Domain 7 Flashcards
What is the information security lifecylce?
Note that the names of the phases are not important for the exam but the concepts of each are:
1) Planning
2) Provisioning
3) Operating
4) Decommissioning
You must own security from end to end. From inception to destruction
What is the planning phase of the IS lifecycle?
Security should always be considered prior to deployment
Planning needs to account for security. It enables you to make risk based decisions
What is the provisioning phase of the IS lifecylce?
This is concerned with preparing a user, service or system for active deployment. Provisioning ends with instantiation.
examples - creating a new user, deploying a new system, developing a new application
Security must be baked in at this level to ensure an initially secure deployment
Security baselines and configuration management are key
What is baseline configuration?
Baseline configuration seeks to determine the required and necessary components of systems and software. Get rid of anything you do not need!
To build baseline security there are several goals:
- determine a reasonable secure starting point for systems configurations - identify what is necessary and what is not
- establish a consistent configuration across majority of systems
- reduce time to recover a deployed system
Do not start from scratch to determine baseline security and configurations - there are many free resources and guidance on this.
- CIS
- Microsoft
- NIST 800s
- DISA STIGs
What is configuration Change Monitoring?
Once you get a secure baseline, you want to make sure it does not change.
You MUST control changes to the baseline configuration.
- You must have an approval process and maybe even a change control board so unauthorized changes dont occur
- you must have controlling and monitoring for security relevant changes
What is baseline monitoring?
Monitoring for key security relevant changes. Make sure the organization continues to operate under correct assumptions about its security posture.
Must monitor our systems for configuration changes
What is the Operating Phase of the IS lifecylce?
Secure provisioning and deployment
- the lengthiest phase within the lifecycle is typically the deployed operational phase
Key activities include:
- change management
- patching and vulnerability management
- security assessment
- preventing and detecting security issues
You cannot set it and forget it with security. Even if you have good security steps in planning and provisioning, you must continue to monitor it
Operating includes on-going maintenance:
- change and patch management
You must also keep an active inventory of all assets so that you can continue to monitor them
- invetory:
- — dont use spreadsheet methods - too slow and incomplete
- need inventories to ensure are are aware of assets that need a hardened configuration and have a grasp on software installed and patching requirements
What is host discovery?
Identify all hosts on our networks so we have them ll in our inventory
- do you know all your laptops, desktops, routers, switches, HVAC, printers, building automation, physical security devices, etc.
Active host discovery:
- The most direct way to identify hosts is via active host discovery
- from one node, we send a stimulus trying to elicit response from possible endpoints
- examples are ping sweep of relevant IP address space
Passive host discovery:
- if a system does not have a listener, we can detect the systems by sniffing any IP addresses or unknown MAC addresses
- could also determine particular application for some that are generating traffic
- we employ a sniffer and look for evidence of traffic indicative of systems
What is software application tracking?
You also see all the old applications and software out there being used.
Know the various endpoints and some applications. Most important to know about the vulnerable software they may be running
Can do this through vulnerability scans
What is monitoring?
SOC can do this, outsource most of this but not all. You can continuously monitor the state of the organization’s systems, applications and users
What is a security assessment?
Routinely assessing security posture. This is an operational task that must be done continuously.
Discussed in detail in domain 6
What is the decommissioning phase of the IS Lifecylce
decommissioning - process of removing an application, system, user or data from active production
- systems - ensure no sensitive data persists
- — wiping hard disks; formatting is not enough
- — printers are systems too
- users - ensure post employment access is appropriate
- — ensure orgs data is transferred to the right person
- — ensure all users access ceases with their employment
- Data - ensure data past its retention data is appropriately removed/wiped from all locations
What is cloud computing?
Cloud computing uses virtualization to provide highly available applications and servers
- modeled after the electrical grid
- based on network clouds
What is elastic cloud computing?
Focuses on dynamically provisioning resources to cloud services - lowers friction by providing cloud resources dynamically. Instead of operating a service 24/7, a client may deploy a service as needed, from hours on up and then decommission the service when no longer needed.
Can also be used on-demand - e.g. rent a high volume web service for 8 hours
Organizations typically pay per unit not per virtual host
What is IAAS, PASS, and SAAS?
