Domain 3: Security Engineering; Virtualization and Distributed Computing

Question 1

What is virtualization?

Answer 1

Virtualization adds a software layer between the operating system and the underlying computer hardware. This allows multiple guest operating systems to run on a physical host computer. Popular products include VMware, QEMU, Xen.

Question 2

What is transparent virtualization?

Answer 2

Transparent virtualization runs stock operating systems, such as Windows 10 or Ubuntu Linux 15.04, as virtual guests. No changes to the guest OS are required.

Question 3

What is paravirtualization?

Answer 3

Paravirtualization runs specially modified operating systems, with modified kernel system calls. Paravirtualization can be more efficient, but requires changing the guest OS which may not be possible for closed OSes such as the Microsoft Windows family.

Question 4

The key to virtualization security is the hypervisor, which does what?

Answer 4

Controls access between the virtual guests and the host hardware.

Question 5

What is the difference between a Type 1 and Type 2 hypervisor?

Answer 5

A Type 1 hypervisor (also called bare metal) is part of an operating system that runs directly on host hardware. A Type 2 hypervisor runs as an application on a normal operating system, such as Windows 10. VMware ESX is a Type 1 hypervisor, and VMware Workstation is Type 2.

Question 6

What is VMEscape?

Answer 6

Where an attacker exploits the host OS or guest from another guest.

Question 7

What is cloud computing?

Answer 7

Public cloud computing outsources IT infrastructure, storage, or applications to a 3rd party provider. A cloud also implies geographic diversity of computer resources. The goal of cloud computing is to allow large providers to leverage their economies of scale to provide computing resources to other companies that typically pay for these services based on their usage.

Question 8

What are the three commonly available levels of service provided by cloud providers?

Answer 8

Infrastructure as a Service
Platform as a Service
Software as a Service

Question 9

What is a private cloud?

Answer 9

Private clouds house data for a single organization, and may be operated by a 3rd party, or by the organization itself.

Question 10

What is a government cloud?

Answer 10

Government clouds are designed to keep data and resources geographically contained within the borders of one crountry, designed for the government of the respective country.

Question 11

What are the benefits of cloud computing?

Answer 11

Reduced upfront capital expenditure, reduced maintenance costs, robust levels of service, and overall operational cost-savings.

Question 12

What are the concerns of cloud computing?

Answer 12

One concern is the compromise of one cloud customer could lead to the compromise of other customers.

Question 13

What is the risk of using a pre-configured image?

Answer 13

Any vulnerability associated with the pre-configured image can introduce risk to every organization that uses the image.

Question 14

What are some rights an organization should negotiate before signing a contract with a cloud computing provider?

Answer 14

The right to audit, the right to conduct a vulnerability assessment, and the right to conduct a penetration test (both electronic and physical) of data and systems placed in the cloud.

Question 15

When data needs to comply with US-based laws, should a public cloud be used?

Answer 15

Data in public clouds could be moved to another country. US-based laws such as HIPAA or GLBA have no effect outside the US. Private or Government clouds should be used in these cases.

Question 16

What is Grid Computing?

Answer 16

Unlike using large clusters of similar systems or a single supercomputer, grid computing makes use of spare CPU cycles of a network of dissimilar devices.

Question 17

What is Large-Scale Parallel Data Systems?

Answer 17

The primary purpose is to allow for increased performance through economies of scale. Often parallel systems will leverage some degree of shared memory which, if not managed appropriately, can expose potential race conditions that introduce integrity challenges.

Question 18

What is Peer to Peer network?

Answer 18

In a P2P network, any computer can act as the server or client. P2P networks were designed to be neutral with regards to intellectual property rights. P2P networks are frequently used to download commercial music and movies, often in violation to the owner’s intellectual property rights. Decentralized P2P networks are resilient since there are no central servers that can be taken offline. Integrity is a key concern. With no central repository of data, what assurance do users have of receiving legitimate data? Cryptographic hashes are a critical control, and should be used to verify the integrity of data downloaded from a P2P network.

Question 19

What is a Thin Client?

Answer 19

Thin clients are simpler than normal computer systems with harddrives, full operating systems, and locally installed applications. They rely on central servers, which server applications and store the associated data.

Question 20

What is a diskless workstation?

Answer 20

A diskless workstation contains memory, cpu, and firmware, but no harddrive. The kernel and operating system are typicall loaded via the network.

Question 21

What is the boot order of a diskless workstation?

Answer 21

BIOS>POST>TCP/IP>BOOTP or DHCP.

Question 22

What are thin client applications?

Answer 22

Thin client applications normally run on a system with a full operating system, but use a Web browser as a universal client. Network traffic typicall uses HTTP (TCP port 80) and HTTPS (TCP port 443).

Question 23

What are The Internet of Things (IoT)?

Answer 23

The Internet of Things refers to small internet connected devices such as baby monitors, thermostats, light bulbs, cash registers, appliances, smart meters, cars, etc. Many of these devices are directly accessible via the internet.

Question 24

What are the security risks associated with IoT?

Answer 24

Default credentials are common, enterprise management tools are usually lacking, patching can be difficult (if not impossible). Vendors often release patches slowly and commonly end support of devices that are still in widespread use.