Becker - ISC S3 Flashcards

Cybersecurity

The practice of protecting an organization’s IT infrastructure and critical data from bad actors by deploying a variety of technologies, internal control processes, and best practices to mitigate the business impact of attacks

Data Breach

When information is compromised and utilized without the authorization of the owner

Examples include ransomware, phishing, malware, and compromised passwords

Service Disruptions

An unplanned event that causes the general system or major application to be inoperable for an unacceptable length of time

Examples include malware, DDoS attacks, SQL injections, and password attacks

Cyberattack

Any type of malicious activity that targets computer information systems, infrastructures, computer networks, or personal computer devices, and attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself

Threat Agent

An internal or external attacker that could negatively impact data security through theft, manipulation, or control of sensitive information or systems

Examples include an attacker, threat actor, or hacker

Adversary

Actors with interests in conflict with the organization

They are incentivized to perform malicious actions against the organization’s cyber resources such as intercepting purchases, theft of data, tampering with hardware prior to installation, social engineering attacks, and more

Network-Based Attacks

Type of cyberattack in which the goal is to gain unauthorized access or disrupt operations for users

Infrastructure of a network is targeted, including switches, routers, servers, and cabling

Backdoors (Trapdoors)

Methods to bypass security access procedures by creating an entry and exit point to a network that is undocumented

Often installed by system owners so they can bypass security measures to gain quick access

May be intentionally installed or unintentionally left available to product defects

Covert Channels

Mechanisms used to transmit data using methods not originally intended for data transmission by the system designers

Violate the entity’s security policy but do not exceed the entity’s access authorization, so they can communicate data in small parts

Two types: storage and timing channels

Storage Channel

Type of covert channel in which data is transmitted by modifying a storage location, allowing another party with lower security permission to access the data

Timing Channel

Type of covert channel in which the delay (or gaps) in transmitting data packets is used to hide the transmission

Buffer Overflows

Type of network-based cyberattack in which attackers overload a program’s buffer, the temporary storage, with more input than it is designed to hold

May cause the program to overwrite the memory of an application or crash

The attacker can then inject malicious code or take control of a system

Denial-of-Service (DoS) Attacks

Type of network-based cyberattack in which an attacker floods a system’s network by congesting it with large volumes of traffic that are greater than the bandwidth it was designed to handle

This excess volume consumes the network’s resources so that it cannot respond to service requests, leaving it vulnerable to network protocol or application exploitation

Distributed Denial-of-Service (DDoS) Attacks

When multiple attackers or compromised devices are working in unison to flood an organization’s network with traffic

These network-based cyberattacks manipulate the operation of network equipment and services in such a way that may be more powerful than a traditional DoS attack

Man-in-the-Middle (MITM) Attacks

Type of network-based cyberattack in which the attacker acts as an intermediary between two parties intercepting communications, acting as a legitimate entity within a typical secure session

As information is passed between the two parties, the attacker can read or redirect traffic

Port Scanning Attacks

Attackers scan networks for open ports to find vulnerabilities that can be exploited so that they can gain unauthorized access to a company’s network

This network-based cyberattack focuses on logical ports that are used for protocols such as TCP port 80, which is one of the most common ports used on the internet

Ransomware Attack

Type of network-based cyberattack that typically comes in the form of malware that locks a user or company’s operating systems, applications, and the ability to access data until a ransom is paid

Reverse Shell Attack

Type of network-based cyberattack in which a victim initiates communication with an attacker from behind a company's firewall so that the attacker can bypass the firewall and any other network safeguards and remotely control the victim’s machine

Replay Attack

A type of MITM cyberattack (network-based) in which a cybercriminal eavesdrops on a secure network communication, intercepts it, and then “replays” the message at a later time to the intended target to gain access to the network and the data that is behind the firewall

Return-Oriented Attack

Type of network-based cyberattack that uses a sophisticated technique that utilizes pieces of legitimate original system code (each a gadget) in a sequence to perform operations useful to the attacker

