Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
16 Cards in this Set
- Front
- Back
- 3rd side (hint)
|
Define Cybersecurity |
Protection for information. Protection against unauthorized access. Cybersecurity refers to the protection of internet-connected systems such as software, hardware, electronic data, etc. from cyber attacks. |
Protection |
|
|
What is cryptography? |
Cryptography is a method to transform and transmit data in an encoded way to protect the information from 3rd parties for whom data is not authorized |
Transform and transmit |
|
|
What is the difference between Threat, Vulnerability, and Risk? |
Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk Threat: Someone with the potential to cause harm by damaging or destroying the official data of a system or organization e.g. phishing attack. Vulnerability: Refers to weaknesses in a system that makes threat outcomes more possible and even more dangerous e.g. SQL Injections, cross-site scripting. Risk: It refers to a combination of threat probability and impact/loss. It is related to potential damage or loss when a threat exploits the vulnerability. Threat probability * Potential loss = Risk |
Threat = Entity/person/attacker Vulnerability = Weaknesses Risk = Combination |
|
|
What is Cross-Site Scripting and how can it be mitigated? |
XSS is aka a client-side injection attack. It aims at executing malicious scripts on a victim's web browser by injecting malicious code. Preventing Cross-Site Scripting: Input validation, preventing the use of certain characters or combinations of characters Encoding special characters Using anti-xss tools or services |
|
|
|
What is the difference between IDS and IPS? |
IDS is Intrusion Detection Systems which only detects intrusions as it is a monitoring system IPS is Intrusion Prevention Systems which both detect and prevent intrusions. |
|
|
|
What is a botnet? |
A group of internet-connected devices, essentially zombies, such as servers, PCs, mobile devices, etc. that are affected and controlled by malware. Used for stealing data, sending SPAM, performing DDoS attacks, and more |
Zombie network |
|
|
What is the CIA triad? |
Confidentiality - A collection of rules that limits access to information Integrity - It assures the information is trustworthy and reliable Availability - It provides reliable access to data for authorized people or systems |
|
|
|
What is the difference between Symmetric vs Asymmetric encryption? |
Symmetric encryption uses 1 key to encrypt and decrypt information, it is faster than asymmetric, and it is the preferred method for encrypting huge amounts of data. Examples are AES, RC4, 3DES, Blowfish Asymmetric encryption uses 2 keys, a public and a private key, to encrypt and decrypt information, it is comparatively slower. Examples are diffie-helman and RSA. Mostly, it is used to exchange keys for Symmetric encryption safely. |
|
|
|
What is the difference between hashing and encryption? |
Hashing is a one-way transformation of data used to verify integrity and encryption can be decrypted back to its original data. |
|
|
|
What is a the use of a firewall and how can it be implemented? |
A firewall is a security system used to control and monitor network traffic. To set up a firewall you should: Change the default password of the firewall device. Disable remote administration Configure port forwarding for specific applications, such as an FTP server or a web server. Disable the firewall's DHCP if there is an existing DHCP server on the network Set a default deny rule at the base of your rules |
|
|
|
What is the difference between a vulnerability assessment and Penetration Testing? |
A vulnerability assessment is a process to define, detect, and prioritize the vulnerabilities in an organization's computer systems, network infrastructure, applications, etc., and gives the company the required information to fix the flaws. Penetration Testing is a process of testing a network, system, application, etc., to identify vulnerabilities that an attacker could exploit |
|
|
|
What is the difference between stored cross-site scripting and reflected cross-site scripting? |
Stored XSS Attacks are where the injected scripts are stored on the target servers permanently. In this, the victim retrieves the malicious script from the server when they request the stored information. Reflected XSS Attacks are where the user has to send the request first, then it will start running on the victim's browser and reflects results from the browser to the user who sent the request. |
|
|
|
What is the 3-way handshake? |
This is a process used in TCP (Transmission Control Protocol) to establish a reliable connection before data is sent between the host and the client. It has 3 steps, SYN, SYN/ACK, ACK. |
|
|
|
What are HTTP response codes? |
1xx (Informational) - The request has been received and the process is continuing. 2xx (Success) - The request was successfully received and accepted 3xx (Redirect) - Further action must be taken to complete it 4xx (Client Error) - Request cannot be fulfilled or has incorrect syntax 5xx (Server Error) - The server failed to fulfill the request |
|
|
|
What are techniques used in preventing a Brute Force Attack? |
Password complexity Limit login attempts Two- or Multi-factor authentication |
|
|
|
What are common types of Cybersecurity attacks? |
Malware SQLi Cross-site scripting MitM Attacks Credential reuse Phishing Session Hijacking DoS and DDoS |
|
