Domain 1 : Security Concepts Flashcards
Confidentiality
Confidentiality ensures that sensitive information remains shielded from prying eyes and that access is granted solely to those with the appropriate authorization.
Integrity
Integrity ensures that your data remains unaltered and trustworthy. It prevents unauthorized changes or manipulations to your information, maintaining its accuracy and reliability
Availability
This principle guarantees that your digital assets and services are accessible when needed. Availability ensures that your systems are up and running, that your data can be accessed promptly, and that your online services remain accessible.
What is the CIA triad
Confidentiality
Integrity
Availability
Non-Repudiation
Non-repudiation prevents denial of actions, ensuring accountability and reliability in electronic transactions and communications
AAA server
An AAA server is a server program that handles user requests for access to computer resources and, for an enterprise, provides authentication, authorization and accounting (AAA) services.
Authentication systems use …
At the forefront of modern authentication strategies stand the AAA framework and the 802.1X protocol
AAA protocols are..(LIST)
Radius
Diameter
TACAS
RADUIS
RADIUS is a cornerstone in network security, particularly in remote access scenarios. RADIUS clients encompass a variety of devices, including wireless access points, routers, and switches.
Diameter
Diameter has stepped in as RADIUS’s evolved successor, extending its capabilities to modern network technologies. In this realm, network elements such as 4G and 5G infrastructure devices, including LTE and WiMAX access points, serve as Diameter clients
TACAS+
TACACS+, created by CISCO, is used to grant or deny access to network devices. TACACS+ clients often include routers, switches, and firewalls. Just as with RADIUS and Diameter, the shared secret’s role remains pivotal, as it forms the bedrock of secure interactions between TACACS+ clients and servers.
What is Gap Analysis?
Gap analysis is a strategic process that evaluates an organization’s security practices against established security standards, regulations, and industry best practices.
Gap analysis requires
Assessment: A thorough assessment is conducted to understand the organization’s current security measures, policies, procedures, and technologies.
Benchmarking: This involves comparing the existing security practices against established industry standards, frameworks, and compliance regulations.
Identification: Gaps are pinpointed by identifying areas where security measures fall short of the desired or required level.
Prioritization: Not all gaps are equal in terms of risk. Prioritization involves ranking the identified gaps based on their potential impact and likelihood of exploitation.
Remediation strategy: With prioritized gaps in mind, a comprehensive remediation strategy is developed. This strategy outlines actionable steps to close the identified gaps and enhance the organization’s security posture.
Infrared Sensor
Infrared
These detect heat signature changes, effectively identifying human or animal presence. They find applications in perimeter protection and indoor security.
Pressure sensor
Sensing changes in pressure from touch or step, these provide reliable indicators of movement, both indoors and outdoors.
Microwave sensors
Emitting microwave pulses and detecting frequency alterations caused by moving objects, these sensors excel in diverse security scenarios.
Ultrasonic Sensors
Operating with sound waves, ultrasonic sensors “see” around corners or within concealed areas, proving valuable in challenging environments.
Physical Security
encompasses a range of measures designed to deter, detect, and respond to potential risks. From robust barriers to cutting-edge surveillance, each element contributes to the creation of a security framework that safeguards people, assets, and critical information.
Deception and Disruption
these technologies intend to deceive attackers so that we can find out more information about them as well as to disrupt their attacks.
Honeypot
When security teams are trying to find out the attack methods that hackers are using, they set up a website similar to a legitimate website with lower security, known as a honeypot.
Honeynets
Honeynets are a group of honeypots that give the appearance of a network
Honeyfile
In the world of deception, even individual files can become artful lures. The honeyfile stands as an elegant ruse; it may well be a file titled password that is saved onto a desktop.
Honeytoken
Honeytokens play a vigilant role in the realm of cybersecurity, designed to ensnare digital intruders in their tracks. Crafted with precision, these tokens house deceptive markers—dummy data that presents itself as a prized possession to potential thieves.
Fake Information
A DNS sinkhole, often playfully dubbed the “black hole of the internet,” is a tactic where DNS queries are deliberately redirected to different IP addresses
Zero Trust
never trust always verify
Control Plane
The control plane serves as an instrumental command center for cybersecurity. It uses the subject/identity with company policies and threat intelligence data to decide which users or devices can access the network. By centralizing control this way, organizations can regulate access, monitor activity, and swiftly respond to emerging threats.
Policy driven access control
The translation of security policies and guidelines into concrete action is a challenge faced by many organizations. Policy-driven access control offers a solution by automating the enforcement of these directives. Through a systematic approach, organizations can define access rights, permissions, and responses to specific scenarios. This not only ensures consistency but also eliminates the risk of human error in the execution of security protocols.
