Isys 414 Chapter 7

Front 1

time-based model of secutiry

Back 1

focuses on the relationship between preventive, detective, and corrective controls. P > D+C

Front 2

defense-in-depth

Back 2

is to employ multiple laters of controls in order to avoid having a single point of failure.

Front 3

Authentication

Back 3

focuses on verifying the identity of the person or device attempting to access the system.

Front 4

biometric identifier

Back 4

device which reads some physical characteristic of an individual, such as their fingerprint or voice.

Front 5

multifactor authentication

Back 5

the use of two or more methods of authentication in conjuction.

Front 6

Authorization

Back 6

restricts access of authenticated users to specific portions of the system and specifies what actions they are permitted to perform.

Front 7

access control matrix

Back 7

a table specifying which portions of the system users are permitted to access and what actions they can perform.

Front 8

compatibility test

Back 8

matching the user's authentication credentials against the access control matrix to determine whether that employee should be allowed to access that resource.

Front 9

Social Engineering

Back 9

use of deception to obtain unauthorized access to information resources.

Front 10

border router

Back 10

connects an organization's information system to the internet.

Front 11

firewall

Back 11

either a special-purpose hardware device or software running on a general purpose computer. Controls traffic in and out of a system.

Front 12

Demilitarized Zone (DMZ)

Back 12

a separate network that permits controlled access from the internet to selected resources.

Front 13

Transmission Control Protocol (TCP)

Back 13

specifies the procedures for dividing files and documents into packets to be sent over the internet and methods for reassembly of the original document or file at the destination

Front 14

Internet Protocol (IP)

Back 14

specifies the structure of those packets and how to route them to the proper destination

Front 15

routers

Back 15

are designed to read the destination addres fields in IP packet headers to decide where to send the packet next.

Front 16

Access Control List (ACL)

Back 16

determines which packets are allowed entry and which are dropped.

Front 17

static packet filtering

Back 17

screening of individual IP packets based solely on the contents of the source and or destination fileds in the IP packet header.

Front 18

Stateful Packet Filtering

Back 18

aintains a table that lists all established connections between the organization's computers and the internet. checks packets against open connections to verify if they are initiated by an internal computer.

Front 19

Deep packet filtering

Back 19

inspection of the full body of a packet to control packet access and distribution.

Front 20

intrusion prevention system (IPS)

Back 20

desinged to identify and drop packets that are part of an attack.

Front 21

Remote Authentication Dial-In User Service (RADIUS)

Back 21

system to permit employees to remotely access the organizational network by dialing in with a modem. User Authentication also takes place.

Front 22

war dialing

Back 22

calling of every telephone number assigned to an organization to identify those whicha re connected to modems.

Front 23

vulnerability

Back 23

flaws or weaknesses which can be exploited to either crash the system or take control of it.

Front 24

hardening

Back 24

turning off of unneccesary features to reduce vulnerabilities

Front 25

Encryption

Back 25

is the process of transforming normal text, called Plaintext, into unreadable gibberish, called ciphertext.

Front 26

Plain Text

Back 26

Normal text

Front 27

ciphertext

Back 27

encrypted text

Front 28

Decryption

Back 28

reversal of the encryption process to get plaintext

Front 29

key escrow

Back 29

making copies of all encryption keys used by empolyees and storing those copies securely.

Front 30

Symmetric encryption system

Back 30

use the same key both to encrypt and to decrypt. DES and AES

Front 31

Asymmetric encryption system

Back 31

use two separate keys. Public and private keys. RSA and PGP

Front 32

public key

Back 32

a widely distributed key which is available to the public.

Front 33

private key

Back 33

a secret key and known only to the owner of that pair of keys.

Front 34

hashing

Back 34

a process that takes plaintext of any length and transforms it into a short code called a hash. non-reversible

Front 35

digital signature

Back 35

information encrypted with the creator's private-key. proves the author of a document or file.

Front 36

digital certificate

Back 36

is an electronic document, created and digitally signed by a trusted third party, that certifies the identity of the owner of a particular public key.

Front 37

certificate authority

Back 37

the organization that issues public and private keys and records the public key in a digital certificate.

Front 38

e-signature

Back 38

a cursive style imprint of a person's name that is applied to an electronic document.

Front 39

log analysis

Back 39

the process of monitoring logs to monitor security

Front 40

Intrusion Detection System (IDS)

Back 40

create logs of network traffic that was permitted to pass the firewall and then alanyze those logs for signs of attempted or successful intrusions.

Front 41

vulnerability scans

Back 41

use automated tools designed to identify whether a given system possesses any well-known vulnerabilities.

Front 42

penetration test

Back 42

an authorized attempt by either an internal audit team or an external security consulting firm to break into the organization's information system.

Front 43

Computer Emergency Response Team (CERT)

Back 43

responsible for dealing with major computer secutiry incidents.

Front 44

exploit

Back 44

a set of instructions for taking advantage of a vulnerability

Front 45

patch

Back 45

code released by software developers that fixes a particular vulnerability

Front 46

patch management

Back 46

the process for regularly applying patches and updates to all software used by the organization.

Front 47

CERT steps

Back 47

recognize a problem - Contain the problem - recover from the problem - follow-up on the problem.

Front 48

Encryption Strength Components

Back 48

key length - key management policies - nature of the encryption algorithm

Front 49

hosting areas of attention

Back 49

host configuration - user accounts - software design

Front 50

Trust Services Framework Criteria

Back 50

develop and document policies - effectively communicate policies - design and employ appropriate control procedures - monitor the system and take corrective action to maintain compliance.

Front 51

TSF systems reliability

Back 51

1. security 2. confidentiality 3. privacy 4. processing integrity 5. availability