Network Security and the CIA Triad

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson
Download our mobile app to listen on the go
Get App

Questions and Answers

What is the MOST critical focus of network security, distinguishing it from general computer science?

  • Achieving desired system behavior.
  • Optimizing system performance.
  • Ensuring user-friendly interfaces.
  • Preventing undesired system behavior. (correct)

Which of the following scenarios BEST exemplifies a violation of the 'Confidentiality' principle within the CIA triad?

  • An employee accidentally leaves a laptop containing unencrypted customer data on a train. (correct)
  • A disgruntled employee intentionally deletes important project files from a shared drive.
  • A server containing critical financial data crashes due to a power outage.
  • A hacker modifies sensitive patient records in a hospital database.

In the context of network security, which of the following BEST describes the role of 'Authentication'?

  • Verifying the identity of a user or system attempting to access resources. (correct)
  • Ensuring that data remains unchanged during transmission.
  • Controlling which resources a user can access after logging in.
  • Encrypting data to prevent unauthorized viewing.

Which of the following scenarios BEST demonstrates a successful implementation of 'Physical Security' as a tool for confidentiality?

<p>Storing sensitive data in a locked, windowless room accessible only by authorized personnel. (A)</p> Signup and view all the answers

What is the MOST significant characteristic of a 'Checksum' function used to ensure data integrity?

<p>It produces a numerical value that is highly sensitive to even minor changes in the data. (D)</p> Signup and view all the answers

In the context of data integrity, how do 'Data Correcting Codes' provide an advantage over simple checksums?

<p>They can automatically fix small errors in data, while checksums only detect them. (A)</p> Signup and view all the answers

Which of the following BEST describes the primary purpose of 'Computational Redundancies' in ensuring availability?

<p>To provide backup systems that can take over in case of failures. (A)</p> Signup and view all the answers

How does 'Assurance' contribute to the overall security of a system?

<p>It manages how trust is provided and managed within the system. (D)</p> Signup and view all the answers

Which of the following is the MOST critical function of 'Digital Signatures' in establishing Authenticity?

<p>Providing non-repudiation, ensuring that the sender cannot deny having sent the message. (D)</p> Signup and view all the answers

Which of the following tools is MOST directly associated with achieving 'Anonymity' in online communications?

<p>Proxies. (A)</p> Signup and view all the answers

What underlying principle is MOST directly compromised by 'Eavesdropping'?

<p>Confidentiality. (C)</p> Signup and view all the answers

Which scenario BEST demonstrates the 'Alteration' threat in network security?

<p>A malicious actor intercepts and modifies financial transaction data during transmission. (C)</p> Signup and view all the answers

Which is the PRIMARY goal of a 'Denial-of-Service' attack?

<p>To prevent legitimate users from accessing a service or resource. (C)</p> Signup and view all the answers

What key element defines an act of 'Repudiation' in the context of network security?

<p>The denial of having sent or received data. (B)</p> Signup and view all the answers

How would the use of a 'Mixing' tool help achieve anonymity?

<p>By intertwining transactions, information, or communications to prevent tracing. (B)</p> Signup and view all the answers

In the CIA triad, what is the relationship between 'Confidentiality' and 'Integrity'?

<p>Confidentiality protects against unauthorized disclosure, while integrity ensures data accuracy and completeness. (B)</p> Signup and view all the answers

Which of the following BEST represents a scenario where 'Authentication' and 'Authorization' are both successfully implemented?

<p>A user enters the correct username and password but is only able to access public files. (D)</p> Signup and view all the answers

Which of the following is a critical distinction between 'Policies' and 'Protections' in the context of trust management?

<p>Policies determine expectations, while protections enforce permissions. (B)</p> Signup and view all the answers

How does implementing 'Physical Protections' contribute to the overall 'Availability' of a system?

<p>By ensuring that the system is resistant to environmental disruptions and physical damage. (D)</p> Signup and view all the answers

How does the concept of 'Non-Repudiation' relate to digital signatures and online transactions?

<p>It prevents a sender from denying they sent a message. (B)</p> Signup and view all the answers

Which action would MOST directly mitigate the risk associated with 'Eavesdropping' attacks?

<p>Encrypting network communications. (D)</p> Signup and view all the answers

What is the MOST effective method to counter a 'Man-in-the-Middle' attack?

<p>Implementing end-to-end encryption. (A)</p> Signup and view all the answers

What strategy would be MOST effective in defending against a 'Denial-of-Service' attack?

<p>Filtering malicious traffic. (A)</p> Signup and view all the answers

In a situation where a customer denies placing an order online, what security measure could offer protection against such 'Repudiation'?

