Cissp - Access Control

Front 1

access controls

Back 1

security features that control how users and systems communicate and interact with other systems and resources. They protect the systems and resources from unauthorized access.

Front 2

access

Back 2

the flow of information between a subject and an object.

Front 3

subject

Back 3

can be a user, program or process that accesses an object to accomplish a task.

Front 4

three main security principals

Back 4

Availability, Integrity, and Confidentiality

Front 5

availabilty

Back 5

information , systems and resources must be available to users in a timely manner so productivity will not be affected

Front 6

integrity

Back 6

information must be accurate, complete and protected from unauthorized modification.

Front 7

confidentiality

Back 7

the assurance that information is not disclosed to unauthorized individuals, programs or processes.

Front 8

Indentification

Back 8

describes a method of ensuring that a subject( user, program or process) is the entity it claims to be.

Front 9

authentication

Back 9

providing the correct password, pass phrase, cryptographic key, or PIN to gain access to a system after identifying yourself properly.

Front 10

authorization

Back 10

determining if an authenticated subject has been given the necessary rights and privileges to carry out it's requested actions.

Front 11

accountability

Back 11

The subject needs to be held accountable for the actions taken within a system or domain. The only way to ensure accountability is if the subject is uniquely identified and the subject's actions are recorded.

Front 12

Logical access controls

(also know as technical access controls)

Back 12

technical tools used for identification, authentication, authorization, and accountability. They are software components that enforce access control measures for systems, programs, processes, and information. They can be embedded within operating systems, applications, add on security packages or database and telecommunication management systems.

Front 13

race condition

Back 13

a race condition is when processes carry out their tasks on a shared resource in an incorrect order. A race condition is possible when two or more processes use a shared resource, as in data within a variable.

In software, when authentication and authorization steps are split into two functions, there is a possibility an attacker could use a race condition to force the authorization step to be completed before the authentication step.

Front 14

3 factors for authentication

Back 14

something a person knows, something a person has, and something a person is. They are commonly called authentication by knowledge, authentication by ownership, and authentication by characteristic. Strong authentication contains 2 out of 3 of these methods.

Front 15

Verification 1:1

Back 15

the measurement of an identity against a single claimed identity

Front 16

examples of authentication by knowledge

Back 16

a password, PIN, mothers maiden name, or combination to a lock.

Front 17

examples of authentication by ownership

Back 17

a key, swipe card, access card, badge,

Front 18

examples of authentication by characteristic

Back 18

unique physical attribute - biometrics

Front 19

Mutual authentication

Back 19

when the two communicating entities must authenticate to each other before passing data

Front 20

Identification Component Requirements

Back 20

Each value should be unique, for user accountability.

A standard naming scheme should be followed.

The value should be nondescriptive of the users position or tasks.

The value should not be shared between users.

Front 21

Identity Management

Back 21

a broad and loaded term that encompasses the use of different products to identify, authenticate, and authorize users through automated means. IdM allows organizations to create and manage digital identities life cycles (create, maintain, terminate) in a timely and automated fashion.

Front 22

examples of identity management solutions

Back 22

Directories - X.500 or LDAP, Active Directory

Web access management

Password Management

Legacy Single sign-on

Account management

Profile Update

Front 23

Web access management

Back 23

software that controls what users can access when using a web browser to interact with web based enterprise assets.

Front 24

Cookie

Back 24

a cookie can be in the format of a text file stored on the user's hard drive(permanent) or it can be only held in memory(session). If the cookie contains any type of sensitive information, then it should only be held in memory and be erased once the session has completed.

Front 25

Password Management

Back 25

a technology that provides a secure and automated password management system. The most common approaches are:

Password Synchronization

Self service password reset

assisted password reset

Front 26

Legacy Single Sign-On

Back 26

an SSO technology allows a user to authenticate one time and then access resources in the environment without needing to re-authenticate.

Front 27

account management

Back 27

Account Management deals with creating user accounts on all systems, modifying the account privileges when necessary, and decommissioning the accounts when they are no longer needed.

Front 28

Authoritative source

Back 28

The authoritative source is the "system of record" or the location where identity information originates and is maintained. It should have the most up to date and reliable identity information.

Front 29

Authoritative System of Record

Back 29

is a hierarchical tree like structure system that tracks subjects and their authorization chains.

