Chapter 1 - Security Governance Through Principles and Policies Flashcards
1
Q
What does CIA stand for?
A
Confidentiality, Integrity and Availability
2
Q
What does DAD stand for?
A
Disclosure, alteration, and destruction
3
Q
Concepts to assess confidentiality
A
Sensitivity,
Discretion,
criticality,
concealment,
secrecy,
privacy,
seclusion,
isolation
4
Q
Sensitivity
A
Quality of information, which could cause harm or damage if disclosed
5
Q
Discretion
A
Act of decision where an operator can influence or control disclosure in order to minimize harm or damage
6
Q
Criticality
A
Level of which information is missin critical is its measure of criticality. The. higher the level the more likly to maintain higher confidentiality
7
Q
Concealment
A
Act of hiding or preventing disclosure
8
Q
Secrecy
A
Acto of keeping something a secret or preventing the disclosure of information
9
Q
Privacy
A
Refers to keeping information confidential
10
Q
Seclusion
A
Involves storing in an out of the way location
11
Q
Isolation
A
Act of keeping something separated from others
12
Q
Integrity
A
Dependent on confidentiality and access control - Concepts include Accuracy, Truthfulness, Validity, Accountability, Responsibility, Completeness, Comprehensiveness
13
Q
AAA Services
A
Identification, Authentication, Authorization, Auditing, Accounting
14
Q
Defense in Depth
A
Also known as LAYERING. Is the use of multiple controls in a series. No one control can protects against all possible threats.
15
Q
Abstraction
A
Used for efficiency. Similar elements are put into groups, classes, or roles.
16
Q
Data Hiding
A
Preventing data from being discovered by positioning in a logical storage compartment that is not accessible or seen
17
Q
Security through obscurity
A
Idea of not informing a subject about an object being present and hoping will not be discovered
18
Q
Security governance
A
Collection of practices related to supporting, evaluating, defining, and directing the security efforts of an organization
19
Q
Who is responsible for security governance?
A
Board of directors, CEO, CISO.
20
Q
ATO
A
Authorization to operate. Failing to provide sufficient documentation to meet requirements of third party governance can result in loss of ATO.
21
Q
Security Management Planning
A
Ensures creation, implementation and enforcement of a security policy. Aligns security functions to the strategy, goals, mission, and objectives of the organization.
22
Q
COBIT 5 Principles
A
Created by ISACA, COBIT allows practitioners to govern and manage IT
framework help organizations optimize their IT management and governance processes by meeting contractual agreements and complying with the latest regulatory and legal requirements.
-meeting stakeholder needs,
-covering the enterprise end-to-end,
-applying a single integrated framework,
-enabling a holistic approach,
-and separating governance from management
23
Q
AUP
A
Acceptable Use Policy defines what is and what is not acceptable activity practice or use of company equipment and resources.
24
Q
Collusion
A
When several people work together to perpetrate a crime
25
What is important when addressing Multiparty Risk
When several entities or organizations are involved in a project use SLAs to address risks.
26
Risk Conceptual Formula
risk = Threat * Vulnerability or
risk = probability of harm * severity of harm
27
Six Elements of Quantitative Risk Analysis
1) Asset Vauation (AV)
2) Exposure Factor (EF)
3) Single Loss Expectancy (SLE)
4) Annualize Rate of Occurence (ARO)
5) Annualized Loss Expectancy (ALE)
6) Cost Benefit Analysis of countermeasures
28
Exposure Factor (EF)
% of loss that an organization would experience if a specific asset is violated by a realized risk
29
Single Loss Expectancy (SLE)
Potential loss associated with a single relaized threat against a specific asset
SLE = AV * EF
SLE is expressed in $$
30
Annualized Rate of Occurrence (ARO)
Expected frequency a specific threat or risk will occur per year
31
Annualized Loss Expectancy (ALE)
ALE = SLE * ARO
ALE = AV * EF * ARO
32
Risk Reponse
Mitigation or Reduction
Assignment or Transfer
Deterrence
Avoidance
Acceptance
Reject or Ignore
33
Total Risk
Total Risk = threats * vulnerabilities * asset value
34
Controls Gap
Controls Gap = Total Risk - Residual Risk
Controls Gap is the amount of risk that is reduced by implementing safeguards
35
ACS
Annual Cost to Safeguard
36
STRIDE
The STRIDE threat model is a developer-focused model to identify and classify threats under 6 types of attacks
Spoofing,
Tampering,
Repudiation,
Information Disclosure,
Denial of Service,
Elevation of Priviledges
To identify threats and vulnerabilities
And develop countermeasures
37
Potential Annual Cost of a Safeguard
Cost/Benefit Calculation or Analysis
[ALE Pre-Safeguard - ALE Post-Safeguard] - Annual Cost of Safeguard ACS =
Value of the safeguard to the company
Negative is Bad, Positive is Good
38
Types of Security Controls
Preventive
Deterrent
Detective
Compensating
Corrective
Recovery
DIrective
39
Preventive Controls
Deployed to thwart or stop unwanted or unathorized activity
40
Deterrent
Discourage security policy violations
41
Detective
Deployed to discover or detect unwanted or unauthorized activity
42
Compensating
deployed to provide various options to other existing controls to aid in enforcement and support of security policies
43
Corrective
Modifies the environment to return systems to normal after an unwanted or unauthorized activity has occurred
44
Recovery
Extension to corrective controls but have more advanced or complex activities. Looks to repair or restore resources, functions, and capabilities after a security policy violation.
45
Directive
Deployed to direct, confine, or control actions of subjects to force or encourage compliance with security policies.
46
Computer Fraud and Abuse Act
Amendment to The first major piece of US cybercribe -specific legislation. 1986
To address hacking with penalties
47
Federal Sentencing Guidelines
Provided punishment guidelines to help federal judges interpret computer crime laws
48
Federal Information Security Management Act (FISMA)
Required a formal Infosec operations for federal government
49
Copyright and the Digital Millennium Copyright Act
Covers literary, musical, and dramatic works. DMCA prohibits the circuvention of copy protection mechanisms placed in digital media and limits the liability of the internet service providers for the activities of their users.
50
Security Control Assessment (SCA)
Formal evaluation of a security infrastructure individual mechanisms against a baseline or reliability expectation.
51
RMM
Risk Maturity Model - Assess keyindicators and activities or a mature, sustainable, and repeatable risk management process
52
RMF
Risk Management Framework.
NIST RMF in SP 800-37 establishes mandatory security requirements for federal agencies.
53
What are the six cyclical phases of NIST RMF?
Prepare
Categorize
Select
Implement
Assess
Authorize
Monitor
54
Whaling
Type of spear phishing targeted at high value individuals
55
Smishing
SPam over instant messaging.
56
VIshing
Phishing over telephony or voice comm systems
57
Spoofed email
email with falsified source address. DMARC is used to filter spoofed messages
58
Hoax
Form of social engineering designed to convince targets to perform an action that will cause problems or reduce IT security
59
BCP
Business Continuity Planning - Four main steps 1) Project Scope and Planning, 2) Business impact analysis, 3) Continuity Planning, 4) Approval and implementation
60
BC and DR Terms
MTD - Max tolerable downtime
RTO
RPO
ARO - Annualized Rate of Occurence
61
BCP
Focuses on the whole business
62
DRP
Focuses on technical aspects of recovery
63
Criminal Law
Serve to protect society against computer crimes.
