Csslp - Fips And Other

Front 1

FIPS 140

Back 1

Cryptographic module

Front 2

FIPS - 197

Back 2

AES/ Rijndael algorithm Cypher

It provides the definition of the Advanced Encryption Standard (AES)

Front 3

FIPS - 199

Back 3

Categorization of security

FIPS 199 requires Federal agencies to assess their information systems in each of the categories of confidentiality, integrity and availability, rating each system as low, moderate or high impact in each category. The most severe rating from any category becomes the information system's overall security categorization.

Front 4

FIPS - 201

Back 4

PIVs is a United States federal government standard that specifies Personal Identity Verification (PIV) requirements for Federal employees and contractors.

Front 5

FIPS - 200

Back 5

Security controls FIPS200 defines following 17 security areas covered under confidentiality, integrity, and availability (CIA) of federal information systems and the information processed, stored, and transmitted by those systems.

Front 6

DoD 8570

Back 6

Training, certification, guidance

Front 7

ISO 27000

Back 7

Information security management

Front 8

ISO- 9126

Back 8

Software quality

Front 9

NIST 800

Back 9

Secure SDLC .The NIST 800 Series is a set of documents that describe US federal government computer security policies, procedures and guidelines.

Front 10

COSO

Back 10

Crime- Risk management

Front 11

CVSS

Back 11

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to threat.

Front 12

OCTAVE

Back 12

OCTAVE- risk assessment

OCTAVE is an acronym for Operationally Critical Threat, Asset and Vulnerability Evaluation and it includes a suite of tools, techniques

Front 13

OSSTMM

Back 13

The Open Source Security Testing Methodology Manual, or OSSTMM, is a peer-reviewed methodology for security testing, maintained by the Institute for Security and Open Methodologies (ISECOM). The manual is updated every six months or so, to remain relevant to the current state of security testing.

Front 14

COBIT

Back 14

COBIT is used globally by all IT business process managers to equip them with a model to deliver value to the organization, and practice better risk management practices associated with the IT processes. The COBIT control model guarantees the integrity of the information system

Front 15

ITIL

Back 15

ITIL, formerly an acronym for Information Technology Infrastructure Library, is a set of detailed practices for IT service management (ITSM) that focuses on aligning IT services with the needs of business.

Front 16

The Gramm-Leach-Bliley Act

Back 16

The Gramm-Leach-Bliley Act (GLB Act or GLBA) is also known as the Financial Modernization Act of 1999. It is a United States federal law that requires financial institutions to explain how they share and protect their customers' private information.

Front 17

CVE

Back 17

Common Vulnerability Enumeration language

Front 18

Single Loss Expectancy

Back 18

SLE = Asset Value x Exposure Factor

Front 19

Annual Loss Expactancy

Back 19

ALE = Annual Rate of Occurrence x SLE

ALE= ARO x SLE

Front 20

High Cohesion

Back 20

High cohesion is a software engineering concept that refers to how closely all the routines in a class, or all the code in a routine, support a central purpose. the heuristic goal is to make cohesion as high as possible.

Front 21

Low Coupeling

Back 21

Low coupling refers to a relationship in which one module interacts with another module through a simple and stable interface and does not need to be concerned with the other module's internal implementation

Front 22

Symmetric Algorithms

Back 22

Skipjack, Rijndael=AES, Blowish, RC4,DES,ARS -128,192,256

Front 23

Asymmetric algorithms

Back 23

Diffi-Helmans, RSA,ECC,DSA, Gamal

Front 24

Declarative coding

Back 24

"All or nothing" SQL

Front 25

Imperative Coding

Back 25

More granularity and control in classes

Front 26

Network Layer

Back 26

7. Application - Buffer overflow, XSS,DDos,Botnets

6. Presentation - DRM,DLP, SSL strip, Unicode Vulnerability

5. Session - MMAttack, session hijacking, DNS poisoning

4. Transport - SSL, SYN flood,session hijacking. SSL strip

3. Network - IPSec, ACL ,IP spoofing, packet sniffing, wormhole, TCMP attack

2. Data Link - MAC address , mac attack, DHCP attack

1. Physical

Front 27

FIPS - 180

Back 27

FIPS 180 - SHS secure hash standard

Front 28

FIPS - 186

Back 28

FIPS - 186 Digital Signature Standard (DSS)

Front 29

FIPS - 202

Back 29

FIPS 202 - specifies the Secure Hash Algorithm-3 (SHA- 3)

Front 30

DAC

Back 30

DAC. Stands for "Digital-to-Analog Converter"

Front 31

Parity Check

Back 31

A parity check is the process that ensures accurate data transmission between nodes during communication. A parity bit is appended to the original data bits to create an even or odd bit number;