Ethical Hacking Fundamentals
this is a state of well-being of information and infrastructure where the possibility of theft, tampering, and disruption of information/services is low or tolerable
Information security
Assurance that the information is accessible only to authorized individuals
Confidentiality
Capable of infecting a network within seconds
Viruses and worms
Protects information regarding health
HIPPA
unskilled hacker who compromises a systems by running scripts, tools, and software developed by real hackers
Script Kiddies
Three Security Challenges
Compliance Lack of qualified professionals non-centralized computing environment Fragmented/complex privacy/data protection BYOD policies and legacy data centers without proper cloud configuration
Availability
Attack that is focused on stealing information from the victim without the user being aware of it
Advanced persistant threats (APTs)
Protects financial card information including debit, credit, prepaid, atm, etc.
PCI-DSS
individuals employed by governments to hack top-secret information (normally from other governments)
State-Sponsored Hackers
An attack that does not tamper with the data and involves intercepting and monitoring of data/ data traffic
Passive attacks
Trustworthiness of data/resources in terms of preventing unauthorized changes
Integrity
Restricts access to the systems files/folders and demands a payment
Ransomware
Designed to protect investors/public by increasing the accuracy and reliability of corporate disclosures. Contains 11 parts
Sarbanes Oxley Act (SOX)
Hackers who are promoting some kind of agenda or cause
Hacktivists
Attacks that disrupt the communication of services between the systems to bypass or break into secured systems
Active Attacks
Gaurantee that the sender can't deny sending the message/file
Non-Repudiation
allows attackers to access another clients data on a cloud platform
flaw in application
Digital Millenium Copyright Act (DMCA)
an employee who uses privileged access to violate rules
malicious insiders
Reconaissance Weaponization delivery exploitation installation command/control actions on objectives
Five Elements of Information Security
Confidentiality Integrity Availability Authenticity Non-Repudiation
Five infosec attack vectors
Cloud computing
APTs
Viruses/Worms
Ransomware and Mobile threats
Specifes requirements for establishing, implementing, maintaining, and improving insec management systems and is suitable for several types of use
ISO/IEC 27001:2013
individuals who are motivated by religious/political beliefs in order to create fear through disruption of computer networks
cyber terrorists