Any action that could damage an asset

Passed in 1999, requires that all types of financial institutions to protect private financial information

A detailed written definition for hardware and software and how it is to be used

Ethical hacking using various penetration tools to uncover vulnerabilities.

Definition of different data types

any weakness in a system that makes it possible for a threat to cause harm

Refers to the likely hood of exposure to danger

A laps in a security control in a policy creates a gap

is the practice of hiding data and keeping it away from unauthorized users

is the process of transforming data from clear text into ciphertext

request-impact assessment-approval-build/test-implement-monitor

user, workstation, LAN, LAN-to-WAN, WAN, remote access, and system/application domain

type of attack in which the attacker takes control of a session between two machines and masquerades as one of them

using threats or harassment to bully another person for information

email or web pages that resemble the work of a reputable organization to capture sensitive information

is deceiving or using people to get around security controls

breaks IT security for the challenge and to prove technical powers, and poke holes in system

wannabe hacker, average abilities either becoming a black or white hat hacker

a weakness that allows a threat to be realized or to have an effect on an asset

process of identifying, assessing, prioritizing, and addressing risk

A password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

estimated loss due to a specific realized threat.
to calculate ALE is ALE = SLE x ARO

Methods used to restrict and allow access to resources.

Access Tokens-Security Descriptors-Access Control Lists-Access Control Entries-Access Rights and-Access Masks-Security Identifiers

are high-level statements or rules about protecting people or systems

Benchmarks used to make sure that a system provides a minimum level of security across multiple applications and across different products.

Implementing BIA – Business Impact Analysis is a formal analysis of an organization’s functions and activities that classifies them as critical or noncritical. BCP Business Community Plan is a plan for a structured response to any events that result in an interruption to critical business activities or functions.– DRP –Disaster Recovery Plan which directs the actions necessary to recover resources after a disaster and is part of a BCP

Vulnerability scanners
Port scanners
Sniffers
Wardialers
Keyloggers

any software that gives partial to full control of your computer to do whatever the malware creator wants.
Malware, Spyware, Viruses, Worms, Trojans, Keyloggers, Dialer, and RootKits

a risk-analysis method that uses mathematical formulas and numbers to assist in ranking risk severity.

Authorization, Identification, Authentication, Accountability

a risk-analysis method that uses relatives ranking to provide further definition of the identified risks in order to determine responses to them.