CISSP terminology Flashcards
Availability terms:
MTD
RPO
RTO
Maximum Tolerable Downtime
Recovery Point Objective
Recovery Time Objective
Disaster vs Catastrophe?
todo check handerhan video
IAAAA
Identification: User should be uniquely Identified
Authentication: Validation of an entity’s identity claim
Authorization: Confirms that an authenticated entity has the privileges and permissions
necessary.
Auditing: Any activity in the application/system should be audited (Identify technical issues/
Breaches)
Accountability: Tracing an action to a subject
Strategic vs Tactical?
Strategic - Longer (5 years)
Tactical - Mid/Short (6 months to 1 year)
Operational - Shortest (Days to weeks)
US Government data classifications
Top Secret (Classified - grave damage to national security if disclosed)
Secret (Classified - critical/serious damage to national security if disclosed)
Confidential (Classified - serious/actual damage to national security if disclosed)
Sensitive But Unclassified
For Official Use Only
Unclassified
Note: for CISSP, sensitive typically means “neither public nor unclassified”
Security Roles
- Senior Manager - Management (Ultimately responsible)
- Security Professional - Information Security team
- Data Owner - Classifies the data
- Data Custodian - Takes care of day to day activity (performing backups)
- User - End user
- Auditor - Responsible for reviewing the data
STRIDE
S - Spoofing (authentication)
T - Tampering (integrity)
R - Repudiation (digital signatures)
I - Information Disclosure (encryption/confidentiality)
D - Denial of Service (availability, fault tolerance/redundancy)
E - Escalation of privilege (authorisation)
DREAD
D - Damage potential (How severe the damage likely to be if the threat is realized)
R - Reproducibility (How complicated it is for the attacker to reproduce the exploit)
E - Exploitability (How hard it is to perform the attack)
A - Affected users (How many users are likely to be affected)
D - Discoverability (How hard it is for an attacker to discover the weakness)
Asset, Threat, Vulnerability, Exploit, Control
Asset Valuation - Value of an asset
Risk: Likelihood that a threat will exploit a vulnerability in an asset.
Threat: Has the potential to harm an asset.
Vulnerability: A weakness; a lack of safeguard
Exploit: Instance of compromise
Controls: Protective mechanisms to secure vulnerabilities
• Safeguards: Proactive
• Countermeasure: Reactive mechanism
AV, EF, SLE, ARO, ALE?
AV = asset value EF = exposure factor = proportion of asset value lost in single event
SLE = AV * EF = single loss expectancy (expected loss from single event)
ARO = annualised rate of occurrence
ALE = SLE * ARO = annualised loss expectancy (expected loss each year)
Risk treatments
M - Mitigate (Reduce likelihood and/or impact) A - Accept A - Avoid T - Transfer/Assign D -Deter
R - Reject (not a real option)
Categories of law
- Criminal law: Law enforcement is involved (Murder) - reasonable doubt
- Civil Law: Designed to provide an orderly society & govern matters which are not criminal. {United states code} (Law suite, defamation cases) - preponderance of evidence
- Administrative Law: Covers topics as procedures to be used within federal agency. - balance of evidence ?
Goals of cryptography
P - Privacy (Confidentiality)
A - Authentication
I - Integrity
N - Non-Repudiation - depends on Authentication and Integrity
Integrity depends on Authentication and vv? check Handerhan video
Zero Knowledge proof (eg for authentication)
Proof that knowledge without sharing that knowledge eg challenge response
Stream vs Block ciphers
Stream: RC-4 on exam; also Salsa/ChaCha (DJB)
Block: generally more secure than stream but typically slower?
AES, RC-2, RC-5/6, DES/3DES, Blowfish, IDEA (PGP) are all block based
Hybrid cryptography
Encrypt message with symmetric alto (faster) and then encrypt symmetric key using asymmetric crypto (public key).
used in eg SSL/TLS and PGP
Security by Design
- Principle of Least Privilege: Access to the system should always be limited based on least privilege.
- Separation of Duties: Ensuring no single person should be able to complete a critical task alone.
- Trust but verify: It’s totally okay to trust your users but always ensure to verify just to avoid any unauthorized impact on CIA.
- Principle of Defense in Depth: Never rely on one security control. Always implement layered security.
- Fail Securely: There would be several reasons the system would fail. However, when it fails, do not let any user/process gain more privileges.
- Secure defaults: Establishing secure defaults means there should be strong security rules for how user registrations are handled, how often passwords must be updated, how complex passwords should be and so on.
• Privacy by design: It’s equally important to consider privacy at the design phase. Considering the system will be subject to processing PII data, it’s important to design the controls to protect it.
- Keep it simple: More complex the design of the system will be, it will be difficult to protect.
- Minimize attack surface: Always perform the threat model to know your potential threats.
• Asset classification: It’s important to know what to protect. Without classification, controls cannot be implemented.
Security model composition theories
Composition Theories:
- Cascading. Output of System A is input of System B
- Feedback: Output of System A is input of System B and vice versa
- Hookup: Output of System A is input of System B and other System C
Security models
Bell-LaPadula (prevent leak to lower level)
BIBA (prevent corruption from lower level)
Clark Wilson (untrusted accesses trusted through constrained interfaces)
Brewer Nash (chinese wall?)
Bell-LaPadula and Biba rules
Simple = read related Star/* = write related
Bell-LaPadula:
Simple: no read up
Star/*: no write down
Biba:
Simple: no read down
Star/*: no write up
Strong star/*: ???
Security Evaluation Models
TCSEC “Orange book” - Trusted Computer System Evaluation Criteria
(Rainbow series, US Federal)
A / B1/2/3 / C1/2 / D
ITSEC - Information Technology Security Evaluation Criteria
(European alternative to TCSEC)
levels todo!!
