Work > chap 4 - Security architecture and engineering > Flashcards

chap 4 - Security architecture and engineering Flashcards

(67 cards)

Study These Flashcards
1
Q

Security engineering : what are the technical processes

A
  1. business & mission analysis process -> the scope
  2. Stakeholder need & requirement definition process -> security requirements
  3. system requirements definition process -> translate sec requirements to system requirements
  4. Architecture definition process -> security view of system architecture
  5. design definition process -> security-related data and information about system
  6. system analysis process -> essential data & info for tech understanding of the security aspects
  7. implementation process
  8. integration process
    verification process
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

technical management process

A
  1. project planning
  2. project assessment & control
  3. decision mgmt
  4. risk mgmt
  5. configuration mgmt
  6. information mgmt
  7. measurement
  8. quality assurance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are the enabling process

A
  1. lifecycle model mgmt
  2. infrastructure mgmt
  3. portfolio mgmt
  4. human resources mgmt
  5. quality mgmt
  6. knowledge mgmt
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what are the agreement process

A
  1. acquisition
  2. supply
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what are the 4 key security models (architecture)

A
  1. state machine model
  2. information flow model
  3. non-interference model
  4. ring model
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is the security ring model

A

Ring 0 -> OS & security kernel
Ring 1 -> device driver
Ring 2 -> system utilities -> admin
Ring 3 -> Applications -> users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security architecture for establish a secure system

A
  1. privileged mode instructions
  2. processor states
  3. memory mgmt
  4. abstraction layers
  5. data & code space isolation & code & data segregation
  6. file system attribute
  7. security kernel
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what are the key extensions to basic security architecture

A
  1. access control
  2. virtual machine
  3. sandbox environment
  4. cryptographic systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is the fundamental building block of info system architecture

A

Service model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what are the types of service models (systems)

A
  1. client based system
  2. server based system
  3. Database system
  4. Industrial control system (ICS)
  5. embedded systems
  6. Internet of things IoT)
  7. distributed systems
  8. Virtualized systems
  9. cloud based system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

five essential characteristics of cloud computing

A
  1. on-demand self-service
  2. broad network access
  3. resource pooling
  4. rapid elasticity
  5. measured services
    (6. multi-tenancy)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what are the main cloud services models

A
  1. software as a service (SaaS)
  2. Platform as a Service (PaaS)
  3. Infrastructure as a Service (IaaS)
  4. Network as a Service (NaaS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what are the cloud deployments models

A
  1. private cloud
  2. community cloud
  3. public cloud
  4. hybrid cloud
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what are cloud vulnerabilities & mitigations

A

vulnerabilities:
- exposure to external communication & access
- misconfiguration
- becoming outdated

mitigation:
- stron SLA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are microservices vulnerabilities & mitigations

A

vulnerabilities:
- authorization
- quality of service
- denial of service

mitigation:
- IAM
- containers
- API gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

containerization vulnerabilities & mitigations

A

vulnerability
- insecure image
- excessive privilege
- unrestricted comms
- rogue malicious process
- improper isolation

mitigation
- image mgmt
- immutable infra
- granular sec
- micro segmentation
- proper config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Serverless architecture vulnerabilities & mitigations

A

vulnerability:
- malicious injection into function
- insecure conf.
- cross execution’s data persistency

mitigation
- train staff for conf
- secure coding practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

High performance computing sys vulnerabilities & mitigations

A

vulnerabilities:
- latency constraints
- improper workload

mitigation
- proper architecture design
- monitoring & log practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

edge & Fog computing vulnerabilities & mitigations

A

vulnerability
- network compromise
- increase attack surface

mitigation
- network monitoring
- incident response
- asset inventory
accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

industrial control system vulnerabilities & mitigations

A

vulnerabilities:
- limited functions
- limited protection
- long service life
- misconf & misuse
- susceptible DoS
- attack have physical effect
- remote/unattended locations

mitigation
- isolated network infra
- access control & monitoring
- high segmentation & microsegmentation
- protect comms chanels
- configuration controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

type of industrial control systems

A
  1. supervisory control & data acquisition (SCADA)
  2. Distributed control system (DCSs)
  3. Programmable logical controllers (PLCs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

embedded system vulnerabilities & mitigations

A

vulnerabilities
- programming errors
- web-based vulnerability
- weak access control
- poor crypto
- reverse engineering
- malware
- eavesdropping

mitigations
- risk assessment
- patching & updating
- secure coding technique
- implementing 3rd party risk mgmt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

