Domain: 7 Security Operations 13% Flashcards
Administrative Security
Provides the means to control people’s operational access to data.
Least Privilege
We give employees the minimum necessary access they need, no more, no less.
Need to know
Even if you have access, if you do not need to know, then you should not access the data.
Separation of duties
More than one individual in a single task is an internal control intended to prevent fraud and error. We do not allow the same person to enter the purchase order and issue the check.
Job rotation
Job rotation to detect errors and frauds. Makes it easier to detect fraud and there is less chance of collusion btw individuals if we use job rota
Mandatory vacations
Done to ensure one person is not always performing the same task, someone else has to cover and it can keep fraud from happening or help us detect it. Their accounts are locked and an audit is prfrmd on the accnt.
NDA (non disclosure agreement)
Can be btw employees and the org. Or btw two orgs.
Background check
references, degrees, employment history, certifications, criminal history, credit history. For sensitive pos the bckgrnd chck is an ongoing process.
Privilege monitoring
The more access and privilege an employee has the more we keep an eye on their activity. We continually audit and monitor what they access. This is normally automated.
Digital (comp) forensics
Focuses on the recovery and investigation of material found in digital devices, often in relation to comp crime. Forensics is based on gathering and protecting the evidence, where incidents responses are how we react in an event breach. We preserve the crime scene and the evidence, we can prove the integrity of it at a later needed time,oftn court.
The forensic process:
- Id the potential evidence, acquire the evidence, anayze the evidence, make a report.
- be aware of how we gather our forensic evidence, attckrs are cvring their tracks, deleting the evdnc and logs.
- This can be through malware that is only in volatile mem, if pwr is shut off (to preserve the crime scene), the malware is gone and the evidence is lost.
- Disconnect sys from ntwrk adn take bit by bit copies of the mem, drives, running processes & ntwrk cxn data.
The evidence
we collect must be accurate, complete, authentic, convincing, admissible.
Identification
Id the evidence, what is left behind.
Preservation
Evrythng is documented, chain of custody: Who had it when? What was done? When did they do it? Pull the og, put it in write protected machine, we make a hash. We ony do examinations and analysis on bit level copies, we confirm they have the same hash as the og before and after examination.
Collection
We examine and analyze the data, again we document evrythng. We handle the evidence as little as possible. Work from most volatile to least volatile, starting with the RAM and ending with the hard disks.
Incidence response plan
can include getting our HR and Legal dept involved. Ensure evidence is acquired in a legal manner remember US Cons 4th amendment.
Examination
find the facts and document them, collecting the data.
Analysis
look at the data and look for meaning or reason
Presentation in court
we present our findings and any other evidence.
Decision
The court rules on the case.
Forensic data
is normally obtained from binary images of secondary storage, portable storages devices: hard drives, flash drvs, CDs, DVDs, cell phone, mp3 players. We use binary or bit stream image copy to ensure ew get an exact copy of the device, and not just a copy of certain sectors.
Real Evidence
Tangible adn physical objects, in IT Sec: hd, usb -NOT the data on them.
Evidence Integrity
It is vital the evidences integrity cannot be questioned, we do this with hashes. Any forensics is done on copies and never the originals, we check hash on both original and copy before and after the forensics. Heresay, but admissible due to Law 803.
Chain of Custody
Chain of custody form, this is done to prove the integrity of the data. No tampering is done. Who handled it? When did they handle it? What did they do with it? Where did they handle it?
Allocated space
The portions of the disk that are marked as actively containing data.
Unallocated space
The portions of the disk that does not contain active data. This is parts that have never been allocated and previously allocated parts that have been marked unallocated. When a file is deleted, the parts of the disk that held the deted file are marked as unallocated and made avaialble for use. So that data is there unit ovrwrtten
Slack space
data is stored in specific size chunks known as clusters (clusters = sectors or blocks). A cluster is the minimum size that can be allocated by a file system. If a particular file, or final portion of a file, does not require the use of the entire cluster then some extra space will exist within the cluster. This leftover space is known as slack space: it may contain old data, or can be used intentionally by the attackers to hide information.
Bad blocks/clusters/sectors
HD end up with sectors that cannot be read due to some physical defect. The sectors marked as bad will ignored by the OS since no data could be read in those defective portions. Attackers can mark sectors or clusters as being bad in order to hide data within this portion of the disk.
Network forensics
we look at monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Network investigations deal with volatile and dynamic info. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.
The first type
monitoring a network for anomalous traffic and id intrusions (IDS/IPS). An attacker might be able to erase all log files on a compromised host, a network-based evidence might be the only evidence available for forensic analysis.
The second type
relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human comm such as emls or cht sessions
Catch-it-as-you-can
All packets passing through a certain traffic point are captured and written to storage with analysis beind done subsequently in batch mode. This approach requires large amounts of storage.