64
Civil Law
Provide for an orderly sociatey and governs matters that are not crimes but require an impartial arbiter to settle dispute.
65
Administrative Law
Executive brand of the US government that requires agencies with a wide ranging set of responsibilites to ensure the government functions effectively
66
Computer Fraud and Abuse Act (CFAA)
First major piece of cybercrime specific legislation. Covers computer crimes that cross state boundaries to avoid infringing on state rights. CFAA was amended in 1994.
67
National Information Infrastructure Protection Act of 1996
Another amendement to CFAA designed to further extend to computer systems used in international commerce.
68
FISMA - Federal Information Security Management Act
Passed in 2002. Requires federal agencies to implement an information security program to cover agency's operations. Includes contractor activities.
NIST - National Institute of Standards and Technology is responsible for developing the implementation guidelines.
1) Periodic assessment of risk
2) Establish policies and procedures based on the risk assessments
3) Subordinate plans for adequate info security for networks, facilites, info systems, etc
4) Security awareness training
5) Periodic testing and evaluation
6) Process for planning, implementing, evaluating, and documenting remedial actions
7) Procedures for detecting, reporting, and responding to security incidents
8) Plans and procedures to ensure continuity of opertions for information systems
69
Federal Cybersecurity Laws of 2014
By President Barack Obama
2 key bills:
1) Federal Info Systems Modernization Act (confusingly FISMA) - Centralized federal cybersecurity under Homeland Security. Excludes defense related and national intelligence related cybersecurity issues.
2) Cybersecurity Enhancement Act - charges NIST with responsibility for coordinating nationwide work on voluntary cybersecurity standards. (i.e. NIST SP 800-53, SP 800-171, Cybersecurity Framework)
3) National Cybersecurity Protection Act - charged the Dept of Homeland Security with establishing a national cybersecurity and communication integrations center. Interface between federat agencies with civilian orgs to share cyber information.
70
Copyright Law
Guarantees creators of original work of authorship - protect against duplication
Literary, Musical, Drama, Patomimes, Pictorical, Movies, sound, architectural works
For computers it is the source code
Protection period - works by one or more authors are protected 70 years after the last surviving author. Works for hire and anonymous works are provided protection for 95 years from the date of first publication or 120 years from the date of creation, which ever is shorter.
71
Digital Millenium Copyright Act (DMCA)
1998. Limited the liability of internet service providers when their circuits were used by criminals to violate copyright laws.
72
Trademark
Protects words, slogas, and logos used to identify a company, products and services
73
Patents
Protect intellectual property rights of inventors. 20 year period from the time of the invention (date of initial application)
74
Trade Secrets
Not published or made public. Kept a secret and control measure must be put in place.
75
Four Common Types of License Agreements
Contractual
Shrink Wrap
Click Through
Cloud Services (click through to the extreme)
76
ITAR - International Traffic in Arms Regulations
Controls exports of items that are specifically designated as military and defense items including technical inforation.
77
EAR - Export Administration Regulations
Covers export regulations of a broader set of items that are designated for commercial use but have military application.
78
BIS - Dept of Commerce Bureau of Industry and Security
Regulates export of encryption products
79
Privacy Act of 1974
Limits the ability of federal government agencies to disclose private citizen information without prior written consent. Mandates agencies to maintain only records necessary for conducting business. Destroy records no longer needed. Provides formal procedure for individuals to gain access to their data and request incorrect records to be amended.
Only applies to government agencies
80
ECPA - Electronic Communications Privacy Act - 1986
Makes it a crime to invade electronic privacy of an individual. Expands on the Federal Wiretap Act. Protects against the monitoring of email and voice mail communic
81
CALEA - Communications Assistance for Law Enforcement of 1994
Amend ECPA to allow wiretaps for law enforcement with an appropriate court order regardless of technology use.
82
Economic Espionage Act of 1996
Extends definition of property to include proprietary economic information
83
HIPAA - Health Insurance Portability and Accountability Act of 1996
Established strict security measures to protect patient medical records in terms on how it is processed and stored. It also clearly defines the rights of individuals who are the subject of medical records and requires organizations that maintain such records to disclose these rights in writing.
84
HITECH - Health Information Technology for Economic and Clinical Health Act of 2009
Amendment to HIPAA. Changed how the law applies to business associates, which are orgs that handle the protected PHI data from HIPAA covered entities. Covered entities and BAs must be governed by a written contract know as the BAA agreement. BAs are subject to HIPAA rules. HITECH also introduced data breach notification requirements. Breaches must notify individuals as well as the secretary of heal and human services and the media - breaches must affect more than 500 individuals.
85
COPPA - Children's Online Privacy Protection Act of 1998
COPPA demands websites that cater to children to have
1) Privacy notice that states the type of information collected and what its used for
2) Parents must have the opportunity to review any info collected and have the ability to delete
3) Parents must give verifiable consent to collect info for 13 and younger
86
Gramm Leach Bliley Act of 1999 - GLBA
Allowed commercial banks, investment banks, securities firms, and insurance companies were allowed to consolidate. Set limitations on the type of info that can be exchanged among subsidiaries and required the provision of privacy policies to all customers.
87
USA PATRIOT Act of 2001
Providing Appropriate Tools Required to Intercept and Obstruct Terrorism..
Broadened powers of law enforcement when monitoring electronic communications.
Chnaged how government worked with ISPs. Can obtain user activity data via subpoena.
88
EU GDPR - General Data Protection Regulation
Key Provisions
-Lawfulness, Fairness and transparency
-Purpose Limitation
-Data Minimization
-Accuracy
-Storage Limitation - "right to be forgotten"
-Security
-Accountability
89
Sensitive Data
Any information that is not public or unclassified. PII, PHI, Proprietary
90
Government Data Classification
Top Secret, Secret, Confidential, Unclassified
91
Non Governmental Data Classification
No set standard. Typical, Confidential/Proprietary, Private, Sensitive, Public
92
Data States
Data at rest, in Transit, in use
93
What are "air gaps"
A physical security control and means that systems and cables from the classified network never physically touch those from unclassified.
94
DLP
Data Loss Prevention
1) Network Based - scans all outgoing data. Placed on edge of network.
2) End Point - scans files stored on a system as well as files sent to other systems.
95
Data Remanence
Is the data that remains on media after the data was supposedly erased.
Degaussers can be used to erase data on magnetic media only
For SSD must be destroyed
96
Data Erasing
Only removes the directory or catalog link to the data. The actual data remains on the drive and over time slowly re written.
97
Clearing Data
Or overwriting. Unclassified data is written over all addressable locations on the media. Example single character or bit pattern is writtne over the entire media. May still be possible to retrieve data using sophisticated lab or forensic techniques
98
Purging Data
More intense clearing process. Multiple clearing passess. Combines with degausing. Not trusted by the US government.
99
Degaussing
USe of strong magnetic field to erase media. Does not work with optical CDs, DVDs or SSDs
100
Crytographic Erasure
Destruction of the encryption key. For cloud this may be the only method or secure deletion.
