2.1 Defense In Depth Flashcards
The principle that system protections need to be layered and deployed across a wide range of controls. It involves the CIA triad and risk assessment.
Defense in depth
These three things comprise the CIA triad
Confidentiality, integrity, availability
What is the “secure by design” concept?
The concept that security of the application is not an afterthought but a prerequisite for each building block of the solution.
This is considered the foundation of defense in depth
Filtering
These are four examples of network filtering
Firewalls, anti-DDoS, proxy servers, mail relays
These are two examples of host filtering
Anti-malware, application control
A way of filtering that will allow only approved applications to run
Application control
Intermediate systems that handle requests to resources on behalf of other systems. They also tend to perform some kind of content filtering.
Proxy servers
The four approaches to defense in depth
Uniform protection, protected enclaves, information centric, threat vector analysis
This DiD approach involves segmenting your network, involving VLANs and filtering traffic between sections of the network.
Protected enclaves
Also known as port isolation this is a technique in computer networking where a VLAN contains switch ports that are restricted so that they can only communicate with a given uplink.
Private VLAN
DiD approach where your organization uses multiple layers to access confidential information.
Information centric
DiD approach where we prevent a threat from “crossing the bridge” or using a vector. Such as disabling USB drives.
Vector oriented
This model is a compliment to DiD. Every request regardless if it comes from inside or outside the network must be authenticated and authorized.
Zero trust model
Enables you to dynamically change access based upon conditions and points that are accumulated.
Zero trust, variable trust
IAAA
Identification, authentication, authorization, accountability
The discipline of establishing a known baseline condition and then managing that condition. Ideally based on reputed established standards.
Configuration management
Tracking logging and validating every change.
Change control
The four general methods for cracking passwords
Dictionary attack, hybrid attack, brute Force attack, pre-computation attack
Three authentication factors
Something you know, something you have, something you are
These are based on an irreversible hash function. Transforms the input to a fixed length output called a digest.
Key derivation function KDF
an additional input for the kdf, a random string of characters added to the password before hashing. This is stored next to the password.
Salt
An additional input for kdf, a random string of characters added to the password before hashing. It is stored in a secure location locally. Unique per application.
Pepper
A list of hashed passwords available online, either cracked or not cracked.
Password dump
Generally a number of hashing iterations. Intended to slow down brute Force attacks.
Difficulty factor
The fastest method for cracking passwords. It tests all the words and a dictionary or word file against password hashes.
Dictionary attack
This builds on the dictionary attack method by adding numerals and symbols to dictionary words.
Hybrid attack
The most powerful password cracking method. It will always succeed no matter how complex, it’s just a matter of time.
Brute Force attack
Password cracking attack where hashes are pre-computed of possible passwords and stored in a rainbow table, saving CPU time.
Pre-computation attack
A file containing pre-computed password hash values
Rainbow table
The process of calculating hashes that is split up over large amounts of processing units or CPU cores
Data parallelism
This refers to limiting a password cracking attack to a certain password structure or password policy. For example minimum of eight characters with complexity, etc.
Masking
A method of authentication which access is only granted after being presented with more than one authenticator.
Multifactor authentication
Term for using the context of a request to determine the required authentication level.
Adaptive authentication
Data in the /etc/passwd file that contains user data such as full names, addresses, phone numbers, and more.
GECOS data
A consensus document of 20 crucial controls designed to begin the process of establishing a prioritized baseline of information security measures and controls.
CIS controls
This is the most effective security control that you can deploy today. only the trusted and expected executables can execute on a system, and no others. Allow list of software.
Application control
