2.3 Troubleshoot common security issues

Question 1

Unencrypted credentials/cleartext

Answer 1

• Ensure you are using secure protocols like Secure Shell (SSH)
• Ensure that you are using SSL/TLS to secure communications with any compatible protocol (HTTP, email, etc.)

Question 2

Logs and event anomalies

Answer 2

Automated alerts (via email, etc.) allow admins to identify and troubleshoot these issues.

Question 3

Permission issues

Answer 3

Solution: A system of permission auditing that regularly reviews privileges.

Question 4

Access violations

Answer 4

Logging intrusions or attempted intrusions.

Question 5

Certificate issues

Answer 5

The most common certificate issue is the client rejecting a server certificate.

• Existing certificate: check the expiration date.
• New certificate: check key usage settings. Or verify clients have correct chain of trust, they need root and intermediate CA certificates before a leaf certificate can be trusted.

Question 6

Misconfigured Firewall

Answer 6

This will become apparent due to users reporting failure in data traffic.
Troubleshoot:
- Try connecting from both sides of the firewall. If it connects from outside but not inside the firewall, this confirms the issue is the firewall.

Question 7

Misconfigured Access points

Answer 7

Troubleshoot:

• Ensure that wireless AP’s are implementing WPA/WPA2 with strong passphrase or enterprise authentication.
• Ensure clients have correct passphrase or that AP’s communicate with RADIUS servers.
• Ensure no other wireless signals are interfering with the AP’s transmission.

Question 8

Weak security configurations

Answer 8

When installing/configuring a device or software, you must use a security policy to determine the strongest possible configuration, not just leave it default.

Question 9

Personnel - Policy violation

Answer 9

• Determine the policy that was violated
• Bring it to the person’s attention
• Suggest ways for the person to comply better in the future
• To prevent reoccurrence, develop a training program.

Question 10

Personnel - Insider threat

Answer 10

• Conduct an exit interview and thoroughly offboard the terminated employee.
• Employ personnel management tasks like mandatory vacation and job rotation to reduce the amount of power any one employee holds.
• Regularly review and audit privileged users’ activities.

Question 11

Personnel - Social engineering

Answer 11

• Train users on how to spot social engineering attempts and mitigate their efforts.
• Uphold the principle of least privilege to minimize the effects of a successful social engineering attack.

Question 12

Personnel - Social media and personal email

Answer 12

• Remind employee of the policy and how divulging too much information on social media can help attackers.
• Technical control: implement data loss/leak prevention (DLP) solutions to prevent personnel from sending sensitive info to external user or websites.

Question 13

Unauthorized software

Answer 13

2 types of execution control:

• Whitelist: nothing can run if it is not on the approved whitelist
• Blacklist: anything not on the prohibited blacklist can run

Question 14

Baseline deviation

Answer 14

Testing the actual configuration of clients and servers to ensure that they are patched and that their configuration settings match the baseline template.

Question 15

License compliance violation (availability and integrity)

Answer 15

Availability: the software vendor may suspend all licenses if the customer is found to be non-compliant.
Integrity: Unlicensed software exposes an organization to large fines and penalties.

Troubleshoot:

• Identify unlicensed and unauthorized software. Audit devices
• Don’t over-allocate seats compared to what their license agreement allows.
• Prepare for vendor audits.
• Ensure compliance with open source licensing terms

Question 16

Asset management

Answer 16

• Ensure relevant assets are participating in a tracking system like barcodes or radio frequency IDs (RFIDs)
• Tag newly acquired assets
• Remove obsolete assets from system
• Check assets for conflicting IDs
• Check assets for inaccurate metadata
• Update asset management software to fix any bugs or security issues

Question 17

Data exfiltration

Answer 17

Definition: unauthorized copying or retrieval of data from a system.
Troubleshoot:
- Encrypt data
- Create offsite backups
- Ensure access controls are implemented
- Restrict types of network channels