101
Digital Rights Management (DRM)
Data protection method to provide copy right protection for copyrighted works.
102
DRM License
Typically a small file that includes a terms of use and decryption key to grant access
103
Persistent Online Authentication - Always ON DRM
Requires systems to be connected to the internet. Periodically connects to authentication server.
104
Continuous Audit Trail
Combined with persistence it can track abuse such as concurrent use of product across different geos.
105
Automatic Expiration
Subscription basis products limited to 30 days
106
CASB - Cloud Access Security Broker
Monitors all activities from on-prem to cloud traffic. Ensures policies such as encryption at rest on cloud is enforced. Or detecting Shadow IT.. Logs all activities. Includes authentication and authorization controls to cloud resources.
107
Pseudonymization
Process of using pseudonyms to represent other data. Its an alias. Useful for GDPR
108
Tokenization
Use of a token, random string of characters, to replace other data. Typically for Credit Card transactions.
109
Anonymization
Used when personal data is not needed. Process of removing all relevant data so that it is theoretically impossible to identify original subject or person.
Randomized masking - swaps data in individual columns so records no longer represent actual data.
Can not be reversed
110
Data Owners
Person who has ultimate org responsibility for data, CEO, Department Head.
Data Classification
Security Controls
Rules for appropriate use
Establish security requirements for system owners
Access and priviledges and access rights
Identification and assessment of common security controls where info resides
111
Asset Owner
Individual who owns the asset or system that process sensitive data.
Develops and maintains security plan
Training personnel
Assist in identification, implementation, and assessment of common security controls.
112
Business and Mission Owners
Responsible for ensuring systems provide value to the organization
Use of governance methods like COBIT to help business owners and mission owners balance security control requirements with business and mission needs.
113
Data Processors vs Data Controllers
Data processor per GDPR is natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller
Data Controller - Controls / collects the processing of data
114
Data Custodians
Data owners often delegate day to day tasks to data custodians. Custodians protect integrity and security of data. Store, protected, backed up, audited/logs. Typically IT.
115
Administrators
Many orgs views any individual with elevated privileges to be administrators
116
Use of Security Baselines
Use of Imaging to establish systems baselines and then use of auditing processes to ensure no changes are made
NIST SP800-53 identifies baseline security controls
117
Tailoring and Scoping of Security Baselines
Tailoring modifies list of security controls baselines to align with organization mission.
Scoping is part of the tailoring process that reviews the baseline list of controls and selecting only those that apply to the IT systems trying to protect.
118
Four Fundamental Goals of Cryptography
Confidentiality, Integrity, Authentication, and Non Repudiation
Data at Rest, in Motion and in Use
119
Types of Cryptosystems that enforce confidentiality
Symmetric and Asymmetric
120
Digital Signatures
Ensures data was not altered in transit. Created upon transmission of a message.
121
Non Repudiation
Provides assurance to the recipient of a message that it originated by the sender and not someone else masquerading. It also prevents sender from claiming they did not send.
Only achievable using Asymmetric or Public Key cryptosystems
122
Kerckhoff's Principles
The thought of allowing Algorithms to be public and known. The secret is kept in the keys themselves. Allows for more scrutiny on the algorithms and flush out exposures sooner for change and improvements.
123
Plaintext
Message prior to being encrypted. "P"
124
Cypertext
Message after encryption. "C"
125
Keys
All cryptographic algorithms rely on Keys. These are nothing more than a number. Large#
126
Key Space
Range of values that are valid for use as a key for a specific algorithm.
127
Cryptography
The art of creating and implementing secret codes and ciphers
128
Cryptanalysis
Study of methods to defeat codes and ciphers
129
Cryptology
combined Cryptography and Cryptoanalysis
130
AND Operation
Checks whether both values are true
131
OR Operation
Check whether at least one of the values is true
132
NOT Operation
Reverses the value of the input
133
XOR Exclusive OR
Returns true value only when one of the values is True
134
Modulo Function
The remainder value left after a division operation
135
One Way Functions
Mathematical operation that easily produces output values for each possible combination of inputs but makes it it impossible to retrieve the input values.
136
Nonce
Method used to add randomness to encryption process. A nonce is a random number that acts as a placeholder for mathematical functions.
137
Zero Knowledge Proof
Appears in cyptography in cases where one individual wants to demonstrate knowledge of a fact (i.e. password or key) without actually disclosing the secret to the other individual.
138
Split Knowledge
Information or privilege required to perform an operation is divided among multiple users. Separation of duties and two-person control . Best example is KEY ESCROW - key is stored with third party for safekeeping. Environments where only one escrow recovery agent exists there is opportunity for fraud. M of N Control requires a min number of agents to work together,
139
Work Function
The amount of time and effort required to perform a complete brute force attack against and encryption system
140
Codes vs Ciphers
Not the same. Codes are crypto systems of symbols that represent word or phrases, are sometimes secret, but are not always meant to provide confidentiality. Ciphers are always meant to hid the true meaning of the message -work at the bits and blocks.
141
Transposition Cipher
Use of encryption algorithm to rearrange the letters of a plaintext message forming ciphertext message.
142
Substitution Cipher
Use of encryption algorithm to replace each character or bit with a different character
143
One Time Pads
Powerful type of substitution cipher. Function. Ciphertext C = (PlainText P + EncrypKey K) Mode 26. key Must - Randomly generated, Physically Protected, Used only Once, must be as long at the message to be encrypted.
144
Running Key Cipher
Also known as a book cipher. Key is often as long at the message itself and chosen from a common book newspaper or magazine.
145
Block Cipher
Operate at the "chunk" or blocks level and apply the encryption to an entire message block at the same time. Transposition ciphers are examples.
146
Stream Cipher
operate on one character or bit at a time. Caesar cipher and one time pad are examples.
147
Confusion and Diffusion
These are the two basic operations crypto algorithms use to obscure plain text messages.
148
Pro and Cons of Symmtric KEY Cryptography
pro - performance
cons - Key distribution, does not implement non-repudiation, algorithm is not scalable, keys must be regenerated often.
149
Strengths of Asymmetric Key Cryptography
1) Addition of new users requires generation of only one public private key pair
2) Easy removal of users via a key revocation mechanism
3) Key generation is only needed when private key is compromised
4) Provides integrity, authentication and non repudiation
5) Simple key distribution
6) No preexisting communication link needs to exist
Major weakness is slow performance
150
Hybrid Cryptography
Where Asymmetric cryptography is used to share symmetric private keys to enable a secure and performant communication.
151
Hashing Algorithms
Public key cryptosystems can provide digital signature capabilities when used in conjunction with message digest.
Message digest (also known as hash values or fingerprints) are summaries of a messsages content produced by a hashing algorithm.
Message digest are designed to protect the INTEGRITY of a piece of data. Detects changes or alterations.
152
Electronic Code Book Mode (ECB)
Type of Crypto mode of operation.
Simplest mode in that it simply encrypts the block using a chosen secret.
Easy to break bc if eavesdrpped can easily build code book and decrypt.
Impractical and used only for short small amount os data exchanges.
153
Cipher Block Chaining (CBC)
Type of Crypto mode of operation
Each block of unencrypted text is XORed with the block of cyphertext immediately preceeding it before it is encrypted.
Errors are easy to propagae.