Each gadget ends with a “return” instruction causing a series of code to execute and carry out complex operations

Spoofing

The act of impersonating someone or something to obtain unauthorized system access by using falsified credentials or imitating a legitimate person or entity by using fake IP addresses, domains, or email addresses

Type of network-based cyberattack

Application-Based Attacks

Type of cyberattack that targets specific software or applications (desktop or web) such as databases or websites to gain unauthorized access or disrupt functionality

SQL Injection

Type of application-based cyberattack in which an attacker injects malicious SQL code into existing SQL code on a company’s website to gain unauthorized access to a company’s data

Cross-Site Scripting (XSS)

Type of application-based cyberattack in which the attacker injects code to a company’s website that attacks users visiting the company’s website

Race Condition

Type of application-based cyberattack in which an attacker exploits a system or application that relies on a specific sequence of operations

Mobile Code

Type of application-based cyberattack in which a software program is designed to move from computer to computer to “infect” other applications by altering them in some way to include a version of the code

Overwrite Virus

Type of virus that deletes or overwrites information in the file infected

Multi-Partite Virus

Type of virus that uses a mixture of infection methods to infect files, trying different ways to infect a file if others fail

Parasitic Virus

Type of virus that launches when an application that has the virus launches and the same rights as the program being launched are given to the virus

Polymorphic Virus

Type of virus that mutates by changing its structure so that it can avoid detection

Resident Virus

Type of virus that installs a copy of itself on a computer’s memory

Host-Based Attack

Type of cyberattack that targets a single host such as a laptop, mobile device, or a server to disrupt functionality or obtain unauthorized access

Brute Force Attack

Type of host-based cyberattack that is a password-cracking scheme in which an attacker uses an automated program that attempts to guess a password

The program tries all possible combinations of potential passwords based on a preset algorithm

Keystroke Logging

Type of host-based cyberattack in which the attacker tracks the sequence of keys pressed by a user on a keyboard to collect confidential data such as usernames, passwords, and personal information

Malware

Software or firmware intended to perform an unauthorized process that has an adverse impact on the confidentiality, integrity, or availability of an information system

Common examples are viruses, worms, Trojan horses, adware, spyware, and other code-based programs that infect a host

Rogue Mobile Apps

Type of host-based cyberattack that involves the use of a malicious app that appears legitimate

A fraudulent party creates a mobile application that is installed by a victim unsuspectingly and that app then steals information, gives the attacker unauthorized access, or executes some other malicious act

Social Engineering Attack

Type of cyberattack that involves the use of psychological manipulation or deception to get employees to divulge sensitive information, provide unauthorized access, or assist an attacker in committing fraud

Phishing

Type of social engineering cyberattack in which the attacker uses authentic looking, but bogus, emails that request information from users or direct them to a fake website that requests information

Spear Phishing

Form of phishing that targets employees in a corporate entity by posing as a legitimate department or employee, such as human resources or the IT director

The goal is to obtain confidential information such as usernames, passwords, or personal data that can be used for exploitation

Business Email Compromise (BEC)

Type of social engineering cyberattack in which the attacker targets executives and other high-ranking individuals

Form of phishing

Pretexting

Type of social engineering cyberattack in which the attacker creates a fake identity or scenario so that the employee has a sense of urgency to act

Similar to BEC and spear phishing

Catfishing

Type of social engineering cyberattack in which the attacker creates a fake online persona that is used to lure a victim into a personal relationship with a fraudster

Pharming

Type of social engineering cyberattack in which a victim enters personal information into a website or portal that imitates a legitimate website

Often used in combination with phishing

Vishing

Type of social engineering cyberattack in which the attacker uses the telephonic system Voice over Internet Protocol (VoIP)

Normally involves a spoofed or fraudulent caller ID that is tied to a legitimate business or person

Physical (On-Premises) Attack

Type of cyberattack that is a security breach carried out on an organization’s premises or performed in some way that physically involves a bad actor gaining control of sensitive data, hardware, and/or software

