Enterprise security

Question 1

What is an IP schema?

Answer 1

An IP address plan or way of standardizing IP addresses, such as the number of subnets or the amount of hosts per subnet, or different IP ranges for different networks or different locations.

Question 2

What is a baseline configuration?

Answer 2

A baseline for the way application security is handled. The firewall settings, patch levels, or OS version in use.

Question 3

Which security principle would come into play when deciding whether or not you should move data that is stored about customers in another country into your local datacenters in the US?

Answer 3

Data sovereignty

Question 4

Which region of the world is affected by GDPR?

Answer 4

The EU.

European union.

Question 5

If you receive a receipt after a purchase that shows the card used to make the purchase as “*********0329” which data privacy principle was used?

Answer 5

Data masking.

Data masking on your receipt does not necessarily mean that the rest of the card number was not stored elsewhere though.

Question 6

What is data at rest?

Answer 6

Data which resides on a storage drive for long term storage, rather than just existing in memory.

Question 7

What is data in transit?

Answer 7

Data which is currently in motion across the network.

Question 8

What is data in use?

Answer 8

Data which is actively processing in the memory.

Question 9

Is data in use inside of memory typically encrypted?

Answer 9

No, it would be very hard to use if it were.

Question 10

Which type of encryption does tokenization typically use?

Answer 10

None. tokenization is not encrypting or hashing.

Question 11

What is tokenization?

Answer 11

Replacing sensitize data with a non-sensitive placeholder, a one time token.

Question 12

How would tokenization work while making a purchase with your phone or watch at a store?

Answer 12

1. You register a credit/debit card on your phone using apple pay, etc
2. The card is registered with the token service center for this company.
3. The token service company stores a token on your device.
4. You use your phone at checkout somewhere using NFC.
5. The token is transmitted over to the payment processing server.
6. The payment processing server sends the token over to the token service company for validation.
7. The token service company validates that this token is valid and the account is authorized for this purchase and replies back to the payment processing server saying that it is valid and the purchase is complete.

Question 13

What is IRM?

Answer 13

Information rights management(IRM).
Think when you open a MS word document and it says that you can only read the word doc and not edit it.
This can be used in emails and other things as well.
The point is to prevent the way a document is interacted with, such as edits, screenshots, etc.
The goal is to limit attackers abilities with a document to that of the current user they are logged in as.

Question 14

What is an endpoint DLP?

Answer 14

A data loss prevention (DLP) that resides on an endpoint device.

Question 15

What would be the name for a DLP solution that exists between users and the external internet, using no hardware or no software?

Answer 15

Cloud based DLP.
This can be used for blocking custom defined data strings from entering or leaving a server or to manage access to certain URLs.

Question 16

What would an email DLP solution look like?

Answer 16

It would check every email inbound or outbound.
Inbound: Blocking on certain keywords, identifying spoofing, quarantining emails.
Outbound: Fake wire transfers, w-2 transmissions, employee private information ,etc.

Question 17

Which is newer SSL or TLS?

Answer 17

TLS is the replacement for SSL. In fact no one should be using SSL for any reason, and it should be concerning if you are because it is insecure.

Question 18

What is SSL/TLS inspection?

Answer 18

SSL/TLS inspection is a way of inspecting outgoing(usually) SSL/TLS traffic.
It extends the trust that your browser has with the certificate authority(CA) and the certificate received, to the inspector in the middle, typically within a firewall or some kind of ssl decryption device.
The device doing the inspection contains its own local CA certificate, just for use internally within your organization, nothing going outbound.
Every user on the network would have this CA certificate existing on the inspecting device as a trusted CA in their browser.
The inspecting device will now act as a proxy, handling all web traffic and sending them to the correct parties, but first decrypting them and inspecting them, but sending the packets unchanged to the necessary parties.

Question 19

How would a WAF be a great way of securing API calls on your network?

Answer 19

A WAF(web application firewall) could limit users allowed to send API calls, and furthermore limit which API calls specific users were able to make.

Question 20

Which security event would typically bring into focus following a site resiliency plan?

Answer 20

A disaster is called.
It could be days, month, even longer before you are able to use your original datacenter again, and you need a plan in place to shift operations over to a fallback alternate processing site.
Documentation must be made for moving to a disaster alternate site and for coming back to your original datacenter.

Question 21

What is a Hot Site?

Answer 21

In disaster recovery, a Hot Site is an exact replica of what we are running in our production enviroment, everything is duplicated. Applications and software are constantly updated so everything is in sync.
This should make for a very easy switch in the event of disaster, effectively flipping a switch and everything should be ready to go at the DR location.

Question 22

What is a cold site?

Answer 22

Effectively the opposite of a Hot site. Just a building and nothing else. Doesn’t have any hardware inside, a completely empty building. None of your data or none of your applications. This means that you need to bring the data with you. No people either, you need to bring the personnel to set everything up and maintain it.

Question 23

What is a warm site?

Answer 23

Somewhere in the middle between a hot site and a cold site. It contains just enough to get going. Instead of having nothing or everything. There might be some hardware already there.

Question 24

What is a honeynet?

Answer 24

Multiple honeypots chained together on a network. Containing more than one source of information.

Question 25

What is a honeyfile?

Answer 25

Bait for the honeynet, or honeypot, honeyfiles are the files inside of your trap. An alert will be sent if the file is accessed.
“passwords.txt”

Question 26

What is fake telemetry?

Answer 26

Fake telemetry would be an attacker feeding fake information to a machine learning defense system intentionally to trick it into thinking that certain kinds of malicious behavior are actually benign.

Question 27

What is a DNS sinkhole?

Answer 27

A DNS sinkhole when used by an organization is a DNS that hands out incorrect IP addresses as a response at its discretion based on what it perceives to be unwanted traffic going out, and logging the results of which users tried to access a malicious/suspicious site, giving your security team a chance to check out what is going on.

Typically integrated in an IDS/IPS or a next generation firewall.

When an attacker uses a DNS sinkhole it can be bad because they are able to redirect users to a malicious attack, or create a DoS because no one is able to get to the legitimate service, although this is less common.