2.1 Security Concepts Flashcards
the process of maintaining systems, such as computer hardware and software, in a desired state. A method of ensuring that systems perform in a manner consistent with expectations over time.
• The only constant is change
– Operating systems, patches, application updates, network
modifications, new application instances, etc.
• Identify and document hardware and software settings
– Manage the security when changes occur
• Rebuild those systems if a disaster occurs
– Documentation and processes will be critical
Configuration management
a visual representation of a computer or telecommunications network. It shows the components that make up a network and how they interact, including routers, devices, hubs, firewalls, etc.
• Network [this] - Document the physical wire and device
• Physical data center layout
– Can include physical rack locations
• Device [this] - Individual cabling
Diagrams
an agreed description of the attributes of a product, at a point in time, which serves as a basis for defining change. A change is a movement from this baseline state to a next state.
• The security of an application environment
should be well defined
– All application instances must follow this baseline
– Firewall settings, patch levels, OS file versions
– May require constant updates
• Integrity measurements check for the
secure baseline
– These should be performed often
– Check against well-documented baselines
– Failure requires an immediate correction
Baseline configuration
a convention for naming things. [This] differ in their intents, which may include to: Allow useful information to be deduced from the names based on regularities. • Create a standard – Needs to be easily understood by everyone • Devices – Asset tag names and numbers – Computer names - location or region – Serial numbers • Networks - Port labeling • Domain configurations – User account names – Standard email addresses
Standard naming conventions
consists of Internet Protocol (IP) addresses and two special cases of IP addresses: broadcast addresses and loopback addresses. Internet addresses. The Internet Protocol (IP) uses a 32-bit, two-part address field.
• An IP address plan or model
– Consistent addressing for network devices
– Helps avoid duplicate IP addressing
• Locations
– Number of subnets, hosts per subnet
• IP ranges
– Different sites have a different subnet
– 10.1.x.x/24, 10.2.x.x/24, 10.3.x.x/24
• Reserved addresses
– Users, printers, routers/default gateways
IP schema
the process of safeguarding important information from corruption, compromise or loss. The importance of data protection increases as the amount of data created and stored continues to grow at unprecedented rates.
• A primary job task
– An organization is out of business without data
• Data is everywhere
– On a storage drive, on the network, in a CPU
• Protecting the data
– Encryption, security policies
• Data permissions
– Not everyone has the same access
Data Protection
data is subject to the laws and regulations of the geographic location where that data is collected and processed. [This] is a country-specific requirement that data must remain within the borders of the jurisdiction where it originated.
– Data that resides in a country is subject to
the laws of that country
– Legal monitoring, court orders, etc.
• Laws may prohibit where data is stored
– GDPR (General Data Protection Regulation)
– Data collected on EU citizens must be stored
in the EU
– A complex mesh of technology and legalities
• Where is your data stored?
– Your compliance laws may prohibit
moving data out of the country
Data sovereignty
the process of modifying sensitive data in such a way that it is of no or little value to unauthorized intruders while still being usable by software or authorized personnel.
• Data obfuscation
– Hide some of the original data
• Protects PII
– And other sensitive data
• May only be hidden from view
– The data may still be intact in storage
– Control the view based on permissions
• Many different techniques
– Substituting, shuffling, encrypting, masking out, etc.
Data masking
a way of translating data from plaintext (unencrypted) to ciphertext (encrypted).
• Encode information into unreadable data
– Original information is plaintext, encrypted
form is ciphertext
• This is a two-way street
– Convert between one and the other
– If you have the proper key
• Confusion
– The encrypted data is drastically different
than the plaintext
• Diffusion
– Change one character of the input, and many
characters change of the output
Data encryption
data that has reached a destination and is not being accessed or used. It typically refers to stored data and excludes data that is moving across a network or is temporarily in computer memory waiting to be read or updated. • The data is on a storage device – Hard drive, SSD, flash drive, etc. • Encrypt the data – Whole disk encryption – Database encryption – File- or folder-level encryption • Apply permissions – Access control lists – Only authorized users can access the data
Data at-rest
data actively moving from one location to another such as across the internet or through a private network. • Data transmitted over the network – Also called data in-motion • Not much protection as it travels – Many different switches, routers, devices • Network-based protection – Firewall, IPS • Provide transport encryption – TLS (Transport Layer Security) – IPsec (Internet Protocol Security)
Data in-transit
data that is currently being updated, processed, erased, accessed or read by a system. This type of data is not being passively stored, but is instead actively moving through parts of an IT infrastructure.
• Data is actively processing in memory
– System RAM, CPU registers and cache
• The data is almost always decrypted
– Otherwise, you couldn’t do anything with it
• The attackers can pick the decrypted information
out of RAM
– A very attractive option
• Target Corp. breach - November 2013
– 110 million credit cards
– Data in-transit encryption and data at-rest encryption
– Attackers picked the credit card numbers out of the
point-of-sale RAM
Data in-use
the process of replacing sensitive data, such as credit card numbers, with unique identification data while retaining all the essential information about the data. Because [this] is a non-destructive form of obfuscation, data is recoverable via a unique security key.
• Replace sensitive data with a non-sensitive placeholder
– SSN 266-12-1112 is now 691-61-8539
• Common with credit card processing
– Use a temporary token during payment
– An attacker capturing the card numbers
can’t use them later
• This isn’t encryption or hashing
– The original data and token aren’t mathematically related
– No encryption overhead
Tokenization
a subset of digital rights management, technologies that protect sensitive information from unauthorized access. It is sometimes referred to as E-DRM or Enterprise Digital Rights Management. • Control how data is used – Microsoft Office documents, email messages, PDFs • Restrict data access to unauthorized persons – Prevent copy and paste – Control screenshots – Manage printing – Restrict editing • Each user has their own set of rights – Attackers have limited options
Information Rights Management (IRM)
makes sure that users do not send sensitive or critical information outside the corporate network. The term describes software products that help a network administrator control the data that users can transfer. • Where’s your data? – Social Security numbers, credit card numbers, medical records • Stop the data before the attackers get it – Data “leakage” • So many sources, so many destinations – Often requires multiple solutions in different places [This] systems • On your computer – Data in use – Endpoint DLP • On your network – Data in motion • On your server – Data at rest
Data Loss Prevention (DLP)