Common Criteria ISO-15408
assurance levels EAL1..7
EAL4 is most common target - tested and reviewed but no formal methods
Security Evaluation - certification vs accreditation
Certification: Technical Evaluation. Internal verification trusted by your (ie the supplier’s) internal organization.
Accreditation: Formal Acceptance by the management. Performed by third party and accepted by everyone.
*Exam tip: When
Cloud computing key elements
Virtualisation
Elasticity
Resource pooling
Service provided by third party
SCADA
Supervisory Control And Data Acquisition
Control system for Industrial Control System (ICS).
Stuxnet was a root kit for SCADA systems
OWASP top 10
Code injection - mitigate with input validation (or proper escaping/encapsulation!)
Broken authentication / Session management
Sensitive data exposure - mitigate with encryption
XML external entities
Broken access control
Security misconfiguration
XSS Cross-site Scripting - input validation or proper escaping/encapsulation
Insecure deserialisation
Using known vulnerable components
Insufficient logging and monitoring
CSRF dropped off in 2017?
Others include: buffer overflow, race conditions, side-channel attacks, file based attacks
Primary responsibility of OS
To keep the computing environment stable nd to maintain process isolation
TEMPEST
Faraday cage around system.
+
White noise injected to mask signals
First and last lines of defence
Physical security is first line of defence
People are the last line of defence
Physical boundary security
Fence
- 3-4 foot - casual trespass
- 6-7 foot - most intruders
- 8+ foot - determined intruders
Gate
Turnstile - prevents tailgating
Man trap - prevents piggybacking
Security guards - expensive, unreliable, can use judgement
Dogs - expensive, liability
OSI and TCP/IP models
todo - picture/table
Ping based attacks
Loki (covert channel)
ping of death (oversized packet)
Ping flood
Smurf
level 3 attacks using ICMP
whereas SYN flood (TCP) and Fraggle (UDP echo/chargen) are layer 4
Smurf and Fraggle re both reflection/amplification attacks
RBAC, DAC, MAC, RuBAC etc
todo
Firewall types
Packet Filter - layer 3(/4), src/dest IP address, port, protocol (TCP vs UDP)
Application level Proxy/Firewall - layer 7, inspect content of data stream, performance overhead
Stateful firewall - layer 3+4, tracks connection state and block unsolicited replies
Deep Packet Inspection - looks inside packets for specific threats
AIPA
Private IP ranges defined in RFC1918
- x.x.x (Class A)
- 16.x.x-172.31.x.x (Class B)
- 168.x.x (Class C)
Protocol Data Units for each layer
todo
wifi standards
- 11 Family
- 802.11 a : 54 Mbps/ 5 GHz/ 8 channels
- 802.11 b : 11 Mbps/ 2.4 GHz (same as home network) 3. 802.11 g : 54 Mbps/ 2.4 GHz
- 802.11 n : 200+ Mbps/ 2.4 GHz or 5 GHz
- 802.11 ac : 1 Gbps/ 5GHz
b/g/n all same freq and backwards compatible
Bluetooth attacks
Blue Jacking –> Sending SPAM
Blue Snarfing –> Copies information of the remote device
Blue Bugging –> More serious. Allows full use of phone, make call and can eaves drop on calls.
wireless security
- Wired Equivalent Protocol (WEP)
a. Shared Authentication Passwords b. Weak Initialization vector (24 bits) c. IV transmitted in clear text
d. RC4 (Stream Cipher)
e. Easily crack able
f. Only option for 802.11 b - Wi-Fi Protected Access (WPA)
a. Stronger IV
b. Introduced Temporal Key Integrity Protocol (TKIP)
c. Still uses RC4 (to make upgrade from WEP easier) - WPA 2
a. AES (Block Cipher)
b. CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol)
c. Not backward compatible
Uses 802.1X/EAP authentication to have individual passwords for individual users.
Dial up/WAN link authentication
PAP - Password Authentication Protocol - password sent in clear
CHAP - Challenge Handshake Authentication Protocol (also MS-CHAP, MS-CHAPv2)
EAP - Extensible Authentication Protocol - to support non-password authentication e.g. biometrics
EAP variations eg PEAP, LEAP
Protected EAP: EAP itself doesn’t provide any security so it encapsulates EAP in TLS tunnel.
Lightweight EAP: Cisco Proprietary but it was broken with ASLEAP attack.
VPN protocols
PPP - Point-to-Point Protocol (still in use eg PPPoE, PPPoE) - no encryption
PPTP - Point-to-Point Tunnelling Protocol - no encryption
L2TP - Layer 2 Tunnelling Protocol - no encryption so often run over IPSec
IPSec - limited to IP protocols - run L2TP over IPSec to tunnel non-IP protocols
Authentication factor types
Type1: Something you know (password, pin)
Type2: Something you have (smart card, token)
Type3: Something you are (biometric)
Type4: Somewhere you are (location, IP address?)
(Type5: Something you do e.g. typing cadence, walking gait)
(Biometric/Behavioural) Authentication failure modes/rates
Type1 error: False Rejection Rate (FRR)
Type2 error: False Acceptance Rate (FAR)
Cross over error rate (CER): It’s the meeting point of FAR and FRR
Identity Assurance Level
IAL 1: If any are self-asserted or should be treated as self-asserted.
IAL 2: Either remote or in person identity proofing is required. It requires identity proofing to have been verified in person or remotely.
IAL 3: In person identity proofing is required. Identifying attributes must be verified by the authorized Credential Service Provider (CSP) representative through examination of physical documentation.
