Acct 321 (C.8) Control And Audit Of Aiss #1

Front 1

Defense in Depth

Back 1

Employing multiple layers of controls to avoid a single point of failure.

Front 2

Time-based Model of Security

Back 2

Implementing a combination of preventive, detective, and corrective controls that protect information assets long enough to enable an organization to recognize that an attack is occurring and take steps to thwart it before any information is lost or compromised.

Front 3

Social Engineering

Back 3

Using deception to obtain unauthorized access to information resources.

Front 4

Authentication

Back 4

Verifying the identity of the person or device attempting to access the system.

Front 5

Biometric Identifier

Back 5

A physical or behavioral characteristic that is used as an authentication credential.

Front 6

Multifactor Authentication

Back 6

The use of two or more types of authentication credentials in conjunction to achieve a greater level of security.

Hint 6

Ex: finger print, password, and badge

Front 7

Multimodal Authentication

Back 7

The use of multiple authentication credentials of the same type to achieve a greater level of security.

Hint 7

Ex: password & user ID

Front 8

Authorization

Back 8

The process of restricting access of authenticated users to specific portions of the system and limiting what actions they are permitted to perform.

Front 9

Access Control Matrix

Back 9

A table used to implement authorization controls.

Front 10

Compatibility Test

Back 10

Matching the users' authentication credentials against the access control matrix to determine whether that employee should be allowed to access that resource and perform the requested action.

Front 11

Border Router

Back 11

A device that connects an organization's information system to the internet.

Front 12

Firewall

Back 12

A special-purpose hardware device or software running a general-purpose computer that controls both inbound and outbound communication between a system behind the firewall and other networks.

Front 13

Demilitarized Zone (DMZ)

Back 13

A separate network located outside the organization's internal information system that permits controlled access from the internet.

Front 14

Routers

Back 14

Special purpose devices that are designed to read the source and destination address fields in IP packet headers to decide where to send (route) the packet next.

Front 15

Access Control List (ACL)

Back 15

A set of IF-THEN rules used to determine what to do with arriving packets.

Front 16

Packet Filtering

Back 16

A process that uses various fields in a packet IP and TCP headers to decide what to do with the packet.

Front 17

Deep Packet Inspection

Back 17

A process that examines the data in the body of a TCP packet to control traffic rather than looking only at the information in the IP and TCP headers.

Front 18

Intrusion Prevention Systems

Back 18

Software or hardware that monitors patterns in the traffic flow to identify and automatically block attacks.

Front 19

Remote Authentication Dial-in User Service (RADIUS)

Back 19

A standard method for verifying the identity of users attempting to connect via dial in access.

Front 20

War Dialing

Back 20

Searching for an idle modem by programming a computer to dial thousands of phone lines.

Hint 20

Used to detect employees setting up unsecured/unauthorized modems into the business network.

Front 21

Endpoints

Back 21

Collective terms for the workstations servers printers and other devices that comprise an organization's network.

Front 22

Vulnerabilities

Back 22

Flaws in programs that can be exploited to either crash the system or take control of it.

Front 23

Vulnerability Scanners

Back 23

Automated tools designed to identify whether a given system possesses any unused and unnecessary programs that represent potential security threats.

Front 24

Hardening

Back 24

The process of modifying the default configuration of endpoints to eliminate unnecessary settings and services.

Front 25

Change Control and Change Management

Back 25

The formal process used to ensure that modifications to hardware, software, or processes do not reduce systems reliability.

Front 26

Log Analysis

Back 26

The process of examining logs to identify evidence of possible attacks.

Front 27

Intrusion Detection Systems (IDS)

Back 27

A system that creates logs of all network traffic that was permitted to pass the firewall and then analyzes those logs for signs of attempted or successful intrusions.

Front 28

Penetration Test

Back 28

An authorized attempt to break into the organization's information system.

Front 29

Computer Incident Response Team (CIRT)

Back 29

A team that is responsible for dealing with major security incidents.

Front 30

Expoit

Back 30

A program designed to take advantage of a known vulnerability.

Front 31

Patch

Back 31

Code released by software developers that fixes a particular vulnerability.

Front 32

Patch Management

Back 32

The process of regularly applying patches and updates to software.

Front 33

Virtualization

Back 33

Running multiple systems simultaneously on one physical computer.

Front 34

Cloud Computing

Back 34

Using a browser to remotely access software, data storage, hardware, and applications.