptical Curve, ElGamal, digital signature

Front 262

Online certificate status protocol (OCSP)

Back 262

is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate.

Front 263

Web of trust

Back 263

all parties involved trust each other equally. No CA to certify certificate owners.

Front 264

GNU privacy guard

Back 264

a version of pretty good privacy cryptographic software

Front 265

Pretty good Privacy

Back 265

is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. It was created by Phil Zimmermann in 1991

Front 266

OSI model

Back 266

1 physical, 2 data link, 3 network, 4 transport, 5 session, 6 presentation, 7 application

Front 267

IGMP

Back 267

multicast control protocol, 1 signal to be sent to multiple addresses. Network layer protocol.

Front 268

ICMP

Back 268

protocol, IP’s toolbox, ping, traceroute, network layer protocol

Front 269

Multicast

Back 269

one to many, controlled by group management protocols

Front 270

EMI

Back 270

electromagnetic interference, generated by electrical impulses. Noise on a wire

Front 271

RFI

Back 271

radio frequency interference, wireless interference.

Front 272

Fiber

Back 272

Fiber optics, light transmitted thru glass fibers in a cable.

Front 273

DSSS

Back 273

wireless transmission large band, small amplitude

Front 274

FHSS

Back 274

Wireless transmission rapidly changes frequencies

Front 275

OFDM

Back 275

wireless transmission multiplexes sub-frequency bands

Front 276

FDMA

Back 276

wireless transmission each call has separate frequency

Front 277

CDMA

Back 277

wirelss transmission unique code to each call and spreads it over the available frequencies

Front 278

MPPE

Back 278

microsoft point-to-point encryption, data encryption protocol

Front 279

L2F

Back 279

tunneling protocol by cisco, VPN

Front 280

L2TP

Back 280

tunneling protocol for VPNs by ISPs.

Front 281

PPTP

Back 281

point to point tunneling protocol. VPNs

Front 282

IPSec

Back 282

a protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session

Front 283

Tunnel Mode

Back 283

Gateway-to-gateway, Server-to-gateway, Server-to-server

Front 284

AH

Back 284

encapsulates an IP packet with an Authentication Header and IP header and signs the entire packet for integrity and authentication.

Front 285

SOCKS

Back 285

SocketSecure. Circuit proxy server. Layer 5 of OSI. a Internet protocol that routes network packets between a client and server through a proxy server

Front 286

Beacon Frame

Back 286

transmitted periodically to announce the presence of a Wireless LAN, It contains all the information about the network, SSID.

Front 287

Primary rate interface (PRI)

Back 287

a standardized telecommunications service level within the Integrated Services Digital Network (ISDN) specification for carrying multiple DS0 voice and data transmissions between a network and a user. PRI is the standard for providing telecommunication services to offices. It is based on the T-carrier (T1) line in the US and Canada, and the E-carrier (E1) line in Europe. The T1 line consists of 24 channels, while an E1 has 32.

Front 288

Data over cable service interface specification (DOCSIS)

Back 288

an international telecommunications standard that permits the addition of high-speed data transfer to an existing cable TV (CATV) system. It is employed by many cable television operators to provide Internet access over their existing hybrid fiber-coaxial (HFC) infrastructure.

Front 289

ActiveX

Back 289

a software framework created by Microsoft which adapts its earlier Component Object Model (COM) and Object Linking and Embedding (OLE) technologies for content downloaded from a network, particularly in the context of the World Wide Web

Front 290

Jscript

Back 290

Active Scripting engine, microsoft

Front 291

JavaScript

Back 291

a dynamic computer programming language. It is most commonly used as part of web browsers, whose implementations allow client-side scripts to interact with the user, control the browser, communicate asynchronously, and alter the document content that is displayed

Front 292

Java Applet

Back 292

a small application which is written in Java and delivered to users in the form of byte-code.

Front 293

Capability maturity model

Back 293

a development model created to improve existing software-development processes, but it can also be applied to other processes.

