4.1-4.4 Flashcards
3 steps of secure baselines
establish
deploy
maintain
mdm
mobile device management. used to mannage company owned mobile devices. set policies on apps,data, control the remote device
COPE
Corporate ownerd, personally enabled. company buys the device, used as both a corporate and personal. full control belongs to organization
CYOD
Choose your own device.
Like COPE but user chooses the device
wpa3 , psk authentication process
USES SAE to create pmk
creates a shared session key that doesn’t need to be sent across network. no fourway handshake no hash no brute force.
SAE
SAE-everyone uses the same psk with a different session key
AAA framework
authentication authorization accounting
radius
common aaa protocol, centralizes authentication. remote vpn access. server authentication.
input validation
check and correct all input
SAST
Static Application Security Testing. Help to identify security flaws in code. Not always accurate so needs verification
app monitoring
watch for blocked injection attempts, app usage, unusual file transfers, increase in client access
enumeration
list all parts of an asset (cpu,memory,storage drive, keyboard,mouse)
sanitization
system disposal or decommissioning, completely remove data. to destroy or to recycle
certification of destruction
certificate of destruction after device has been disposed of
data retention
backup your data
dynamic analysis(fuzzing)
send random input to an application, looking for something out of the ordinary. many diff types of fuzzing engines
cta
cyber threat alliance. members allow specific threat intelligence. this is a information sharing organization
prioritize vulnerabilities
not every vulnerability shares the same priority. some are critical some are not.
cvss
common vulnerability scoring system 0-10
exposure factor
loss of value of business activity if the vulnerability is exploited.
Example: a small ddos may limit access to a service. -50% exposure factor
secure enclave
the tpm of a mobile device
exception
not dealing with a vulnerability because it has low severity score. usually needs formal process to approve
risk tolerance
the amount of risk acceptable to an organization
reporting
ongoing checks for vulnerabilities
monitoring
archiving
access to data is critical,collecting older data and moving it to a protected location so that it can be retrieved if needed
alert tuning
a balancing act, prevent false positives and false neg
SCAP
Security content automation protocol. allows tools to identify and act on the same criteria. language for all tools to use basically
snmp
simple network management protocol uses mib managament information base that uses oid object identifiers to poll devices at fixed intervals over udp 161
snmp traps
over udp 162
