Security Final

Front 1

What is RAND R-609

Back 1

Written by William H. Ware, it attempted to define the multiple controls and mechanisms necessary for protection of a computerized data processing system

Front 2

What is CIA? What does each word mean?

Back 2

Confidentiality – protected from disclosure to unauthorized individuals

Integrity – Describes how data is whole, complete, and uncorrupted

Availability – Data is accessible and correctly formatted for use without obstruction

Front 3

Who invented the Internet?

Back 3

Dr. Larry Roberts

Front 4

Is technological obsolesce good or bad in regard to security? Why/Why Not?

Back 4

When new products come out making old products obsolete. Like blackberries getting replaced by other Smartphones. Or house phone replaced by cellphone.

Can have people make up laptops with different chargers, so reusing tech is lower, meaning more spending and waste of utility and resources

Front 5

Password Strength: Length or Complexity is better? What is the formula for possible passwords.

Back 5

different combinations = number of possible characters ^password length

Longer is better

Front 6

What is the difference between phishing and pharming?

Back 6

Phishing - defrauding an online account holder of financial information by posing as a legitimate company.

Pharming - directing Internet users to a bogus website that mimics the appearance of a legitimate one, in order to obtain personal information such as passwords, account numbers, etc.

Front 7

Computer Fraud and Abuse Act of 1986

Back 7

Made hacking “illegal”; cornerstone to many computer-related federal laws

Front 8

USA PATRIOT ACT of 2001

Back 8

Allowed the Government the ability to monitor activity when investigating terrorism

Front 9

Computer Security Act of 1987

Back 9

Requires systems to have acceptable security practices

Front 10

Health Insurance Portability and Accountability Act

Back 10

Mandates industry-wide standards for health care information on electronic billing

Front 11

Sarbanes–Oxley Act of 2002

Back 11

Established accountability for executives at publicly traded companies

Front 12

Children’s Internet Protection Act

Back 12

Requires K-12 schools and libraries to use Internet filters

Front 13

Calculating Risk

Back 13

(Likelyhood % * Attack Success %)

*

(Asset Value * Probably Loss %)

+

Uncertainty

Front 14

Learn the OSI Model

Back 14

Physical, Data Link, Network, Transmission, Session, Presentation, Application

Front 15

Cost Benefit Analysis (CBA)

Back 15

ALE(prior) – ALE(post) – Annualized Cost of Safeguard(ACS)

Front 16

Annualized Loss Expectancy (ALE)

Back 16

SLE * Annual Rate of Occurrence (ARO)

Front 17

Single Loss Expectancy (SLE)

Back 17

Exposure Factor (EF) * Asset Value (AV)

Front 18

How does Kerberos work?

Back 18

1) Computer lets Kerberos know that its a PC

2) Kerberos acknowledges it

3) Computer asks for a ticket

4) kerberos grants ticket

5) computer tries to use ticket

6) kerberos checks to see that the ticket is good

7) server takes out the document/performs task

8) server checks with kerberos that the actions were done right

9) Kerberos acknowledges

10) process granted back to the computer

Front 19

The difference between identification,authentication, authorization, andaccountability

Back 19

Identification - when a user claims to have some form of identity

Authentification - provides a way of identifying a user via name or password

Authorization - after logging in the user may try to issue commands. authorization determines whether you have the ability to issue commands.

Accountability - Logs the user's actions to make sure they didnt use too many resources that they don't have

Front 20

What is the purpose of NAT? (Not what does itdo, why?)

Back 20

Think of a receptionist at an office. NAT operated on a router, usually connecting two networks together, and translates the private addresses in the internal network into legal address.

Front 21

What are some examples of Firewalls? How dothey work?

Back 21

Can be software or hardware

Hardware can be a dedicated server designed to catch weird OP connections and time them out.

Software is the piece that regulates which websites you can access and what can reach you on your PC online.

Front 22

What does Lightweight Directory AccessProtocol (LDAP) do?

Back 22

directory service protocol that runs on a layer above IT stack. provides a mechanism used to connect to internet.

Front 23

What are honeypots and how do padded cellsystems utilize them?

Back 23

Honeypot - is a deception trap designed to entice an attacker into attempting to compromise the information. Dummy info.