Intercepting Discarded Equipment

Type of physical cyberattack in which fraudsters obtain access to outdated or discarded equipment in the trash or through companies that accept discarded equipment and steal sensitive data stored on such devices

Piggybacking

Type of physical cyberattack in which the attacker uses an authorized person’s access to gain entrance to a physical location or electronic access

Tampering

Type of physical cyberattack in which the attacker gains physical access to a company’s IT infrastructure and modifies the way its network collects, stores, processes, or transmits data

Theft

Type of physical cyberattack in which the attacker physically steals data, hardware, or software

Supply Chain Attack

Type of cyberattack that targets the production and distribution of goods within a supply chain so that there are larger disruptions in the normal operations of a company, government, or other entity

Embedded Software Code

Type of supply chain cyberattack in which the attacker inserts code into prepackaged software or firmware being sold to a company that later installs the software after purchase

Foreign-Sourced Attack

Type of supply chain cyberattack in which governments may use products sold to other countries to conduct surveillance or deliver malicious code

Pre-Installed Malware on Hardware

Type of supply chain cyberattack in which the attacker installs malware on devices that will be used by computers in a supply chain, such as USB drives, cameras, or phones

Vendor Attack

Type of supply chain cyberattack in which the attacker targets key vendors so that the normal production of goods or business operations is disrupted

Watering Hole Attack

Type of supply chain cyberattack in which fraudsters identify websites of suppliers, customers, or regulatory entities that are known to be used by several companies or even entire industries

The attackers then look for weaknesses at that third party that can be used to deliver malware, steal data, or obtain unauthorized access

Reconnaissance

First stage of a cyberattack in which attackers discover and collect as much information about the target IT system as possible

Gaining Access

Second stage of a cyberattack in which the information collected in the previous steps is used to gain access to the target of an attack using a variety of techniques

Escalation of Privileges

Third stage of a cyberattack in which attackers attempt to gain higher levels of access

Maintaining Access

Fourth stage of a cyberattack in which the attacker remains in the system for a sustained period of time until the attack is completed and looks for alternative ways to prolong access or return later

Network Exploitation/Exfiltration

Fifth stage of a cyberattack in which attackers proceed with the objective of disrupting system operations by stealing sensitive data, modifying data, disabling access to systems or data, or performing other malicious activities

Covering Tracks

Sixth and final stage of a cyberattack that occurs while the attack is in progress or after the attack is completed and involves the attacker concealing the entry or exit points in which access was breached

Cloud Computing

Store, use, process, and share data, software, and applications without owning or managing the resources on premises

SOC 2 Engagements

Independent audits of management’s attestation regarding the cloud service provider’s controls and other claims made by management regarding security over their customer’s data, privacy, and confidentiality

Cloud Controls Matrix

Provides security principals to guide cloud vendors, assists prospective cloud customers in assessing the overall security risk of a cloud provider, and utilizes industry-accepted security standards, regulations, and controls frameworks such as COBIT, NIST, etc

Internet of Things (IoT)

A class of smart devices connected to the internet that provide automation and remote control for other devices in a home or office setting such as cameras, tablets, wearable devices, phones, and alarm systems

Threat Modeling

The process of identifying, analyzing, and mitigating threats to a network, system, or application

The goal is to understand all risks a system could face and develop controls and countermeasures to minimize the impact of a risk or to try and prevent it from happening

PASTA

Seven stage hreat model that focuses on risks and countermeasures that are prioritized by the value of the assets being protected

VAST

Threat model based on the Agile project management methodology

Its goal is to integrate threat management into a programming environment on a scalable basis

STRIDE

Threat model developed by Microsoft that is used for assessing threats related to applications and operating systems

COSO

An advisory group that provides guidance on internal controls, fraud deterrence, and risk management

Operational, Reporting, Compliance (ORC)

What are the three groups that the COSO framework classifies internal control objectives into?

Control Environment, Risk Assessment, Information/Communication, Monitoring Activities, Existing Control Activities (CRIME)

What are the five components of the COSO internal control framework?

