Security And Risk Analysis

Front 1

Attack Protocol

Back 1

a series of steps or processes used by and attacker, in a logical sequence, to launch an attack against a target system or network.

Front 2

Footprinting

Back 2

is the organized research of the Internet addresses owned or controlled by a target organization. The attacker uses public Internet data sources to perform keyword searches to identify the network addresses of the organization. This research is augmented by browsing the organization’s Web pages.

Front 3

Fingerprinting

Back 3

a systematic survey of all of the target organization’s Internet addresses (which were collected during the footprinting phase described above); the survey is conducted to identify the network services offered by the hosts in that range. Fingerprinting reveals useful info about the internal structure and operational nature of the target system or network.

Front 4

Packet Sniffing

Back 4

(network protocol analyzer), is a network tool that collects copies of packets from the network and analyzes them. It can provide a network administrator with valuable info for diagnosing and resolving networking issues. To use a packet sniffer legally, the admin must 1.) be on network that the organization owns, 2.) be under direct authorization, 3.) have knowledge and consent of the content creators.

Front 5

Access Control

Back 5

security measure that admits or prohibits people from entering sensitive areas.

Front 6

Supplicant

Back 6

A prospective user who, in the context of access control, seeks to use a protected system, logically access a protected service, or physically enter a protected place.

Front 7

Token

Back 7

a card or key fob with a computer chip and a liquid crystal display that shows a computer-generated number used to support remote login authentication

Front 8

Synchronous Token

Back 8

synchronized with a server, both devices (server and token) use the same time or a time-based database to generate a number that is displayed and entered during the user login phase.

Front 9

Asynchronous Token

Back 9

use a challenge response system, in which the server challenges the supplicant during login with a numerical sequence.

Front 10

Biometrics

Back 10

process of using body measurements (fingerprints, retinal print, iris pattern)
Must be truly unique.

Front 11

FRR(Type I Error)

Back 11

False Reject Rate- is the percentage of identification instances in which authorized users are denied access a result of a failure in the biometrics device.

Front 12

FAR(Type II Error)

Back 12

False Accept Rate – is the percentage of identification instances in which unauthorized users are allowed access to systems or areas as a result of a failure in the biometric device.

Front 13

Algorithm

Back 13

The programmatic steps used to convert an unencrypted message into an encrypted sequence of bits that represent the message: sometimes refers to the programs that enable cryptographic processes.

Front 14

Cipher/Cryptosystem

Back 14

An encryption method of process encompassing the algorithm, keys, or cryptovariables, and procedures used to perform encryption and decryption.

Front 15

Ciphertext/Cryptogram

Back 15

The encoded message resulting from an encryption.

Front 16

Decipher

Back 16

To decrypt or convert ciphertext into the equivalent plain text

Front 17

Encipher

Back 17

To encrypt or convert plaintext into the equivalent ciphertext

Front 18

Key/Cryptovariable

Back 18

The information used in conjunction with an algorithm to create the ciphertext from the plaintext or derive the plaintext from the ciphertext; the key can be a series of bits used by a computer program, or it can be a passphrase used by humans that is then converted into a series of bits used by a computer program.

Front 19

Cipher Method

Back 19

bit stream – each bit in the plaintext is transformed into a cipher bit on bit at a time.

Front 20

Block Cipher

Back 20

the message is divided into blocks, and then each block of plaintext bits is transformed into an encrypted block of cipher bits using an algorithm and a key.

Front 21

Substitution cipher

Back 21

you substitute one value for another

Front 22

Monoalphabetic sub. cipher

Back 22

only uses one alphabet

Front 23

Polyalphabetic sub. cipher

Back 23

uses 2 or more alphabets

Front 24

Vigenere cipher

Back 24

An advanced type of substitution cipher that uses a simple polyalphabetic code and involves using the Vigenere Square, which is made up of 26 distinct cipher alphabets.

Front 25

Transposition Cipher

Back 25

(permutation cipher), simply rearranges the values within a block to create the ciphertext

Front 26

Exclusive OR (XOR)

Back 26

is a function of Boolean algebra in which two bits are compared, and if the two bits are identical, the result is a binary 0. If the two bits are not the same, the result is a binary 1.

Front 27

Keys

Back 27

encryption methodologies that require the same secret key to encipher and decipher the message are using what is called a private key encryption or symmetric key encryption.