Front 294

Systems development life cycle

Back 294

Planning, Analysis, Design, Implementation, Maintenance.

Front 295

Waterfall method

Back 295

a sequential design process, often used in software development processes, in which progress is seen as flowing steadily downwards (like a waterfall) through the phases of Conception, Initiation, Analysis, Design, Construction, Testing, Production/Implementation, and Maintenance.

Front 296

Spiral Method

Back 296

a risk-driven process model generator for software projects. Based on the unique risk patterns of a given project, the spiral model guides a team to adopt elements of one or more process models, such as incremental, waterfall, or evolutionary prototyping.

Front 297

Project Initiation

Back 297

Systems development life cycle, first phase.

Front 298

Joint Application Development

Back 298

management process that allows developers to work directly with users.

Front 299

Exploratory Model

Back 299

requirements built on what is available, on assumptions as to how the system might work, planning and trying different designs before development, not cost effective, results in less than optimal systems.

Front 300

Message

Back 300

how objects communicate

Front 301

Method

Back 301

functionality an object can carry out

Front 302

Behavior

Back 302

results or output of an object

Front 303

Coupling and Cohesion

Back 303

coupling: level of interaction between objects, low coupling means less interaction and easier to troubleshoot. Cohesion: degree to which an object depends on other objects, high cohesion has low dependence on other objects and is easier to troubleshoot.

Front 304

Polymorphism

Back 304

how different objects respond to the same command

Front 305

Polyinstantiation

Back 305

creating 2 versions of the same object, versions are distinguished by security levels, prevents inference attacks, enables a relation to contain multiple rows with the same primary key.

Front 306

Security Kernel

Back 306

ring level 0, reference monitor. All access to information must go through the kernel, kernel must be protected from any type of unauthorized access or modification.

Front 307

Security policy

Back 307

set of rules that dictates how information and resources is going to be managed, framework for the security architecture.

Front 308

Change Management

Back 308

a process by which all system changes are tracked, audited, controlled, identified and approved.

Front 309

Stealth virus

Back 309

a virus that hides itself from the OS and other protective software, such as anti-virus software.

Front 310

Polymorphic virus

Back 310

virus that changes its signature upon infection of a new system, attempting to evade signature-based anti-virus software.

Front 311

Oligomorphic virus

Back 311

code similar to polymorphic, but has a decryptor that does not show up on signature list.

Front 312

Metamorphic virus

Back 312

reprograms itself, carries various versions of itself. Translates ifself into temporary representations and then back to normal code. Capable of infecting more that one OS.

Front 313

Candidate Key

Back 313

attributes identifying a record

Front 314

Primary Key

Back 314

unique identifier

Front 315

Attribute

Back 315

field (column)

Front 316

Foreign Key

Back 316

attribute related to another table

Front 317

Concurrency

Back 317

allows one change at a time (Database)

Front 318

Deadlocking

Back 318

access to data at the same time, both are denied

Front 319

Inference

Back 319

the act or process of deriving logical conclusions from premises known or assumed to be true.

Front 320

ACID

Back 320

Atomicity, Consistency, Isolation, Durability is a set of properties that guarantee that database transactions are processed reliably

Front 321

Rollback

Back 321

ends current transactions, cancels changes, database returns to previous state.

Front 322

Two-Phase Commit

Back 322

a type of atomic commitment protocol (ACP). It is a distributed algorithm that coordinates all the processes that participate in a distributed atomic transaction on whether to commit or abort (roll back) the transaction (it is a specialized type of consensus protocol).

Front 323

Asynchronous token

Back 323

generates an one time password, but do not use time synchronization between token and authentication server. a random challenge is generated and sent to the user who enters the challenge into the token. The token displays a result that the user sends back to the authenticator.

Front 324

Synchronous token

Back 324

time-synchronized to an authentication server for the purpose of creating a One-Time Password. The token and the server each have independent clocks that must be synchronized to the same timebase.

Front 325

Static token

Back 325

the device which does the authentication does not compute anything, it has a set value stored on the device.