Stop, look and listen
each packet is anlyzed in a basic way in memory and only certain fino is saved for future analysis. The approach requires a faster process to keep up with incoming traffic.
Catch-it-as-you-can
All packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.
Stop, look and listen
each packet is anlyzed in a basic way in memory and only certain info is saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.
Forensic software analysis
Comparing and/or reverse engineering software. REverse engineering malware is one of the most common examples. Investigators often have a binary copy of a malware program, and try to deduce what it does. Common tools are disassembers and debuggers.
Embedded device forensics
SSD’s, GPS’, cell phones, PDA. They contain a lot of info, but how we safely retrieve it while keeping the integrity of the data. IOT can be a sec concern. Where does the GPS say the car, phone or person was at a certain time? When did the AC turn on? Can we assume someone was home at that time?
Incident management
Involves the monitoring and detection of security sevents on our systems, and how we react in those events. The primary purpose is to have a well understood and predictable reponse to events and computer intrusions. We have very clear processes and a responses, and our teams are trained in them and know what to when an even occurs.
Incidents and events can generally be categorized in 3 classes
Natural: Hurricanes, flds, earthquakes, blizzards, anything that is caused by nature. Human: Done intentially or unintentionally by humans, these are by far the most common. Enviromental: The pwr grid, the Internet cxns, hwd failure, sftwr flaws.
Event
An observable change in state, this is neither negative nor positive, it is just something has changed.
Alert
Triggers warnings if certain event happens.
Incident
Multiple adverse events happening on our systems or network, often caused by people.
Problem
Incidence with an unknown cause, we would follow similar steps to incidence reponse. More time would be spent on root cause analysis, we need to know what happened so we can prevent it from happening again.
Inconvenience (non-disasters)
Non-disruptive failures, hd failure, 1 server in a cluster is down.
Emergency (Crisis)
Urgent, event with the potential for loss of life or property.
Diaster
Our entire facility is unusable for 24 hrs or +
Diaster
Our entire facility is unusable for 24 hrs or +. Yes, a snowstorm can be a disaster.
Incident management, 7-step lifecycle
- Prep (left out in exam). 2. Detection (Id). 3. Response (Containment). 4 Mitigation (Eradication). 5 Reporting. 6. Recovery. 7 Remediation. 8 Lessons Learned (Post-incident activity, post mortem, or reporting)
- Preparation
We write the policies, procedures, we train our staff, we procure the detection sft/hrdwr, we give our incidence response team the tools they need to respond to an incident.
- Detection
Events are analyzed to determine if they might be a security incident. IDS’ can help us detect, IPS’ can help us detect and prevent further compromise. SIEM = security incident event manager, collects everything from everything all alerts,logs, event, incident.
- Response
When the incident response team begins interacting with affected systems and attempts to keep further damage from occurring as a result of the incident. Isolate the sys, network/traffic. Make bit level copies of sys
- Response
When the incident response team begins interacting with affected systems and attempts to keep further damage from occurring as a result of the incident. Isolate the sys, network/traffic. Make bit level copies of sys Stop it from spreading
- Mitigation
Understanding the cause of the incident that the sys can be reliably cleaned and restored to operational status later in the recovery phase.
- Reporting
begins with the detection, and we start reporting immediately when twe detect malicious activity. Reporting has 2 focus areas technical and non-technical. The incident handling team reports the tech details of the incident as they start the incident handling process, but they also notify management of serious incidents. The procedures and policies will outline when which level of managment needs to be informed and involved.
- Recovery
We carefully restore the sys/s to operational status. We closely monitor the rebuilt sys incase a backdoor was left.
- Remediation
Remediation happens during the mitigation phase, where vulnerabilities on teh impacted system/s are mitigated. Patching all sys with the same vulnerability or change how the org authenticates.
- Lessons Learned
Problem there has been fixed, what was compromised, what are the vulnerabilities, how did the team react, which part of our plans worked and which didn’t.
Root-cause analysis
We need to fix the vulner on the sys/s that were effected, but also on any system in the organization that has the particular vulnerability or set of vulnerability.
IDS and IPS
can be categorized into 2 types and with 2 different approaches to identifying malicious traffic.
Network based
placed on a network segment (a switch port in promiscuous mode)
Host based
on a client, normally a server or workstation
Signature (pattern) matching
similar to antivirus, it matches traffic against a long list of known malicious traffic patterns
Heuristic (Behavioral) based
uses a normal traffic pattern baseline to monitor for abnormal traffic.
SIEM (Security Info and Event Management)
gives you a full picture views and data correlation.
IDS (Intrustion Detection Sys)
They are passive, they monitor, but they take no action other than sending out alerts.
IPS (Intrusion Prevention System)
Similar to IDS, but they also take action to malicious traffic, what they do with the traffic is determined by configuration. Events trigger an action.
IDS/IPS
Part of our layered defense. Basically they are packet sniffers with analysis engines.
