Information Security Terminology Quiz

Information Security Terminology

• Resource: Any valuable object needing protection.
• Vulnerability: A system weakness exploitable by a threat.
• Threat: Potential danger to a resource or network.
• Attack: Action intended to harm a resource.
• Risk: Likelihood of loss, modification, or destruction of a resource due to a threat exploiting a vulnerability.
• Risk = Resource + Threat + Vulnerability
• Countermeasure: Protection mitigating a threat or risk.

Types of Hackers

• Hackers: Individuals fascinated by network systems.
• White Hat Hackers: Ethical hackers performing security audits to improve systems.
• Black Hat Hackers: Unethical hackers aiming for illicit purposes, like data theft.
• Gray Hat Hackers: Individuals with a mix of white and black hat characteristics.
• Blue Hat Hackers: Individuals testing software applications for bugs.
• Script Kiddies: Novice hackers using scripts to launch attacks without in-depth knowledge.
• Hacktivists: Hackers motivated by ideological causes.
• Phreakers: Experts in attacking telephonic systems.
• Carders: Hackers specializing in attacking smart card systems.

Malicious Codes (Malware)

• Virus: Program attaching to software to perform unintended actions. Requires user activation; can be programmed to run passively.
• Worms: Standalone programs that exploit vulnerabilities to spread throughout a network rapidly. Do not require user interaction.
• Spyware: Software tracking user activity and collecting information. Often used for targeted advertising or unauthorized data gathering.
• Adware: Software displaying advertisements, often pop-up windows.
• Scaryware: Software designed to convince users their system is infected and promote solutions, often for profit.
• Trojan Horse: Program with seemingly useful functionality but hidden malicious actions, often leading to unauthorized access.
• Ransomware: Malware blocking access to a system until a payment is made.

Network Security

• Physical Security: Protecting the physical environment where resources are located, including server rooms, networks equipment, preventing accidents, and uninterrupted power supply.
• Logical Security: Implementing policies using software to control access. Includes using strong passwords, access models (authentication, authorization, and traceability), configuring firewalls, implementing Intrusion Prevention Systems (IPS), and using Virtual Private Networks (VPNs).
• Administrative Security: Rules and procedures used by an organization to monitor and control its network, including preventing errors and fraud, defining responsibilities of staff, and protecting property.

Types of Network Attacks

• Reconnaissance Attacks (Passive): Goal is to gather info about the target network. Techniques like ping sweeps (identifying active hosts), port scanning (determining open ports), and packet sniffing (capturing network traffic).
• Password Attacks: Goal is to discover usernames and passwords. Approaches include dictionary attacks (using a list of common words) and brute-force attacks (trying all possible combinations).
• Access Attacks: Goal is to gain unauthorized access. Techniques like phishing (sending fraudulent emails), pharming (redirecting traffic), man-in-the-middle attacks (intercepting communication), and spoofing (making a system appear legitimate).
• Network Attacks against Availability: Goal is to render a network resource unavailable. Methods include denial-of-service (DoS) attacks, flooding the system with requests, and distributed denial-of-service (DDoS) attacks using multiple sources.
• Close Attacks: Attacker is physically present at the target system.
• Attacks on Approval Relationships: Exploiting approval relationships between network devices to gain greater control.

Network Security Measures

• Separation of Resources: Categorizing resources into different security zones, such as DMZ.
• Deep Protection: Deploying security devices strategically across a network.
• Least Privilege: Limiting access rights to the minimum necessary.
• Adequate Protection: Implementing strong protection mechanisms at all network levels.
• Restricting Information: Limiting access based on employee roles and tasks.
• Separation of Tasks/Job Rotation: Reducing vulnerabilities caused by individuals having too much responsibility.

Vulnerability Audit Measures

• Preventive Measures: Precautions to reduce the possibility of an attack.
• Detective Measures: Identifying security violations using logs and monitoring tools.
• Corrective Measures: Rectifying security breaches or weaknesses.
• Recovery Measures: Procedures to restore network functionality after an incident.
• Deterrence Measures: Discouraging potential attackers.

Test your knowledge on key information security terms and types of hackers. This quiz covers essential vocabulary such as vulnerabilities, threats, and countermeasures, as well as different categories of hackers. Challenge yourself and learn more about the landscape of cybersecurity!