4. Security Operations Flashcards
4.1 Mobile device hardening
use strong authentication password, biometrics, regular updates, enable remote-wipe capabilities
4.1 Hardening for workstations
Patch management, antivirus, access controls, firewalls
4.1 Hardening for switches
Change default credentials, ACLs, Firmware updates, network segmentation, logging
4.1 Hardening for routers
change default credentials, encrypted communication, firmware updates, disable unused services
4.1 Hardening for cloud infrastructure
IAM, conduct regular security audits, MFA, IRPs
4.1 Hardening for Servers
Firewalls, disable unnecessary services, strong authentication methods, monitoring, logging
4.1 Hardening for ICS/SCADA
SCADA: Supervisory Control and Data Acquisition
ICS: Industrial Control Systems
Segment to isolated part of the network, regular patching, IDS, backup and recovery
4.1 Hardening for Embedded Systems
They don’t get patch updates often. Install updates as soon as possible, network segmentation for these devices is encouraged.
4.1 Hardening for IoT
Update regularly
4.1 Mobile Deployment Models and their hardening techniques
MDM: mobile device management, implement access controls and remote wipe
BYOD: use containerization to separate corporate and personal data, endpoint security, user training
COPE (corporate owned, personally enabled): Fully manage and control these devices, app installation management, data protection for corporate data, regular audits.
CYOD (choose your own device): Identify a list of pre-approved devices, apply baselines, implement access controls, regular updates.
4.1 Wireless Hardening
WPA3, AAA/RADIUS, Cryptographic Protocols, Authentication Protocols
4.1 Authentication Protocols
RADIUS: centralized authentication, implement access control, maintain logs, encrypt RADIUS communications
Kereberos, OAuth2, SAML
4.1 Application Hardening
Input Validation, Secure Cookies (HTTPOnly flags), static code analysis, Code Signing
4.2 Procurement considerations for hardware, software, and data
Hardware: Evaluate vendors, ensure compatibility and scalability
Software: Acquire licenses/subscriptions or create custom software solutions. Review licensing agreements.
Data: Acquire data sources, databases, and services to interact with databases. Ensure protection standards.
4.2 Assignment/Accounting considerations for hardware, software, and data
Hardware: track ownership with individuals and departments. Classify hardware based on function and lifecycle stage.
Software: Assign licenses, classify software based on purpose and criticality.
Data: classify data based on sensitivty, confidentiality, and regulatory requirements. Ensure access controls.
4.2 Monitoring/Tracking considerations for hardware, software, and data
Hardware: up-to-date inventory, track asset locations, usage, and maintenance schedules.
Software: monitor usage and performance. track installations, updates, and patches. Ensure optimization.
Data: monitor data usage and access integrity. Track data flows and perform regular audits.
4.2 Disposal considerations for hardware, software, and data.
Hardware: properly dispose, including sanitizing data and physicall destroying hardrives. Obtain certificate of destruction.
Software: Decommission software that is no longer needed. Revoke licenses as needed. Ensure no residual data or configurations remain on devices.
Data: Sanitize and securely delete.
4.3 Application Vulnerability Management Techniques
Static Analysis
Dynamic Analysis
Package Monitoring
4.4 SCAP
Security Content Automation Protocol. Standardizes the way security software communicates.
4.4 Agent/Agentless tools
Agentless does not require installing a software.
4.4 Signature-based vs. Heuristic-based antivirus
signature-based usually identifies previously known threats. Heuristic-based uses rulesets and pattern recognition to identify threats.
4.4 NetFlow
Network protocol developed by Cisco for collecting IP traffic and analyzing traffic flow and unusual activity.
4.5 Screened Subnet
AKA DMZ, used for public-facing applications. Establish proper firewall rules to allow specific traffic through.
4.5 URL Scanning
A web filter should use URL scanning to inspect URLs before allowing users to access them or users to pass them to the application.
On-demand inspection: URL Scanning ocurs in real-time when a user enters a URL or clicks a link.
URL is checked against known databases.