IoT vulnerabilities & mitigations

A

vulnerabilities
- DoS
- Device security
- crypto security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

distributed system vulnerabilities & mitigations

A

vulnerabilities
- lack of monitoring
- lack of access control

mitigation
- IAM
- IDS/IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
virtualized system vulnerabilities & mitigations
vulnerabilities - image mgmt (VM sprawl) - VW escape - underlying hardware weakness - knowledge gap mitigation - IAM - change mgmt
26
why is cryptography critical to security
confidentiality integrity authenticity availability non-repudiation access control
27
what is "work factor" in cryptography
the cost of breaking the code must be higher than the reward
28
key challenge of cryptography
key managment
29
type of cryptography
1. symmetric 2. asymmetric
30
what are the cryptosystem components (steps)
1. plaintext 2. encryption algorithm --> using an encryption Key 3. ciphertext
31
what are the critical properties of Key strengh
1. No collisions 2. difficult to invert 3. large key space -> minimal or no key space clumping 4. deterministic decrytion
32
what is the difference between block VS. Stream processing
Stream mode encryption: encrypt one symbol of the plaintext input at a time block mode encryption: process fixed length groups of symbols (block size measure in 8 bites)
33
Asymmetric encryption
uses 2 keys (public & private) advantage: digital signature & no key exchange issue: slower & longer Key type of encryption: - RSA 2048 - Elgamal - ECC (ecliptic) - Diffie helmann
34
Symmetric encryption
uses a single key advantage: faster & shorter key issue: key exchange type of encryption: - DES (56) -> not secured anymore - 3DES (168) - AES (128/ 192 / 256) - Rijindal - RC 5 / RC 6 -> RC 4 is stream encryption - Blowfish - twofis - IDEA - CAST - SAFER
35
Hashing
it is a 1 way math process - variable inputs - fixed length outputs - unique inputs generate a unique output advantage: no key required use case: concealment and integrity (check) types of hashing: - MD-5 (128) -> 32 character - SHA1 (160) -> 40 character - SHA2 (224/512) - SHA3 (512) - HAVAL - RIPEMD 160
36
what are the key requirements of Hashing
1. uniformly distributed 2. collision resistant 3. impossible to invert 4. computed on full message 5. deterministic
37
what is a distributed ledger (blockchain)
decentralized register of transactions that is protected by and graph-linked together with cryptographic controls --> rely on asymmetric crypto
38
what is the Kerckoff's principle about encryption
if everything is known except the encryption key, then the cipher must be safe
39
on which mathematical concept is RSA algorithm build on
prime number factoring
40
what is a public Key infrastructure (PKI)
system, software, protocol required to use, manage & control public Key cryptography
41
what type of encryption does PKI use
Diffie-Hellman-Merkle key negotiation algorithm
42
what is a message digest
hash representation of a plaintext used to verify integrity of the message
43
what is the Key management lifecycle
1. generating 2. recording 3. transcribing 4. distributing 5. installing 6. storing 7. changing 8. using
44
what is Key recovery
a backup mechanism that ensures an organization can have continued access to its own encrypted information if the key are lost/damaged
45
key methods of key recovery
- Key escrow - key registration - digital wallet
46
main issues regarding key creation
1. random & pseudorandom number generator 2. symmetric key generation, storage, distribution and management 3. asymmetric key length
47
what can be a solution to symmetric key distribution
Key wrapping and key encrypting keys (KEKs) use a special purpose long-term use Key called Key encrypting Keys (KEK) to distribute symmetrics keys KEKs is currently used in TLS / PGP / S/MIME sessions
48
what are the methods to protect stored Keys
1. trusted, tamperproof hardware security module (HSM) 2. passphrase-protected smart cards 3. key wrapping using a long term KEKs 4. splitting cipher keys and storing in physically seperated storage location 5. protecting key using strong password, passphrase and key expiry & related policies
49
what are main cihertext-based attacks