Front 326

Biometric Type 1 error

Back 326

False reject rate (FRR) user is authorize, but is rejected.

Front 327

Biometric Type 2 error

Back 327

False accept rate (FAR) user is unauthorized but is accepted.

Front 328

Key distribution Center (KDC)

Back 328

consists of a ticket granting service and authentication server.

Front 329

SESAME

Back 329

secure European system for applications in a multi-vendor environment. Uses symmetric and asymmetric encryption. Compatible with Kerberos v.5. Uses privilege attribute certificates (PAC) instead of Kerberos tickets.

Front 330

Kerberos

Back 330

a trusted third-party authentication protocol, establishes single-sign on. Uses symmetric keys for encryption. No PKI or asymmetric encryption involved.

Front 331

LDAP

Back 331

Lightweight Directory Access Protocol, an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

Front 332

MS-Chap

Back 332

the Microsoft version of the Challenge-Handshake Authentication Protocol.

Front 333

Mandatory Access control

Back 333

based on sensitivity labels, controlled by security policy administrators, users cannot over-ride security policy.

Front 334

Discretionary Access Control

Back 334

Users set privileges on information they own, sensitivity labels are not required, dynamic and allows the sharing of information.

Front 335

Rule-Based Access Control

Back 335

roles are created based on functions and tasks. Users are assigned to roles, permissions are assigned to the roles and users only acquire permissions on the assumption of the role.

Front 336

Rule-Based Access Control

Back 336

access is allowed or denied to resource objects based on a set of rules defined by a system administrator.

Front 337

IDS in passive mode

Back 337

looks for security breaches, but effectively takes on action.

Front 338

Anomaly detection

Back 338

the identification of items, events or observations which do not conform to an expected pattern.

Front 339

Signature-based detection

Back 339

evaluates attacks based on a database of signatures written by the vendor or operator.

Front 340

False positive

Back 340

accepted activity identified as malicious activity.

Front 341

False negatives

Back 341

malicious activity that is not reported.

Front 342

True Positive

Back 342

malicious activity identified as malicious activity

Front 343

True Negative

Back 343

normal traffic identified as normal traffic.

Front 344

Pre-emptive multi-tasking

Back 344

a computer operating system uses some criteria to decide how long to allocate to any one task before giving another task a turn to use the operating system.

Front 345

Cooperative multi-tasking

Back 345

a method where multiple tasks are performed during the same period of time - they are executed concurrently (in overlapping time periods, new tasks starting before others have ended) instead of sequentially (one completing before the next starts). The tasks share common processing resources, such as a CPU and main memory.

Front 346

Multi-threading

Back 346

the ability of a program or an operating system process to manage its use by more than one user at a time and to even manage multiple requests by the same user without having to have multiple copies of the programming running in the computer.

Front 347

Forking

Back 347

developers take a copy of source code from one software package and start independent development on it, creating a distinct piece of software.

Front 348

Volatile memory

Back 348

computer memory that requires power to maintain the stored information. It retains its contents while powered, but when power is interrupted stored data is immediately lost.

Front 349

Non-volatile memory

Back 349

memory that maintains its content even when unpowered.

Front 350

Sequential memory

Back 350

a class of data storage devices that read their data in sequence. This is in contrast to random access memory (RAM) where data can be accessed in any order. Sequential access devices are usually a form of magnetic memory.

Front 351

Secondary memory

Back 351

not accessed directly by the CPU. Instead, data accessed from secondary memory is first loaded into RAM and is then sent to the processor. Refers to storage devices, such as hard drives and solid state drives. It may also refer to removable storage media, such as USB flash drives, CDs, and DVDs.

Front 352

Running State

Back 352

A process moves into the running state when it is chosen for execution. The process's instructions are executed by one of the CPUs (or cores) of the system. There is at most one running process per CPU or core.

Front 353

Waiting State

Back 353

the processor needs to access external memory, it starts placing the address of the requested information on the address bus. It then must wait for the answer, Each of the cycles spent waiting is called a wait state.