Front 30

User provisioning

Back 30

Refers to the creation, maintenance, and deactivation of user objects and attributes as they exist in one or more systems, directories or applications, in response to business processes.

Front 31

Profile Update

Back 31

A profile is the data associated with the identity of a user. The profile should be centrally located for easier management. Users should be allowed to update nonsensative data themselves. Admins should be able to create, make changes, or delete these profiles in an automated fashion when necessary.

Front 32

Federation

Back 32

sharing identity and authentication information between companies using a trust relationship

Front 33

federated identity

Back 33

a portable identity and its associated entitlements, that can be used across business boundaries. It allows a user to be authenticated across multiple IT systems and enterprises.

Front 34

Digital Identity

Back 34

made up of a user's attributes, entitlements and traits.

Front 35

markup language

Back 35

a way to to structure text and data sets, and it dictates how these will be viewed and used.

examples: xml, spml, saml, xacml

Front 36

extensible markup language (XML)

Back 36

a universal and foundational standard that provides a structure for other independent markup languages to be built from and still allow for interoperability.

Front 37

Service Provisioning Markup Language (SPML)

Back 37

allows for the exchange of provisioning data between applications, which could reside in one organization or many. SPML allows for the automation of user management and access entitlement configuration related to electronically published services across multiple provisioning systems.

SPML is made up of three entities:

Requesting Authority (RA) - the entity that ius making the request to setup a new account or make changes to an existing account

Provisioning Service Provider (PSP) - the software that responds to the account rquests

Provisioning Service Target (PST) - the entity that carries out the provisioning activities on the requested system.

Front 38

Security Assertion Markup Language (SAML)

Back 38

an XML standard that allows the exchange of authentication and authorization data to be shared between security domains. SAML provides the authentication pieces to federated identity management systems to allow business to business and business to Consumer transactions. SAML commonly uses the SOAP protocol for data tranmission - Simple Object Access Protocol

Front 39

service oriented architecture

Back 39

a way to provide independent services residing on different systems in different business domains in one consistent manner.

Front 40

Extensible Access Control Markup Language (XACML)

Back 40

used to express security policies and access rights to assets provided through web services and other enterprise applications. XACML is both an access control policy language and a processing model that allows for policies to be interpreted and enforced in a standard manner.

Front 41

Organization for the Advancement of Structured Information Standards (OASIS)

Back 41

This organization develops and maintains the standards for how various aspects of web based communication are built and maintained.

Front 42

Biometrics

Back 42

Verifies an individual's identity by analyzing a unique personal attribute or behavior, which is one of the most effective and accurate methods of verifying identification.

Front 43

Biometric processing speed

Back 43

From the time a user inserts data until she receives an accept or reject response should take five to ten seconds.

Front 44

Finger Scan technology

Back 44

extracts specific features from the fingerprint and stores just that information, which takes up less hard drive space and allows for quicker database lookups and comparisons.

Front 45

Palm Scan

Back 45

The palm holds a wealth of information and has many aspects that are used to identify an individual.

Front 46

Hand Geometry

Back 46

The shape of a person's hand defines hand geometry. This trait differs significantly between people and is used in some bio metric systems.

Front 47

Retina Scan

Back 47

scans the blood vessel pattern of the retina on the backside of the eyeball.

Front 48

IRIS scan

Back 48

The iris has unique patterns, rifts and colors. This is the most accurate of all the biometric systems.

Front 49

Signature Dynamics

Back 49

When a person signs a signature, usually they do so in the same manner and speed each time. Signing a signature produces electronic signals that can be captured by a biometric system.

A digitized signature is not the same, and is not a biometric system.

Front 50

Keystroke Dynamics

Back 50

Keystroke Dynamics captures electrical signals when a person types a specified phrase. As a person types the phrase the biometric system captures the speed and motions of this action.

Front 51

Voice Print

Back 51

Peoples speech sounds and patterns have many subtle distinguishing differences.

Front 52

Facial Scan

Back 52

A system that scans a persons face and takes attributes and characteristics and compares this to a earlier scan.

Front 53

Hand Topography

Back 53

looks at different peaks and valleys of the hand, along with its overall shape and curvature. Is commonly not used by itself, but in conjunction with hand geometry.

Front 54

passwords

Back 54

one of the most commonly used authentication methods used today, they are also considered one of the weakest security mechanisms. This is because most passwords are easily guessed.

Front 55

Electronic monitoring

Back 55

Listening to network traffic to capture information, especially when a user is sending their password to an authentication server.

