Fundamentals Of Information Security

Front 1

Healthcare Industry

Back 1

HIPPA/HITECHPAYMENT

Front 2

Payment Card Industry

Back 2

PCI-DSS

Front 3

Federal Government Agencies

Back 3

FISMA

Front 4

Attack that allows unauthorized users to access our data, applications, or environments, and are primarily an attack against confidentiality.

Back 4

Interception

Front 5

Attacks that cause our assets to become unusable or unavailable for our use, on a temporary or permanent basis. Often affects availability but can be an attack on integrity as well.

Back 5

Interruption

Front 6

Attacks that involve tampering with our asset. Such attacks might primarily be considered an integrity attack but could also represent an availability attack.

Back 6

Modification

Front 7

Attacks that involve generating data, processes, communications, or other similar activities with a system. These primarily affect integrity but could be considered an availability attack as well.

Back 7

Fabrication

Front 8

The likelihood that an event will occur.

Back 8

Risk

Front 9

Any events that are being man-made, natural or environmental that could cause damage to assets.

Back 9

Threats

Front 10

A weakness that a threat event or the threat agent can take advantage of.

Back 10

Vulnerability

Front 11

An additional step that is taking into account then asset’s cost.

Back 11

Impact

Front 12

Vulnerability scanning tool. Scans target systems to discover which ports are open on them, and then interrogating each open port to find out exactly which service is listening on the port in question.

Back 12

Nessus

Front 13

Often used to protect information sent over networks and over the internet.

Back 13

SSL & TLS

Front 14

Also known as private key cryptography, utilizes a single key for both encryption of the plain text and decryption of the ciphertext.

Back 14

Symmetric cryptography

Front 15

Also known as public key cryptography, utilities two keys: a public key and a private key. The public key is used to encrypt data from the sender to the receiver and is shared with everyone.

Back 15

Asymmetric cryptography

Front 16

Represents a third cryptography type alongside symmetric and asymmetric cryptography, what we might call keyless cryptography. These are also referred to as message digests. They do not use a key.

Back 16

Hash Functions

Front 17

Makes use of two types of ciphers: block ciphers and steam ciphers.

Back 17

Symmetric key

Front 18

Takes a predetermined number of bits, known as a block. Blocks are commonly composed of 64 bits but can be larger or smaller depending on the particular algorithm being used and the various modes in which the algorithm might be capable of operating.

Back 18

Block cipher

Front 19

Encrypts each bit in the plaintext message, one bit at a time.

Back 19

Stream cipher

Front 20

a block cipher based on symmetric key cryptography and uses a 56 bit key. Was considered to be very secure for some period of time. It is no longer considered to be so.

Back 20

DES

Front 21

Simply DES used to encrypt each block 3 times, each time with a different key.

Back 21

3DES

Front 22

A set of symmetric block ciphers endorsed by the US government through NIST, and now used by a variety of other organizations, and is the replacement for DES as the standard encryption algorithm for the US federal government. Uses 3 different ciphers. One with a 128-bit key. One with a 192-bit key. One with 256-bit key. All having a block length of 128 bits. Shares the same block modes that DES uses and also includes other modes.

Back 22

AES

Front 23

Can be used to determine whether the message has changed. Cannot be used to discover the original content of a message. Keyless cryptography.

Back 23

Hash functions

Front 24

Provides a framework for ensuring the effectiveness of information security controls in government.

Back 24

FISMA

Front 25

Protects the privacy of students and their parents.

Back 25

FERPA

Front 26

Regulates the financial practice and governance of corporations. Protects investors and the general public.

Back 26

SOX

Front 27

Protects the customers of financial institutions.

Back 27

GLBA

Front 28

Imposes certain requirements on operators of websites or online services directed to children under 13 years of age.

Back 28

COPPA

Front 29

When you pretend to be manager, customer, reporter, or even a coworkers family member, using a fake identity and creating a fake scenario to get the target to give sensitive information or do something they wouldn’t normally do for a stranger.

Back 29

Pretexting

Front 30

Network mapper. Can scan ports but can also search for hosts on a network, identify the OS those hosts are running, detect the versions of the services running on any open ports, etc.

Back 30

NMAP

Front 31

Commonly used to detects wireless access points and can find them even when attempts have been made to make doing so difficult.

Back 31

Kismet

Front 32

Graphical interface tool for packet analyzer.

Back 32

Wireshark

Front 33

Command-line packet sniffing tool. Runs on Linux and Unix operating systems.

Back 33

Tcpdump

Front 34

Can detect, monitor, and sometimes tamper with the activities of an attacker. They are configured to deliberately display vulnerabilities or materials that would make the system attractive to an attacker.

Back 34

Honeypots 🍯

Front 35

Used to test firewall vulnerabilities.

Back 35

Hping3

Front 36

Which Web attack is possible, due to a lack of input validation?

Back 36

SQL injection

Front 37

Which two principles of the CIA triad can be violated by a fabrication attack?

Back 37

Integrity and availability

Front 38

Which two principles of the CIA triad can be violated by an interruption attack?

Back 38

Integrity and availability

Front 39

A company developing and distributing open source applications, realizes that attackers are copying the publicly available open source code, and inserting malware into the code.

which type of cryptographic tool should the company use to protect the integrity of its open source applications?

Back 39

Hash Functions

Front 40

What is an example of symmetric key encryption?

Back 40

AES

Front 41

Which asymmetric cryptographic algorithm can provide confidentiality for data in motion?

Back 41

RSA