Control Plane features
policy engine determines who gains access to critical network resources on a per-user basis. It operates based on policies, written by the organization’s security team, which lay down the rules for access. Context is crucial, with data from SIEM, threat intelligence, user attributes, and device information informing decisions. Once the policy engine evaluates all the parameters, it communicates its decision to a policy administrator, who executes it on the ground.
The policy administrator executes the decisions made by the policy engine to control access to the network. They issue access tokens and can communicate with the data plane
Policy Enforcement - The policy enforcement point assumes the role of a vigilant gatekeeper. It’s like a security checkpoint that follows the rules set by the policy administrator and double-checked by the policy engine. This checkpoint ensures that only authorized actions get through and prevents potential breaches. It’s the ultimate decision-maker that verifies everything is safe and trustworthy before letting it in. Just like a bouncer at a club, it keeps out trouble and lets in only those who are allowed.
Data Plane
The data plane in cybersecurity is the operational core responsible for the actual movement and forwarding of data packets within a network
subjects( within the data plane)
Subjects in the data plane are the entities that initiate data communication
systems(data plane)
systems represent the collective infrastructure, resources, and devices that are responsible for processing and forwarding data packets as they traverse the network.
DMZ
The DMZ is an area that is neither fully trusted nor fully untrusted. It’s an intermediate zone that allows controlled access to certain services from the external network. Communication between the DMZ and the internal network might be subject to more stringent controls. This is also commonly known as a screened subnet, where resources that are accessed by untrusted and trusted networks reside.
Adaptive identity
he conventional approach to user identity is undergoing a revolutionary transformation with the emergence of adaptive identity. No longer confined to static roles and permissions, adaptive identity tailors user privileges based on contextual understanding. By analyzing user behavior, location, and device characteristics, this approach ensures that access rights are dynamically adjusted, drastically minimizing the risk of unauthorized activity while allowing for seamless user experiences.
Process of Change Management
Approval process: The approval process looks at the proposed change and the reasons behind it (for example, due to new technology or more stringent regulations). This change is sent to any affected stakeholders for input. This way, the approval process ensures that the project’s direction aligns with the organization’s goals. Following approval, those changes are thoroughly documented so that they can be tracked once completed. In simple terms, the approval process is how we ensure that important decisions and changes get the green light from the right people. These decisions could be big, such as upgrading the entire computer system of a company, or small, such as giving someone access to a restricted part of a network.
Ownership: Ownership in change management refers to a person within a department who has asked for a change and will be responsible for ensuring that it is carried out effectively. This could be a company director or a project manager. In terms of security, clear ownership is crucial; this change might be handled by the Chief Information Security Officer (CISO). The CISO ensures that security tasks are carried out effectively and that there is accountability. An example could be ensuring that the proper level of encryption has been implemented and security tasks have been monitored effectively.
Stakeholders: Stakeholders are individuals, groups, or entities that have a vested interest (or stake) in a company’s operations, activities, or outcomes. They can significantly influence or be influenced by the company’s decisions, actions, and performance. However, the concept of stakeholders is not limited to shareholders and investors. It encompasses a broader spectrum of parties that can impact or be impacted by how the company functions. Table 3.1 shows the primary categories of stakeholders in a company:
Impact Analysis
Before making changes, it’s important to analyze how they could impact the organization. In security, this means considering how a change could affect the overall safety of systems and data. This analysis helps in foreseeing potential security risks and finding ways to address them before they become real problems.
Test results
Whenever a new security measure or change is introduced, it’s smart to test it first. Just like a seatbelt is tested before a car hits the road, security measures need to be tested to ensure they work as intended. Test results give confidence that the security actions will protect the organization as expected.
Backout plan
A backout plan is like having a safety net when conducting a risky activity. In security operations, it’s a plan to undo a change if things go wrong. If a new security update crashes a system, the backout plan helps return everything to the way it was, keeping an organization safe from prolonged security vulnerabilities.
Maintenance window
Think of a maintenance window as a scheduled time for fixing things. This would be carried out during silent hours so that it affects fewer people. In terms of security, this is a planned time to implement changes or updates that could impact the organization’s systems. By doing these during a maintenance window, disruptions are minimized, and security measures can be applied smoothly.
Standard Operating Procedure
A standard operating procedure (SOP) is like a rulebook that guides how things should be done. Imagine you’re a pilot preparing for takeoff. Before the engines roar to life, you follow a checklist that outlines every critical step. This is the essence of SOPs. They are meticulously crafted guidelines, akin to your preflight checklist, designed to ensure that complex tasks are executed consistently and accurately.
