CH01 Overview of Security

Question 1

What is CIA Triad

Answer 1

Confidentiality - information has not been disclosed to unauthorized people
Integrity - information has not been modified without proper authorization
Availability - information is able to be stored, access, or protected at all times

Question 2

What is AAA of Security?

Answer 2

Authentication - When a person’s identity is established with proof and confirmed by a system
Authorization - Occurs when a user is given access to a certain piece of data or certain areas of a building
Accounting - Tracking of data, computer usage, and network resources

Question 3

5 Methods of authentication

Answer 3

Something you know - username and password
Something you are - finger print, eye scan
Something you have - token, driver license, credit card
Something you do - way you speak, way you sign your name
somewhere you are - location factor based on your GPS location

Question 4

What are 4 Security Threads?

Answer 4

Malware
Unauthorized Access
System Failure
Social Engineering

Question 5

What are 3 controls that you do to mitigate Threads?

Answer 5

Physical Controls - Alarm systems, locks, surveillance cameras, identification cards, and security guards

Technical Controls - Smart cards, encryption, access control lists (ACLs), intrusion detection systems, and network authentication

Administrative Controls - Policies, procedures, security awareness training, contingency planning, and disaster recovery plans

Question 6

What is White Hats Hacker

Answer 6

Non-malicious hackers who attempt to break into a company’s systems at their request

Question 7

What is Black Hats Hacker

Answer 7

Malicious hackers who break into computer systems and networks without authorization or permission

Question 8

What is Gray Hats Hacker

Answer 8

Hackers without any affiliation to a company who attempt to break into a company’s network but risk the law by doing so

Question 9

What is Blue Hats Hacker

Answer 9

Hackers who attempt to hack into a network with permission of the company but are not employed by the company (Freeland ethical hacker or freelance penetration tester)

Question 10

What is Elite Hacker

Answer 10

Hackers who find and exploit vulnerabilities before anyone else does. They create their own tools. They do their own programming and they’re the ones who are going to develop the tools that pretty much everyone else is going to end up using

Question 11

What is Script kiddies

Answer 11

Hackers who have limited skill and only run other people’s exploits and tools

Question 12

What is Hacktivists Hacker

Answer 12

Hackers who are driven by a cause like social change, political agendas, or terrorism

Question 13

What is Organized Crime Hacker

Answer 13

Hackers who are part of a crime group that is well-funded and highly sophisticated

Question 14

What is Advanced Persistent Threats Hacker

Answer 14

Highly trained and funded groups of hackers (often by nation states) with covert and open-source intelligence at their disposal

Question 15

4 Factors of thread intelligence and sources

Answer 15

1. Timeliness – property of an intelligence source that ensures it is up to date. Over the time the information is not as nearly as valuable.
2. Relevancy – property of an intelligence source that ensures it matches the use cases intended for it. Increase in attacks on Mac OS may not be as relevant for me if I use Windows or Linux.
3. Accuracy – property of an intelligence source that ensures it produces effective results. Information needs to be valid and true.
4. Confidence Level – property of an intelligence source that ensures it produces qualified statements about reliability. Information can be graded to check how good we think that information is.

Question 16

Three places you can get information from

Answer 16

Proprietary - threat intelligence that comes as a commercial service offering with a fee.

Closed-Source - Data that is derived from the provider’s own research and analysis efforts.

Open-Source - Data that is available to use without subscription

Question 17

Sources for open-source

Answer 17

▪ US-CERT
▪ UK’s NCSC
▪ AT&T Security (OTX)
▪ MISP
▪ VirusTotal
▪ Spamhaus
▪ SANS ISC Suspicious Domains

Question 18

What is Open-Source Intelligence (OSINT)

Answer 18

Methods of obtaining information about a person or organization through public records, websites, and social media

Question 19

What is Thread Hunting

Answer 19

cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring.
Proactive ways to look for threats.
Threat hunting is potentially less disruptive than penetration testing.
Penetration test – you’re trying to break into your system to demonstrate a weakness
Threat hunting – trying to analyze data within the systems we already have.

Question 20

3 types of attack frameworks

Answer 20

▪ Lockheed Martin Kill Chain - describes the stages by which a threat actor progresses a network intrusion
▪ MITRE ATT&CK framework - A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and common knowledge or procedures
▪ Diamond Model of Intrusion Analysis - A framework for analyzing cybersecurity incidents and intrusions by exploring the relationships between four core features: adversary, capability, infrastructure, and victim