Lesson 3: Managing Data, Application, And Host Security

Front 1

What is layered Security?

Back 1

an approach to securing systems and their data against attack that incorporates many different avenues of defense.

Front 2

Defense in depth?

Back 2

Layered approach to security that if any one element is breached, other secure systems can defend.

-Ex. Think prison example.

Front 3

What is Data Security?

Back 3

-

Front 4

What some data Security vulnerabilities?

Back 4

- Increased cloud computing

- Lack of restricted access to data systems

- Lack of user awareness

Front 5

What are some common Data Storage Methods?

Back 5

- Direct-attach storage (DAS)

- Network-attached storage (NAS)

- Storage area networks (SANs)

- Cloud-based storage

Front 6

What is direct-attached storage (DAS)?

Back 6

Storage that is plug in directly to a computer.

Front 7

Storage area networks (SANs)

Back 7

-

Front 8

Network-attached storage (NAS)

Back 8

Any storage available to the network.

Front 9

Cloud-based storage

Back 9

Outside party is provides storage.

Front 10

What are some Data Encryption Methods?

Back 10

-Full Disk

-Database

-File

-Removable media

-Mobile device

-Email

-Voice

Front 11

How does Full Disk encryption work?

Back 11

Encrypts an entire disk and all the data stored in it.

Front 12

Database encryption

Back 12

Encrypts sensitive data stored in the database.

Front 13

File Encryption

Back 13

protects individual files that contain private or confidential data.

Front 14

Removable media encryption

Back 14

Encryption on external storage devices.

Front 15

Mobile device encryption

Back 15

protects any data stored on smartphones or other mobile devices.

Front 16

Voice Encryption

Back 16

protects voice communications and data across a network.

Front 17

Email Encryption

Back 17

protects emails and attachments from being read by unauthorized users.

Front 18

Hardware-Based Encryption Devices

Back 18

- are devices that enforces encryption, decryption, and access control using an Hardware Security Module (HSM).

- Denies execution of external programs.

Front 19

What are some benefits of Hardware-based Encryption?

Back 19

- Prevents unauthenticated storage mapping.

- Prevents copying data without the assigned HSM.

- Self-governed; not affected by malicious code or other OS issues.

- Proves that all computers are encrypted.

Front 20

Types of Hardware-Based Encryption Devices

Back 20

- Trusted Platform Module (TPM)

- Hardware Security Module (HSM)

- USB encryption

- Hard drive encryption

Front 21

What does "Data at rest" mean?

Back 21

This referes to data in storage, whether in a database, on a disk, or on another storage medium.

Front 22

What are some Data at rest encryption methods?

Back 22

- PGP Whole Disk Encryption

- Microsoft Windows BitLocker disk encryption

- OS X FileVault

- Database encryption for database systems such as MySQL and Oracle

- TrueCrypt

Front 23

Data in transit

Back 23

refers to data that is moving across a network, including data for web applications, mobile device apps, and instant messaging.

Front 24

What are some data in transit encryption methods (transport encryption)?

Back 24

- HTTPS/Secure Sockets Layer/Transport Layer Security (SSL/TLS)

- Wi-Fi Protected Access 2 (WPA2)

- Virtual private networks (VPNs)

- Internet Protocol Security (IPSec)

- Secure Shell (SSH)

Front 25

What is an Access Control List (ACL)?

Back 25

A list that enables you to restrict access to resources like files and folders.

Front 26

What is "Big Data"?

Back 26

Data collections that are so large and complex that they are difficult for traditional database tools to manage.

Front 27

Data Policies

Back 27

- Normally covered under AUP and other general corporate security polices.

- Can also be developed as a separate policy to guarantee protection of personal data.

Front 28

What are some types of Data Policies?

Back 28

-Wiping

-Disposing

-Retention

-Storage

Front 29

What are some Guidelines for Managing Data Security?

Back 29

- Consider implementing layered security.

- Identify forms of data storage, and select security controls to protect each type.

- Consider implementing controls to protect data in transit, in use, and at rest.

- Consider developing and enforcing data policies that protect data while allowing the correct level of accessibility.

Front 30

What is Application Security?

Back 30

-

Front 31

What is Patch Management?

Back 31

The practice of monitoring for, obtaining, evaluating, testing, and deploying software patches and updates.

Front 32

Application Security Methods

Back 32

- Configuration baseline

- Application hardening

- Patch management

Front 33

Configuration baseline

Back 33

a basleline composed of the minimum security requirements needed for an application to be complete.

Front 34

Application hardening

Back 34

process used to configure a default application to prevent security threats and vulnerabilities.

"Making the application harder to break."

Front 35

Patch Management

Back 35

-

Front 36

Input validation

Back 36

ensuring that the data entered into a field or variable in an application is within acceptable bounds for the object that will receive the data.

Front 37

Input validation vulnerabilities

Back 37

- Any type of software

- Websites and applications are popular targets.

- Requires careful coding to avoid.

