CISAundso

Having the service provider sign an indemnity clause will ensure compliance to the enterprise’s security policies because any violations discovered would lead to a financial liability for the service provider. This will also prompt the enterprise to monitor security violations closely.

An uninterruptible power supply (UPS) is used to provide constant power even if main power is lost.

Normalization is the removal of redundant data elements from the database structure. Disabling normalization in relational databases will create redundancy and a risk of not maintaining consistency of data, with the consequent loss of data integrity.

Encapsulation is a property of objects, and it prevents accessing either properties or methods that have not been previously defined as public. This means that any implementation of the behavior of an object is not accessible. An object defines a communication interface with the exterior and only that which belongs to that interface can be accessed.

The use of Ping with a packet size higher than 65 KB and no fragmentation flag on will cause a denial of service.

A leapfrog attack, the act of telneting through one or more hosts to preclude a trace, makes use of user ID and password information obtained illicitly from one host to compromise another host.

A negative acknowledgment (NAK) is a penetration technique that capitalizes on a potential weakness in an operating system that does not handle asynchronous interrupts properly, leaving the system in an unprotected state during such interrupts.

Kerberos is a network authentication protocol for client-server applications that can be used to restrict access to the database to authorized users.

The pharming attack redirects the traffic to an unauthorized web site by exploiting vulnerabilities of the DNS server. To avoid this kind of attack, it is necessary to eliminate any known vulnerability that could allow DNS poisoning. Older versions of DNS software are vulnerable to this kind of attack and should be patched.

Occurs when unauthorized modifications affect the integrity of the data or code.

Comprise a collection of compromised computers running software, usually installed via worms, trojan horses or back doors.

Smurf attack - occurs when misconfigured network devices alow packets to be sent to all hosts on a particular network via the broadcast addres of the network

ping flood - occurs when the target system is overwhelmed with ping packets

teardrop attack - involves sending mangled IP fragments with overlapping, oversized payloads to the target machine

DDoS - Distributed denial-of-service attack - occurs when multiple compromised systems flood the bandwith or resources of the targeted system

Nuke - A DoS attack against computer networks in which fragmented or invalid ICMP packets are sent to the target. Modified ping utility is used to repeatedly send corrupt data, thus slowing down the affected computer to a complete stop.

An intruder gathers the information flowing trough the network with the intent of acquiring and releasing the message contents for either personal analysis or for third parties who might have comissioned such eavesdropping. These activities can enable the intruder to gain unauthorized access to fraudulently use of information such as credit card accounts and to compromise the confidentiality of sensitive information that could jeopardize or harm an individuals or an organizations reputation.

Trojan horses

Logic bomb  - A program or a section of a program that is triggered when a certain condior event occurs

Trap doors - Bits of code embedded in programs by programmers to quickly gain access during the testing or debugging phase.

An attack that aims to redirect the traffic of a web site to a bogus website. Pharming can be conducted either by changing the hosts file on a victims computer or by exploiting a vulnerability in DNS server software.

The act of following an authorized person through a secured door or electronically attaching to an authorized telecommunications link to intercept and possibly alter transmissions.

Involves slicing smal amounts of money from a computerized transation or account.