What are some examples of managerial controls?, Periodic risk assessments, security planning exercises, and the incorporation of security into the organization’s change management, service acquisition, and project management practices, What are four security control categories?, Technical controls, operational controls, managerial controls, and physical controls, List the criteria that must be met for a compensating control to be satisfactory under PCI DSS., Controls must meet the intent and rigor of the original requirement and must provide a similar level of defense, and must sufficiently offset the risk that the original PCI DSS requirement addressed. Existing PCI DSS requirements cannot be considered as compensating controls if they’re already required for other assessed items, existing requirements may be considered as compensating controls if they are required for another area but are not required for the item under review., What are some examples of operational controls?, User access reviews, log monitoring, and vulnerability management, What are some examples of technical controls?, Firewall rules, access control lists, intrusion prevention systems, and encryption, Name all security control types, Preventive controls, detective controls, corrective controls, deterrent controls, compensating controls, and directive controls, What are some examples of physical controls?, Fences, perimeter lighting, locks, fire suppression systems, and burglar alarms, What are pressure sensors?, They detect a change in pressure. While not commonly deployed in most environments, they may be used when an organization needs to detect an object being moved or when someone is moving through an area using a pressure plate or pad., Describe how zero trust works., Zero trust presumes that there is no trust boundary and no network edge. Each action is validated when requested as part of a continuous authentication process and access is only allowed after policies are checked, including elements like identity, permissions, system configuration and security status, threat intelligence data review, and security posture., What are specific goals of confidentiality, integrity, and availability?, Confidentiality ensures that unauthorized individuals are not able to gain access to sensitive information; integrity ensures that there are no unauthorized modifications to information or systems, either intentionally or unintentionally; and availability ensures that information and systems are ready to meet the needs of legitimate users at the time those users request them., What is a bollard?, Bollards are posts or other obstacles that prevent vehicles from moving through an area. Bollards may look like posts, pillars, or even planters, but their purpose remains the same: preventing vehicle access., What are the disadvantages of guards?, Guards can be fallible, and social engineering attempts can persuade guards to violate policies or even to provide attackers with assistance. Guards are relatively expensive., What are the advantages of guards?, Guards can make decisions that technical control systems cannot, and they provide additional capabilities by offering both detection and response capabilities. Guards can validate an individual’s identity, ensure that they enter only the areas they are supposed to, and ensure that they have signed a visitor log and that their signature matches a signature on file or on their ID card., What are two types of advanced security camera capabilities?, Motion recognition and object detection, What is an access control vestibule?, An access control vestibule is a pair of doors that both require some form of authorized access to open. The first door opens after authorization, closes, and only after it is closed can the person who wants to enter provide their authorization to open the second door., What are infrared sensors?, They rely on infrared light, or heat radiation. They look for changes in infrared radiation in a room or space and alert when that change occurs., What are microwave sensors?, Microwave sensors use a baseline for a room or space that is generated by detecting normal responses when the space is at a baseline. When those responses to the microwaves sent out by the sensor change, they will trigger. They can detect motion through materials that infrared sensors cannot., What are three key objectives of cybersecurity programs?, Confidentiality, integrity, and availability, What term describes the unauthorized modification of information?, Alteration is the unauthorized modification of information and is a violation of the principle of integrity. Denial is the unintended disruption of an authorized user’s legitimate access to information., What is the primary goal of change management?, To ensure that changes do not cause outages., What are allow and deny lists?, An allow list allows you to build a list of software, applications, and other system components that are allowed to exist and run on a system. If they are not on the allow list, they will be removed, disabled, or will not be able to be installed. Deny lists are lists of software or applications that cannot be installed or run, rather than a list of what is allowed., What do many organizations use to coordinate changes to information systems?, Maintenance windows., What is the purpose of version control?, It ensures that developers and users have access to the latest versions of software and that changes are carefully managed throughout the release process., What is the function of a hardware security module (HSM)?, HSMs manage encryption keys and perform cryptographic operations efficiently., What are three key lengths allowed by the AES cipher and what are their corresponding number of encryption rounds?, 128‐bit keys require 10 rounds of encryption; 192‐bit keys require 12 rounds of encryption; and 256‐bit keys require 14 rounds of encryption., What are four fundamental goals of cryptography?, Confidentiality, integrity, authentication, and nonrepudiation., What is homomorphic encryption?, Homomorphic encryption technology allows encrypting data in a way that preserves the ability to perform computation on that data., What are two major categories of modern ciphers and what are their methods of operation?, Block ciphers operate on “chunks,” or blocks, of a