AP®︎ Cybersecurity: Unit 5 Flashcards

Files with no cryptographic barrier; an adversary with access to the device or drive can read their contents even if operating-system permissions are bypassed

A standard user has limited permissions for routine tasks; an administrative user has elevated privileges to control settings and typically access any files or applications

Permissions beyond those of a standard user that allow control of system settings, files, applications, or other protected resources

Permissions that allow more users or applications than necessary to view, edit, execute, or delete resources

A program stored as executable data whose instructions a computer runs; it may run locally or on a server as a web application accessed over a network

Verifying before processing that input meets expected criteria such as type, format, length, range, or allowed characters

Removing unsafe content or rejecting input before processing so user data cannot become commands, executable code, or unauthorized file paths

Supplying an unexpected character string that an application interprets as instructions, altering the program’s intended behavior

A computer language used to request information from databases and create, change, or delete database entries

Placing SQL commands or control characters in application input so a database query discloses, changes, adds, or deletes unintended data

The markup language used to describe the structure and content of web pages

A scripting language used for dynamic web content whose commands commonly execute in a website visitor’s browser

Injecting malicious code into a website so that a visitor’s browser executes it in the website’s context

XSS in which malicious code in a crafted link or request is reflected by a vulnerable website and executed by the victim’s browser

XSS in which malicious code is saved in website content and executed by the browsers of users who later view that content

A designated section of computer memory with a fixed size for holding data such as application input

Feeding more data into a buffer than it can hold, overwriting adjacent memory and potentially causing crashes or unauthorized code execution

A request sent using Hypertext Transfer Protocol that asks a server for the resource identified by a URL or path

Modifying a URL or GET request, often with ../ parent-directory components, to access server files outside the intended directory

The three primary security goals: prevent unauthorized disclosure, prevent unauthorized alteration or destruction, and keep data and systems accessible when needed

Risk often involving highly sensitive or regulated data and a highly likely or easily performed exploit with severe consequences

Risk often involving sensitive data protected by encryption that is too weak or access controls that are not strict enough

Risk often involving less sensitive information with weak encryption or loose access controls and relatively limited likely harm

Data saved on a drive or other storage medium rather than actively being transmitted or processed; it is protected with physical security, encryption, and access controls

Data being sent between devices; protected through transmission-media security, encryption, and restrictions on senders and receivers

Data being processed by a person or software; it must be unencrypted for use, so access controls are especially important

Categorizing data by sensitivity, potential harm, regulatory requirements, and required handling so more sensitive data receive stronger protection and monitoring

Data that allows a person to be identified, such as a name, address, biometric data, Social Security number, birth date, or email address

A law associated in this course with protecting personally identifiable information

A law protecting personal information collected online from children under age 13

Data about an individual’s health, treatment, or health-care payment, such as test results, treatment records, and visit notes

A law that includes protections for protected health information

Data collected to process card payments, including the name, account number, expiration date, address, and CVV code

The principal security standard for protecting payment card information

An organizational policy defining approved encryption protocols and algorithms, key lengths, key generation, and key storage

A policy defining when web applications require security assessment, how assessments occur, and risk-based deadlines for remediation

A subject is the user, service, process, or application requesting to perform an operation such as reading or modifying an object such as a file or application

An access model that assigns subjects to roles and gives permissions to those roles

An access model that evaluates stated rules and contextual conditions to allow or deny access, usually on top of another model

An access model in which object owners choose other subjects’ permissions, subject to administrator or superuser overrides

An access model using strict, centrally administered rules and externally assigned levels for subjects and objects

A mandatory access control model that protects confidentiality through ordered security levels for subjects and objects

Bell-LaPadula’s “no read up” rule: a subject may not read an object above its security level

Bell-LaPadula’s “no write down” rule: a subject may not write to an object below its security level

Bell-LaPadula’s permitted direction: subjects may write at their level or higher and read at their level or lower

Give each entity exactly the access needed to perform its function and no more

Granting an entity permission to have a particular type of access to a resource

r allows viewing a file, w allows changing it, and x allows running it; they always appear in rwx order

The three Linux permission classes, always ordered as file owner, file group, and all other users

Displays a detailed file listing, including the conventional owner, group, and others permissions

Displays additional file permissions when a plus sign after the conventional permissions indicates they exist

A Linux command that changes file permissions using numeric values or symbolic entities, operators, and permission letters

