Security Plus Chapter 2

Front 1

Goals of Information Security can be expressed as CIA. What does CIA stand for?

Back 1

1. Confidentiality (controling access to data)
   
2. Integrity (data integrity) uses hashing Digital signatures, Certificate, Non repudiation
   
3. Availability ensuring information is there when user wants it.
   

Front 2

Methods of ensuring Confidentiality

Back 2

1. Access Control/Permissions
   
2. Encryption (storage or in transit)
   
3. Steganography (hiding info in a file)
   

Front 3

What is Due Care, and Due Diligence

Back 3

1. Due Care is doing the right thing
2. Due Diligence is identifying risk to know security controls controls to put in place (due care)
   

Front 4

Identification is happens before?

Back 4

Authentication and is the process of having users identify themselves to the system.

Front 5

The step after the user inputs the identifying information for the account is?

Back 5

Authentication which where the identifying information is verified

Front 6

The step after Authentication is?

Back 6

Authorization is being given access examples:

Permissions, Router ACLs, Proxy servers, Facility access.

Front 7

The difference between Due Care and Due diligence.

Back 7

Due care is the performance of actions that ensure the security and are the result of Due diligence. Note: Audits and log files are part of Due diligence.

Front 8

Digital signature are created with the?

Back 8

Sender's private key and verified with the sender's mathematically related public key.

Front 9

The Private Key pair within a digital certificate can be used to ___________ and _____________ sensitive files.

Back 9

Encrypt and Decrypt

Front 10

Digital certificates can also be used to __________ a computer to a _____________ ___________ or ____________ , such as a VPN server.

Back 10

Authenticate, secure server, appliance

Front 11

Methods of ensuring Data Integrity.

Back 11

1. Hashing (algorithm and values)
2. Digital Signature
3. Certificate
4. Non repudiation
   

Front 12

Methods of ensuring Availability.

Back 12

1. Permissions
   
2. Backups
3. Fault tolerance (redundancy)
   
4. Clustering (multiple servers for fallover)
   
5. Patching
   

Front 13

What is Accountability?

Back 13

Ensuring that employees are accountable for their actions.

Front 14

What are four methods of implementing accountability?

Back 14

1. Log Files
2. Audit files (security)
3. Firewalls and proxy servers
4. Application logging
   

Front 15

What is Authorization?

Back 15

Configuring what assets the person can access after they have identified themselves to the system and have been authenticated.

Front 16

Three steps involved in network access are?

Back 16

1. Identify
2. Authenticate
3. Authorize
   

Front 17

What is the difference between the Owner and the Custodian?

Back 17

1. The Owner decides on the value of teh asset and what level of protection is needed.
2. The Custodian is responsible for implementing the controls to protect the asset and is your IT staff.