Padded Cells are honeypots that are hard to crack. Hardened Honey Pot

Front 24

What is Snort an example of?

Back 24

Snort is a free and open source network intrusion prevention system

Front 25

What vulnerability does the DROWN attack exploit?

Back 25

cross-protocol security bug that attacks servers supporting modern protocol suites making them obsolete.

Drowning a security guard. If they control security you snuff them out

Front 26

Be able to translate using the Vigenère and XORCiphers

Back 26

Viginere: Make a graph, with ABC going X and Y. In the center write out the alphabet in the center.

use key under the code.:

Codecodecodecode

keykeykeykeykeyke

and top line is code. left is key. find middle letter that crosses the x and y and use that. repeat

XoR. Take your phrase as number. Place key under it. Add them up.

If its 1 + 1 = 0

if its 0 + 0 = 0

if its 1 and 0 = 1

If its same its 0. if its different its a 1

done

Front 27

What is a shifting substitution cipher?

Back 27

if the number is 3 then:

ABCDEFGHI

XYZABCDEF

scoots the number over a bit by the given number

Front 28

What is DES based off? What is DES’s successor?

Back 28

Data Encryption Sandbar. gotten at IBM. alhorith at National Bureau of Standards.

Replaced by AES (advanced Encryption Standard)

Front 29

What is the difference between brute-force,dictionary, and rainbow table attacks?

Back 29

Brute Force - try all the possible combinations

Dictionary - guessing attack using precompiled list of options, using options that are likely to work

Rainbow - optimized for hashes and passwords with great space optimization while maintaining look-up speed. In essence a specific dictionary

Front 30

Why is WEP considered less effective than WPA?

Back 30

WEP uses statick IP

Front 31

What is steganography?

Back 31

practice of concealing messages or information within other nonsecret text of data

Front 32

What fire extinguisher classes should be in the event ofan electrical fire? Flammable liquid/gas?

Back 32

Dry Powder against Flamable liquid / gas

Probably same for electrical fire

Front 33

What is are the different classes and their mnemonic? (When covering Fire Extinguishers)

Back 33

A - Ash

B - Barrel

C - Current

D - Dynamite

K - Kitchen

Front 34

What is the importance of UPS?

Back 34

making sure power doesnt go out completely destroying the machine or the files in it

Front 35

Janitors are often required to have access tosensitive areas, what policies/procedures can beused to ensure safety of information?

Back 35

track their cards and make them a different identification than most

Front 36

What are the different types of locks? How doeseach one differ?

Back 36

electro magnetic - accepts variety of input as keys

fail safe- auto releases when power goes out

mechanical - physical lock that requires a key

fail secure - locks when power goes out

Front 37

What is change culture? What is the LewinChange Model?

Back 37

unlock the system. change the components. lock it down so no editing can happen

Front 38

What are deliverables? Milestones

Back 38

deliverable is a tangible outcome of a project

milestone is the expected milestone

Front 39

Why are job rotation, separation of duties, andleast privilege considered good securitypractices?

Back 39

evereyone can do a bit of everything. not give one person all the power. provides split responsibility rather than relying on one person

Front 40

Be able to explain why Misha Glenny says “Hirethe hackers” (specifically why he says it

Back 40

because hackers know how to break things, so use that knowledge in terms of how to fix the breaks

Front 41

Be able to explain the different steps ofemployment (from interview to termination)

Back 41

-job description

-interview

-background checks

-contracts

-orientation

-on-site security trininig

-termination

---exit interviews

--hostile vs friendly department

Front 42

What is SQL Injection? How did you extract passwords from thedatabase?Could you do it again? (Hint hint)

Back 42

injecting different commands to extract information from a file that uses SQL injection

Front 43

What is the HOSTS file for?

Back 43

allows you to define domain names from DNS servers. IP is the number. domain name is the site name

Front 44

What are the different types of account policy controls that can beapplied to passwords?

Back 44

age max and min

history

length

complexity

how long it lasts

lock out time

lock out period

Front 45

Difference between telnet and SSH? Remote desktop?

Back 45

Telnet is unencrypted text only connection to a remote computer using command shell

SSH is encrypted cousin of Telnet

Remote Desktop is an encrypted connection to a Windows machine that allows you to run the full Windows interface remotely