<p>Digital signatures. (D)</p> Signup and view all the answers

Within the context of 'Assurance', how do 'Permissions' interact with 'Policies' and 'Protections' to manage trust?

<p>Permissions are behaviors allowed to agents, informed by policies and enforced by protections. (C)</p> Signup and view all the answers

Which of the following attack types PRIMARILY targets the 'Availability' aspect of the CIA triad?

<p>Distributed Denial-of-Service (DDoS). (D)</p> Signup and view all the answers

An organization implements a system where user actions are logged and timestamped, providing an audit trail. Which security concept does this PRIMARILY support?

<p>Non-Repudiation. (A)</p> Signup and view all the answers

A company decides to use homomorphic encryption. What security goal is BEST achieved by this technology?

<p>Allowing computation on encrypted data without decryption. (A)</p> Signup and view all the answers

A network administrator notices unusual traffic patterns and suspects a network sniffing attack. What immediate action should they take to contain the potential damage?

<p>Deploy intrusion detection systems and analyze network traffic. (C)</p> Signup and view all the answers

A company wants to ensure that even if there is a full breach of their data center, customer PII remains unreadable. Which of the following security measures BEST achieves this?

<p>Encrypting all data at rest with rotating keys. (A)</p> Signup and view all the answers

A company's incident response team discovers that an attacker has successfully launched an SQL injection attack. What security principle has been MOST directly violated?

<p>Integrity. (B)</p> Signup and view all the answers

An organization adopts a 'Zero Trust' security model. What fundamentally changes about their network security approach?

<p>Every user and device, whether inside or outside the network, must be authenticated and authorized. (C)</p> Signup and view all the answers

How Can 'Aggregation' can be used to better achieve anonymity?

<p>By combining and showing result data for all the entities, rather than any single entity. (B)</p> Signup and view all the answers

Why should security best-practices still be followed if obscurity is baked into a system?

<p>Obscurity is only useful as a part of defense in depth. (C)</p> Signup and view all the answers

What is the BEST way to keep the password database secure?

<p>Strong hashing algorithms with long, randomized salts. (A)</p> Signup and view all the answers

A server is undergoing an alteration attack. What is the BEST way to reduce the attack surface?

<p>Reducing open ports and services. (C)</p> Signup and view all the answers

An attacker copies the files off a server, but the data itself is still secure. What CIA triad component has been affected?

<p>Availability. (C)</p> Signup and view all the answers

What is the STRONGEST reason to use a VPN?

<p>To gain security on untrusted networks. (A)</p> Signup and view all the answers

Flashcards

Computer/Network Security

Policies, processes, and practices to prevent unauthorized access or misuse of a computer network and its resources.

Desired Behavior

Achieving a desired behavior in computer science.

Preventing undesired behavior

Preventing undesired behavior in computer science.

Adversary

An enemy/hacker/adversary actively trying to circumvent security.

Signup and view all the flashcards

CIA Triad

Fundamental security objectives for data, information, and computing services.

Signup and view all the flashcards

Confidentiality

Preventing the disclosure of data to unauthorized parties.

Signup and view all the flashcards

Encryption

The process of converting information into a code to prevent unauthorized access.

Signup and view all the flashcards

Access Control

Rules limiting access to confidential information to those with a need to know.

Signup and view all the flashcards

Authentication

Determining someone's identity or role.

Signup and view all the flashcards

Physical Security

Physical barriers to limit access to protected resources.

Signup and view all the flashcards

Integrity

Protecting information from unauthorized modification.

Signup and view all the flashcards

Backups

Periodic archiving of data.

Signup and view all the flashcards

Checksums

Function that maps file contents to a numerical value for integrity checks.

Signup and view all the flashcards

Data Correcting Codes

Storing data so small changes can be automatically detected and corrected.

Signup and view all the flashcards

Availability

Ensuring authorized parties can access information when needed.

Signup and view all the flashcards

Physical Protections

Infrastructure to keep information available despite physical challenges.

Signup and view all the flashcards

Computational Redundancies

Computers and storage that serve as fallbacks during failures.

Signup and view all the flashcards

Assurance

How trust is provided and managed in computer systems.

Signup and view all the flashcards

Policies

Behavioral expectations for people or systems.

Signup and view all the flashcards

Permissions

Behaviors allowed by agents interacting with a person or system.

Signup and view all the flashcards

Protections

Mechanisms in place to enforce permissions and policies.

Signup and view all the flashcards

Authenticity

Ability to determine statements are genuine.