Front 38

Client-Side Validation

Back 38

- Input validation and error recovery at the browser.

- JavaScript, AJAC, VBScript, and HTML 5 attributes.

- For enhanced user experience.

Front 39

Server-side validation

Back 39

- Input validation and error recover at the server

- Perl, PHP, ASP, and other scripting languages

- For enhanced security.

Front 40

cross-stie scripting (XSS) attack

Back 40

- The attacker takes advantage of scripting and input validation vulnerabilities in an interactvive website to attack legitimate users in two different ways. Stored attack and Reflected attack.

Front 41

What are some cross-site attack prevention methods?

Back 41

- Restrict HTML formatting in form fields.

- Use input validation.

- Restrict cookie information

- Encrypt data communications.

- Advise on the Remember Me option.

Front 42

Cross-site Request Forgery (XSRF) attack

Back 42

when an attacker takes advantage of the trust established between an authorized user of a website and the website itself.

Front 43

What is fuzzing?

Back 43

A testing method used to identify vulnerabilities and weaknesses in applications by sending the application a range of random or unusual input data and noting any failures and crashes that result.

Front 44

What are some features of Web Browser Security?

Back 44

- Pop-up blocker

- Parental controls

- Automated updating

- Encryption

- Proxy support

- Web content

- Advanced security

Front 45

What are the internet Zones? (Inside of your internet options)

Back 45

-Internet

-Intranet

-Trusted Sites

-Restricted Sites

Front 46

Proxy is on test

Back 46

find in internet explorer

Front 47

NoSQL Databases

Back 47

- Organize and group data by non-relational means: Key-value stores, Document stores, Graph Stores, and Column Stores

- Used for web applications, agile applications, and big data projects.

Front 48

What are the guidelines for Managing Application Security?

Back 48

- Establish security configuration baseline.

- Harden applications, especially web browsers.

- Implement patch management for applications.

- Implement input validation.

- Consider implementing a combination of client-side validation and server-side validation.

- Implement error and exception handling for applications developed in-house.

- Protect against XSS and XSRF attacks.

- Protect databases and associated.

Front 49

Hardening

Back 49

- Reducing the attack surface.

Front 50

What are some Operating System Security Setting?

Back 50

- Manage services

- Configure firewall

- Configure Internet Security

- Manage automatic updates

- Enable auditing and logging

Front 51

What is the difference between Application Blacklisting and Whitelisting?

Back 51

Blacklisting: preventing identified programs from running.

Whitelisting: allowing only identified programs to run.

Front 52

What are the types of anti-malware software?

Back 52

- Antivirus

- Anti-spam

- Anti-spyware

- Pop-up blockers

- Host-based firewalls

Front 53

What are some Virtualization Security Techniques?

Back 53

- Establish a patch management system.

- Apply the least privilege concept.

- Establish log requirements.

- Establish secure design for virtual components.

- Take consistent snapshots of virtual environments.

- Ensure that virtual hosts are consistently available and elastic.

- Leverage virtual sandboxes for security testing.

Front 54

Hardware Security Controls

Back 54

- Logoff and shutdown procedures

- Wireless device approval

- Properly secured mobile devices

- Cable Locks

- Strong password policies

Front 55

Non-standard Host

Back 55

Hosts and devices with static environments

Front 56

What are some examples of Non-standard Hosts?

Back 56

- SCADA

- Embedded-software systems

- Mainframe Computers

- Some Mobile devices

Front 57

What are some security controls for Non-Standard Hosts?

Back 57

- Layered Security: Network segmentation & Application Firewalls

- Manual updates: Android & iOS

- Firmware version control: SCADA systems & Embedded system

- Wrappers

- Controlling redundancy and diversity.

Front 58

What are some examples of Mobile Device Security Controls?

Back 58

- Enable screen lock.

- Enforce access control.

- Track assets and keep inventory.

- Require strong passwords.

Front 59

What are some "Bring Your Own Device (BYOD)" Controls?

Back 59

- Corporate and acceptable use policies

- On-boarding and off-boarding

- Data/support ownership

- Patch and antivirus management

- Architecture and infrastructure needs

- Forensics

- Privacy

- Control for on-board camera, microphone, and video use

Front 60

What are some Network Devices?

Back 60

- Router

- Switch

- Proxy Server

- Firewall

- Load Balancer

- All-in-one security appliance

Front 61

Name some Network Analysis Tools

Back 61

- Sniffers

- Spam filters

- Protocol analyzers

Front 62

Telephony Components

Back 62

- VoIP

- Private Branch exchange

- CTI

Front 63

Cloud Computing Deployment Models

Back 63

- Private

- Public

- Community

- Hybrid

Front 64

What are some Cloud Computing Service Types?

Back 64

- SaaS

- PaaS (Platform As A Service)

- IaaS

Front 65

What are the difference between the 802.11 Standards?

Back 65

- 802.11

- 802.11a

- 802.11b

- 802.11g

- 802.11n

- 802.11ac