Front 354

Stopped State

Back 354

processor or service has stopped execution of the code.

Front 355

Supervisor State

Back 355

a hardware mode in which the operating system executes instructions unavailable to an application program; for example, I/O instructions.

Front 356

Dedicated

Back 356

system dedicated to particular level. Security clearance for all data, Approved to access all data, Need-to-know for all information.

Front 357

System High

Back 357

Security clearance required for all data, Approved to access all data, Need-to-know for all information.

Front 358

Compartmented/partitioned

Back 358

Security clearance for all data, Approved to access data they will have access to, need to know for data they will have access to.

Front 359

Multilevel Security

Back 359

Security clearance where security clearance dominates the file’s security label. Approved access to data they will have access to, need to know for data they will have access to

Front 360

Bell La-Padula simple security property

Back 360

a set of access control rules which use security labels on objects and clearances for subjects. Security labels range from the most sensitive (e.g."Top Secret"), down to the least sensitive (e.g., "Unclassified" or "Public").

Front 361

Biba Simple Integrity Axiom

Back 361

a subject at a given level of integrity must not read an object at a lower integrity level (no read down).

Front 362

Biba * Integrity Axiom

Back 362

a subject at a given level of integrity must not write to any object at a higher level of integrity (no write up).

Front 363

Clark-Wilson

Back 363

Focuses on integrity, uses a subject/program/object relationship, separation of duties.

Front 364

Chinese Wall

Back 364

information barrier implemented within a firm organization to prevent exchanges of information that could cause conflicts of interest.

Front 365

Brewer and Nash

Back 365

provide information security access controls that can change dynamically. This security model, also known as the Chinese wall model, was designed to provide controls that mitigate conflict of interest in commercial organizations, and is built upon an information flow model.

Front 366

Graham Denning model

Back 366

made up of subjects, objects and rights. Subjects can manipulate objects or other subjects based upon their rights. Create/Delete object, subject, read/grant/delete/transfer access right.

Front 367

Process isolation

Back 367

each process has its own memory space.

Front 368

Common Criteria

Back 368

assurance that the process of specification, implementation and evaluation of a computer security product has been conducted in a rigorous and standard and repeatable manner at a level that is commensurate with the target environment for use.

Front 369

TCSEC and ITSEC

Back 369

TCSEC focuses on confidentiality, ITSEC focuses on CIA triangle. TCSEC: A1, B3, B2, B1, C2, C1, ITSEC: E0-E6, F1-F10

Front 370

Protection Profile

Back 370

security requirements to be specified “I want”

Front 371

Target of Evaluation

Back 371

a vendor’s product.

Front 372

Security Target

Back 372

vendor’s claims of security “I will provide”

Front 373

Security Requirements Profile

Back 373

a document used as part of the certification process. a combination of threats, security objectives, assumptions, security functional requirements (SFRs), security assurance requirements (SARs) and rationales.

Front 374

Crime Prevention through Environmental Design

Back 374

a multi-disciplinary approach to deterring criminal behavior through environmental design. the ability to influence offender decisions that precede criminal acts.

Front 375

Data Center/Server Room

Back 375

physically secured room which houses servers and data storage devices. Located in core area of facility, not directly accessible from public areas, not located on top floors, on a different electrical grid from building.

Front 376

Fault

Back 376

Momentary loss of power

Front 377

Blackout

Back 377

Prolonged loss of power

Front 378

Sag

Back 378

sag/dip Momentary low voltage

Front 379

Brownout

Back 379

Prolonged low voltage

Front 380

Static Electricity

Back 380

an imbalance of electric charges within or on the surface of a material. The charge remains until it is able to move away by means of an electric current or electrical discharge.

Front 381

Corrosion

Back 381

the gradual destruction of materials (usually metals) by chemical reaction with its environment.

