Isaca Cybersecurity Fundamentals: Domain 1 - Cybersecurity Concepts

Front 1

Knowledge of Cybersecurity Principles used to manage risk related to the use, processing, storage and transmission of information or data.

Back 1

Confidentiality: The protection of information from unauthorized access or disclosure.

Integrity: The protection of information from unauthorized modification.

Availability: The timely and reliable access to and use of information and systems.

Nonrepudiation: the assurance that a party cannot later deny originating data; provision of proof of the integrity and origin of the data and that can be verified by a 3rd party.

Front 2

Cybersecurity Roles

Back 2

Board of Directors

Executive Committee

Security Management

Cybersecurity Practitoners

Front 3

Threat Agents

Back 3

Corporations

Nation States

Hacktivists

Cyberterrorists

Cybercriminals

Cyberwarriors

Script Kiddies

Online Social Hackers

Employees

Front 4

Adversarial Threat Process

Back 4

1. Perform Reconnaissance

2. Create Attack Tools

3. Deliver malicious capabilities

4. Exploit and compromise

5. Conduct an attack

6. Achieve results

7. Maintain a presence or set of capabilities

8. Coordinate a campaign

Front 5

Attacks that perform reconnaissance

Back 5

1. Sniffing or scanning the network perimeter

2. Using open source discovery of organizational information

3. Running malware to identify potential targets

Front 6

Attacks that create attack tools

Back 6

1. Phishing or spear phishing attacks

2. Crafting counterfeit web sites or certificates

3. Creating and operating false front organizations to inject malicious components into the supply chain.

Front 7

Attacks that deliver malicious capabilities

Back 7

1. Introducing malware into organizational information systems.

2. Placing subverted individuals into privileged positions within the organization.

3. Installing sniffers or scanning devices on targeted networks and systems.

4. Inserting tampered hardware or critical components into organizational systems or supply chains.

Front 8

Attacks that exploit and compromise

Back 8

1. Split tunneling or gaining physical access to organizational facilities.

2. Exfiltrating data or sensitive information.

3. Exploiting multitenancy in a cloud environment.

4. Launching zero-day exploits.

Front 9

Attacks that help conduct an attack

Back 9

1. Communication interception or wireless jamming attacks.

2. Denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks

3. Remote interference with or physical attacks on organizational facilities or infrastructures.

4. Session-hijacking or man-in-the-middle attacks.

Front 10

Attacks to achieve results

Back 10

1. Obtaining unauthorized access to systems and/or sensitive information

2. Degrading organizational services or capabilities.

3. Creating, corrupting or deleting critical data.

Front 11

Attacks to maintain a presence or set of capabilities

Back 11

1. Obfuscating adversary actions or interfering with intrusion detection systems (IDSs)

2. Adapting cyberattacks in response to organizational security measures.

Front 12

Attacks to coordinate a campaign

Back 12

1. Multi-staged attacks

2. Internal and external attacks

3. Widespread and adaptive attacks.

Front 13

Cybersecurity Controls

Back 13

1. Identity Management

2. Provisioning and Deprovisioning

3. Authorization

4. Access Control Lists

5. Access Lists

6. Privileged User Management

7. Change Management

8. Configuration Management

9. Patch Management

Front 14

Viruses

Back 14

It is a piece of code that can replicate itself and spread from one computer to another. It requires intervention or execution to replicate and/or cause damage.

Front 15

Network worm

Back 15

A variant of the computer virus, which is essentially a piece of self-replicating code designed to spread itself across computer networks. It does not require intervention or execution to replicate.

Front 16

Trojan horses

Back 16

A further category of malware; which is a piece of malware that gains access to a targeted system by hiding within a genuine application. Trojan horses are often broken down into categories reflecting their purposes.

Front 17

Botnets

Back 17

It (a term derived from "robot network") is a large, automated and distributed network of previously compromised computers that can be simultaneously controlled to launch large-scale attacks such as denial-of-service (DoS).

Front 18

Spyware

Back 18

A class of malware that gathers information about a person or organization without the knowledge of that person or organization.

Front 19

Adware

Back 19

Designed to present advertisements (generally unwanted) to users.

Front 20

Ransomware

Back 20

A class of extortive malware that locks or encyrpts data or functions and demands a payment to unlock them.

Front 21

Keylogger

Back 21

A class of malware that secretly records user keystrokes and, in some cases, screen content.

Front 22

Rootkit

Back 22

A class of malware that hides the existence of other malware by modifying the underlying operating system.

Front 23

Advanced persistent threats

Back 23

Complex and coordinated attacks directed at a specific entity or organization. They require an enormous amount of research and time, often taking months or even years to fully execute.

