1.6 Vulnerabilities & Security Concerns Flashcards
Security concerns of a zero-day vulnerability
- Nearly impossible to defend against a vulnerability that is unknown
- Important to keep up to date on newly emerging vulnerabilities
Security concern of open permissions
When data is stored across different systems it becomes easier to make a configuration mistake leaving open access to the data
Security concern of unsecure root/admin accounts
Hackers could gain access to a system if the root/admin accounts have default, weak, or unset passwords
Security concern of app error messages
Not properly masking app error messages could expose valuable information an attacker could use to breach a system
Security concerns of weak encryption protocols
Use of weak encryption protocols could expose sensitive data. Also important to keep up to date on encryption protocols to ensure that data is not exposed
Security concerns of unsecure protocols
Many protocols, such as HTTP, FTP, Telnet, send data in clear text without encryption exposing transmitted data
Security concerns of default settings
Some devices have default admin passwords set or default settings that are unsecure. Ensure any new devices are properly configured and secured before live use.
Security concerns of open ports/services
It is easy to mis-type when creating ACLs or forget to block unused ports which creates an opening for attackers to exploit
Security concerns of using third-party vendors
Third-party vendors often have direct access to data and hardware. Must monitor and check all services provided by third-party vendors to ensure that everything is secure
What is a key security concern of systems integration with external systems?
Ensuring those systems share the same security standards as your organization
What is a key security concern involving lack of vendor support
When evaluating products from vendors it is important to ensure that they provide adequate support and system updates/patches
Security concerns/risks of supply chain
Equipment/software could be compromised prior to delivery from a vendor
3 key practices to address security concerns of outsourced development
- Block access to production environment
- Don’t provide sensitive data for testing purposes
- review all code to ensure integrity and no back doors
Security concerns of outsourced data storage
Must ensure that all data is stored and transmitted with proper security per organization standards and legal regulations
What are the 3 key software types to include in a patch management plan
Firmware, Operating System, Applications
