Cybersecurity Exam 1

Computer Security

The protection of items you value, called the assets of a computer or computer system

Vulnerability

A weakness in the system that could be exploited to cause harm

Threat

A set of circumstances that has the potential to cause loss or harm

Attack

A human who exploits a vulnerability

Control

An action, device, procedure, or technique that removes or reduces a vulnerability

Confidentitality

The ability of a system to ensure that an asset is viewed only by authorized parties

Integrity

The ability of a system to ensure that an asset is modified only by authorized parties

Availability

The ability of a system to ensure that an asset can be used by any authorized parties

Nonrepudiation/Accountability

The ability of a system to confirm that a sender cannot convincingly deny having sent something

Authentication

The ability of a system to confirm the identity of a sender

Auditability

The ability of a system to trace all actions related to a given asset

Random Attack

The attacker wants to harm any computer or user

Directed attack

The attacker intends to harm specific computers

Common Vulnerability Scoring System (CVSS)

A standard measurement system that allows accurate and consistent scoring of vulnerability impact

Cyberthreat

A threat not just against a single computer but against many computers that belong to a network

Cyberspace

The online world of computers, especially the internet

Cybercrime

An illegal attack against computers connected to or reached from their network, as well as their users, data, services, and infrastructure

Harm

The negative consequences of an actualized threat

Risk management

Choosing which threats to control and what resources to devote to protection

Residual risk

The risk that remains uncovered by controls

Method

The skills, knowledge, tools, and other things with which to perpetrate the attack

Opportunity

The time and access needed to execute an attack

Motive

Reason to want to attack

Attack surface

The systems full set of vulnerabilities — actual and potential

Physical controls

Stop or block an attack by using something

Procedural/Administrative controls

Use a command or agreement that requires or advises people how to act

Technical controls

Counter threats with technology (hardware or software)

Overlapping controls

More than one control or more than one class of control to achieve protection

Types of Attackers

Individuals, worldwide groups, organized crime, terrorists

Nonhuman threats

natural disasters like fires or floods; loss of electrical power; failure of a component such as a communications cable, processor chip, or disk drive; or attack by a wild animal

Nonmalicious threats

Accidentally spilling a soft drink on a laptop, unintentionally deleting a text, inadvertently sending an email message to the wrong person, carelessly typing 12 instead of 21 when entering a phone number, or clicking [yes] instead of [no] to overwrite a file

Identification

The act of asserting who a person is

Authentication mechanisms

Something the user has (key fob, ID card), something the user knows (password, PIN), something the user is (facial recognition, finger or voice scan)

False positive

Incorrectly confirming an identitiy 

False negative

Incorrectly denying an identity

Receiver operating characteristic (ROC) curve

A graphical representation of the trade-off between the false negative and false positive rates

Exhaustive/Brute force attack

The attacker tries all possible passwords, usually in some automated fashion

Biometrics

Biological properties, based on some physical characteristics of the human body

Passive token

Contents of the token never change

Active token

Can have some variability or interaction with its surroundings

Static token

The value remains fixed

Dynamic token

One whose value changes

Skimming

The use of a device to copy authentication data surreptitiously and relay it to an attacker

Single sign-on process

An umbrella procedure to which you log in once per session; the umbrella procedure maintains your identities and authentication codes for all the different processes you access

Subject

Human users, often represneted by surrogate programs running on behalf of the users

Object

Things on which an action can be performed: Files, tables, programs, memory objects, hadrware devices, strings, data field, network connections, and processors

Access mode

Any controllable actions of subjects on objects, including read, write, modify, delete, execute, create, destroy, copy, export, import

Domain

The collection of objects to which the process has access

Symmetric encryption

One key encrypts and decrypts

Asymmetric encryption

One key encrypts, a different key decrypts

Block cipher

Encrypts a group of plaintext symbols as a single block

Access control

Limiting who can access what in what ways

Effective policy implementation

Check every access right periodically, enforce least privilege, verify acceptable usage

Limited privilege

The act of restraining users and processes so that any harm they can do is contained in some way, so it is not likely to be catastrophic

Capability

An unforgeable token that gives the possessor certain rights to an object

Role-based access control

Associate privileges with groups, such as all administrators can do this or candlestick makers are forbidden to do that

Encryption - encode, encrypt, encipher

The process of encoding a message so that its meaning is not obvious

Decryption - decode. decrypt, decipher

The reverse process, transforming an encrypted message back into its normal, original form

Cryptography

General designation for the field of designing, analyzing, and using algorithms for encryption and decryption

Cryptosystem

A system for encryption and decryption

Plaintext

The original form of a message

Ciphertext

Encrypted form

Keyless cipher

An encryption scheme that does not require the use of a key

Cryptanalyst

Studies encryption and encrypted messages

Cryptology

The research into and study of encryption and decryption

Work factor

The difficulty of breaking an encryption

Collision

Two inputs that produce the same output

Program flaw

Can be a fault affecting the correctness of the programs result — that is, a fault can lead to a failure

Failure

A departure from the systems required behavior

Buffer

A space in memory in which data can be held

Buffer overflow

Occurs when a program exceeds the space allocated for the buffer

White hat hacker

Someone who find flaws in products and reports them to the developer or other proper authorities to have the flaws fixed

Black hat hacker

Does the searching for flaws but uses them maliciously, either exploiting them or selling them on the black market

Program counter

A pointer or register that indicates the next instruction

Local data

Data used strictly within one procedure

Shared/common/global data

Shared between two or more procedures

Stack

A key data structure necessary for interchange of data between procedures

Stack frame

Data group of parameters, return address, and stack pointer

Stack smashing

Attacker wants to overwrite stack memory in a purposeful manner

Data driven attack

The data is the mechanism causing harm

Static code analyzer

Analyzes source code to detect unsafe conditions

Backdoor/trapdoor

An undocumented access point

Malicious code/rogue programs/malware

General name for programs or program parts planted by an agent with malicious intent to cause unanticipated or undesired effects

Virus

A program that can replicate itself and pass on malicious code to other nonmalicious programs by modifying them

Transient virus

Has a life span that depends on the life of its host; the virus runs when the program to which it is attached executes, and it terminates when the attached program ends

Resident virus

Locates itself in memory; it can then remain active or be activated as a stand-alone program, even after its attached program ends

Worm

A program that speads copies of itself through a network

Bot (short for robot)

A kind of worm used in vast numbers by search engine hosts like Bing and Google; armies run on any computers on which they can install themselves; they scan acessible web content continuously and report back to their controller any newly found content

Trojan horse

Malicious code that, in addition to its primary effect, has a secind, nonobvious, malicious effect

Rabbit

Code that replicates itself without limit, to exhaust resources

Malicious code infection - harm

How they affect users and systems

Malicious code infection - transmission and propogation

How they are transmitted and replicate, and how they cause further transmission

Malicious code infection - activation

How they gain control and install themselves so that they can reactivate

Malicious code infection - stealth

How they hide to avoid detection

Virus hoaxes

Messages falsely warning of a piece of malicious code, apparently to cause receivers to panic and forward the message to contacts, thus spreading the panic

Destructive

This type of code corrupts files, deletes files, damages software, or executes commands to cause hardware stress or breakage with no apparent motive other than to harm the recipient

Commercial or criminal intent

An infection of this type tries to take over the recipients computer, installing code to allow a remote agent to cause the computer to perform actions on the agents signal or to forward sensitive data to the agent

Polymorphic virus

A virus that can change its appearance

Countermeasures

Avoiding points of contamination and blocking avenues of vulnerability during the entire process

Encapsulation

Hides a components implementation details, but it does not necessarily mean complete isolation