Acceptable Use Policy (AUP)

A control document that is created by an organization to regulate and protect technology resources by assigning varying levels of responsibilities to job roles, listing acceptable behaviors by employees and vendors, and specifying consequences for those who violate it

Bring-Your-Own-Device (BYOD) Policy

Policy that may have some of the same elements as an AUP but will address monitoring and enforcement of actions on personal devices, ownership of data on the device, personal liability and indemnification, and restricted activities and application downloads

Standard Operating Procedures (SOPs)

Lowest level of documentation that provide detailed instructions on how to perfrom specific security tasks or controls

Typically involve a combination of systems, software, and physical actions so that the goals of the security policy and standards are achieved

Network

A system of physical and virtual devices that are connected using wired cables or wireless technology that communicate using a mixture of different protocols so that users can send, receive, and store data

Access Point (AP)

A wireless connection point for users to directly connect to a wired network using wireless-enabled devices

Bridge

Connects separate networks that use the same protocol, even if those networks have different topologies or transmission speeds

Operate at the data link layer of a network

Gateway

Connect multiple networks that use different protocols, translating one protocol to another so that the two networks can interact

Can operate in all layers of a network but frequently operate in the application layer

Hubs

Connection points that link multiple systems and devices using the same protocol within a single network

Receive data packets and forward them to all other devices

Switches

Similar to hubs, but instead of broadcasting received signals to every other networked device, switches only route traffic to target destinations, connecting various devices within a network for most modern organizations

Routers

Devices that control data flow on a network using the same protocol by receiving incoming data packets and forwarding those to the correct destination based on IP addresses

Modem

Device that modulates between digital information and an analog signal to support networks

They are most commonly used to connect computers to the internet

Proxies

A form of gateway that does not translate protocols but rather acts as a mediator that performs functions on behalf of another network using the same protocol instead of just connecting the networks

Servers

Devices that support computers and networks by performing different core functions

Signal Modifiers

Devices such as amplifiers, concentrators, or repeaters receive signals and then modify them by increasing the signal strength, combining multiple signals, or simply regenerating the signal

Network Segmentation (Isolation)

The process of controlling network traffic so that it is either inaccessible or separated from outside communications or other segments within an organization’s own network

Firewall

Physical devices, software, or both that filter and monitor incoming and outgoing network traffic to a public network to block malicious activity from attackers

Service Set Identifier (SSID)

The name assigned to a wireless network

Broadcast by a wireless access point within a certain range so that wireless-enabled devices can connect

Virtual Private Network (VPN)

A virtual network built on top of existing physical networks that provides a means of secure communications using encryption protocols such as tunneling or Internet Protocol Security (IPsec)

Tunneling

A process in which the data, or packets, in one protocol are encapsulated in packets within a different protocol, which creates a tunnel of protection

IPsec

Uses cryptography to encrypt communications, provide access control, and authenticate using IP protocols

Wi-Fi Protected Access (WPA)

A security protocol that encrypts wireless internet connections between devices such as routers, switches, and mobile devices

Endpoint Security

The notion that every device, also called hosts, connected to a network should have some form of local security that is separate from any other security measure in place on the network or communications channel

Examples include antivirus and malware screening software, authentication mechanisms, auditing software, local host firewalls, prevention systems, etc

System Hardening

A multipronged comprehensive security approach that reduces risk by minimizing the number of access points through which a company can be attacked

Media Access Control (MAC) Filtering

Form of filtering in which an access point blocks access to unauthorized devices using a list of approved MAC addresses

Zero Trust

Assumes that a company’s network is always at risk, even after a user has been authenticated

Focuses on continuous authentication at every point of a user’s interaction with a network

Zero-Trust Architecture (ZTA)

Designed to prevent data breaches and limit internal lateral movement by implementing a set of system design principles and a coordinated cybersecurity and system management strategy

Least Privilege

Notion that users and systems are granted the minimum authorization and system resources needed to perform a function (data focused)

Need-to-Know

Principle that follows the idea that employees are only given what they must know to perform their job (system focused)