Security Principles and Cryptography

Flashcards covering key concepts related to security principles, cryptography, and various technical processes.

KISS Principle (Economy of Mechanism)

Security mechanisms should be simple and small as possible.

Open Design

The principle that security software code is made public for review.

Data sent over HTTP

Plaintext.

In cryptography, what do algorithms and keys represent?

Algorithms = process, Keys = secret values.

Caesar cipher

An example of symmetric encryption.

False statement about Symmetric encryption

Uses public and private key pair.

Asymmetric keys

If public encrypts, then only private key decrypts.

Cryptanalysis

Breaking encrypted data without the key by studying patterns.

Correct statement about hashing

One-way, not reversible.

False statement about hashing

Users directly see and use hashing.

Comparison of hashing vs encryption

Encryption is reversible, hashing is one-way.

Password storage in a database

Salt + hashed password.

Randomness in systems

Uses entropy from unpredictable sources.

Appropriate hashing algorithm for password storage

Slow hashing.

Least access account if compromised

Standard user.

Windows Time service account

Local Service.

Reason DHCP Client runs under Network Service

Needs network access but limited privileges.

Internal OS identification of logged-in user

SID (Security Identifier).

Difference between program and process

Process = running program, Program = file.

Ensures Chrome & Word run without interference

Process Isolation.

Code sent by attacker to trigger a flaw

Exploit.

Type of exploit for gaining admin access from normal user

Privilege escalation.

Vulnerability type used by Stuxnet

Zero-day vulnerability.

Reason Khalil did not receive Facebook bug bounty

Broke disclosure rules.

CVE identifier

A unique identifier assigned to a confirmed vulnerability.

High CVSS score means actively exploited

False.

Process existence without a program

True.

Using salt with hashing ensures identical hashes for identical passwords

False.

Speed comparison of symmetric vs asymmetric encryption

Symmetric encryption is faster.

Killing a process effect on the program

Killing a process does not necessarily remove the program from the system.