Front 382

Smoke/fire detectors

Back 382

heat, flame and smoke detectors. Ionization (smoke), Heat (rate of rise), Photoelectric (Smoke), Ultaviolet//Infared (flame).

Front 383

Fire extinguisher classes

Back 383

A : common comustibles, B: Liquids, C: Electrical, D: Metal, K: Kitchen Fires.

Front 384

Turnstile

Back 384

personnel entries, one at a time. Designed to prevent tailgating.

Front 385

Gate

Back 385

vehicular gates: Class I - residential, Class II - commercial, Class III - Industrial, Class IV - restricted access requiring security personnel (prison, airport)

Front 386

Bollard

Back 386

pillars placed to prevent vehicular access

Front 387

Mantrap

Back 387

a double-door single-person access control space, first door must close and lock prior to the second opening. Each door requires different form of authentication to open.

Front 388

Pan/tilt/zoom

Back 388

closed circuit television, change view of camera

Front 389

Drill Frequency

Back 389

how often procedures are practiced

Front 390

Business continuity plan

Back 390

Focuses on the business as a whole (everything), Identifies risks to time-critical business processes and functions. Ensures business operations continues in the event of an emergency or disruptive event. Includes disaster recovery plan and continuity of operations.

Front 391

Disaster Recovery Plan

Back 391

Focuses on short term fixes for IT oriented disruptions. Designed to minimize decision-making during disruptive events.

Front 392

RTO

Back 392

Recovery Time Objective - time required to restore business process before business impact becomes fatal.

Front 393

Recovery Point Objective

Back 393

how fresh does the data need to be. When last backed up.

Front 394

Time Critical Business Process

Back 394

process with the potential to degrade the ability to do business.

Front 395

Maximum Tolerable Downtime

Back 395

Nonessential: 30 days, Normal: 7 days, Important: 72 hours, Urgent: 24 hours, Critical: minutes to hours.

Front 396

Hotsite

Back 396

a offsite backup that can be operational in a few minutes or hours. Usually operational in a few seconds.

Front 397

Coldsite

Back 397

facility offsite that has no infrastructure in place, but can be operational in 1-2 weeks.

Front 398

Warmsite

Back 398

facility offsite that has some infrastructure in place, can be operation within 5 days.

Front 399

Mobilesite

Back 399

movable site that can be made operational within 3-5 days.

Front 400

Crisis management planning

Back 400

Provides effective coordination between managers int eh event of a disruptive event. Crisis communications plan, call trees, emergency operations center, vital records.

Front 401

Damage Assessment Team

Back 401

perform damage assessment as prescribed in the operations briefing and in accordance with the teams’ prioritized list of sites.

Front 402

Recovery Management Team

Back 402

Emergency Management Team, made up of senior executives, responsible for overall recover of organization, not concerned with day to day operations, responds to and assists with resolution of issues, spokesperson for organization to the media, decision maker on how to manage the business impacts of the event.

Front 403

Backup Activation Team

Back 403

Emergency Response Team: retrieve offsite records and recovery information from offsite storage, report to the alt site execute the business recovery procedures in prioritized order, communicate status, identify issues and establish shifts, identify replacement equipment/software needed for recovery.

Front 404

Common Law

Back 404

Criminal Law “protect people”, Civil Law (Tort Law) “wrongs inflicted on people or business

Front 405

Patents

Back 405

Good for 20 years, invention must be new, useful. Inventor granted exclusive rights during patent period. It is an intellectual property right granted by the Government of the United States of America to an inventor “to exclude others from making, using, offering for sale, or selling the invention throughout the United States or importing the invention into the United States” for a limited time in exchange for public disclosure of the invention when the patent is granted.

Front 406

Trade Secrets

Back 406

Intellectual property that is absolutely critical to a business. Protection is solely the responsibility of the business. Commonly protected by non-compete or non-disclosure agreements. Lasts forever or until it becomes public knowledge by legal means.

Front 407

PCI DSS

Back 407

Payment Card Industry Data Security Standards, sets the security standards for credit card companies.

