Upgrade to remove ads
Net+ Chapter 8
Terms in this set (59)
Determining what rights and privileges an entity has.
Determining and assigning privileges to resources,
Determining who to hold responsible for an activity or event.
Tracking and recording system activities and resource access.
The fundamental principle of keeping information and communications private and protected from unauthorized access.
The property of keeping organizational information accurate, free of errors, and without unauthorized modifications.
The fundamental principle of ensuring that systems operate continuously and that authorized persons can access the data that they need.
The security goal of ensuring that data remains
associated with the party that creates it or sends a transmission.
The security principle that establishes that users and software should only have the minimal level of access that is necessary for them to perform the duties required of them.
An information security concept that indicates exposure to the chance of damage or loss, and signifies the likelihood of a hazard or threat.
A security incident where sensitive, protected, or
confidential data is copied, transmitted, viewed, stolen, or used by an individual who is not authorized to do so.
Any type of network or data access that is not
explicitly approved by an organization.
Any condition that leaves a network open to attack.
Attacker has identified a vulnerability and takes advantage of it.
Any event or action that could potentially result in the violation of a security requirement, policy, or procedure. Could be manmade or even natural disasters/bad weather.
Any technique that is used to exploit a vulnerability in any application on a computing device without authorization.
A user who excels at programming or managing and configuring computing devices, and has the skills to gain access to devices through unauthorized or unapproved means.
A term for a user who gains unauthorized access to devices and networks for malicious purposes.
Log files should include information such as:
Time, Who, Error messages, The change that was made.
A formalized statement that defines how security will be implemented within a particular organization.
Data Loss Prevention
A method or strategy to ensure that users are
prevented from sending critical, confidential, or restricted data outside of the network, or even outside of a specified group within the organization.
A type of attack in which an attacker uses unauthorized access to obtain protected network information.
The practice of using deception and trickery to convince unsuspecting users to provide sensitive data or to violate security guidelines.
A human- or software-based attack where the goal is to pretend to be someone else for the purpose of identity concealment.
A type of spoofing in which an attacker pretends to be someone they are not; typically an average user in distress or a help desk representative.
A type of email-based social engineering attack in which the attacker sends email from a spoofed source, such as a bank, to try to elicit private information from the victim.
Vishing (voice phishing)
A human-based attack where the attacker
extracts information while speaking over the phone or leveraging IP-based voice messaging services, such as VoIP.
An email- or web-based form of phishing that targets individuals who are known to be upper-level executives or other high-profile employees, with the goal of obtaining sensitive information. Also called spear phishing.
An email-based threat that floods the user's inbox with emails that typically carry unsolicited advertising material for products or other spurious content, and which sometimes delivers viruses.
Spam over Internet Messaging
Any type of incorrect or misleading information that is disseminated to multiple users through unofficial channels.
A malicious employee who in some fashion compromises your network or uses his or her access to obtain sensitive company information.
Malicious code, such as viruses, Trojans, or worms, designed to gain unauthorized access to, make unauthorized use of, or damage devices and networks.
A type of software attack where an attacker inserts
some type of undesired or unauthorized software into a target device.
A sample of code that spreads from one device to another by attaching itself to other files.
Code that spreads from one device to another on its own, not by attaching itself to another file.
An insidious type of malware that is itself a software attack and can pave the way for a number of other types of attacks.
Code that sits dormant on a target device until it is triggered by the occurrence of specific conditions, such as a specific date and time.
Surreptitiously installed malicious software that is intended to track and report on the usage of a target device or collect other data the author wishes to obtain.
Software that automatically displays or downloads
advertisements when it is used.
Software that is intended to take full or partial control of a device at the lowest levels.
A collection of software robots run by a command and control program that is controlled by a person.
Malicious code that restricts access to a user's device or the data stored on it until the victim pays the attacker to remove the restriction.
A device that has been infected by malware or otherwise controlled by an outside entity.
Any type of attack in which the attacker attempts to obtain and make use of passwords illegitimately.
A human-based attack where the goal is to
guess a password or PIN through brute force means or by using deduction.
A type of password attack that automates
password guessing by comparing encrypted passwords against a predetermined list of possible password values.
Brute Force Attack
A password-cracking program that tries every possible combination of characters.
An attack that utilizes multiple attack vectors, including dictionary, rainbow table, and brute force attack methodologies when trying to crack a password.
IP Spoofing Attacks
An attack in which an attacker creates IP packets with a forged source IP address and uses those packets to gain access to a remote device.
A network attack in which an attacker attempts to disrupt or disable devices that provide network services.
A software attack in which an attacker hijacks or manipulates multiple devices (through the use of zombies or drones) on disparate networks to carry out a DoS attack.
An attack that involves sending forged requests of
some type to a very large number of devices that will reply to the requests.
DNS amplification attack
A reflective DoS attack that uses open, publicly
available DNS servers to flood a target system with what was initially a small query, that turns into a large payload that overloads the victim's servers.
A WiFi attack in which a deauthentication
frame is sent from one station to another, terminating the connection to the wireless access point.
A form of eavesdropping in which the attacker makes an independent connection between two victims (two clients or a client and a server) and
relays information between the two victims as if they are directly talking to each other over a closed connection, when in reality the attacker is
controlling the information that travels between the two victims.
ARP Cache Poisoning Attacks
An attack that occurs when an attacker redirects an IP address to the MAC address of a device that is not the intended recipient.
DNS Poisoning Attacks
Attacks that exploit DNS vulnerabilities to redirect traffic to spoofed servers or sites instead of to the actual server or site.
A method of attack in which an attacking host on a VLAN gains access to traffic on other VLANs that would normally not be accessible.
THIS SET IS OFTEN IN FOLDERS WITH...
Network+ N10-007 Ethernet Standards and…
Comptia Network+ Missed Questions
YOU MIGHT ALSO LIKE...
Security+ Attack Types and Terms!!
ISSA Chapter 3
Security Plus: Chapter 2
OTHER SETS BY THIS CREATOR
Sec+ Missed Questions
Sec+ Trouble Areas Pt 3
Sec+ Trouble Areas Pt 2