- Infrastructure as a service - IAAS - cloud based virtual private servers sucah as a linux server. you have full control of the OS, including root and admin. You install software, patch the kernal and upgrade the OS
- Platform as a services (PAAS) - a server service, such as an apache web service. a web server instance. Admins have control over the service configuration only and not the general OS. You could restart the web service but not reboot the entire system
- Software as a service (SAAS) - a client service such as client email like Gmail - cloud based application access like webmail
What is provisioning and deprovisioning cloud servers?
1) Provisioning
- you can configure everything yourself of you can provision a preconfigured server with all required software already installed and configured.
- this offers time savings
- risk is misconfiguration, mistakes, security vulnerabilities
2) deprovisioning
- secure deprovisioning is essential
- how do you know if virtual images are securely wiped?, do backups remain on the cloud?, have data remnants been securely deleted?
- contracts should spell out data retention and remanence policies
USE dual factor authentication for your cloud console
What are multi-tenant clouds?
Clouds that combine virtual machines from multiple organizations onto one physical host.
Single-tenant is when clouds dedicate host hardware to a specific organization.
Multi-tenant you could assume some of the risk of the other consumers resources
What are clouds without borders?
Most clouds provide no geographic boundaries: Infrastructure, platrforms, software, and data may move freely across the world.
Must know your regulations and carefully consider them.
Where is your data in the world?
What are details in a cloud contract?
- SLA (establish contractual obligations required to be met in order to provide acceptable service. they must be measurable to determine compliance or noncompliance) - financial compensation if vendor does not meet the SLA
- — turnaround times
- — average response times
- — number of online users
- — system utilization rates
- — system up time
- — volume of transactions
- — production problems
- Right to audit and pen test
- ownership of data
- termination agreement including secure return and or destruction of data and all copies
What are the advantages and disadvantages of cloud?
Advantages:
- no need to manage data center to host equipment and software
- preconfigured services may be quickly deployed
- redundancy
- speedy deployment times
- lower cost
- higher performance
- easier scalability
Security Concerns:
- outsourcing trust to the cloud provider
- what if the cloud provider is compromised?
- where is the data?
- do you have the right to audit?
- no longer have direct control over applications and data
What is Change Management?
The process of ensuring that changes dont negatively impact the system
Changes must be approved by the Change Control Board and documented in the change management database
Security should be considered when approving a change
Goals of change management:
- ensure that changes dont negatively impact the security posture of the organization
- notify stakeholders of upcoming changes
- determine potential system security impacts are acceptable
- document planned changes to allow for review
- identify possible means to revert to prior state should changes have unexpected negative impacts
What is the change control board?
Group responsible for ensuring that changes happen in a manner that doesnt negatively impact the organization.
Helps in the management of change. Changes are proposed, presented, reviewed, approved and scheduled by the CCB.
Need for speed - need fast decision making
What is the change control process?
- Notification of desire for change
- Formally documenting change details (also document failback plan should change not proceed as expected)
- determine appropriate schedule for change
- making the change
- reporting success, failure, and any relevant additional details regarding change
- uptime availability
Changes should be formally tested and a full report must be submitted to management with a summary of the change
What is patch management?
Specific type of change that is routine updating of an OS and applications as vendor updates are released.
Should be done at least monthly if not faster.
Patch testing and deployment procedures are typically required. Need to find a balance between operational stability and uptime versus rapid patch deployment. There are risks with patching without testing as well as not patching fast enough
Patch Now = beyond critical - there is malware on the wire, go now! (do ASAP - within 2 days)
Critical = patch fast - about 2 weeks
What is patch windows and testing?
A maintenance window for patch installations should be agreed upon in advance as routine patch releases are to be expected.
A process for accelerated patch deployment, in advance of a maintenance window, should be reviewed in case a time comes when a patch is so critical that waiting for a maintenance window introduces an unacceptable level of risk.
Patch testing considerations are not clear-cute. A risk based decision must be made to determine the level of testing needed for an org.
Patch-rinse-repeat:
- there is a never ending cycle of patching
- patch identification
- possible patch testing
- patch deployment
- patch verification - ensure that the patches have been successfully installed on all systems.
What is vulnerability management?
Vulnerability scanning can provide a means outside of patch management solutions to answer if patches have been deployed and if any systems were missed.
