2.1 Security Measures Flashcards
Summarise various security measures and their purposes
Logical controls
Prevent or allow access to resources once a user’s identity has been established. Can be hardware or software.
Auditing of logical controls
Once-off; examining the controls and procedures in place
Monitoring of logical controls
Ongoing checks of the controls and procedures in place
Managerial controls
Focuses on the design of the security or the policy implementation associated with the security
List three controls that fall under ‘managerial’
- Data classification and labelling
- Personnel supervision
- Security awareness training
Operational controls
Controls managed by people
Give two examples of operational controls
Guards at the front doors; security awareness training
Technical controls
Using own systems to prevent security events from occurring
Give two examples of technical controls
Firewall on the network; antivirus on workstations
Provide one advantage and one disadvantage of see-through fences
Employees and guards can see incoming threats; outsides can see inside the property
Provide one advantage and one disadvantage of non see-through fences
Outsiders are prevented from seeing in, but employees and guards can’t see incoming threats
What are some considerations when installing bollards?
Will they protect the most vital assets?
Do they still integrate with the environment so as not to be off-putting to customers/staff?
List two best practices for lighting
Always on and having motion sensors
Preventive control
Prevents access to a particular area
Give three examples of preventive controls
- Locks on a door
- Security guard
- Firewall
Detective control
Identifies and records that a security event has occurred but may not be able to prevent access
Give two examples of a detective control
- Motion sensor
- IDS
Corrective control
Designed to mitigate any damage that has occurred because of a security event
Give two examples of a corrective control
- IPS
- Offsite backup
Deterrent
A security measure that may deter someone from performing and intrusion
Compensating control
Attempts to recover from an intrusion by compensating for the issues caused
Give two examples of a compensating control
- Buying a new device and restoring from backup to replace an old one
- Having a generator in case of loss of power
Physical control
Something tangible that would prevent the security event
Proximity alarm
Alarm that turns on when there is movement in a certain area
Duress alarm
Can be manually triggered by someone when there is a threat
What may a mechanically operated lock also be referred to as?
Cipher lock
What is bad about fingerprint readers?
They are considered a hygiene issue
Name two security measures that could be used to protect a data cabinet
- Chassis lock
- Faceplate
List three types of badge readers that can be used as a way to log into a computer
- Magnetic strip
- Smart card
- RFID
Are badge readers contact or non contact based?
Contact-based
DAC
Object access is determined via and access policy set by the object’s owner
What are the two fundamental rules of DAC?
- Every object in a system must have an owner
- Each owner must determine the access rights and permissions for each object
MAC
An access control policy that is uniformly enforced across all subjects and objects within the boundary of an information system
What is the primary use case of MAC and why?
In organisations that deal with highly sensitive data (e.g. military, government, healthcare) because it has a high, centralised level of control
How are MAC criteria defined and enforced?
Defined by the system admin and enforced by the OS or security kernel. They cannot be altered by end users
What are the two factors that MAC considers when restricting access to a resource?
Sensitivity of information and authorisation level of the user
RBAC
Users are assigned permissions based on their role (and placed in groups) rather than being assigned permissions individually
Power user
A user with more rights than a normal user but not as many as an administrator
Zero-trust
A security framework that requires ALL users inside or outside the organisation to be authenticated, authorised and validated
What are the four steps to implementing a zero-trust framework?
- Reexamine all default access controls
- Employ a variety of prevention techniques and defense in depth
- Enable real-time monitoring and controls to identify and stop malicious activity
4 . Ensure the network’s zero-trust architecture aligns with a broader security strategy
MFA
Using two or more factors to prove a user’s identity
What are the five factors of MFA?
- Knowledge
- Ownership
- Characteristic
- Location
- Action
TOTP
A computer algorithm that generates a one-time password using the current time as a source of uniqueness
HOTP
Password is computed from a shared secret and synchronised across the client and the server
In-band authentication
Identity signals that rely on the same system that is requesting user authentication (verifies within the primary channel)
Out-of-band authentication
Uses a separate channel for verification
Is in-band or out-of-band authentication more secure?
Out-of-band
EMM
The set of people, processes and technology that enable centralised management and control of corporate mobile devices
Give three elements of EMM
- Tracking
- Controlling
- Securing
Contrast EMM and MDM
EMM uses policies and tools to manage the entire mobile ecosystem, whereas MDM focuses on simple management of devices and uses more technical controls
When would you set a phone to remote wipe?
- Incorrect password entered too many times
- Device attempts to connect to a network and doesn’t meet baseline requirements
List 6 technical controls used in MDM
- Application control
- Password/passcode functionality
- MFA requirements
- Token-based access
- Patch management
- Remote wipe
List 7 settings that can be used to manage security in the AD
- Domain-based security
- Security group
- Organisational unit
- Group policies
- Login scripts
- Home folders
- Folder redirection
How can you assign permissions to a security group in AD?
- Group policies
- Login scripts
- Access control list
What is an organisational unit
A way of dividing the domain into different administrative realms
Group policies
Allow for configuration of computer and user profile settings
Home folder
Private drive mapped to a network share
Folder redirection
Redirecting the path of a known folder to a new location. Can be done manually or by group policy, and can be a local folder or a directory on a file share