- brute force - known plaintext - chosen plaintext
50
type of attack on encryption (algorithm attack)
- brute force - pass the hash attack -> capture authentic hash and re-use it - man-in-the-middle attack (MITM) - side channel attack -> use time, frequency - fault analysis --> make error and check result for clue - probing -> analyze the circuitry surrounding the crypto module - replay -> resent of repeated files to host - rainbow table -> look-up table of sorted hash outputs (good for password) - algebraic -> math structure - frequency analysis - birthday attack --> percentage of collision - factoring attack --> RSA - dictionary attack-> dictionary of words - attacking the random number -> hybrid - fault injection - temporary files --> find in RAM, SWAP, Hyberfiles.sys
51
what is the best language to support a federated identity management system?
Security Assertion Markup Language SAML
52
If a system’s security goal is that no subject can gain access to any object without authorizations what should be implemented?
The security kernel implementing the reference monitor concept
53
When a company is considering adopting a biometric systems which is the LEAST important consideration?
Technology type.
54
In a SAML 2.0 systems when a user across the internet is attempting to access a web services what happens?
The web server uses a federated login system to authenticate the user
55
What type of encryption would be appropriate for HIPAA documents in transit?
TLS
56
Which attack helped drive vendors to move away from SSL toward TLS-only by default?
POODLE
57
Ed has been asked to send data that his organization classifies as confidential and proprietary via email. What encryption technology would be appropriate to ensure that the contents of the files attached to the email remain confidential as they traverse the Internet?
PGP PGP, or Pretty Good Privacy (or its open-source alternative, GPG) provide strong encryption of files, which can then be sent via email.
58
Harry would like to retrieve a lost encryption key from a database that uses m of n control with m = 4 and n = 8. What is the minimum number of escrow agents required to retrieve the key?
4 In an m of n control system, at least m of n possible escrow agents must collaborate to retrieve an encryption key from the escrow database
59
Bob is a security administrator with the federal government and wishes to choose a digital signature approach that is an approved part of the federal Digital Signature Standard under FIPS 186-4. Which one of the following encryption algorithms is not an acceptable choice for use in digital signatures?
HAVAL HAVAL is a hash function, not an encryption algorithm
60
If Alice wishes to send Bob an encrypted message, what key does she use to encrypt the message?
Bob’s public key
61
When Bob receives the encrypted message from Alice, what key does he use to decrypt the message?
Bob’s private key
62
Alice would also like to digitally sign the message that she sends to Bob. What key should she use to create the digital signature?
Alice’s private key Alice creates the digital signature using her own private key. Then Bob, or any other user, can verify the digital signature using Alice’s public key.
63
James is working with a Department of Defense system that is authorized to simultaneously handle information classified at the Secret and Top Secret levels. What type of system is he using?
Multistate
64
Which one of the following terms accurately describes the Caesar cipher?
Shift cipher
65
Sherry conducted an inventory of the cryptographic technologies in use within her organization and found the following algorithms and protocols in use. Which one of these technologies should she replace because it is no longer considered secure?
MD5 The MD5 hash algorithm has known collisions and, as of 2005, is no longer considered secure for use in modern environments.
66
What standard governs the creation and validation of digital certificates for use in a public key infrastructure?
X.509
67
In a Software as a Service cloud computing environment, who is normally responsible for ensuring that appropriate firewall controls are in place?
Vendor
Work
flashcards
Decks in class (9)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions