Term
| Configuration Compliance Scanner |
|
Definition
-Checks hosts against various config templates
-Identifies systems not in compliance
-Allows for quick remediation |
|
|
Term
|
Definition
-Outside of Baselines
-Occasional wrong clicks weeded out
-Identify Brute-force attacks
-Probes as attackers try and see what they can access
-SKilled and persistent access over time
-Map the network |
|
|
Term
|
Definition
-Results in giving access to people that shouldn't have it
-Quickly recall and replace
-Rotate keys keep track of how resources are secured
-Infrastructure needed to quickly invalidate when compromised |
|
|
Term
|
Definition
-Root CA offline
-Subordinate CA's
-Issuing CA's |
|
|
Term
|
Definition
-Firewalls can allow traffic that should be blocked and reduces overall security
-Content Filters can allow malicious code to be displayed and downloaded
-Access Points: Can be used to capture credentials, traffic, confidential info |
|
|
Term
|
Definition
| Attacker negotiates a weaker security protocol |
|
|
Term
|
Definition
Policy Violations
-Methods in place to deal with violations
-Automated process to alert on violations
Insider Threats
-Audit logs, monitoring, access controls with triggers
-Job Rotation, Mandatory Vacations |
|
|
Term
|
Definition
| -Personnel give away too much information |
|
|
Term
|
Definition
| -Posting sensitive or proprietary information on LInkedIn and Facebook |
|
|
Term
|
Definition
Software Policies in Place
-Pirated software often contains malware
-Security implications are not vetted or fully understood
-Licensing and Copyright violations
-Unknown Intent |
|
|
Term
| Devices That Require Baselines and Monitoring |
|
Definition
-Firewalls
-Switches
-Servers
-Applications
-SAN/NAS
-NIDS/NIPS |
|
|
Term
| License Compliance Violation |
|
Definition
-Needs of Business
-Consume now True Up later
-Established Methods of Delivery
-Potential for application service to stop |
|
|
Term
| Cost of License Compliance VIolation |
|
Definition
-Financial Penalties - fees
-True up costs
-Impact to availability or integrity
-Security product stop working |
|
|
Term
|
Definition
-Compliance Licensing
-Patching/Updates
-Hard to monitor what you don't know |
|
|
Term
|
Definition
|
|