message and apply the encryption algorithm to an entire message block at the same time. Stream ciphers operate on one character or bit of a message (or data stream) at a time., List some major strengths of asymmetric key cryptography., The addition of new users requires the generation of only one public‐private key pair; users can be removed far more easily from asymmetric systems; key regeneration is required only when a user’s private key is compromised; asymmetric key encryption can provide integrity, authentication, and nonrepudiation; key distribution is a simple process; and no preexisting communication link needs to exist., What are three techniques to verify the authenticity of certificates and identify revoked certificates?, Certificate revocation lists (CRLs), Online Certificate Status Protocol (OCSP), and certificate stapling, What are three tools that can be used in the data obfuscation process?, Hashing uses a hash function to transform a value in our dataset to a corresponding hash value. Tokenization replaces sensitive values with a unique identifier using a lookup table. Data masking partially redacts sensitive information by replacing some or all of sensitive fields with blank characters., Why might a certificate authority need to revoke a digital certificate?, The certificate was compromised (e.g., the certificate owner accidentally gave away the private key); the certificate was erroneously issued (e.g., the CA mistakenly issued a certificate without proper verification); the details of the certificate changed (e.g., the subject’s name changed); and the security association changed (e.g., the subject is no longer employed by the organization sponsoring the certificate)., What term is used to describe using cryptographic techniques to embed secret messages within another file, such as hiding a message within an image file?, Steganography is the art of using cryptographic techniques to embed secret messages within another file., What is the difference between symmetric and asymmetric cryptography?, Symmetric cryptosystems use a shared secret key available to all users of the cryptosystem. Asymmetric cryptosystems use individual combinations of public and private keys for each user of the system., What are three major functions provided by TPM chips?, Trusted Platform Module (TPM) chips are frequently used to provide built‐in encryption, and they provide three major functions: remote attestation, allowing hardware and software configurations to be verified; binding, which encrypts data; and sealing, which encrypts data and sets requirements for the state of the TPM chip before decryption., What are some of the attributes used in an X.509 certificate?, Version of X.509; serial number; signature algorithm identifier; issuer name; validity period; subject’s Common Name (CN); certificates may optionally contain Subject Alternative Names (SAN) that allow you to specify additional items (IP addresses, domain names, and so on) to be protected by the single certificate; and subject’s public key, Name two choices you need to make when you implement encryption, The algorithm to use to perform encryption and decryption; the encryption key to use with that algorithm, How does FDE work?, Full disk encryption (FDE) encrypts the disk and requires that the bootloader or a hardware device provide a decryption key and software or hardware to decrypt the drive for use., What is the substitution cipher?, A substitution cipher is a type of coding or ciphering system that changes one character or symbol into another., Name some tools we can use in the process of data obfuscation., Hashing, tokenization, and masking, What are cryptographic key management systems used for?, Cryptographic key management systems are used to store keys and certificates as well as to manage them centrally., What is data encryption?, Encryption technology uses mathematical algorithms to protect information from prying eyes, both while it is in transit over a network and while it resides on systems., What are HSMs?, Hardware security modules (HSMs) are typically external devices or plug‐in cards used to create, store, and manage digital keys for cryptographic functions and authentication, as well as to offload cryptographic processing., What is a cipher?, A method used to scramble or obfuscate characters to hide their value. Ciphering is the process of using a cipher to do that type of scrambling to a message., List some weaknesses of symmetric key cryptography., Key exchange is a major problem; symmetric key cryptography does not implement nonrepudiation; the algorithm is not scalable; and keys must be regenerated often, What are five basic requirements for a cryptographic hash function?, They accept an input of any length; they produce an output of a fixed length; the hash value is relatively easy to compute; the hash function is one‐way (meaning that it is extremely hard to determine the input when provided with the output); and the hash function is collision free (meaning that it is extremely hard to find two messages that produce the same hash value)., What are three main methods used to exchange secret keys securely?, Offline distribution, public key encryption, and the Diffie–Hellman key exchange algorithm, What are two distinct goals of digital signature infrastructure?, Digitally signed messages assure the recipient that the message truly came from the claimed sender. They enforce nonrepudiation. Digitally signed messages assure the recipient that the message was not altered while in transit between the sender and recipient. This protects against both malicious modification and unintentional modification., What is frequency analysis?, Frequency analysis involves looking at the blocks of an encrypted message to determine if any common patterns exist., What kinds of potential downfalls does disk encryption bring?, If the encryption key is lost, the data on the drive will likely be unrecoverable since the same strong encryption that protects it will make it unlikely that you will be able to brute‐force the key and acquire the data. Technical support can be more challenging, and data corruption or other issues can have a larger impact, resulting in unrecoverable data.

Domain1

by
Print
Embed

Leaderboard

Visual style

Options

Switch template

Continue editing: ?