154
Cipher Feedback Mode (CFB)
Streaming cipher version of CBC. Operates agains data produced in real time.
155
Output Feedback Mode (OFB)
Same as CFB mode but instead of XORing and encrypted version of the previous block of the ciphertext, OFB XORs the plaintext with a seed value.
156
Counter Mode (CTR)
Similar to CFB and OFB as a stream cipher, but uses a simple counter that increments for each operatrion. Errors do not propagate.
157
Galois Counter Mode (GCM)
Takes CTR and adds authenticity giving assurances to the integrity of the data received.
158
Counter with Cipher Block Chaining Message Authentication Code Mode (CCM)
Similar to GCM it offer both authenticity and confidentiality. Combines CTR for confidentiality with Cipher Block Chaning Message Code algorithm for authenticity. Used only with block ciphers that have 128 bit block length and requires a nonce that must change for each transmission.
159
Data Encryption Standard (DES)
US gov published in 1977
No longer secure
64 Bit cipher
Five modes - ECB, CBC, CFB, OFB, and CTR
KEY Used is 56 bits long
160
Triple DES
Stronger adapted version of DES but also no longer considered adequate.
161
International Data Encryption Algorithm
Developed in response to the insufficient key length of the DES algorithm.
Operates on 64 bit blocks of plain text. However it begins operation with a 128 Bit key.
Operates in DES, ECB, CBC, CFB, OFB, and CTR.
162
Blowfish
Another block cipher operates on 64 Bit blocks of text.
Allows use of variable length keys rainging from 32 bits to 448 bits. With more security eats away at performance.
163
Skipjack
Approved for use in US gov in FIPS 185, Escrowed Encryption Standard (EES). Operates on 64 Bits blocks of text. Uses 80 bit key and supports the four DES modes of operation.
It supports the escrow of encryption keys
Skipjack and the CLipper chip were not embraced by the crypto community due to mistrust of the escrow procedures from the US gov.
164
Rivest Ciphers (RC)
Ron Rivest of Rivenst-SHamir-Adleman Data Security
Symmtric Cipher
165
RC4
Stream cipher developed in 1987
Single round of encryption
Use variable key lengths - 40 to 2048 bits
166
RC5
Variable block sizes (32, 63 or 128 bits)
Key sizes between 0 to 2040
167
RC6
Next version of RC5
Uses 128 bit block size
Allows use of 128, 192 or 256 symmetric keys
168
Advanced Encryption Standard
Oct 2000 NIST announced Rijndael block cipher was chosed to replace DES. Allows use of 128, 192, and 256 Key sizes. Only allows 128 bit block processings.
169
CAST
Algorithms are another family of symmetric block cipers.
Two forms CAST -128 and CAST-256.
170
Three main methods to securely exchange Symmetric Keys
Offline distribution
Public Key Encryption
Diffie-Hellman
171
M of N Control
A protection measure that requires that a minimum number of agents (M) out of the total number of agents (N) work together to perform high-security tasks.
172
Split Knowledge
A process by which a cryptographic key is split into multiple key components, individually sharing no knowledge of the original key, which can be subsequently input into, or output from, a cryptographic module by separate entities and combined to recreate the original cryptographic key.
173
Initialization Vector (IV)
An initialization vector (IV) is an arbitrary number that can be used with a secret key for data encryption to foil cyber attacks. This number, also called a nonce (number used once), is employed only one time in any session to prevent unauthorized decryption of the message by a suspicious or malicious actor.
174
VIgenere Cipher
type of substitution cipher used for data encryption in which the original plaintext structure is somewhat concealed in the ciphertext by using several different monoalphabetic substitution ciphers rather than just one; the code key specifies which particular substitution is to be employed for encrypting each plaintext symbol.
175
Steganography
is the practice of concealing information within another message or physical object to avoid detection. Steganography can be used to hide virtually any type of digital content, including text, image, video, or audio content. That hidden data is then extracted at its destination.
Content concealed through steganography is sometimes encrypted before being hidden within another file format. If it isn’t encrypted, then it may be processed in some way to make it harder to detect.
176
How many keys required per # of users in Symmetric crypto
N(N-1)/2
177
RSA
Most famous public key cryptosystem. RSA public key algorithm remain a worldwide standard today.
1977
Ronald Rivest, Adi Shamir and Leonard Adleman
178
ELGamal
Another asymmetric algorithm which takes the principles of DIffie Hellman key exchange (for Symmetric Key Exchanges) can be extended to support an entire public key cryptosystem.
Open to public domain
Downside is that it doubles the size of the message it encrypts.
179
Elliptic Curve
ECC, an alternative technique to RSA, is a powerful cryptography approach. It generates security between key pairs for public key encryption by using the mathematics of elliptic curves.
Formulaic problem is more difficult and harder to break than RSA, Diffie-Hellman or ElGamal.
Key length is important but due to the nature of ECC, crypto key of 256 ECC is equivalent to a 3072bit RSA key.
180
DIffie Hellman Key Exchange
Allows two individuals to generate a shared secret key over an insecure communication channel.
This is an example of public key cryptography.
Key exchange protocol, NOT an encryption protocol.
Used to establish a symmetric encryption communication channel. "Hybrid Cryptography"
Used in TLS
181
Hash Functions
Real of digital signatures. Proof that a message originated from a specific user.
They take a potentially long message generate a unique output value derived from the content of the message. This is referred as a "message digest"
SHA
MD5
RIPEMD
182
Five requirements of a Hash Function
!) The input can be of any length
2) The output has a fixed length
3) Easy to compute for any input
4) One way function (hard to determine input with the output)
5) Collision resistant
183
SHA - Secure Hash Algorithm
SHA 1 - 160 bit message digest.
Deprecated 2017
SHA 256 - 256 message digest, 512 block size
SHA 224 - 224 message digest using 512 block size. Truncated version of 256
SHA 512 - 512 message digest 1024 block size
SHA 384 is the truncated version of 512
SHA 2 Generally considered secure
184
MD5
Message Digest developed by Ronald Rivest same as RSA.128 bit 512 blocks.
No longer viable due to attacks
185
RIPEMD
Used in Bitcoin
128 bit digest.
Not secure
Latest secure version is RIPEMD-160 - 160 bit hash
186
Digital Signatures
Ensures messages truly came from sender and no modifications in transit.
Ensures crypto goals of integrity, authentication and non repudiation
187
HMAC
Hashed message authentication code - implements a partial digital signature, it guarantees the integrity of the message during transmission ,but does not provide non-repudiation. Relies on a shared key.
188
Digital Signature Standard DSS
Authentication Algorithms
NIST specifies which digital signature algorithms are acceptable for federal use.
Today must use SHA-3
DSS also specifies acceptable encryption algorithms - DSA - Digital Signature Algorithm
RSA,
ECDSA - Elliptic Curve DSA.
189
Certificat Enrollment
Proving to the CA your identity
190
Certificate Signing Request
Provide your public key to the CA, who in turn provides you with a X.509 certificate signed with the CA Private Key
191
Different Types of CA Certificates
Domain Validation - CA validates certificate subject has control of domain name
Extended Validation - higher level of assurance that subject is a legitimate business
192
Certificate Verification
Check digital signature of the CA is authentic
You trust the CA
Certificate is no on a CRL (Certificate Revocation List)
Cert actually contains the data you are trusting
193
Certificate Pinning
Instructs browsers to attach a cert to a subject for an extended period of time.