Restricted activities
Restricted activities prevent actions that could potentially lead to vulnerabilities or disruptions. These activities include unauthorized software installations, unauthorized system modifications, direct access to critical servers, and access to sensitive data or unauthorized data transfers.
Application restart
Application restart vulnerabilities encompass potential security weaknesses that can emerge when an application is restarted. Improper restart procedures can cause data inconsistencies or corruption, potentially affecting the integrity of the application and its security measures.
SNMP agents
SNMP agents are software modules or processes running on network devices, such as routers, switches, servers, and even IoT device
SNMP Traps
SNMP traps are asynchronous notifications sent by SNMP agents to SNMP managers without a prior request.
SCP protocol
SCP: This protocol is used to transfer files securely between hosts in a Linux environment. PORT 22
DNSSEC
To prevent unauthorized access to access to DNS records, DNSSEC was introduced to protect DNS traffic. Each DNS record is digitally signed, creating an RRSIG record to protect against attacks and guaranteeing that these records are valid and their integrity has been maintained. This prevents DNS poisoning.
DNS poisoning
happens when fake information is entered into the cache of a domain name server, resulting in DNS queries producing an incorrect reply, sending users to the wrong website
site to site vpn
A site-to-site VPN, also known as a router-to-router VPN, is commonly employed by large companies
SSL VPN
SSL VPN (Secure Sockets Layer Virtual Private Network) employs the SSL protocol to secure the connection between the user and the VPN server. It allows remote users to access a private network securely by establishing an encrypted tunnel between the user’s device and the VPN server.
WPA2-Enterprise
Using WPA2-Enterprise-level encryption has a number of advantages that make it a good choice for a large company or enterprise networks, such as eliminating the security risks of shared passwords, enhanced security, and authentication methods and controls, the ability to dynamically assign VLANs and support for Network Access Protection (NAP).
It use 802.1x
WPA3-SAE
WPA3 uses Simultaneous Authentication of Equals (SAE) to provide stronger defenses against password guessing. SAE is a secure key establishment protocol
PEAP
PEAP (Protected Extensible Authentication Protocol) provides a method to transport securely authentication data, including legacy password-based protocols, via 802.11 Wi-Fi networks. PEAP accomplishes this by using tunneling between PEAP clients and an authentication server. better than all the others. udinh MSCHAP V2
EAP-FAST
EAP-FAST – EAP-FAST (Flexible Authentication via Secure Tunneling) uses a Protected Access Credential (PAC) to establish a TLS tunnel in which client credentials are verified. EAP-FAST is Cisco replacement for LEAP.
TTLS-EAP-TLS
TTLS-EAP-TLS – Securely tunnels the EAP-TLS certificate within the TLS records.( SERVER CERT FOR AUTHEN) SECURE TUNNEL
EAP-TLS
CLIENT AND SERVER CERT FOR MUTAL AUTHENTICATION.
REQURIES PKI
COPE
Corporate-Owned, Personally Enabled (COPE):this model, organizations provide employees with corporate-owned devices that can be used for both business and personal use but must comply with company policies
SSID
Service set identifier (SSID) is the number that identifies your internet network
CYOD:Choose Your Own Device (CYOD)
CYOD is a policy in which the company provides employees with a selection of approved devices to choose from. These devices are owned and managed by the organization. This model allows for increased flexibility with company devices but still maintains security control
WPS
WPS allows you to connect to a wireless network by simply pushing a button, negating the need to insert a password each time.
Low-level formatting
Low-level formatting (i.e., closest to the hardware) marks the surfaces of the disks with markers indicating the start of a recording block (typically today called sector markers) and other information like block CRC to be used later
SWGS
is a cyber security product that protects company data and enforces security policies. SWGs operate in between company employees and the Internet.
Initialisation vector
An initialization vector (IV) is a random or pseudo-random value used in cryptography to ensure that identical plaintexts encrypt to different ciphertexts
XDR
XDR is a technology that centralizes various security points, including EDR, network firewalls, identity and access management (IAM), cloud access security brokers (CASB), etc.
Deprovisioning
the process of deleting an employee’s access to your company’s systems, apps and internal data resources
PEAP
Protected Extensible Authentication Protocol (PEAP): PEAP is a version of Extensible Authentication Protocol (EAP) that encapsulates and encrypts the EAP data using a certificate stored on the server, making it more secure for Wireless Local Area Networks (WLANs).
802.1x
This is an overarching access control standard. 802.1x allows access to only authenticated users or devices and is therefore used by managed switches for port-based authentication.