Front 24

Backdoor

Back 24

A means of regaining access to a compromised system by installing software or configuring existing software to enable remote access under attacker-defined conditions.

Front 25

Brute force attack

Back 25

An attack made by trying all possible combinations of passwords or encryption keys until the correct one is found.

Front 26

Buffer overflow

Back 26

Occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information-which has to go somewhere-can overflow into adjacent buffers, corrupting or overwriting the valid data held in them.

Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes type of security attack or data integrity.

Front 27

Cross-site scripting (XSS)

Back 27

A type of injection in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

Front 28

Denial-of-service (DoS) attack.

Back 28

An assault on a service from a single source that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate.

Front 29

Man-in-the-middle attack

Back 29

An attack strategy in which the attacker intercepts the communication stream between two parts of the victim system and then replaces the traffic between the two components with the intruder's own, eventually assuming control of the communication.

Front 30

Social engineering

Back 30

Any attempt to exploit social vulnerabilities to gain access to information and/or systems. It involves a "con game" that tricks others into divulging information or opening malicious software or programs.

Front 31

Phishing

Back 31

A type of electronic mail (email) attack that attempts to convince a user that the originator is genuine, but with the intention of obtaining information for use in social engineering.

Front 32

Spear phishing

Back 32

An attack where social engineering techniques are used to masquerade as a trusted party to obtain important such as passwords from the victim.

Front 33

Spoofing

Back 33

Faking the sending address of a transmission in order to gain illegal entry into a secure system.

Front 34

Structure Query Lanaguage (SQL) injection

Back 34

According to MITRE, SQL injection results from failure of the application to appropriately validate input. When specially crafted user-controlled input consisting of SQL syntax is used without proper validation as part of SQL queries, it is possible to glean information from the database in ways not envisaged during application design.

Front 35

Zero-day exploit

Back 35

A vulnerability that is exploited before the software creator/vendor is even aware of its existence.

Front 36

Security Management - Identify

Back 36

Use organizational understanding to minimize risk to systems, assets, data and capabilites.

Front 37

Security Management - Protect

Back 37

Desing safeguards to limit the impact of potential events on critical services and infrastructure.

Front 38

Security Management - Detect

Back 38

Implement activities to identify the occurrence of a cybersecurity event.

Front 39

Security Management - Respond

Back 39

Take appropriate action after learning of a security event.

Front 40

Security Management - Recover

Back 40

Plan for resilience and the timely repair of compromised capabilities and services.

Front 41

Risk

Back 41

The combination of the probability of an event and its consequences.

Front 42

Threat

Back 42

Anything that is capble of acting against an asset in a manner that can result in harm.

Front 43

Asset

Back 43

Something of either tangible or intangible value that is worth protecting, including people, information, infrastructure, finances and reputation

Front 44

Vulnerability

Back 44

A weakness in the desing, implementation, operation or internal control of a process that could expose the system to adverse threats from threat events.

Front 45

Residual risk

Back 45

Even after safeguards are in place, there will always be residual risk, defined as the remaining risk after management has implemented a risk response.

Front 46

Inherent risk

Back 46

The risk level or exposure without taking into account the actions that management has taken or might take (e.g. implementing controls)

Front 47

Policies

Back 47

Communicate required and prohibited activities and behaviors

Front 48

Standards

Back 48

Interpret policies in specific situations

Front 49

Procedures

Back 49

Provide details on how to comply with policies and standards.

Front 50

Guidelines

Back 50

Provide general guidance on issues such as "what to do in particular circumstances". These are not requirements to be met, but are strongly recommended.

Front 51

Identity Management

Back 51

Focuses on streamlining various business processes needed to manage all forms of identities in an organization.

Front 52

User provisioning

Back 52

Part of the organization's hiring process where user accounts are created; passwords and access control rights are generally assigned based on the job duties of the user

Front 53

User deprovisioning

Back 53

All accounts and accesses must be suspended or deleted in a timely manner

Front 54

Authorization

Back 54

Used for access control that the system be able to identify and differentiate among users.

Front 55

Access Control Lists (ACLs)

Back 55

A register of users (including groups, machines and processes) who have permission to use a particular system resource.

Front 56

Access List

Back 56

Filter traffic at router interfaces based on specified criteria, thus affording basic network security.

Front 57

Privileged User Management

Back 57

Permits authorized users to maintain and protect systems and networks.

Front 58

Change Management

Back 58

Ensure that that changes to processes, systems, software, applications, platforms and configuration are introduced in an orderly, controlled manner.

Front 59

Configuration Management

Back 59

Maintaining the security configurations of network devices, systems, applications, and other IT resources is critically important to ensure security controls are properly installed and maintained.

Front 60

Patch Management

Back 60

The managment of patches to solve software programming erros.