Gives the owner read, write, and execute permissions, the group read and execute permissions, and others no permissions

Gives the owner read and execute permissions, the group read permission, and others write and execute permissions

Gives the owner, group, and all other users read, write, and execute permissions

Use chmod with u, g, o, or a; + or -; and r, w, or x to add or remove named permissions, such as chmod ug+rx testfile

Adds read and execute permissions for the owner and group on testfile

The use of algorithms and keys to hide information and allow it to be recovered with the correct key

Encryption transforms plaintext into ciphertext to hide information; decryption uses the correct key to reverse the transformation and recover the plaintext

Plaintext is the original unencrypted data supplied to an encryption algorithm; ciphertext is the encrypted output and is ordinarily meaningless without the appropriate key

A defined process for encrypting and decrypting information

The number of possible keys an algorithm can use; a larger keyspace makes discovering the correct key by guessing take longer

Encryption that uses the same shared secret key to encrypt and decrypt information

Encryption that uses two different related keys, one to encrypt information and the other to decrypt it

Encryption that processes data in fixed-size chunks called blocks, producing an output block for each input block

Encryption that handles input continuously and produces output one element, commonly one bit, at a time

The most common symmetric-key block cipher; it processes 128-bit blocks using 128-, 192-, or 256-bit keys

Openssl enc -aes-128-cbc -e -in test -k password -out test.enc

Openssl enc -aes-128-cbc -d -in test.enc -k password -out test

Two equal-length binary keys generated together as mathematical inverses, with either key’s operation reversible only by its partner

The public key is published and can encrypt confidential data for its owner; the private key is kept secret and decrypts data encrypted with the matching public key

The receiver generates a key pair, protects the private key, and publishes the public key; the sender encrypts with the receiver’s public key, and the receiver decrypts with the matching private key

Exposure, theft, sharing, corruption, or loss of a private key requiring the old key pair to be retired and replaced

An n-bit binary key has 2^n possible values, and each additional bit doubles the keyspace

An n-bit key requires 2^n / 2 = 2^(n−1) guesses on average when keys are tried without repetition

The number of bits in a key; within the same algorithm, longer keys generally improve security but require more processing

Key lengths can be directly compared only within the same cryptographic algorithm, not across algorithms such as RSA and AES.

A common asymmetric algorithm based on mathematical relationships involving large numbers, used for encryption, signatures, and certificates

Asymmetric cryptography based on mathematical relationships involving elliptic curves, supporting key pairs, signatures, and certificates

A digital signature uses a private key and matching public key to verify origin and integrity; a digital certificate associates an identity with a public key

Building security into every phase of a product’s life cycle as a fundamental design principle rather than adding it after development

Producers should own customer security outcomes, communicate security issues and remediation with transparency and accountability, and provide leadership, authority, and resources for a security-first organization

The principle that a product’s security features should be enabled in its initial configuration so it is secure out of the box

Characters that delimit or control parts of a processed expression, such as the single quote, double quote, and semicolon

The process of recording and monitoring user activities, including who accessed data, when, and what operation was attempted or completed

Reviewing recorded events for suspicious operations or deviations from normal time, location, device, file, or application access patterns

A monitored file containing fake valuable-looking data; attempted access triggers a high-confidence alert because no legitimate user should access it

A repeatable function that converts data into a hash or digest; the same input and algorithm produce the same output

Monitoring of users’ data access, use, copying, and transmission across an organization to detect suspicious activity, with strong coverage at a higher cost

Choose controls according to cost, data or application sensitivity and criticality, and data classification or regulatory requirements

Real-time detection alerts while activity is occurring and enables prompt response; retrospective detection discovers an attack or change after it occurred

A real attack that a detection method fails to identify, such as unchanged data being stolen or an adversary avoiding a honeypot

Record a file’s hash as a baseline, hash the same file later with the same algorithm, and compare the full digests; a difference means the file was altered

Get-FileHash testfile -Algorithm SHA256

Sha256sum testfile

Shasum -a 256 testfile

SQL syntax in logged user input, especially quotes, OR 1=1, the comment marker --, or capitalized control words such as WHERE, IN, and FROM.

Suspicious HTML or JavaScript in logged user input, particularly <script>...</script> tags

Unusually long URL, cookie, query string, or total request lengths in a web request

Sequences of ../ in an HTTP GET path, especially repeated sequences leading to files outside the intended web directory