AP®︎ Cybersecurity: Topic 5.2 Flashcards

Data stored on a drive or other medium; protected through physical security, encryption, and access controls

Data being sent between devices; protected through transmission-media security, encryption, and restrictions on senders and receivers

Data being processed by a person or software; it must be unencrypted for use, so access controls are especially important

Categorizing data by potential harm from disclosure, alteration, destruction, or loss of access so more sensitive data receive stronger protection

Data that allows a person to be identified, such as a name, address, biometric data, Social Security number, birth date, or email address

A law associated in this course with protecting personally identifiable information

A law protecting personal information collected online from children under age 13

Data about an individual’s health, treatment, or health-care payment, such as test results, treatment records, and visit notes

A law that includes protections for protected health information

Data collected to process card payments, including the name, account number, expiration date, address, and CVV code

The principal security standard for protecting payment card information

Organizational policies, requirements, and processes that direct what security work must be done, when, and under which standards

An organizational policy defining approved encryption protocols and algorithms, key lengths, key generation, and key storage

A policy defining when web applications require security assessment, how assessments occur, and risk-based deadlines for remediation

Enforcement of which entities may perform particular actions on particular resources

A user, service, process, or application requesting access

A file, application, or other resource to which access is requested

The action a subject requests on an object, such as accessing, modifying, adding, or removing

A method for determining which subjects may perform which operations on which objects

Granting an entity permission to have a particular type of access to a resource

An access model that assigns subjects to roles and gives permissions to those roles

An access model that evaluates stated rules and contextual conditions to allow or deny access, usually on top of another model

An access model in which object owners choose other subjects’ permissions, subject to administrator or superuser overrides

An access model using strict, centrally administered rules and externally assigned levels for subjects and objects

A mandatory access control model that protects confidentiality through ordered security levels for subjects and objects

Bell-LaPadula’s “no read up” rule: a subject may not read an object above its security level

Bell-LaPadula’s “no write down” rule: a subject may not write to an object below its security level

Bell-LaPadula’s permitted direction: subjects may write at their level or higher and read at their level or lower

Give each entity exactly the access needed to perform its function and no more

r allows viewing a file, w allows changing it, and x allows running it; they always appear in rwx order

The three Linux permission classes, always ordered as file owner, file group, and all other users

Displays a detailed file listing, including the conventional owner, group, and others permissions

Displays additional file permissions when a plus sign after the conventional permissions indicates they exist

Use chmod ### filename; the digits represent owner, group, and others, with each permission sum using r=4, w=2, and x=1

Use chmod with u, g, o, or a; + or -; and r, w, or x to add or remove named permissions, such as chmod ug+rx testfile