Signup and view all the flashcards

Digital Signatures

Cryptographic computations allowing commitment to document authenticity.

Signup and view all the flashcards

Nonrepudiation

Property that authentic statements cannot be denied.

Signup and view all the flashcards

Anonymity

Records/transactions not attributable to any individual.

Signup and view all the flashcards

Aggregation

Combining data from many individuals so sums cannot be tied to individuals.

Signup and view all the flashcards

Mixing

Intertwining transactions so they cannot be traced to individuals.

Signup and view all the flashcards

Proxies

Trusted agents acting without tracing back to the individual.

Signup and view all the flashcards

Alias

Fictional identities filling in for real ones in communications.

Signup and view all the flashcards

Eavesdropping

Interception of information intended for someone else.

Signup and view all the flashcards

Alteration

Unauthorized modification of information.

Signup and view all the flashcards

Man-in-the-Middle Attack

Attack where a network stream is intercepted, modified, and retransmitted.

Signup and view all the flashcards

Denial-of-Service

Interruption/degradation of a data service or information access.

Signup and view all the flashcards

Repudiation

Denial of a commitment or data receipt.

Signup and view all the flashcards

Study Notes

  • Network security includes policies, processes, and practices to prevent, detect, and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources.
  • Most of computer science focuses on achieving desired behavior.
  • Security focuses on preventing undesired behavior.
  • Security involves considering enemies/opponents/hackers/adversaries who are actively and maliciously trying to circumvent protective measures.

Principles of Security

  • The CIA triad embodies fundamental security objectives for data, information, and computing services.
  • CIA represents Confidentiality, Integrity, and Availability.

CIA Triad Explained

  • Confidentiality prevents the disclosure of data to unauthorized parties.
  • Integrity protects information from being modified by unauthorized parties.
  • Availability ensures authorized parties can access information when needed.

Tools for Confidentiality

  • Encryption is the process of converting information or data into a code to prevent unauthorized access.
  • Access control (authorization) includes rules and policies that limit access to confidential information to individuals or systems with a "need to know".
  • Authentication determines the identity or role of an individual, often through a combination of factors.
  • Physical security involves establishing physical barriers to limit access to protected computational resources.

Integrity Tools

  • Backups involve the periodic archiving of data.
  • Checksums compute a function that maps the contents of a file to a numerical value.
  • Data correcting codes involve methods for storing data.

Availability Tools

  • Physical protections infrastructure meant to keep information available even in the event of physical challenges.
  • Computational redundancies includes computers and storage devices that serve as fallbacks if there is failures.

Other Security Concepts

  • A.A.A. refers to Authenticity, Assurance and Anonymity.

Assurance

  • Assurance describes how trust is provided and managed in computer systems.
  • Trust management relies on:
  • Policies: specifies behavioral expectations for people or systems.
  • Permissions: describes behaviors allowed by agents interacting with a person or system.
  • Protections: mechanisms to enforce permissions and polices.

Authenticity

  • Authenticity is being able to determine that statements, policies, and permissions issued by persons or systems are genuine.
  • The primary tool for authenticity is digital signatures which allows a person or system to commit to the authenticity of their documents achieving nonrepudiation.
  • Nonrepudiation is the property that authentic statements issued by some person or system can not be denied.

Anonymity

  • Anonymity is the property that certain records or transactions are not attributable to any individual.
  • Tools to achieve anonymity:
  • Aggregation: combining data from many individuals so disclosed sums or averages can not be tied to any individual.
  • Mixing: intertwining transactions, information, or communications in a way that cannot be traced.
  • Proxies: trusted agents that are willing to engage in actions without being traced back to an individual.
  • Alias: fictional identities used in communications/transactions, known only to a trusted entity.

Threats and Attacks

  • Eavesdropping is the interception of information intended for someone else during transmission.
  • Alteration: unauthorized modification of information.
  • A Man-in-the-middle attack is an example of of alteration, where a network stream is intercepted, modified, and retransmitted.
  • Denial-of-service is the interruption or degradation of a data service or information access.
  • Email spam is an example of a denial-of-service.
  • Repudiation is the denial of a commitment or data receipt.
  • Repudiation involves backing out of a contract or protocol requiring receipt acknowledgements.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

More Like This

Network Security Fundamentals Quiz
11 questions
Info Sec: CIA Triad and Threats
8 questions

Info Sec: CIA Triad and Threats

SustainableSmokyQuartz avatar
SustainableSmokyQuartz
Understanding Security Principles
39 questions
Use Quizgecko on...
Browser
Browser