4.1 Secure Baselines Flashcards

Question

WPA3 and GCMP

Answer 1

Wi-Fi Protected Access 3 (WPA3) – Introduced in 2018 * GCMP block cipher mode – Galois/Counter Mode Protocol – A stronger encryption than WPA2 * GCMP security services – Data confidentiality with AES – Message Integrity Check (MIC) with – Galois Message Authentication Code (GMAC)

Answer 2

WPA3 changes the PSK authentication process – Includes mutual authentication – Creates a shared session key without sending that key across the network – No more four-way handshakes, no hashes, no brute force attacks * Simultaneous Authentication of Equals (SAE) – A Diffie-Hellman derived key exchange with an authentication component – Everyone uses a different session key, even with the same PSK – An IEEE standard - the dragonfly handshake

Answer 3

Gain access to a wireless network – Mobile users, temporary users * Credentials – Shared password / pre-shared key (PSK) – Centralized authentication (802.1X) * Configuration – Part of the wireless network connection – Prompted during the connection process

Answer 4

Configure the authentication on your wireless access point / wireless router * Open System – No authentication password is required * WPA3-Personal / WPA3-PSK – WPA2 or WPA3 with a pre-shared key – Everyone uses the same 256-bit key * WPA3-Enterprise / WPA3-802.1X – Authenticates users individually with an authentication server (i.e., RADIUS

Answer 5

Identification – This is who you claim to be - Usually your username * Authentication – Prove you are who you say you are – Password and other authentication factors * Authorization – Based on your identification and authentication, what access do you have? * Accounting – Resources used: Login time, data sent and received, logout time

Answer 6

One of the more common AAA protocols – Supported on a wide variety of platforms and devices – Not just for dial-in * Centralize authentication for users – Routers, switches, firewalls – Server authentication – Remote VPN access – 802.1X network access * RADIUS services available on almost any server operating system

Answer 7

Port-based Network Access Control (NAC) – You don’t get access to the network until you authenticate * Used in conjunction with an access database – RADIUS, LDAP, TACACS+

Answer 8

Extensible Authentication Protocol (EAP) – An authentication framework * Many different ways to authenticate based on RFC standards – Manufacturers can build their own EAP methods * EAP integrates with 802.1X – Prevents access to the network until the authentication succeeds

Answer 9

Supplicant - the client * Authenticator - The device that provides access * Authentication server - Validates the client credentials

Answer 10

A balance between time and quality – Programming with security in mind is often secondary * Testing, testing, testing – The Quality Assurance (QA) process * Vulnerabilities will eventually be found – And exploited

Answer 11

What is the expected input? – Validate actual vs. expected * Document all input methods - Forms, fields, type * Check and correct all input (normalization) – A zip code should be only X characters long with a letter in the X column – Fix any data with improper input * The fuzzers will find what you missed – Don’t give them an opening

Answer 12

Information stored on your computer by the browser * Used for tracking, personalization, session management – Not executable, not generally a security risk – Unless someone gets access to them * Secure cookies have a Secure attribute set – Browser will only send it over HTTPS * Sensitive information should not be saved in a cookie – This isn’t designed to be secure storage

Answer 13

Static Application Security Testing (SAST) – Help to identify security flaws * Many security vulnerabilities found easily – Buffer overflows, database injections, etc. * Not everything can be identified through analysis – Authentication security, insecure cryptography, etc. – Don’t rely on automation for everything * Still have to verify each finding – False positives are an issue

Answer 14

An application is deployed – Users run application executable or scripts * So many security questions – Has the application been modified in any way? – Can you confirm that the application was written by a specific developer? * The application code can be digitally signed by the developer – Asymmetric encryption – A trusted CA signs the developer’s public key – Developer signs the code with their private key – For internal apps, use your own CA

Answer 15

Applications cannot access unrelated resources – They play in their own sandbox * Commonly used during development – Can be a useful production technique * Used in many different deployments – Virtual machines – Mobile devices – Browser iframes (Inline Frames) – Windows User Account Control (UAC)

Answer 16

Real-time information – Application usage, access demographics * View blocked attacks – SQL injection attempts, patched vulnerabilities * Audit the logs – Find the information gathering and hidden attacks * Anomaly detection – Unusual file transfers – Increase in client access