Front 56

Brute force attacks

Back 56

Performed with tools that cycle through many possible character, number and symbol combinations to uncover a password.

Front 57

Dictionary attacks

Back 57

Files of thousands of words are compared to the user's password until a match is found.

Front 58

Social Engineering

Back 58

an attacker falsely convinces an individual that they have the necessary authorization to access specific resources.

Front 59

Rainbow table

Back 59

An attacker uses a table that contains all possible passwords already in a hash format.

Front 60

Salts

Back 60

random values added to the encryption process to add more complexity and randomness.

Front 61

Password Aging

Back 61

set expiration dates for passwords and keeping a password history that disallows users from reusing their previous passwords.

Front 62

cognitive passwords

Back 62

fact or opinion based information used to verify an individuals identity.

Front 63

Captcha

Back 63

a skewed representation of characteristics a person must enter to prove that the subject is a human and not an automated tool as in a software robot.

Front 64

one time password (OTP)

Back 64

also called a dynamic password, is used for authentication purposes and is only good once. After the password is used, it is no longer valid, thus if a hacker obtained this password, it could not be reused.

Front 65

The token device

Back 65

also called a password generator, is usually a handheld device that has an LCD display and possibly a keypad. This hardware is separate from the computer the user is attempting to access. The token device and authentication server must be synchronized in some manner to be able to authenticate a user.

There are two types - synchronous and asynchronous

Front 66

Type 1 error

Back 66

when a biometric system rejects an authorized individual (false rejection rate)

Front 67

Type 2 error

Back 67

when a biometric system accepts impostors who should be rejected (false acceptance rate)

Front 68

crossover error rate (CER)

Back 68

Also called equal error rate (EER). This is stated as a percentage and represents the point at which the false rejection rate equals the false acceptance rate. The rating is used to measure the systems accuracy. A CER of 3 will be more accurate than a CER of 4.

Front 69

clipping level

Back 69

an older term that just means threshold. If the number of acceptable failed login attempts is set to three, three is the threshold (clipping level) value.

Front 70

password checker

Back 70

a tool used by security professionals to test the strength of a password. Can also be called a password cracker if the same tool is used by a hacker.

Front 71

synchronous token device

Back 71

synchronizes with the authentication service by using time or a counter as the core piece of the authentication process. If the synchronization is time-based, the token device and the authentication service must hold the same time within their internal clocks. The time value on the token device and a secret key are used to create the one-time password, which is displayed to the user.

If the token device and authentication service use counter-synchronization, the user will need to initiate the creation of the one-time password by pushing a button on the token device. This causes the token device and the authentication service to advance to the next authentication value. This value and a base secret are hashed and displayed to the user. The user enters this resulting value along with a user ID to be authenticated. In either time-or counter-based synchronization, the token device and authentication service must share the same secret base key used for encryption and decryption.

Synchronous token-based one-time password generation can be time-based or counter-based. Another term for counter-based is event-based. Counter-based and event-based are interchangeable terms.

Both token systems can fall prey to masquerading if a user shares his identification information (ID or username) and the token device is shared or stolen. The token device can also have battery failure or other malfunctions that would stand in the way of a successful authentication. However, this type of system is not vulnerable to electronic eavesdropping, sniffing, or password guessing.

Front 72

Asynchronous

Back 72

A token device using an asynchronous token– generating method employs a challenge/ response scheme to authenticate the user. In this situation, the authentication server sends the user a challenge, a random value, also called a nonce. The user enters this random value into the token device, which encrypts it and returns a value the user uses as a one-time password. The user sends this value, along with a username, to the authentication server. If the authentication server can decrypt the value and it is the same challenge value sent earlier, the user is authenticated.

Both token systems can fall prey to masquerading if a user shares his identification information (ID or username) and the token device is shared or stolen. The token device can also have battery failure or other malfunctions that would stand in the way of a successful authentication. However, this type of system is not vulnerable to electronic eavesdropping, sniffing, or password guessing.

Front 73

Cryptographic Keys

Back 73

Another way to prove one’s identity is to use a private key by generating a digital signature. A private key is a secret value that should be in the possession of one person, and one person only. It should never be disclosed to an outside party. A digital signature is a technology that uses a private key to encrypt a hash value (message digest). The act of encrypting this hash value with a private key is called digitally signing a message. A digital signature attached to a message proves the message originated from a specific source and that the message itself was not changed while in transit.

