Day 2 - Defense-in-Depth and Attacks Flashcards
2 - Defense-in-Depth and Attacks
- defense in depth
- access control and password management
- security policies
- critical controls
- malicious code and exploit mitigations
- advanced persistent threats
objectives of defense-in-depth
- risk = threat x vulnerabilities
- CIA triad
- strategies for defense-in-depth
- core security strategies
what is defense in depth (DiD)?
- any layer of protection may fail
- multiple levels of protection must be deployed
- measures must be across a wide range of controls
prevention is ideal, but detection is ?
a must
however, detection without response has minimal value
security deals with?
managing risk to your critical assets
risk is?
the probability of a threat crossing or touching a vulnerability
risk = threats x vulnerabilities
Key Focus of Risk
CIA triad
C - confidentiality
vs. Disclosure
Only shared among authorized persons or organizations
I - Integrity
vs. Alteration
Authentic and complete. Sufficiently accurate. Trustworthy and reliable.
A - Availability
vs. Destruction
Accessible when needed by those who need it
Prioritizing CIA
all are important, which one is important in your organization?
Confidentiality: pharmaceuticals and govt
Integrity: Financial institutions
Availability: e-commerce
Approaches to DiD
deploy measures to reduce, accept, or transfer risk
4 basic approaches:
1) uniform protection
2) protected enclaves
3) information centric
4) threat vector analysis
uniform protection -DiD
- most common DiD approach
- firewall, VPN, intrusion detection, antivirus, patching
- all parts of the organization receive equal protection
- treats all systems the same
protected enclaves DiD
- work groups that require additional protection are segmented from the rest of the organization
- restrict access to critical segments
- internal firewalls
- VLANs and ACLs
information-centric DiD
- identify critical assets and provide layered protection
- data is accessed by apps
- apps reside on hosts
- hosts operate on networks
vector-oriented DiD
threat requires vector to cross vulnerability
stop the capability of the threat to use the vector
- usb thumb drives: disable USB
- attachments in e-mails: block or scan attachments
- spoofed e-mails: check address at e-mail server
fixing the problem - main strategy to fix infected system??
rebuild from scratch
module 8:
Access Control and Password Management
Access Control
- Data Classification
- Managing access
- Separation of duties
Password management
- password management technologies
- how password assessment works
IAAA
Identity
Authentication
Authorization
Accounting
Controlling Access
- Least privilege
- Need to know
- Separation of duties
- Rotation of duties
6 common types of access control
1- Discretionary Access Control (DAC) 2- Mandatory Access Control (MAC) 3- Role-based (RBAC) 4- Ruleset-based (RSBAC) 5- List-based 6- Token-based
John the Ripper crack modes
1- Wordlist
2- Single crack - usernames and gecos to guess pwds. should be used first becuz fast
3- incremental - brute force
4- external - custom
Module 9
Security Policy
Security Policies
- need for policies
- policy framework
- enforcement
issue-specific policy examples
- NDA
- copyright
Policy table of contents
- purpose
- related documents or references
- cancellation or expiration
- background
- scope
- policy statement
- responsibility
- action
policies must be?
clear, concise, understood by everyone in the organization and enforced
Module 10
Critical Security Controls
Three control priority families?
- System (Controls 1-10)
- Network (Controls 11-15)
- Application (Controls 16-20)
Key rules when the controls were chosen
- each control mapped to actual known attack
- if known attack doesn’t exist, can’t be a control
- offense must inform defense
Critical Security Controls
1- inventory of authorized/unauthorized devices
2- inventory of authorized/unauthorized software
3- secure configurations for HW/SW
4- continuous vulnerability assessment and remediation
5- controlled use of administrative privileges
6- maintenance, monitoring, and analysis of audit logs
7- email and web browser protections
8- malware defenses
9- limitation and control of network ports
10- data recovery capability
11- secure configurations for network devices
12- boundary defense
13- data protection
14- controlled access based on the need to know
15- wireless access control
16- account monitoring and control
17- security skills assessment and appropriate training to fill gaps
18- application software security
19- incident response and management
20- pen tests and red team exercises
Module 11: Malicious Code and Exploit Mitigation
- Mitnick-Shimomoura
- Defensive strategies
- Common types of attacks
Input attacks
applications receive client data in many forms:
- treat all user supplied input as potential attack points
examples:
- OS command injection
- buffer overflows
- SQL injection
Module 12: APT
- what are APTs and why are they so hard to manage?
- defending against APT
- how can cyber remediation be approached?
- offensive operations
