terminology-information security

defense-in-depth

Employing multiple layers of controls to avoid a single point-of-failure.

time-based model of security

Implementing a combination of preventive, detective, and corrective controls that protect information assets long enough to enable an organization to recognize that an attack is occurring and take steps to thwart it before any information is lost or compromised.

authentication

Verifying the identity of the person or device attempting to access the system.

biometric identifier

A physical or behavioral characteristic used as an authentication credential.

multifactor authentication

The use of two or more types of authentication credentials in conjunction to achieve a greater level of security.

multimodal authentication

The use of multiple authentication credentials of the same type to achieve a greater level of security.

authorization

The process of restricting access of authenticated users to specific portions of the system and limiting what actions they are permitted to perform.

access control matrix

A table used to implement authorization controls.

compatibility test

Matching the user’s authentication credentials against the access control matrix to determine whether that employee should be allowed to access that resource and perform the requested action.

vulnerability scanners

Automated tools designed to identify whether a given system possesses any unused and unnecessary programs that represent potential security threats.

hardening

The process of modifying the default configuration of endpoints to eliminate unnecessary settings and services.

border router

A device that connects an organization’s information system to the Internet.

firewall

A special-purpose hardware device or software running a general-purpose computer that controls both inbound and outbound communication between the system behind the firewall and other networks.

demilitarized zone

A separate network located outside the organization’s internal information system that permits controlled access from the Internet.

routers

Special purpose devices designed to read the source and destination address fields in IP packet headers to decide where to send (route) the packet next.

access control lists

Sets of IF-THEN rules used to determine what to do with arriving packets.

packet filtering

A process that uses various fields in a packet’s IP and TCP headers to decide what to do with the packet.

deep packet inspection

A process that examines the data in the body of a TCP packet to control traffic, rather than looking only at the information in the IP and TCP headers.

intrusion prevention systems

Software or hardware that monitors patterns in the traffic flow to identify and automatically block attacks.

endpoints

Collective term for the workstations, servers, printers, and other devices that comprise an organization’s network.

exploit

A program designed to take advantage of a known vulnerability.

patch

Code released by software developers that fixes a particular vulnerability.

patch management

The process of regularly applying patches and updates to software.

fault tolerance

The capability of a system to continue performing when there is a hardware failure.

cold site

literally just a building with no ethernet, or internet, or wires or anything. cheaper back up plan if you need to relocate, but will take much longer to get the business up and running again

hot site

back up building that has ethernet / internet/ laptops/ electronics/ etc. more expensive backup, but will get the company up and running a lot faster than a cold site (but still slower than a real time mirroring plan)

what is the difference between a (disaster recovery plan) DRP and a (business continuity plan) BCP

DRP: only relative to getting the IT back up and running

BCP: relative to the whole business process getting up and running including IT, people, physical buildings, manufacturing processes, etc

uninterruptible power supply (UPS)

An alternative power supply device that protects against the loss of power and fluctuations in the power level by using battery power to enable the system to operate long enough to back up critical data and safely shut down.

what is ghe difference between an incremental backup system and a differential backup system and full backup

incremental only backs up the things that havent been backed up (think of google photos)

differential literally backs up EVERYTHING all the way to the beginning every time

full backup Exact copy of an entire database

deduplication

A process that uses hashing to identify and backup only those portions of a file or database that have been updated since the last backup.

recovery point objective (RPO)

The amount of data the organization is willing to reenter or potentially lose.

real time mirroring

Maintaining complete copies of a database at two separate data centers and updating both copies in real time as each transaction occurs.

recovery time objective (RTO)

The maximum tolerable time to restore an organization’s information system following a disaster, representing the length of time that the organization is willing to attempt to function without its information system.

archive

A copy of a database, master file, or software retained indefinitely as a historical record, usually to satisfy legal and regulatory requirements.

what is the difference between a recovery point objective (RPO) and a recovery time objective (RTO)?

RPO- how much data you are willing to lose (how much defense do you need to set up BEFORE the problem)

RTO- when do we get the system back up and running (the programs that are in place for AFTER the problem occurs)