Focus is to determine if a patchable flaw persists and enumerate known flaws
Goal is to pick up where scanning finishes and ensure prioritized remediation occurs in a timely fashion
What is a firewall?
The perimeter firewall is likely the first security tool to be encountered on the ingress and the last security tool for egress.
Focus is to provide somewhat basic, but fast security screening before reaching a more capable firewall.
Primarily designed for filtering traffic coming from external networks and should only expose necessary services to the external network.
What is default deny inbound?
It is a default deny rule for inbound traffic that is not explicitly allowed.
What is additional layer 3 inbound filtering?
Firewalls should filter both inbound and outbound traffic. You can bolster the rule base with some additional prevention/detection outside of the implicit deny all function. You can do this through additional filters:
Source IP address filters:
- blacklist source IP addresses historically up to no good
- blacklist bogus source IP (RFC 1918, Bogon (address that shouldnt be on the internet like private addresses), traffic coming from the internet using an internal address that is spoofed)
- Blacklist regions based on geolocation
Destination IP address filters:
- unused public IPs allocated to your org.
What are the four main types of firewalls?
1) Packet filtering
2) stateful
3) proxy
4) next generation firewalls
What is a packet filtering firewall?
It is the most basic type of firewall. It is very fast but not very secure in protecting a network.
It works by examining each packet independently and determines whether it should pass or be dropped.
It has no idea of what traffic came before it. Only looks at the network protocol information in each packet to determine whether the packet should be dropped or allowed. ACL has no memory of previous packets and does not decide on the activity.
It has to make assumptions. Decides based on the reply allow.
They are faster because there is no state table lookup but wouldnt use one today
What is stateful inspection firewall?
This firewall builds on top of packet filtering firewall and overcomes many of the limitations.
This firewall keeps a state table of all traffic that occurred on the network and requests that went out are in the state table. By keeping a state table, assumptions no longer have to be made when filtering out or dropping packets.
The state table is used to determine whether a packet should pass or be dropped because it remembers if someone in the network asked for that packet or not.
This is more secure than packet filtering but it is slower and requires more resources to be used. State table lookup adds a split second delay.
What is a proxy firewall?
A proxy firewall sits between two systems that are communicating. It creates two TCP connections for each request. It maintains one TCP connection with the client and one with the server. It is also known as an application proxy because it processes packets at all seven layers of the OSI model
You connect to the proxy and it connects out. Great control - it allows you to inspect traffic and stop and initiate or not.
What are the two types of proxy firewalls?
1) circuit level proxy firewall
- does not use application level proxy software
- develops a virtual connection between host and destination
- typically sits at the session layer
- SOCKS is the most common example. SOCKS is a circuit level proxy server that is used to authenticate a client. It supports hosts to connect through a firewall to an internal computer and it supports internal computer connections to external networks. replaces network system calls with socks calls. Network utilities have to be “socksified” to operate
- operates as a proxy server
- SOCKS doesnt understand the language - it just proxies things along. It is less granular but more universal because it can proxy more stuff
- cannot understand the granularity of the content because it doesnt speak the language (e.g., doesnt know if someone is on an explicit site or not - just allows https)
2) application proxy firewall
- implemented on a computer by using proxy server software
- hides the origin of packet to the internet
- acts as intermediary and moves an accepted packet from one network to another network
- referred to as application layer gateway
- operates at layer 7
- laid the foundation for NGFW
- SQUID - application level
- can undestand granularity of what people are doing and the actual content - e.g., can stop explicit site usage and knows a variety of protocols including HTTP, SMTP, FTP)
What is a Next Generation Firewall (NGFW)?
Layer 7 content scanning. They are a great control and money well spent.
Need to scan layers 3, 4 and 7. IP addresses and ports in 3 and 4 but need to scan the actual data (layer 7). Is the data clean or dirty?
NGFW was built squarely with layer 7 in mind. It has application inspection capabilities. It exposes detailed understanding of client and web applications, not just IP addresses associated with a particular server/service.
They can understand and filer specific client side application capabilities.
Best example - you want to block facebook chat but you dont want to block all of facebook. A Stateful inspection (layer 3/4 firewall) will have to block the whole site because it blocks based on IP address or port number. A NGFW can block the particular contents of the facebook site by blocking only chat and allowing the other functions of facebook to be allowed. That is because it can dig deeper into the layer 7 content and filter specific capabilities
**NGFW does not replace stateful inspection - they should be used together for ideal security.
What is a bastion host?
