Chapter 11 Security+ SYS-701

What does end of life hardware mean?

No longer sold, but might still receive support

What does secure boot do?

Had DB of trusted signatures and only allows the trusted/signed software to boot

What does measured boot do?

Records/checks boot components using hashes + TPM to detect tampering.

What does remote attestation mean?

Verifies system config uses TPM chip

What is secure enclave?

Secure area inside a CPU that protects encryption keys, biometrics, etc. Like a small room in a house

What is PUF?

Physically Unclonable Function - unique hardware fingerprint for a chip used to identify/authenticate a device or generate keys.

What is a TPM chip used for?

Protects/security-verifies an individual system

What does an HSM chip do?

Creates, stores, manages crypto keys; can offload crypto

What is KMS used for?

Service for centrally managing keys/secrets

What is signature based malware detection?

Detects known malware based on their signautre/hashes

What is heuristic based malware detection?

Observers how software behaves and determines if it is malware or not

What is EDR?

Endpoint detection and response - monitors endpoints and collects data to detect sus activity

What is XDR?

Extended Detection and Response - Broader edr, uses data from different apps and email and etc.

What is dlp?

Data loss prevention - software that can classify and label data and prevents data from being stolen or exposed

What is the concept of hardening?

Reducing the attack surface, so getting rid of things that aren’t needed

What is transparent encryption?

Encryption while the system is running, least noticeable

What is the specialty of SELinux?

It uses MAC (mandatory access control) - doesn’t allow users to change the perms themselves

What is an embedded system?

A computer built into another device, like medical devices, vehicles, etc.

Difference between IPS and HIPS?

IPS = blocks attacks

HIPS = blocks attacks on the host while services remain available

What is a RTOS?

Real-time operating system - designed to be fast

What is an ICS?

Industrial control system

What is a SCADA?

system architecture for monitoring and controlling large/complex industrial processes.

What is RTU?

Collects data from or controls remote devices.

What is degaussing?

strong electromagnetic field destroys data on magnetic media.

How can wear levelling cause an issue when wiping flash memory?

Wear levelling spreads write loads evenly across the drive. This is why it is important to use secure erase instead of traditional data

What is enumeration?

Scanning to discover assets that may be missing from the inventory.

POrts