194
Why Certificates are Revoked
Compromised
Erroneously issued
Details of cert changed
Security association changed ( no longer work or employed by org)
195
Techniques for Cert Revocation
Certificate Revocation List - Latency due to the need to download and sync
Online Certificate Status Protocol (OCSP) - Real time checks via an OCSP server. Burden this server, high activity.
Certificate Stapling is an extension to OCSP to relieve workload. Allows certificates to be "stapled" for a period of time typically 24 hrs where it can be reused.
196
Hardware Security Modules
Provides and effective way to manage encryption keys. Store and manage keys. SImple as a Yubikey or datacenter services offered through IaaS services.
197
Hybrid Cryptography
Takes the best of both worlds of Synmetric and Assymtric keys and combines
Ephemeral Key is a temporary key exchanged once asymmetric crypto connection is established and exchange of a Symmtric key. Ease of deployement + performance.
198
PGP or Pretty Good Privacy
Secure email system - 1991. Combines CA hierarch with Web of Trust concept. You must become trusted by one or more PGP users to begin using the system..
199
S/MIME
Secure/Multipurpose Internet Mail Extentions - Emerged as the defacto standard for encrypted emails.
200
Symmetric Encryption Algorithms
AES
Rijindael
Blowfish
DES
3DES
Rivest Cipher 4
RC5
RC6
Skipjack
CAST 128
CAST 256
Twofish
IDEA
201
Public Key Crypto System - Asymmetric Algorithms
For Key Exchange
RSA
Merkle Hellman Knapsack
ElGamal
Elliptic Curve
Diffie-Hellman Key Exchange
202
Hash Algorithms
SHA
MD5
RIPEMD
203
TLS Transport Layer Security
It is important to understand that beyond looking at the TLS version and ensuring it is one of those supported, one needs to also look at the cipher suite it support.
Cipher suites are combinations of encryption algorithms used together
204
What are the four components of a Cipher Suite
1) Key Exchange Algorithm ( RSA, Diffie Hellman)
2) Authentication Algorithm
3) Bulk Encryption Algorithm
4) Hash Algorithm
205
Tor or The Onion Router
Provides a mechanism for anonymous routing traffic across the internet using encryption and relay nodes. Leverages "perfect forward secrecy" where layers of encryption prevent nodes in the relay chain from reading anything bu what they need to manage traffic.
206
Steganography
The art of using cryptographic techniques to embed secret messages within another message.
207
Circuit Encryption
Link Encryption lower in the OSI layer
End to End Encryption higher in the OSI layer. Header, Trailer, address and routing data is not encrypted like Link Encrypt.
208
IPSec
Architecture framework for secure communications over IP. Network traffic.
Set by Internet Engineering Task Force (IETF)
Two components 1) authentication header - message integrity and non repudiation, 2) encapsulating security payload - confidentiality and integrity of packet contents.
209
IPSec Modes of Operation
Transport Mode - only packet payload is encrypted. End to End encryption
Tunnel Mode - - entire packetincluding header is encrypted. Link encryption
210
Homomorphic Encryption
Technology allows ability to perform computtion on data while it is encrypted.
211
Analytic Attacks
Attacks logic of the algorithms
212
Implementation Attacks
Exploits weaknesses in the implementation of the crypto system. Exploits software code.
213
Statistical Attacks
attacks the hardware or OS for statistical weaknesses such as floating point errors or inability to produce truly random numbers.
214
Brute Force Attack
Attempts every possible valid combination for keys or passwords.
The time required to discover a password/key is proportional to the length of it. There are way to shorten this via 1) Ranbow tables, 2) Specialized scalable computing hardware.
215
Fault Injection Attacks
Compromise by causing external fault for example by using high voltage electricity, high/low temps, or other factors to cause malfunction.
216
Side Channel Attack
Monitor system activity "footprints" to attack the information being actively encrypted.
217
Timing Attacks
Example of a side channel attack which measures how long crypto operations take to complete to undermine security
218
Salts and Passwords
Combats brute force attacks. A cryptographic salt is a random value that is added to the end of a PW before the OS hashes the pw and stored.
219
Frequency Analysis and Ciphertext Only Attack
Looks at the encrypted cyphertext message and counts the number of times a letter appears and determines the types of ciphers being used for example a transposition or substitution cipher.
220
Known Plaintext Attack
Attacker has a copy of the encrypted message and the plain text. This allows to break weaker codes.
221
Chosen Plaintext Attack
Attacker obtains cypher texts and corresponding plain texts of their own choosing to determine key
222
Chosen Ciphertext Attack
Attacker has the ability to decrypt chosen portions of the ciphertext and use the decrypted portions to discover the key
223
Meet in the Middle Attack
Attacks algorithms that use two rounds of encryption. Reason why 2DES was quickly deemed nonviable.
Attacker uses a known plain text and searches for every possible encryption (K1) and decryption keys (K2) to find a match.
224
Man in the Middle Attack
Attacker sit in the middle of two communicating parties and intercepts all communication. This attackers sets up secure sessions with both the sender and recipient.
225
Birthday Attack
During a birthday attack, the attacker tries to find two different input messages that produce the same hash value, called a collision. By finding a collision, the attacker can deceive a system into believing that two other notes are identical. For instance, they can forge a digital signature or crack a password hash.
226
Replay Attack
Attacks systems that dont incorporate temporal protections , ie. timestamps and expiration periods, challenge response mechanims and encrypting authentication session. Attacker intercepts an encrypted message and later replays it to open a new session.
227
Common Password Hashing Algorithms
PBKDF2
bcrypt
scrypt
For Key stretching
228
Transitive Trust
When subject A request Object B and in turn Subject B requests from Object C. In essense A receives data from C..
Serious security concern.
229
Design Principles and Failure Handling
Fail Soft - Is to allow a system to continue to operate after a component failure
Must assess between Physical and Digital World
In the physical world if Human protection is prioritized - Fail Safe
If asset is the priority then - Fail Secure
In the physical world Fail Open is synonimous to Fail Safe and Fail Closed is synonimous to Fail Secure
In the Digital world the protection revolves around Availability and Confidentialigy/Integrity. Fail Open prioritizes Availability over C/I. Fail Closed prioritizes the reverse.
230
Software design and KISS
Dont Repeat yourself - eliminate redundant code
Computing Minimalism - code that uses lease amount of hw/sw resources
Rule of Least Power - use of least powerful programming language
Worse is Better - Quality does not mean increase in capabilities and function
You are not gonna need it - Dont add capabilities until is actually necessary
231
Zero Trust
No longer a security perimeter
Never Trust Always Verify
232
Microsegmentation
Dividing an internal network into numerous subzones. Communications between zones are filtered and may require authentication, require session encryption and subject to allow list and block list controls.
233
Privacy by Design
Have developers integrate privacy protections early in design.
Proactive and not reactive
Preventive not remedeial
Privacy as a default
Privacy embedded in design
Full Functionality
End to End security
Visbility and transparency
Respect for user privacy
234
Trust but Verify
Traditional approach of trusting subjects and devices in a company's security perimeter automatically.