Front 28

Symmetric Encryption

Back 28

use mathematical operations that can be programmed into extremely fast computing algorithms so that the encryption and decryption processes are executed quickly by even small computers.

Front 29

Data Encryption Standard (DES)

Back 29

was developed by IBM and is based on the company’s Lucifer algorithm, which uses a key length of 128 bits. It was adopted in 1976 as a federal standard for encryption of non-classified information, after which it became widely employed in commercial applications. In 1997, it was discovered that the 56bit key size did not provide acceptable levels of security.

Front 30

3DES

Back 30

was created to provide a level of security far beyond that of DES. It soon proved to be too weak.

Front 31

Advanced Encryption Standard (AES)

Back 31

is a Federal Information Processing Standard that specifies a cryptographic algorithm used with the U.S government to protect information in federal agencies that are not a part of the nation defense infrastructure. AES uses a block cipher called the Rijndael Block Cipher with a variable block length and a key length of 128, 192, or 256 bits.

Front 32

asymmetric encryption (public-key encryption) –

Back 32

uses two different but related keys , and either key can be used to encrypt or decrypt the message.

Front 33

Public-key infrastructure (PKI) –

Back 33

Public-key infrastructure (PKI) – an integrated system of software, encryption methodologies, protocols, legal agreements, and third-party services that enables users to communicate securely.

Front 34

digital certificate

Back 34

– public key container files that allow computer programs to validate the key and identify to whom it belongs.

Front 35

Nonrepudiation

Back 35

– The principle of cryptology that give credence to the authentication mechanism collectively known as a digital signature. In this asymmetric cryptographic process, the sender’s private key is used to encrypt a message, and the sender’s public key must be used to decrypt the message – when the decryption happens successfully, it provides verification that the message was sent by the sender and cannot be refuted.

Front 36

digital signature –

Back 36

Encrypted messages that can be mathematically proven authentic

Front 37

Diffie-Hellman Key Exchange

Back 37

– A method for exchanging private keys using public key encryption

Front 38

Steganography

Back 38

– A method of hiding the existence of a secret message

Front 39

Secure Socket Layer (SSL)

Back 39

– A protocol to use public key encryption to secure a channel over the internet.

Front 40

Secure Hypertext Transfer Protocol (S-HTTP

Back 40

) – A protocol designed to enable secure communications across the Internet. S-HTTP is the application of SSL over HTTP, which allows the encryption of all information passing between two computers through a protected and secure virtual connection.

Front 41

Pretty Good Privacy (PGP)

Back 41

A hybrid cryptosystem that combines some of the best available cryptographic algorithms. PGP is the open source de facto standard for encryption and authentication of email and file storage applications.

Front 42

Wired Equivalent Privacy (WEP)

Back 42

was an early attempt to provide security with the 8002.11 network protocol. It is now considered to be too weak to provide meaningful protection from eavesdropping. Uses RC4 cipher stream to encrypt each packet using a 64-bit key. Key management is not effective since most networks use a single shared secret key value for each node. The initialization vector is too small, resulting in the recycling of IVs. And attacker can reverse engineer the RC4 cipher stream and decrypt subsequent packets, or can forge future packets.

Front 43

Wi-Fi Protected Access (WPA)

Back 43

it uses dynamic keys created and shared by an authentication server. WPA accomplishes this through a Temporal Key Integrity Protocol.

Front 44

Bluetooth

Back 44

is a de facto industry standard for short range wireless communications between devices. It is used to establish communications links between wireless telephones and headsets, between PDAs and desktop computers and between laptops.

Front 45

Man-in-the-middle attack

Back 45

an attack designed to intercept the transmission of a public key or even to insert a known key structure in place of the requested public key.

Front 46

correlation attack

Back 46

Attempts to deduce the statistical relationships of the structure of the key and the output of the cryptosystem.

Front 47

dictionary attack

Back 47

A form of brute force attack on passwords that uses a list of commonly used passwords instead of random combinations. In cryptography, this is done by encrypting each entry in the dictionary with the same cryptosystem used by the target, then comparing the resulting ciphertext against the target’s ciphertext.

Front 48

timing attack

Back 48

An attack in which an abuser explores the contents of a Web browser’s cache. These attacks allow a web designer to create a malicious form of cookie to store on the client’s system.