Front 74

passphrase

Back 74

a sequence of characters that is longer and in some cases, taking place of a password during an authentication process. The user enters this phrase into an application, and the application transforms the value into a virtual password, making the passphrase the length and format that is required by the application.

Front 75

memory card

Back 75

holds information but cannot process information

Front 76

smart card

Back 76

holdings information and has the necessary hardware and software to process that information. There are two categories of smart cards - contact and contactless.

Front 77

contact smart card

Back 77

has a gold seal on the face of the card. When this card is fully inserted into a card reader, electrical fingers wipe against the card in the exact position that the chip contacts are located. This will supply power and data I/O to the chip for authentication purposes

Front 78

contactless smart card

Back 78

has an antenna wire that surrounds the perimeter of the card. When this card comes within an electromagnetic field of the reader, the antenna generates energy to power the internal chip and perform the authentication.

Front 79

smart card attacks

Back 79

attacks such as fault generation, side channel attacks, software attacks and microprobing are examples of attacks on smart cards

Front 80

fault generation attack

Back 80

The attacker reviews the result of an encryption function after introducing an error to the card, and also reviews the correct result, which the card performs when no errors are introduced. Analysis of these different results may allow an attacker to reverse engineer the encryption process, with the hope of uncovering the encryption key.

Front 81

side channel attack

Back 81

nonintrusive and are used to uncover sensitive information about how a component works, without trying to compromise any type of flaw or weakness. some examples are observing changes in power emissions during processing and observing frequencies emitted.

Front 82

software attacks

Back 82

also considered non invasive attacks. A smart card has software just like any device that does data processing, and there is the possibility of software flaws that can be exploited. The main goal of this attack is to input instructions into the card that will allow the attacker to extract information, which he can use to make fraudulent purchases.

Front 83

microprobing

Back 83

Microprobing uses needles and ultrasonic vibration to remove the outer protective material on the card's circuits. Once this is completed, data can be accessed and manipulated by directly tapping into the card's ROM chips.

Front 84

ISO/IEC standard 14443

Back 84

outlines the following items for smart card standardization:

ISO 14443-1 - Physical characteristics

ISO 14443-3 - Initialization and anticollision

ISO 14443-4 - Transmission protocol

Front 85

Radio Frequency Identifier (RFID)

Back 85

a technology that provides data communication through the use of radio waves. A common security issues is that data can be captured as it moves from the tag to the reader as most of these solutions are not encrypted

Front 86

Default to no access

Back 86

Access control mechanisms should default to no access as to provide the necessary level of security and ensure no security holes go unnoticed.

Front 87

Need to know principle

Back 87

is similar to the least privilege principle. It is based on the concept that individuals should be given access only to the information they absolutely require in order to perform their job duties

Front 88

authorization creep

Back 88

as employees work at a company over time and are give more and more access rights as they progress from one dept to another

Front 89

single sign on

Back 89

a system that allows a user to enter their credentials one time and be able to access all resources in primary and secondary network domains.

Front 90

Kerberos

Back 90

a single sign on technology that provides authentication functionality with the purpose of protecting a company's assets. It works in a client/server model and is based on symmetric key cryptography. Although it allows the use of passwords for authentication, it was designed specifically to eliminate the need to transmit passwords over the network.

Front 91

Key Distribution Center ( KDC)

Back 91

the most important component within a Kerberos environment. The KDC holds all users' and services secret keys. It provides an authentication service as well as key distribution functionality. The clients and services trust the integrity of the KDC, and this trust is the foundation of Kerberos security.

Front 92

ticket granting service

Back 92

a Kerberos service on the Key Distribution Center that generates a ticket that allows one principal to authenticate to another principal

Front 93

Kerberos Principal

Back 93

another term for users and services

Front 94

ticket granting ticket

Back 94

are used so the user does not have to enter his password each time he needs to communicate with another principal

Front 95

Kerberos secret key

Back 95

shared between the KDC and a principal and is static in nature

Front 96

Kerberos session key

Back 96

shared between two principals and is generated when needed and destroyed after the session is completed

Front 97

replay attack

Back 97

when an attacker captures and resubmits data with the goal of gaining unauthorized access to an asset

Front 98

Sesame

Back 98

a single sign on technology developed to extend Kerberos functionality and improve upon its weaknesses. It uses symmetric and asymmetric key cryptography. It also uses Privileged Attribute Certificates, which contain the subjects identity, access capabilities for the object, access time period, and lifetime of the PAC.

