CS5CRT17 Computer Security Unit I Flashcards

Vocabulary flashcards covering core definitions, security layers, principles, threat types, attacks, sniffing, spoofing, phishing, and pharming from Unit I of Computer Security.

Security

The quality or state of being secure — to be free from danger.

Physical Security

A layer of security focused on controlling physical access to facilities, equipment, and resources to prevent unauthorized entry, theft, or damage.

Personnel Security

A layer of security concerned with protecting the individuals who are authorized to interact with an organization and its operations.

Operations Security

A layer of security that protects the specifics of ongoing and planned operations, including methods, procedures, and tactical details.

Communications Security

A layer of security ensuring that the media, technologies, and content of communications are protected from interception or unauthorized disclosure.

Network Security

A layer of security focused on securing networking infrastructure such as routers, switches, firewalls, and the data transmitted over them.

Information Security

The overarching layer that protects the confidentiality, integrity, and availability (CIA) of information assets through policy, education, training, awareness, and technology.

CIA Triangle

The fundamental model underpinning information security, consisting of Confidentiality, Integrity, and Availability.

Access

The ability of a subject or object to use, manipulate, modify, or affect another subject or object.

Asset

Any organizational resource that is being protected, which can be logical (websites, data) or physical (computers, people).

Threat

A category of objects, persons, or entities that presents a danger to an asset.

Threat Agent

A specific instance of a threat, such as an individual hacker or a specific lightning strike.

Vulnerability

A weakness or fault in a system or protection mechanism that opens it to attack or damage.

Attack

An intentional or unintentional act that can cause damage to or otherwise compromise information and the systems that support it.

Exploit

A documented technique or tool used to take advantage of a vulnerability or exposure in a system for unauthorized gain.

Risk

The probability that something unwanted will happen.

Risk Appetite

The quantity and nature of risk that an organization is willing to accept.

Control / Safeguard / Countermeasure

Security mechanisms, policies, or procedures designed to counter attacks, reduce risk, resolve vulnerabilities, and improve overall security posture.

Exposure

A condition where a vulnerability known to an attacker is present, creating an opportunity for exploitation.

Loss

A single instance of an information asset suffering damage, unauthorized modification, or unauthorized disclosure.

Availability

A characteristic of information that enables authorized users to access information without interference, obstruction, or undue delay in the required format.

Accuracy

The quality of information being free from mistakes or errors and holding the value the end user expects.

Authenticity

The quality or state of being genuine or original, remaining in the same state in which it was created, placed, stored, or transferred.

Confidentiality

The characteristic of information being protected from disclosure or exposure to unauthorized individuals or systems.

Integrity

The characteristic of information being whole, complete, and uncorrupted.

Utility

The quality or state of information having value for a particular purpose or end.

Possession

The quality or state of ownership or control of information, regardless of its format.

Rand Report R-609

A landmark report that was among the first to formally study computer security, expanding its scope beyond physical protection to include data safety, access control, and multi-level organizational involvement.

Bottom-Up Approach

A grassroots security effort driven by systems administrators and technical staff without formal organizational direction or broad support.

Top-Down Approach

A security implementation model initiated by senior management who issue policies, procedures, and dictating goals and accountability.

Security SDLC (SecSDLC)

A methodology that adapts traditional Systems Development Life Cycle phases to integrate security design and operation into a coherent, systematic program.

Information System (IS)

The entire set of software, hardware, data, people, procedures, and networks necessary to use information as a resource in an organization.

Chief Information Officer (CIO)

The senior technology officer primarily responsible for advising senior executives on strategic planning related to information technology.

Chief Information Security Officer (CISO)

The officer primarily responsible for the assessment, management, and implementation of information security in the organization.

Data Owner

The organizational role responsible for the security and use of a particular set of information.

Data Custodian

The organizational role responsible for the storage, maintenance, and protection of information.

Data Users

End users who work with information daily to perform their job functions and support the mission of the organization.

Intellectual Property (IP)

Ownership of ideas and control over their tangible or virtual representation.

Information Extortion

An attack where an attacker steals information from a computer system and demands compensation for its return or non-disclosure.

Virus

Malicious code that attaches itself to other programs and replicates when the host program runs.

Worm

A self-replicating malicious code that spreads independently across networks.

Trojan Horse

A program that appears to be legitimate but carries a hidden malicious payload.

Hoax Attack

A social manipulation attack transmitting a false virus warning to induce user panic and destructive actions while malware executes undetected.

Back Door

A hidden entry point into a system or network that bypasses normal authentication mechanisms.

Brute Force Attack

A password attack that systematically tries every possible combination of characters until the correct password is found.

Dictionary Attack

A password attack targeting specific accounts using a predefined list of commonly used passwords.

Denial-of-Service (DoS) Attack

An attack that floods a target system with connection or information requests to overwhelm its ability to function.

Distributed Denial-of-Service (DDoS) Attack

A coordinated DoS attack launched simultaneously from multiple locations, often utilizing a botnet.

Man-in-the-Middle (MitM) Attack

An attack in which an attacker secretly intercepts, reads, or modifies network communication between two parties without their knowledge.

Spam

Unsolicited commercial email used as a vector for malicious payloads, phishing lures, and social engineering.

Mail Bombing

A variant of DoS attack where an attacker routes extremely large quantities of email to a target to overwhelm the mail server.

Timing Attack

An attack that measures subtle timing differences in cryptographic or computational operations to infer secret keys or internal data.

Social Engineering

The process of using social skills and psychological manipulation to convince individuals to reveal credentials or take insecure actions.

Sniffing

A passive network attack utilizing a packet sniffer to monitor and capture data traveling over a network.

Spoofing

A technique used to gain unauthorized access by assuming a trusted IP address, email address, or identity.

IP Spoofing

Crafting network packets with a forged source IP address to impersonate a trusted host, bypass access controls, or hide attack origin.

Phishing

An attempt to gain personal, financial, or credential information from an individual by posing as a legitimate and trustworthy entity, usually via email.

Spear Phishing

A highly targeted phishing attack directed at specific individuals or organizations, often personalized.

Whaling

Spear phishing specifically targeting senior executives or high-value individuals within an organization.

Smishing

A variant of phishing delivered via SMS or text messages.

Vishing

A variant of phishing conducted via voice calls or voicemail.

Pharming

The redirection of legitimate web traffic to an illegitimate website by corrupting DNS records or host files, even when the user types the correct URL.

DNS Cache Poisoning

A pharming attack in which an attacker injects false records into a DNS server's cache to redirect users to a fraudulent IP address.