Front 408

Safe Harbor

Back 408

allows US companies to pass data without prosecution as long as they comply with regulations. EU citizen personal data can not be transmitted, even with permission of the individual, outside the EU.

Front 409

Negligence

Back 409

opposite of due care. Can be legally found if the due care was not performed.

Front 410

Legal Responsibility

Back 410

requirements by law, legal obligation

Front 411

Prudent Man Rule

Back 411

directs trustees "to observe how men of prudence, discretion and intelligence manage their own affairs, not in regard to speculation, but in regard to the permanent disposition of their funds, considering the probable income, as well as the probable safety of the capital to be invested."

Front 412

Evidence to be admissible

Back 412

must be legally obtained to be considered in court of law.

Front 413

Real Evidence

Back 413

Physical evidence

Front 414

Secondary Evidence

Back 414

class of evidence common in cases involving computers. Consists of copies of original documents and oral descriptions. Computer generated logs and documents might also constitute secondary rather than best evidence; however, Rule 1001 of the US federal rules of evidence can allow readable reports of data contained on a computer to be considered original as opposed to secondary evidence.

Front 415

Direct Evidence

Back 415

is testimony provided by a witness regarding what the witness actually experienced with his or her five senses. Witnesses must have experienced what they are testifying to, rather than having gained the knowledge indirectly through another person (hearsay).

Front 416

Chain of Custody

Back 416

requires that once evidence is acquired, who, what, when , and where with regard to the handling of evidence must be fully documented. Initials and/or signatures on the chain of custody form indicate that the signers attest to the accuracy of the information concerning their role noted on the chain of custody form.

Front 417

Recovery

Back 417

means that they system must be recovered (e.g. reinstalled from OS media or image, dat restored from backups).

Front 418

Detective

Back 418

controls that alert during or after a successful attack. Intrusion detection systems alerting after a successful attack, closed circuit television cameras (CCTV) that alert guards to an intruder, and a building alarm system that is triggered by an intruder are all examples of detective controls.

Front 419

Corrective

Back 419

Work by correcting a damaged system or process. Works hand in hand with the detective controls.

Front 420

Deterrent

Back 420

deter users from performing actions on a system. Examples include a beware of dog sign. A thief facing two building, one with a guard dogs one without he breaks into the one without.

Front 421

Fiduciary Responsibility

Back 421

trust and confidence to manage and protect property and or money or assets of business to the consumer or shareholder.

Front 422

Due Diligence

Back 422

is the investigation of a business or person prior to signing a contract, or an act with a certain standard of care. It can be a legal oblication, but the term will more commonly apply to voluntary investigations.

Front 423

Due Care

Back 423

The conduct that a reasonable man or woman will exercise in a particular situation, in looking out for the safety of others.

Front 424

Liability

Back 424

describes the condition of being actually or potentially subject to a legal obligation.

Front 425

Locard’s Principle

Back 425

holds that the perpetrator of a crime will bring something into the crime scene and leave with something from it, and that both can be used as forensic evidence.

Front 426

RAID

Back 426

Redundant Array of Inexpensive Disks

Front 427

RAID0

Back 427

employs striping to increase the performance of read and write. Offers no data redundancy.

Front 428

RAID1

Back 428

mirrored set, write performance decreased, read performance increased, half disks are dedicated to redundancy, cost is high.

Front 429

RAID2

Back 429

is not considered commercially viable for hard disks and is not used.

Front 430

RAID3

Back 430

striped set with dedicated parity, data at they byte level is striped across multiple disks, an additional disk is leveraged for storage of parity information in the event of a failure.

Front 431

RAID4

Back 431

stripped set with dedicated parity at the block level just like level 3 but at block level.

Front 432

RAID5

Back 432

striped set with distributed parity, one of the most popular configurations, block level striping, parity is spread across multiple disks.

Front 433

RAID6

Back 433

stripped set with dual distributed parity, unlike raid 5, raid 6 allows for 2 disks to fail and still function. This redundancy is achieved by writing the same parity information to two different disks.

