CISSP 2

System Integrity means that all components of the system cannot be tampered with by unauthorized personnel and can be verified that they work properly.

 buffer overflow attack.

A series of the same control characters, hexadecimal code, imbedded in the string is usually an indicator of a buffer overflow attack.

The Intel x86 processors use the hexadecimal number 90 to represent NOP (no operation). Many buffer overflow attacks use long strings of control characters and this is representative of that type of attack. A series of the same control, hexidecimal, characters imbedded in the string is usually an indicator of a buffer overflow attack.  A NOP is a instruction which does nothing (No Operation - the hexadecimal equivalent is 0x90)

A buffer overflow takes place when too much data are accepted as input to a specific process. A buffer is an allocated segment of memory. A buffer can be overflowed arbitrarily with too much data, but for it to be of any use to an attacker, the code inserted into the buffer must be of a specific length, followed up by commands the attacker wants executed. So, the purpose of a buffer overflow may be either to make a mess, by shoving arbitrary data into various memory segments, or to accomplish a specific task, by pushing into the memory segment a carefully crafted set of data that will accomplish a specific task. This task could be to open a command shell with administrative privilege or execute malicious code.

Common threats to system availability, integrity, and confidentiality include hardware failure, misuse of system privileges, buffer overflows and other memory attacks, denial of service, reverse engineering, and system hacking.

Since many vulnerabilities result from insecure design and most threats are well known, it is the responsibility of the security architect to ensure that their designs are addressing security requirements appropriately while also ensuring that the system can continue to perform its intended function.

 SYN scan is when a SYN packet is sent to a specific port and the results are then analyzed.

A half-port scan. the port scanner generates a SYN packet. If the target port is open, it will respond with a SYN-ACK packet. The scanner host responds with a RST packet, closing the connection before the handshake is completed. Also known as a Half Open Port scan.

A packet destined for the network's broadcast address.  this type of packet would not contain a long string of NOPcharacters.

Polyinstantiation

In databases, polyinstantiation is database-related SQL (structured query language) terminology. It allows a relation to contain multiple rows with the same primary key; the multiple instances are distinguished by their security levels. It occurs because of mandatory policy. Depending on the security level established, one record contains sensitive information, and the other one does not, that is, a user will see the record's information depending on his/her level of confidentiality previously dictated by the company's policy.

An RDBMS is a DBMS in which data is stored in tables and the relationships among the data are also stored in tables. The data can be accessed or reassembled in many different ways without having to change the table forms.

Polymorphism  based on the Greek roots “poly” and “morph,” meaning many and forms, respectively): allows the ability to overload operators, performing different methods depending on the context of the input message.

A trojan horse is any code that appears to have some useful purpose but also contains code that has a malicious or harmful purpose imbedded in it. A Trojan often also includes a trapdoor as a means to gain access to a computer system bypassing security controls.

A Trojan horse, or Trojan, in computing is a non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. The term is derived from the story of the wooden horse used to trick defenders of Troy into taking concealed warriors into their city in ancient Greece, because computer Trojans often employ a form of social engineering, presenting themselves as routine, useful, or interesting in order to persuade victims to install them on their computers.

virus. Is incorrect because a Virus is a malicious program and is does not appear to be harmless, it's sole purpose is malicious intent often doing damage to a system.  A computer virus is a type of malware that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data files, or the boot sector of the hard drive; when this replication succeeds, the affected areas are then said to be "infected".

worm. Is incorrect because a Worm is similiar to a Virus but does not require user intervention to execute. Rather than doing damage to the system, worms tend to self-propagate and devour the resources of a system.  A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers.   Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Unlike a computer virus, it does not need to attach itself to an existing program.  Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

trapdoor. Is incorrect because a trapdoor is a means to bypass security by hiding an entry point into a system. Trojan Horses often have a trapdoor imbedded in them.

detection.

By reviewing system logs you can detect after the fact events that have occured.

A timely review of the audit logs would provide early detection of possible and intentional abuses but does nothing to prevent occurrence of abuses, if any. An early detection would lead to prevention of much serious abuses later on. Auditing can be seen as a detection exercise more than a preventive exercise.

avoidance. avoidance is a distractor. By reviewing system logs you have not avoided anything.

deterrence.  system logs are a history of past events. You cannot deter something that has already occurred.

prevention. system logs are a history of past events. You cannot prevent something that has already occurred.

The system is originally designed to provide the necessary security.

The earlier in the process that security is planned for and implement the cheaper it is. It is also much more efficient if security is addressed in each phase of the development cycle rather than an add-on because it gets more complicated to add at the end. If security plan is developed at the beginning it ensures that security won't be overlooked.

The system is optimized prior to the addition of security.if you wait to implement security after a system is completed the cost of adding security increases dramtically and can become much more complex.

The system is procured off-the-shelf.  it is often difficult to add security to off-the shelf systems.

The system is customized to meet the specific security threat. this is a distractor. This implies only a single threat.

A Polymorphic virus produces varied but operational copies of itself in hopes of evading anti-virus software.

boot sector.  boot sector virus attacks the boot sector of a drive. It describes the type of attack of the virus and not the characteristics of its composition.

retrofitting" that means you are adding to an existing database management system (DBMS). You could go back and redesign the entire DBMS but the cost of that could be expensive and there is no telling what the effect will be on existing applications, but that is redesigning and the question states retrofitting. The most cost effective way with the least effect on existing applications while adding a layer of security on top is through a trusted front-end.

 

parasitic.  A parasitic virus attaches itself to other files but does not change its characteristics.

stealth. A stealth virus attempts to hide changes of the affected files but not itself.
Â

Share on FacebookPlus on Google+

SUBSCRIBE MORE CONTENTS