No longer sufficient.
235
Development techniques to ensure CIA
Confinement is making sure that an active process can only acces specific resources (such as memory)
Bounds is the limitation of authorization assigned to a process to limit the resources the process can interact with and the types of interactions
Isolation is the means by which confinement is implemented through the use of bounds.
236
What are the different methods to describe the necessary security attributes of an object?
Tokens - separate object with attributes
Capabilities List - maintains row of security attributes - look ups
Labels - permanent part of the object - attached - can not be altered.
237
What are Security Models
Ways to formalize security policies in code. Provides set of rules that a computer can follow to implement fundamental security concepts, processes, and procedures of a security policy. Provides sw designers a mesurement for their implementations.
238
TCB - Trusted Computing Base (Security Model)
Combination of HW, SW and controls to meet enforce security policy.
Must be as small as possible.
Each TCB must adhere and enforce policy
Security Perimeter - is the boundary
Must establish Trusted Paths of communication in to out of perimeter
Trusted Shell - for communication command line operations
Reference Monitor - Validates access to every resource prior to granting access
Security Kernel - collection of components in the TCB that work together to implement reference monitor functions
239
State Machine Security Model
Describes a system that is always secure no matter what state it is in.
State transistions
IF each posible state and transitions meet security policies
The system is called a secure state machine
240
Information Flow Security Model
Based on the state machine model , controls information flow and ensures all authorized flows and prevents unauthorized flows.
Used to establish relationship between two version or states
241
Non Interference Security Model
Concerned with how the actions of a subject at a higher security level affect the system state or the actions of a subject at a lower security level. Subject A/ High should not affect or interfere with actions of Subject B/Low.
242
Take Grant Security Model
Dictates how rights can be passed from one subject to another - Employs a directed graph.
Used to figure out when rights in the system can change and where leakage (unintended distribution of permissions) can occur.
4 Rules for Rights
1) Take Rule - Take rights
2) Grant Rule - Grant rights
3) Create Rule - Create rights
4) Remove Rule - Remove rights
243
Access Control Matrix
Used by systems to quickly determine whether a requested action by a subject for an object is authorized.
244
Bell-LaPadula Model
From DoD - 1970
Multilevel security policy - Littice based
Prevents leaking or transfer of classified info to less secure clearance levels
Solely focused on Confidentiality
3 Principles
1) Simple Security Property - Subject may not read information at higher sensitivity level - No REad Up
2) *Star Security Property - Subject may not write information to a lower sensitivy level - No Write Down - "Confinement Property"
3) Discretionary Security Property - System uses an access matrix to enforce discretionary access control
First two states which the system can transition. All states end secure.
245
Biba Model
Focuses on Integrity
Prevents modification of objects by unauthorized subjects, prevent unauthorized modification of objects by authorized subjects, and protect internal and external object consistency.
Principles:
1). Simple Integrity Property - States subject cannot read an object at a lower integrity level - No Read Down
2) * Star Integrity Property - States subject cannot modify object at higher integrity level - No Write Up
246
Clark Wilson Model
Not a State machine, Not Latticed model
Enforces Data Integrity
It uses a three part subject/program/object relationship called - Access Control Triplet
2 Principles:
1) Well formed Transactions - Programs
2) Separation of Duties
Subject can only access object through a program, interface or access portal. No direct access to objects.
247
Brewer and Nash Model
To address conflict of interest
Permits access controls to change dynamically based on user previous activity.
"chinese wall", "ethical wall" , "cone of silence"
248
Goguen Meseguer Model
Integrity Model
Foundation for NonInterference concepts and model.
Based on predetermining the set or domain of objects that a subject can access. Subjects in one domain can not interfere those of other.
249
Sutherland Model
Integrity Model
Model is based on the idea of defining a set of system states, initial states, and state transitions. Through these predetermined states integrity is maintained and interference prohibited.
250
Graham Denning Model
Focused on the secure creation and deletion of both subjects and objects
Securely create an object
Securely create a subject
Securely delete an object
Securely create a subject
Securely provide the read access right
Securely provide the grant access right
Securely provide the delete access right
Securely provide the transfer access right
251
Harrison Ruzzo Ullman Model
Fo uses on assignment of object access rights to subjects as well as the resilience of those assigned rights. Extension of the Graham Denning Model
HRU access rights can be represented in a matrix
252
Common Criteria
Buyers consider systems that have been subject to formal evaluation
Common Criteria offers a subjective product evaluation model, key objectives
1) add buyer confidence in security of product
2) elimination of duplicate evaluations
3) make evaluations cost effective and efficient
4) adherence to high and consistent standards
5) promote evaluation
6) functional evaluation and assurances of the target evaluation
TOE - target of evaluation
PP - Protection profile - specifies the requirements and protections to be evaluated
ST - Security Targets - vendor claims "I will provide"
EAL - Evaluation assurance levels 1-7
253
What are the four types of Authorizations an AO (Authorizing Offical) to an ATO?
Authorization to Operate
Common Control Authorization - Security control is inherited from another provider
Authorization to Use - Issued when a 3rd party provider (i.e. cloud service) provides IT/IS servers that are deemed to have a risk acceptable level.
Denial of Authorization
254
Multitasking (Processor)
To handle tow or more tasks simultaneously.
255
Multicore (Processor)
Means a CPU now a chip contains two/four/dozen or more independent cores that can operate simultaneously or independently.
256
Multiprocessing (Processor)
A multiprocessor system harness the power of more than one processor to complete the execution of a multithreaded application.
257
Multithreading (Processor)
This is at a process level.
Permits multiple concurrent tasks to be performed within a single process.
Unlike multitasking where multiple tasks consist of multiple processes.
Multithreading is used in applications where frequest context switching between multiple active processes causes excessive overhead. Switching between threads is more efficient.
258
Multiprogramming (Processor)
Similar to multitasking
Is a way to batch or serialize multiple processes so that when one process stops to wait on a peripheral, its state is saved and the next process in line begins to process.
259
Protection Rings (Processor)
organize code and components in the OS into circles of priviledge.
Ring 0 - Kernel
Ring 1 Other OS components
Ring 2 Drivers protocols
Ring 3 User level programs and applications
0-2 priviledge mode
3 - User mode
Ensures right access to data by the right component in the runtime environment
260
Process States (Processor)
Or Operating states are the various forms of execution which a process may run.
Ready State - Process is ready to resume or begin processing
Running State - Or problem state executes on the CPU and continues until finishes, its time slice expires or it is blocked. if stopped goes back to ready or if paused goes to Waiting
Waiting State - Waiting for I/O to be serviced before continuing.
Supervisory State - When process must perform an action that requires priviledges greater than the problem state's set of priviledges.
Stopped State - Process finishes or must be terminated
261
ROM
Read Only Memory. Several types
1) PROM - Programable
2) ERPOM - Erasable. Ultraviolet EPROM can be erased with a light.
3) EEPROM - Electronically Erasable - Use electric voltages to force erasure
4) Flash Memory - Non volatile form of storage media that can be electronically erased and rewritten.
262
RAM
Random Access Memory
Real Memory - Main or primary memory
Cache RAM - takes data from slower device to temporary store for faster access.