Front 434

RAID10

Back 434

is just raid0 and raid1 together. This makes it stripped and mirrored and encapsulated together.

Front 435

Heisenberg Principle

Back 435

principle where you cannot know both a particle's position and momentum with unlimited accuracy at the same time

Front 436

Timing and Storage Covert Channels

Back 436

the two types of covert channels The Orange book requires protection against

Front 437

Change Control Process

Back 437

One of the key security aspects of revision control and configuration management is the capability to track changes. If problems occur, administrators can examine the system in the context of the software and other installed components to see what might have caused the problem. The first step in creating these traces is to have a policy that mandates a formal change control procedure for all hardware and software systems. This policy should provide for written requests to perform system changes that can include a review for security. Using the policy as the base, the standards and procedures can be written to support the processes that log every change to any information component.

Front 438

Hardware Change Control

Back 438

Ideally, every time new hardware and configurations are added to the network, an entry is made to a change control system to track what has occurred. Considering that this is rarely the case, the best way to start this process is to use the risk analysis to determine the hardware inventory. With the hardware inventory, an effort should be made to place the configurations under change management control. Many organizations use the same procedures as software change management to track the changes of the configuration of the various systems. They realize that it is critical to maintain the configuration of firewalls, switches, and intrusion detection systems to ensure that someone does not change them to cover up her bad intentions. Hardware change control does not just keeping track of system and network components. Documentation should also be kept up-to-date on the network configuration, including information on where the network and telephone cables are located. Undocumented network segments might not be protected or can be used to support insider hacking capabilities. Additionally, you might want to document the various telecommunication access points into the network. Unknown and unprotected modems can be used by anyone with access to a telephone to gain access using the software on the user's desktop, which might not be properly configured to protect the network.

Front 439

Software Change Control

Back 439

Software change control can have a few components. The most common topic of change control is what is used to track software development. In this case, the change management system can be used to re-create software to a certain revision to roll back from changes that might have caused security concerns or bugs.

Front 440

Problem management

Back 440

process of tracking an event back to its root cause to discover and address the underlying cause

Front 441

Archive bit

Back 441

Used to mark a backup state - ALL data is backed up and saved - the archive bit is cleared; The differential does not change the archive bit value; an incremental backup changes the archive bit to ZERO

Front 442

Backup methods

Back 442

Full, Incremental (You need the last full and ALL subsiquent incremental), Differential (You need the last full and last differential)

Front 443

Vulnerability Scanner

Back 443

A process to discover poor configurations and missing patches in an environment (use a vulnerability scanner to determine vulnerabilities)

Front 444

Port Scanner

Back 444

A port scan is a method used by hackers to determine what ports are open or in use on a system or network. By using various tools a hacker can send data to TCP or UDP ports one at a time. Based on the response received the port scan utility can determine if that port is in use. Using this information the hacker can then focus their attack on the ports that are open and try to exploit any weaknesses to gain access.

Front 445

Packet Sniffer

Back 445

Packet sniffing is the act of capturing packets of data flowing across a computer network. The software or device used to do this is called a packet sniffer. Packet sniffing is to computer networks what wire tapping is to a telephone network. Packet sniffing has legitimate uses to monitor network performance or troubleshoot problems with network communications. However, it is also widely used by hackers and crackers to gather information illegally about networks they intend to break into. Using a packet sniffer it is possible to capture data like passwords, IP addresses, protocols being used on the network and other information that will help the attacker infiltrate the network.

Front 446

Conclusive Evidence

Back 446

nonrefutable evidance aka.. the smoking gun

Front 447

Backup Operations Team

Back 447

Team that takes over the more routine operations of the processes while restoration proceedures are initated.

Front 448

European Union Privacy

Back 448

The 1995 Directive was established to provide a regulatory framework to guarantee secure and free movement of personal data across the national borders of the EU member countries, in addition to setting a baseline of security around personal information wherever it is stored, transmitted or processed.