Front 99

PAC - Privileged Attribute Certificate

Back 99

a digitally signed certificate that is validated by a Privileged Attribute Server. It contains the subjects identity, access capabilities for the object, access time period, and lifetime of the PAC

Front 100

Security Domain

Back 100

resources within a domain are working under the same security policy and managed by the same group.

Front 101

Directory services

Back 101

provide users access to network resources transparently, meaning users dont need to know the exact location of the resources or the steps required to access them. Examples are LDAP, Novell Netware Directory Service(NDS), microsoft active directory.

Front 102

Thin Clients

Back 102

Terminals that rely upon a central server for access control, processing and storage.

Front 103

access control model

Back 103

a framework that dictates how subjects access objects. There are three main types:

Discretionary, Mandatory, and role Based

Front 104

Discretionary Access Conrol

Back 104

access is restricted based on the authorization granted to the users. Object owners are allowed to specify what access to give to their objects in this model. Access control lists are used to enforce these access decisions.

Front 105

mandatory access control

Back 105

a much more structured and strict model based on security label system. Users are given a security clearance( secret, top secret, confidential) and the data is classified in the same way. The clearance and classification data are stored in the security labels, which are bound to the specific subjects and objects.

Front 106

role based access control

Back 106

uses a centrally administrated set of controls to determine how subjects and objects interact.The access control levels can be based upon the necessary operations and tasks a user needs to carry out to fulfill their responsibilities without an organization.

Front 107

Core RBAC

Back 107

This is the foundation of the RBAC model. Users roles, permissions, operations, and sessions are defined and mapped according to the security policy.

Front 108

Hierarchical RBAC

Back 108

this component allows the administrator to setup an organizational RBAC model that maps to the organizational structures and functional delineations required in a specific environment.

Front 109

Rule Based Access control

Back 109

uses specific rules that indicate what can and cannot happen between a subject and an object.

Front 110

constrained user interfaces

Back 110

restrict users access abilities by not allowing them to request certain functions or information, or to have access to specific system resources. Three major types exist:

Menus and Shells, DataBase Views, and Physically constrained interfaces

Front 111

access control matrix

Back 111

is a table of subjects and objects indicating what actions individual subjects can take upon individual objects.

Front 112

capability table

Back 112

species the access rights a certain subject possesses pertaining to specific objects, in an access control matrix this is a row

Front 113

access control list

Back 113

used in several operating systems, applications and router configurations. They are lists of subjects that are authorized to access specific object, and they define what level of authorization is granted. ACL corresponds to the column of the access control matrix

Front 114

context dependent access control

Back 114

a system that is using context-dependent access control "reviews the situation" and then makes a decision. an example is a stateful firewall that can understand the context of what is going on when a tcp packet arrives and includes that as part of its access decision.

Front 115

content dependent access control

Back 115

access to objects is determined by the content within the object

Front 116

centralized access control administration

Back 116

one entity is responsible for overseeing access to all corporate resources. some examples are : Radius, TACAS, and Diameter

Front 117

Remote Authentication Dial In User Service

RADIUS

Back 117

a network protocol that provides client/server authentication and authorization, and audits remote users. Uses UDP protocol.

Only encrypts the password as its being transmitted, does not encrypt username, accounting and authorized services.

Front 118

Terminal Access Controller Access Control System

TACACS

Back 118

combines its authentication and authorization processes; and uses fixed passwords for authentication

Front 119

TACACS+

Back 119

separates authentication, authorization and auditing processes, and allows users to employ dynamic one time passwords. it is a totally different protocol from TACACS and not backward compatible with it.

Uses the TCP protocol. Encrypts all data between the client and server.

Front 120

Diameter

Back 120

a protocol built to improve upon Radius. It has two portions - the base protocol that provides secure communication among diameter entities, feature discovery, and version negotiation. The second is extensions, which are built on top of the base protocol to allow various technologies (voip, mobile IP) to use diameter for authentication.

Front 121

Decentralized access control administration

Back 121

gives control of access to the people closer to the resources. It is often the functional manager who assigns access control rights to employees.