EAP-TLS
EAP-TLS is a specific, secure version of wireless authentication that requires a certificate stored on the endpoint (client or device) to verify identity and authorization.
EAP-TTLS
EAP-TTLS: EAP-TTLS uses two phases. The first is to set up a secure session with the server by creating a tunnel using certificates that are stored on the server, and seen by the client. The second is to authenticate the client’s credentials.
Gap Analysis steps
Assessment: A thorough assessment is conducted to understand the organization’s current security measures, policies, procedures, and technologies.
Benchmarking: This involves comparing the existing security practices against established industry standards, frameworks, and compliance regulations.
Identification: Gaps are pinpointed by identifying areas where security measures fall short of the desired or required level.
Prioritization: Not all gaps are equal in terms of risk. Prioritization involves ranking the identified gaps based on their potential impact and likelihood of exploitation.
Remediation strategy: With prioritized gaps in mind, a comprehensive remediation strategy is developed. This strategy outlines actionable steps to close the identified gaps and enhance the organization’s security posture.
Zero Trust Control Plane
The control plane serves as an instrumental command center for cybersecurity. It uses the subject/identity with company policies and threat intelligence data to decide which users or devices can access the network. By centralizing control this way, organizations can regulate access, monitor activity, and swiftly respond to emerging threats.
Threat Scope Reduction
Preventing threats before they manifest is a paramount goal in cybersecurity. This is where the concept of threat scope reduction enters the picture. By intentionally narrowing the potential attack surface, organizations can preemptively thwart possible avenues of exploitation. This involves strategies such as minimizing exposed services, reducing the attackable code base, and employing rigorous patch management. Through such proactive measures, the potential for breaches is significantly diminished.
Policy Driven Access Control
The translation of security policies and guidelines into concrete action is a challenge faced by many organizations. Policy-driven access control offers a solution by automating the enforcement of these directives. Through a systematic approach, organizations can define access rights, permissions, and responses to specific scenarios. This not only ensures consistency but also eliminates the risk of human error in the execution of security protocols.
Policy Enforcement Point
The policy enforcement point assumes the role of a vigilant gatekeeper. It’s like a security checkpoint that follows the rules set by the policy administrator and double-checked by the policy engin
Policy Engine
The policy engine determines who gains access to critical network resources on a per-user basis. It operates based on policies, written by the organization’s security team, which lay down the rules for access. Context is crucial, with data from SIEM, threat intelligence, user attributes, and device information informing decisions
Policy Administrator
The policy administrator executes the decisions made by the policy engine to control access to the network. They issue access tokens and can communicate with the data plane.
Implict Trust Zone
This refers to areas within a network or system where certain levels of trust are assumed without explicit verification. These zones are designed to simplify and expedite communication and interactions between components within those zones
Risk of shared tenancy
When utilizing public cloud services, “shared tenancy” comes into play. This concept refers to multiple customers sharing the same physical infrastructure, where each customer operates within their own isolated virtual environment. If the customer does not secure its data properly, then that could lead to a side-channel attack where another tenant has access to their data inadvertently
RAID 6
RAID 6 uses two parity stripes, the practice of dividing data across the set of hard disks or SSDs, on each disk. It allows for two disk failures within the RAID set before any data loss.
RAID 5
RAID 5 is the most common secure RAID level. It requires at least 3 drives but can work with up to 16. Data blocks are striped across the drives and on one drive a parity checksum of all the block data is written. T
Tabletop
A tabletop exercise is a valuable tool for testing your disaster recovery plan in a controlled setting. During this exercise, key stakeholders gather around a table to discuss and strategize how they would respond to a hypothetical disaster scenario. This exercise allows participants to identify gaps in their plan, refine communication channels, and assess decision-making processes. This exercise is the easiest to set up as it takes the least administrator effort as it is a paper-based exercise.
Controller Level (Level 1):
This level is responsible for the real-time control of the physical processes. It includes devices such as Programmable Logic Controllers (PLCs) that receive input from sensors on the plant floor, process the data, and send commands to actuators and other devices to control the industrial processes. Level 1 controllers ensure that the plant operates efficiently and safely.
SCADA level 0
Plant Level (Level 0): This is the lowest level in the SCADA system hierarchy. It includes the physical equipment and processes on the factory floor, such as sensors, actuators, motors, pumps, and other industrial devices. These devices gather data and perform actions as directed by the higher-level controllers.
SCADA level 0
Plant Level (Level 0): This is the lowest level in the SCADA system hierarchy. It includes the physical equipment and processes on the factory floor, such as sensors, actuators, motors, pumps, and other industrial devices. These devices gather data and perform actions as directed by the higher-level controllers.
