Security Reading
Security Reading Chapter 10 covers many topics such as Types of Security Threats, Network Controls, Risk Assessment, Encryption, User Authentication and Preventing Social Engineering. For the assignment, we were to read from Selected Key Terms listing at the end of the chapter and make a table containing the terms and their related description. Below is the table with all the key terms.
| asset authentication | Ensuring an asset has permissions to do what it is trying to do |
| availability | providing continuous operation of an organizations hardware and software so that staff, customers and suppliers can be assured of no interruption of service. |
| confidentiality | The protection of organizational data from unauthorized disclosure of customer proprietary data. |
| integrity | assurance that data have not been altered or destroyed. |
| risk | level of exposure to an item when compared to other Items |
| biometric system | a technological system that uses information about a person (retina, finger, hand) to identify a person to identify user is sole individual authorized to access he netwrok account |
| brute-force attack | a trial and error method used to obtain information such as a user password or pin. In a brute force attack, automated software is used to generate a large number of consecutive guesses as to the value of the desired data |
| denial-of-service(DoS) attack | when an attacker attempts to disrupt the network by flooding it with messages so that the network cannot process messages from normal users. |
| IP spoofing | when hackers change the IP address in packets |
| business continuity | ensuring availability of data |
| disaster recovery | critical element in correcting problems from a disaster |
| packet-level firewall | examines the source and destination address of every network packet that passes through it. |
| Cryptography | the practice and study of techniques for secure communication in the presence of third parties |
| symmetric | algorithms for cryptography that use the same cryptographic keys |
| key | a variable value that is applied using an algorithm to a string or block of unencrypted text to produce encrypted text or to decrypt encrypted text |
| key management | the management of cryptographic keys in a cryptosystem |
| asymmetric encryption | the key used to decrypt a message is different from the key used to encrypt it. |
| RSA | is one of the first practical public key cryptosystems and is widely used for secure data transmission |
| public and private key | public key is used to encrypt the message and the private key is used to decrypt the message |
| public key infrastructure (PKI) | a set of roles, policies, and procedures needed to create, manage distribute, use, store and revoke digitial certificates and manage public key encryption |
| certificate authority (CA) | a trusted organization that can vouche for the authenticity of the person or organization using authentication |
| symmetric encryption | the key used to encrypt a message is the same as the one used to decrypt it. |
| Data Encryption Standard (DES) | Most commonly used symmetric encryption that uses a symmetric key block cipher published by NIST |
| triple DES (3DES) | a symmetric key cipher, which applies the DES cipher algorithm three times to each data block |
| Advanced Encryption Standard (AES) | A symmetric block cipher chosen by the US government to protect classified information and is implemented in software and hardware throughout the world to encrypt sensitive data. It replaced DES and has key sizes 128, 192, and 256 bits. |
| Kerberos | The most commonly used authentication protocol |
| Secure Sockets layer (SSL) | encryption protocol widely used on the web.It operates between application layer and transport layer |
| IP Security Protocol (IPSec) | another widely used encryption protocol. It differs from SSL in that SSL is focused on web applications whereas IPSec can be used with a much wider variety of application layer protocols |
| IPSec tunnel mode | In a newly identified IP packet, the tunnel mode identifies the IPSec encryptiona agent at the next destination, not the final destination; once the IPSec packet arrives at encryption agent , the encrypted packet is VPN decrypted and sent on its way |
