General Knowledge Flashcards

Question

What is static and dynamic masking?

Answer 1

Static masking involves modifying an entire data set all at once. Good for testing an application. Dynamic masking is masking a particular record in a dataset when accessed - for e.g. when a customer service rep accesses a particular account.

Answer 2

Using an algorithm to mask data in a dataset. | Risk: If algorithm is reverse engineered, an attacker could infer the original data from the masked data.

Answer 3

Inference is a type of attack - e.g. reverse engineering real data from masked data by cracking the masking algorithm.

Answer 4

Data dispersion - data is broken up into smaller chunks and stored across multiple storage - e.g. multiple clouds. Risk: If one cloud provider is unavailable, then whole data set is unavailable. Bit splitting - The data is first encrypted, then separated into pieces, and the pieces are distributed across several storage areas. Processing is intensive. Not great if data is constantly changing as the erasure codes have to be constantly recreated.

Answer 5

- Authorization is permission to do something (e.g. access a file). Cloud provider enforces this. - Access control is allowing denying the expression of that authorization - for example, only allowing a user to perform the task allowed if he/she is authenticated. Cloud provider enforces this. - Entitlement - maps identities to authorizations (e.g. user x can access resource y). Cloud user is responsible for defining this.

Answer 6

Utility = functionality of a product and service to meet a specific need; what the service does Warranty = assurance that the product/service will meet the agreed-upon requirements (SLA) Utility + Warranty = Value in the mind of the customer

Answer 7

Concepts used in allocating CPU to tenants. ``` Limit = the max ceiling for resource allocation Reservation = guaranteed minimum for each tenant Shares = after reservations are met, how the rest of the resources are prioritized between guests. ```

Answer 8

Information Security Access Controls - designed to prevent conflicts of interest in a managed service environment where a company provides services to other companies which may compete with each other. E.g. law firm advising companies A and B who may be competitors.

Answer 9

The standard for Application Security. Key concepts are: a) Application Security Control (ASC) - a control to prevent a security weakness within an application. e.g. an ASC to mask credit card numbers on screen b) Application level of trust - not all applications need the same level of security controls Level 0 (low) to Level 2 (high) c) Organization Normative Framework (ONF) - company-wide repository of ASCs. Stored in a central repository d) Application Normative Framework (ANF) - ASCs that apply to specific applications.

Answer 10

Use a HMAC (Hashed Message Authentication Code)

Answer 11

- SAML is an XML based language - it describes formats; SOAP is a protocol. - SAML is carried over SOAP - SOAP itself is carried over HTTP/S.

Answer 12

- Authorization protocol defined by IETF - Uses HTTP - Delegates authorizations between services

Answer 13

OIDC = Open ID Connect - Standard for federated authentication Uses REST and JSON (not XML like SAML). Extends OAuth2.0 Uses Java Web Tokens (JWT).

Answer 14

Both are identity protocols. SAML is older. OIDC is easier and becoming more popular. SAML - used in enterprise settings v/s OIDC - used in mobile gaming, social media integration SAML based on XML vs. OIDC on REST/JSON

Answer 15

Due care - minimal level of effort necessary to perform your duty to others; lack of due care is negligence. Developing security policies/standards/controls . Due diligence - understanding current threats and implementing counter measures. Activities undertaken in support or furtherance of due care.

Answer 16

Liability is a measure of responsibility for providing due care. While an organization can share risk, it cannot share liability.

Answer 17

The probability of a threat materializing. Risk = Asset * Threat * Vulnerability. If there is no threat, there is no vulnerability If there is no vulnerability, there is no risk If the asset value is zero, there is no risk.

Answer 18

Hot/Cold Aisle have to do with air flow management. Objective is to lower energy costs Cold air intake is on one side, while hot air exhaust is on the other side.

Answer 19

Heat exchange with the outside world. Thus the ambient temperature determines how much energy is actually used. If outside is hot, more energy is needed to cool the air.

Answer 20

Data center floors are raised by 2 feet (18-24"). Underneath the floor is a plenum or duct Used for cold air circulation and optionally cabling. If cabling is used, then gaskets are important to prevent cold air leakage.

Answer 21

1. Risk Framing - characterizing the risk environment. 2. Risk Assessment - identify, estimate, prioritize information security risk. Likelyhood and impact are key factors. Assets, Threats and Vulnerabilities are considered. Qualitative and quantitative risk assessments 3. Responding to Risk - 4. Monitoring for Risk.

Answer 22

- SOAP can be carried over multiple transport - e.g. HTTP, HTTPS, FTP etc. - In SOAP, data is put inside an envelop which can be encrypted. This is why bank applications use them. - This gives an additional layer of protection without having to rely on transport layer protection.

Answer 23

- AV = Asset Value - the value of your asset in $$$ - EF = Exposure Factor = what portion of your asset is actually at risk for a particular threat - SLE = Single Loss Expectancy - how much you can expect to loss by a single attack (AV * EF). - ARO = Annual rate of occurrence - number of times a year you can expect an attack to occur - ALE=Annual Loss Expectancy = your loss each year = (SLE * ARO).

General Knowledge Flashcards

(47 cards)