Data is lost with loss of electrical power
Two types of RAM - Dynamic and Static
Dynamic leverages a charge to maintain bits 1 or 0. Bc the charge fades, the cpu needs to refresh to maintain data
Static RAM maintains the data with a logical device called "flip flop". Does not incur CPU, performs faster, but is more expensive.
263
Registers
On board memory in CPU for the ALU ( arithmetic logical unit) to perform calculations or processes instructions.
264
Memory Addressing
Means to refer to various locations in memory
1) Register Addressing
2) Immediate Addressing - A way of referring to data that is supplied to the CPU as part of an instruction.
3) Direct Addressing - cpu is provided actual memory location to address. Must be on the same memory page.
4) Indirect Addressing - cpu is provided a memory address that contains another where the data resides.
5) Base+Offset - uses a value stored in one of the CPU registers as the base from which to begin counting to compute the desired memory location.
265
Secondary Memory
Used to refer to magnetic, optical or flash based media or other storage devices that contains data not immediately accessble to the CPU.
Data must first be read into real memory.
Virtual memory is a type of secondary memory.
266
Primary and Secondary
Primary Memory = Primary Storage
Secondary Memory = Secondary Storage
267
Volatile vs Non Volatile
Measure of how likely to lose data when power is turned off or cycled.
268
Random vs Sequential
Most secondary storage is random
Tape is an example of sequential where you have to read through all data prior to the desired location.
269
Emanation attack
where adversaries intercept electronic or radio frequencies - i.e. monitors, network cables, modems, mobile
TEMPEST countermeasures originally a government research aimed at protecting equipment from electro magnetic pulse during nuclear explosions, expanded to study this area of vulnerability.
270
TEMPEST Countermeasures
Faraday Cage - external metal skin, wire mesh that surrounds room, buliding, etc
White Noise - broadcase of false traffic
Control Zone - Implementation of both Faraday and White noise to protect an area.
271
Firmware
Also known as Microcode
Software stored in ROM
272
BIOS - Basic Input Output system
Embedded in motherboards EEPROM or flash chip.
Contain the OS independent privimitive instructions that a computer needs to start up and load the OS from disk.
273
UEFI - Unified Extensible Firmware Interface
Supports all same functions as BIOS + more, such as support for larger hard drives, faster boot times, enhanced security etc.
274
Flashing
Process of updating the UEFI, BIOS, or firmware.
Hacker attacks on this is Phlashing
275
Boot Attestation or Secure Boot
Check on a signed preapproved digital certificate.
276
Measure Boot
Optional feature of UEFI that takes a hash calculation to ensure no components where compromised.
277
Symmetric Multiprocessing SMP
Single computer contains multiple processors created equally and controlled by a single OS
278
Asymmetric Multiprocessing AMP
Processors operating independently with own OS and/or task instruction set, dedicated data bus and memory resources
279
Massive Parallel Processing MPP
Collection of AMP linked together to work on a single primary task.
280
Industrial Control Systems
A Programmable Logic Controller (PLC) is used to control a single device in a standalone manner
A Distributed Control System is used to interconnect several PLCs, but within a limited physical range in order to gain centralized control management and oversight through networking
SCADA (supervisory control and data acquisition) expanded to large scale physical areas to interconnect multiple DCSs and PLCs.
281
Edge and Fog Computing
Edge performs processing on the distributed edge close to where data originates. Fog computing performs centralized processing of data collected by distributed sensors.
282
Cyber Physical Systems
Offer computational means to control something in the physical world. Examples - prosthetics to provide human augmentation or assistance, collision avoidance, air traffic control, robot surgery etc.
283
Service Oriented Architecture SOA
This architecture constructs applications or functions out of existing but separate and distinct sw services.
New apps or functions need to be vetted.
284
Microservices
Derivative of SOA. Is one element, feature, capability, business logic or function on a web.
Each must have clearly defined and secure APIs for cross I/Os
285
Infrastructure as Code (IaC)
AWS CloudFormation, Terraform, or Puppet.
286
Virtual Software
SW deployed that it is fooled to believe it is interacting with a full host OS. Instead any interactions with a supposedly OS is intercepted by isolation manager and recorded into a file. This fools the app to believe it is interacting with the OS.
This is sandboxing.
Transform app to be portable.
Evolved to containerization concept.
287
Virtual Desktop Infrastructure
Hosting of desktop/workstations OS virtual machines on central servers that are remotely accessed.
Reduce security risk.
288
VM Escaping
Occurs when software within a guest OS is able to breach the isolation protection provided by the hypervisor and violates the container of other guest OS or infiltrate the host OS.
289
Containerization
Based on the concept of eliminating the duplication of OS elements in a virtual machine.
290
What is the difference between serverless architecture and platform as a service
In PaaS the entire execution environment or platform is spun up to host an application and it is always running, consuming resources and racking up costs. With Serverless Architecture or FaaS, the functions run only when called and then terminate when operations complete.
291
Content Management
Control over mobile devices and the access to content hosted on company systems as well as teh control of access to company data stored on mobile devices
292
Application Control
Device management that limits which applications can be installed on a device.
293
Rooting or Jailbreaking
Action of breaking the digital rights management (DRM) security on the bootloader or a mobile device in order to be able to operate the device with root or full system privileges.
294
HSM - Hardware Security Modules
Hardware security modules (HSMs) are hardened, tamper-resistant hardware devices that secure cryptographic processes by generating, protecting, and managing keys used for encrypting and decrypting data and creating digital signatures and certificates.
295
System Security Policy
Inform and guide the design, development, implementation, testing and maintenance of a particular system.
296
What is a critical path analysis
Is a systematic effort to identify relationships between mission critical applications, processes, and operations and all necessary supporting elements.
297
Technology convergence
when various technologies merge over time. This can be a single point of failure.
298
Crime Prevention Through Environmental Design
CPTED. Core principle is that the design of the physical enviornment can be managed, manipulated and crafted with intention in order to create behavioral effects or changes in people present in those areas that reduce crime as well as fear of crime.
Strategies
1) Natural access control
2) Natural surveillance
3) Natural territorial reinforcement
299
Physical Security Design order of operations
Deter
Deny
Detect
Delay
Determine
Decide
300
Cable Plant Management Facility
Elements include:
1) Entrance facility - where cable from provider connects to the internal cable plant
2) Equipment Room - main wiring closet for the building
3) Backbone distribution system - provides wired connections between the equipment room and telecommunications room, including cross floor connections
4) Wiring Closet - serves connection needs for a floor or section of a large building. Also known as IDF intermediate distrubtion fram, telecommuncations room, and intermediate distribution facilities.
5) Horizontal distribution system - provides connection between telecommunications room and work areas
301
Gait Analysis
Pertains to cameras and video surveillance. Evaluation of the way someone walks as a form of biometric authentication.
302
SCIF
Sensitive Compartmented Information Facility. Used by government and military.
Provide a secure environment for highly sensitive data storage and computation.
303
UPS
Uninterrupted Power Supply
Double Conversion - takes power out of the wall outlet, store in battery, pulling power out to feed whatever devices connected. Ensures common, streamlined quality feed.
Line Interactive - Non in line. If the grid fails will automatically switch to the battery. Has surge protectory, battery charger/inverter and voltage regulator.
