CYBER SECURITY Flashcards
CIA TRIAD
CONFIDENTIALITY
INTEGRITY
AVAILABILITY
CONFIDENTIALITY
Can actors who should not have access to the system or information access the system or information?
INTEGRITY
Can the data or the system be modified in some way that is not intended?
AVAILABILITY
Are the data or the system accessible when and how they are intended to be?
OFFENSIVE SECURITY
DEFENSIVE SECURITY
TRY HARDER MINDSET
If my attack or defense fails, it represents a truth about my current skills/processes/configurations/approach as much as it is a truth about the system.
If my attack or defense fails, this allows me to learn something new, change my approach, and do something differently.
CYBER SECURITY CHALLENGES
INVOLVES MALICIOUS AND INTELLIGENT ACTORS (OPPONENTS)
INVOLVES REASONING UNDER UNCERTAINTY
SECURITY MINDSET
FIRST INTRODUCED BY BRUCE SCHNEIER
encourages a constant questioning of how one can attack (or defend) a system. If we can begin to ask this question automatically when encountering a novel idea, machine, system, network, or object, we can start noticing a wide array of recurring patterns.
GROWTH MINDSET
encourages the belief that mental ability is flexible and adaptable and that one can grow their capacity to learn over time
RISK
A simple way to define risk is to consider two axes: the probability that a negative event will occur, and the impact on something we value if such an event happens. This definition allows us to conceptualize risks via four quadrants:
Low-probability, low impact events
Low-probability, high impact events
High-probability, low impact events
High-probability, high impact events
THREAT
Threat is something that poses risk to an asset we care about protecting. Not all threats are human; if our network depends on the local electricity grid, a severe lightning storm could be a threat to ongoing system operations.
VULNERABILITY
For a threat to become an actual risk, the target being threatened must be vulnerable in some manner.
A vulnerability is a flaw that allows a threat to cause harm. Not all flaws are vulnerabilities.
In computer programs, vulnerabilities occur when someone who interacts with the program can achieve specific objectives that are unintended by the programmer.
EXPLOIT
In computer programs, vulnerabilities occur when someone who interacts with the program can achieve specific objectives that are unintended by the programmer. When these objectives provide the user with access or privileges that they aren’t supposed to have, and when they are pursued deliberately and maliciously, the user’s actions become an exploit.
RISK CONSIDERATION QUESTIONS
How likely is it that a particular attack might happen?
What would be the worst possible outcome if the attack occurs?
CVSS
COMMON VULNERABILITY SCORING SYSTEM
EXPLOIT (NOUN)
As a noun, an exploit is a procedure for abusing a particular vulnerability
EXPLOIT (VERB)
As a verb, to exploit a vulnerability is to perform the procedure that reliably abuses it.
ATTACK SURFACE
DESCRIBES ALL THE POINTS OF CONTACT ON OUR SYSTEM OR NETWORK THAT COULD BE VULNERABLE TO EXPLOITATION
ATTACK VECTOR
SPECIFIC VULNERABILITY AND EXPLOITATION COMBINATION THAT CAN FURTHER A THREAT ACTORS OBJECTIVES.
THREAT ACTOR CLASSIFICATION
HIGH LEVEL CLASSIFICATION:
INDIVIDUAL
GROUP
INSIDER
NATION STATE
INDIVIDUAL MALICIOUS ACTOR
Individual Malicious Actors: On the most superficial level, anyone attempting to do something that they are not supposed to do fits into this category. In cybersecurity, malicious actors can explore digital tactics that are unintended by developers, such as authenticating to restricted services, stealing credentials, and defacing websites.
MALICIOUS GROUP
Malicious Groups: When individuals band together to form groups, they often become stronger than their individual group members.
Malicious groups can have any number of goals but are usually more purposeful, organized, and resourceful than individuals. Thus, they are often considered to be one of the more dangerous threat actors.
INSIDER THREAT
Insider Threats: Perhaps one of the most dangerous types of threat actors, an insider threat is anyone who already has privileged access to a system and can abuse their privileges to attack it. Often, insider threats are individuals or groups of employees or ex-employees of an enterprise that become motivated to harm it in some capacity.
NATION STATES
Nation States: Although international cyber politics, cyber war, and digital intelligence are vast subjects and significantly beyond the scope of this Module, we should recognize that some of the most proficient, resourceful, and well-financed operators of cyber attacks exist at the nation-state level within many different countries across the globe.
SOCIAL ENGINEERING
attacks where an attacker persuades or manipulates human victims to provide them with information or access that they shouldn’t have.
PHISHING
Phishing is usually done in broad sweeps. Phishing strategy is usually performed by sending a malicious communication to as many people as possible, increasing the likelihood of a victim clicking a link or otherwise doing something that would compromise security.
SPEAR-PHISHING
VISHING
SMS-ISHING
RANSOMWARE
CREDENTIAL ABUSE
AUTHENTICATION BYPASS
ZERO TRUST SECURITY MODEL
Zero Trust is a security model that assumes that all users, devices, and networks are untrusted and must be verified before access is granted. It is based on the idea that organizations should not trust any user, device, or network, even if they are inside the organization’s network.
PRINCIPLE OF LEAST PRIVILEGE
Each user and program should operate using the fewest privileges possible.
DEFENSE IN DEPTH
involves multiple layers of security controls to protect an organization’s assets
The goal of Defense-in-Depth is to create a secure environment that is resilient to attack and can quickly detect and respond to any security incidents. By implementing multiple layers of security, organizations can reduce the risk of a successful attack and minimize the damage caused by any successful attack.
OPEN SECURITY
focuses on the need for developers to be aware of the security implications of their code and to take steps to ensure that their code is secure. This includes using secure coding practices, testing for vulnerabilities, and using secure development tools. Security-in-the-Open also encourages developers to collaborate with security experts to ensure that their code is secure.
SHIFT LEFT SECURITY
SECURITY STRATEGIES
24/7 vigilance
Threat modeling
Table top discussions
Continuous training on tactics, processes, and procedures
Continuous automated patching
Continuous supply chain verification
Secure coding and design
Daily log reviews
Multiple layers of well-implemented Security Controls