- exposed to the internet with nothing else protecting it (e.g., firewall)
- computer in the public area or a DMZ
- exposed to attack from the internet
- must have functions to protect itself
- web, mail ftp servers can be considered bastion hosts.
What is host-based firewalls?
- Software that runs on the protected host
- Additional defense in depth layer when combined with network firewalls
- Examples:
- — windows firewall
- — iptables
- —IPFilter
- — Application firewall
- — McAfee personal firewall
- —zonealarm
Should be used in addition to network firewalls
e.g., symantec is a software loaded on your laptop which is the host and is the firewall for the host
What is an intrusion protection system (IPS)?
Like an IDS but tries to prevent.
- It will look to block suspect traffic
- False positive on an IPS is a self-imposed DoS condition because it will be trying to drop traffic based on the payload and can cause service outages. The configuration must be so that false positives cannot occur
Can also filter Layer 7 application data
What is malware detonation/sandboxing?
MDD (malware detonation devices - called sandboxing in the CISSP.
Devices that put things that seem suspect into a box isolated to see what it does. MDD does this automatically. You render and execute files in a box before passing it on to the targets.
What are the capabilities?
- bolster protection against malware from both an exploitation and post exploitation vantage. You run actual malware and see what it does so you have to do this in a very safe place. A lot of times malware will not detonate if it knows its in a sandbox
- Sandbox will attempt to rapidly open/execute suspicious files and render content to determine endpoint impact.
- main emphasis is automatically trying to render or execute files before passing them on.
What is application whitelisting?
It is the list of confirmed authorized or known good software and applications.
Anything beyond the known good list requires exception handling.
We allow a list of known good software that has been vetted and deemed approved. Anything beyond the list should be blocked or considered suspicious until handled.
You whitelist the application - not the file. The whitelist will not care if a spreadsheet has changed. It does not give confidentiality and integrity of data. It also doesnt help with malicious executables being written to a compromised system - only becomes relevant when that malware tries to run. You can still copy malware to the system it just wont run.
What is antimalware and antivirus?
Endpoint security software that attempts to block malware and virus threats.
Antivirus focuses on worms and viruses
antimalware might bundle antivirus, antispyware, host IPS, application whitelisting
Do not set it and forget it
Just get it - most professionals complain and dont like it but you should just get it
What is Intrusion detection system? (IDS)
IDS is a passive system that sends alerts when malicious actions occur. requires read only access to a network
Sits on network and sniffs traffic. It is a sniffer with rules that look for indication of an attack. It operates in two modes:
1) passive - sends alert but does not stop the attack
2) active - stops the attack, usually by sending resets
IDS events are classified as:
- true positive - sets off alert and its a real attack
- true negative - does not set off an alert and it is normal traffic
- false positive - sets off alert and its normal traffic
- false negative - does not set off an alert and it is an attack
Increase the true positives and true negatives.
Both IDS and IPS run in three modes:
- signature matching
- protocol behavior
- anomaly identification
What is signature matching?
This is a form of detection which alerts when specific patters are recognized
Looks for any evil pattern and alerts - can only do this if it has seen a pattern in the past. If there is something brand new or custom, it wont work because it has never seen it.
It is a form of blacklisting
It is prone to false positives and tends to fail against:
- new or custom malware attack techniques
- polymorphic malware - changes as it spreads
- encrypted traffic
What is protocol behavior?
Alert for malicious traffic that is not following modeled protocol behavior:
Example:
- model expected protocol usage for TCP as SYN-> SYN/ACK -> ACK. Alert when you receive non standard protocol usage such as SYN/FIN or SYN/RST
This is prone to false positives with complex protocols, nonstandard implementations and changing protocol use
What is anomaly detection?
Models expected behavior and ignores it. IT alerts on anomalous behavior
Could be new application, user or just statistically significant behavior changes but it will be alerted on.
Prone to false positives when behavior changes and often difficult to understand cause of the alerts.
It is best used on small, well designed networks and in specific high risk cases. It has earned a poor reputation based on poor design and deployments.
It learns on learning mode different behaviors - it will learn and then when its on alert mode it will alert anything out of what it had learned.