Front 122

access control layers

Back 122

consists of three broad categories:

administrative, technical, and physical

Front 123

Administrative control components

Back 123

Policy and Procedures

Personnel controls

Supervisory structure

security awareness training

testing

Front 124

Physical control components

Back 124

Network segregation

perimeter security

computer controls

work area separation

data backups

cabling

control zone

Front 125

Technical control components

Back 125

System access

Network Architecture

Network access

Encryption and protocols

Auditing

Front 126

tempest

Back 126

a standard developed in the late 1950s to deal with electrical and electromagnetic radiation emitted from electrical equipment, mainly computers.

Front 127

white noise

Back 127

a countermeasure used to keep intruders from extracting information from electrical transmissions by sending a uniform spectrum of random electrical signals over the full spectrum so the bandwidth is constant and an intruder is not able to decipher real information from random noise or random information.

Front 128

Control Zone

Back 128

using material in your walls to contain electrical signals to protect against unauthorized access to data

Front 129

access control monitoring

Back 129

a method of tracking who attempts to access specific company resources

Front 130

intrusion detection systems

Back 130

designed to detect a security breach. It is the process of detecting an unauthorized use of, or attack upon, a computer, network, or telecomm infrastructure. IDS can be network based or host based.

Front 131

knowledge or signature based IDS (misuse detection systems)

Back 131

Signature based is also known as pattern matching. Models of how attacks are carried out are developed and called signatures. Each identified attach has a signature, which is used to detect an attack in progress or determine if one has occurred within the network. effectiveness depends on regularly updating the software with new signatures

Front 132

State based IDS

Back 132

Specific state changes (activities) take place with specific types of attacks. In a state based IDS the initial state is the state prior to the execution of an attack, and the compromised state is the state after successful penetration. The IDS has rules that outline which state transition sequences should sound an alarm. This type of IDS scans for attack signatures in the context of a stream of activity instead of just looking at individual packets. It can only identify known attacks and requires frequent updates of its signatures

Front 133

Statistical Anomaly Based IDS

Back 133

a behavioral based system. Behavioral based IDS products do not use predefined signatures, but rather are put in learning mode to build a profile of an environment's "normal" activities. This profile is built by continually sampling the environment's activities. The longer the IDS is put in learning mode, in most instances, the more accurate a profile it will build and the better protection it will provide.

Front 134

heuristic

Back 134

means to create new information from different data sources.

Front 135

protocol anomaly based IDS

Back 135

these types of IDS have specific knowledge of each protocol they will monitor. A protocol anomaly pertains to the format and behavior of a protocol. The IDS builds a model of each protocol's normal usage. it looks for anomalies that do not match the profiles built for the individual protocols.

Front 136

Traffic anomaly based IDS

Back 136

detect changes in traffic patterns, and in DOS attacks or a new service that appears on the network. A profile is built that captures the baselines of an environments ordinary traffic, all future traffic patterns are compared to that profile. this can detect unknown attacks

Front 137

Rule based IDS

Back 137

is commonly associated with a expert system. An expert system is made up of a knowledge base, inference engine, and rule based programming. Knowledge is represented as rules, and the data to be analyzed are referred to as facts.

IDS gathers data from a sensor or log, and the inference engine uses its reprogrammed rules on it.

Front 138

Honeypot

Back 138

a system setup to entice a would be attacker to attack it instead of authentic production systems. It contains no real company information, and thus will not be at risk if attacked.

Front 139

entrapment

Back 139

when an intruder is induced or tricked into committing a crime.

Front 140

Dictionary attack

Back 140

a program that hashes a list of dictionary words and compares the resulting message digest with the system password file that also stores the password in a one way hash format. If the hash values match, it means the password has been identified.

Front 141

brute force attacks

Back 141

also known as an exhaustive attack, it will try every possible combination until the correct one is found. War dialing to find a modem is a type of brute force attack.

Front 142

phishing

Back 142

a type of social engineering with the goal of obtaining personal information, credentials, credit card #s, or financial data. The attackers can send fake emails or crate fake websites and trick users to input their information into them.

Front 143

pharming

Back 143

using DNS poisoning to redirect users to a fake but legitimate looking website

Front 144

spear phishing

Back 144

a phishing attack targeted at a specific person

Front 145

threat modeling

Back 145

a process of identifying the threats that could negatively affect an asset and the attack vectors they would use to achieve their goals

Front 146

identity theft

Back 146

a situation where someone obtains key pieces of personal information and then uses that information to impersonate someone else.