304
Power Issues
Fault - momentary loss of power
Blackout - complete loss of power
Sag - momentary low voltage
Brownout - prolonged low voltage
Spike - Momentary high voltage
Surge - Prolonged high voltage
Inrush - surge of power usually associated with power source connect
Ground - electrical circuit for alternate pathway to flow to earth.
305
Noise
Is the interference of power through some form of disturvance, interruption or fluctuation,
EMI is electromagnetic interference. Two types - Common mode noise and Traverse mode.
RFI or radio frequency interference
306
Hot and Cold Aisles
Technique to arrange server rakes in lines separated by ailes.
307
Occupant Emergency Plans OEP
GUides and assists with sustaining personnel safety in the wake of a ddisaster.
308
OSI - Open Systems Interconnection
Layer 7 - Application
Layer 6 - Presentation
Layer 5 - Session
Layer 4 - Transport
Layer 3 - Network
Layer 2 - Data Link
Layer 1 - Physical
309
OSI encapsulation / de encapsulation
Communcation between OSI layers occur through encap and deencap
Headers and footers
Peer layer communcations
310
OSI Layer 7 - Application
Responsible for interfacing user application, network services or the OS with the protocol stack.
311
OSI Layer 6 - Presentation
Formats data. Also responsible for encryption and compression
312
OSI Layer 5 - Session
Responsible for establishing, maintaining and terminating communication sessions between two computers
Simplex
Half Duplex
Full Duplex
313
OSI Layer 4 - Transport
Manages the integrity of a connection and controllling the session.
TCP/ UDP/ TLS protocols operate in this layer
314
OSI Layer 3 - Network
Reponsible for logical addressing and performin routing. Routers are the primary network hardware in this layer.
Distance vector vs link state
315
OSI Layer 2 - Data Link
Formats packets to frames for transmission
Deals on actual physical addresses - MAC, NIC Ethernet
Protocols includ the Address Resolution Protocol ARP
Switches and bridges are the hardware devices in this layer
316
OSI Layer 1 - Physical
Converts frams into bits for transmission of the physical connection
317
TCP/IP
Four layers instead of 7 in OSI
Application
Transport
Network Interface
Link
318
Protocol Analyzers
Examines contents of network traffic.
Also called sniffer, netowkr evaluator, network analyzer, traffic onitor, or packet capturing utility..
Places NIC in promiscuous mode.
Sets rules for capture and display filters.
319
OSI Application Layer Protocols
Telnet, TCP Port 23 - SUpports remote connectivity for executing commands and running applications. No transfer of file support
FIle Transfer Protocol FTP - TCP Ports 20 and 21
Trivial FIle Transfer Protocol TFTP UDP Port 69
Simple Mail Transfer Protocol SMTP - TCP Port 25
Post Office Protocol POP3 TCP Port 110
Internet Message Access Protocol IMAP4 TCP Port 143
Dynamic Host Configuration Protocol DHCP - UDP Ports 67server and 68 for client
Hypertext transfer protocol HTTP TCP Port 80
HTTPS TCP Port 443
Line Printer Daemon LPC TCP Port 515
X Window TCP Port 6000-6063
NFS TCP Port 2049
SImple Network Management Protocol - SNMP UDP Port 161
320
Transport Layer Protocols
Two primary protocols of TCP/IP is TCP (full duplex) and UDP (simplex)
Done using ports
Port numbers are 16 digit binary numbers totalling 2^16 or 65,536
Firlst 1024 are well known ports used by servers
From 1024 to 49151 are registered software ports used by networking software products
From 49153 to 65535 are random, dynamic or ephemeral ports used by clients.
3 way hand shack - client send SYNC, Server SYNC/ACK, and client ACK
321
TCP vs UDP
TCP for data delivery. Guarantees data delivery. Retrys
UDP used when delivery of data is not essential. Best effort. No error detection or corrections, no sequencies, no flow control. Used for real time streaming - audio, video.
322
Domain Name
Computer name is a "temporary" Human Friendly covention assigned to an IP address
323
IP Address
Temporary logical address assigned over or onto the MAC Address
324
MAC Address
Permanent physical address
325
DNS - Domain Name System
Resolves human friendly domain name with IP address
DNS operates over TCP and UDP over port 53
326
FQDN Fully Qualified Domain Name
Top Level Domain TLD - is the .com
Registered Domain - is the google
Subdomain or hostname is the www
FQDN can exceed 253 characters. Any sincle section cant exceed 63.
327
DoH - DNS over HTTPS
Creates an encypted session with a DNS server of TLS protected HTTP and uses that session as a form of VPN to protect then DNS query and response
328
ODoH - Oblivious DoH
Adds a DNS proxy between the client and the DNS resolvers so the identity of the requesting client is isolated from the DNS resolvers. Provides anonimity and privacy to the DNS queries.
329
DNS Poisoning Attacks
DNS Poisoning
Rogue DNS Server
DNS Cache Poisoning
DNS Pharming
Altering the Host File
Corrupt the IP Configuration
DNS Query Spoofing
Use Proxy Falsification
330
DNS Poisoning Defenses
Limit zone transfers from internal to external DNS servers
Require internal clients to resolve all domain naes through the internal DNS
Limit the external DNS servers from which internal DNS servers pull zone transfers
Deploy a network intrusion detection system NIDS
Harden DNS and clients systems
Use DNSSEC to secure infrastructure
Use DoH or ODoH on all clients
331
Domain Hijacking
Malicious act of changing registration of a domain name without the authorization of the owner
332
Typosquatting
takes advantage of user mistypes of the domain or IP and redirects traffic
333
Homograph attack
takes advantage on similarities in character sets to register phony international domain names that to the naked eye look legitimate
334
URL Hijacking
Practice of displaying a link or adverstisement that looks like a well known product, service or site
335
Clickjacking
Means to redirect a user's click or selection on a web to an alternate malicious site
336
IPv4 vs IPv6
IPv4 uses 32 bits vs IPv6 uses 128
New with IPv6 : scoped addresses, autoconfiguration, and QoS
Concerns of Transition
1) More addresses that attackers can use
2) IPv6 requires that all security filtering and monitoring products be fully upgraded to IPv6
3) Loss or lack of NAT - reduces privacy due to the lack of masking of the actual IP address from private to public realms
337
Ways for IPv4 and IPv6 to co-exist
Dual stack, tunneling, or NAT-PT. Network address translation Protocol translation.
338
Secure Communications Protocols
IPSEC
Kerberos
SSH
Signal Protocol
Secure Remote Procedure Calls
Transport Layer Security. TLS
339
Implications of Multilayer Protocols
Benefits:
1) A wide range of protocols can be used at higher layers
2) Encryption can be in various layers
3) Flexibiity and resiliency in coplex network structures
Drawbacks:
1) Covert channels are allowed
2) Filters can be bypassed
3) Legally segmented network boundaries can be overstepped
340
Network Access Control (NAC)
Concept of controlling access to an environment through strict adherence to and enforcement of security policy. Automates detection and response. Reacts realtime. Monitors systems to be current on patches and updates and compliant with latest security confirutations. Keep unauthorized devices out of the network
341
Proxy
Provides clients on a private network with internet access while protecting their identities.
342
