General Review Flashcards by Brant Lumpkin

Cyber Kill Chain

Reconnaissance

Weaponization

Delivery

Exploitation

Installation

Command/control

Actions on objectives

How well did you know this?

Not at all

Perfectly

Diamond Model of Intrusion Analysis

Adversary - threat actor group

Capabilities - adversary exploit to carry out attack

Victim

Infrastructure - how attacker gets to victim

Applies scientific principles to provide post-event analysis of intrusion

How well did you know this?

Not at all

Perfectly

Symmetric Algorithms

RC4

AES (strongest)

DES

3DES

QUAD

How well did you know this?

Not at all

Perfectly

Asymmetric Algorithms

RSA

Diffie-Hellman

ECC

El Gamal

DSA

How well did you know this?

Not at all

Perfectly

Linux permissions

Read - 4

Write - 2

Execute - 1

Owner | Group | Other

How well did you know this?

Not at all

Perfectly

Strongest digital certificate type

Extended validation

How well did you know this?

Not at all

Perfectly

Quickest digital certificate type to obtain

Domain Validation

How well did you know this?

Not at all

Perfectly

Function call closely associated with Linux injection attacks

system( )

How well did you know this?

Not at all

Perfectly

Attack that depends on users being logged into multiple sites in same browser

XSRF

How well did you know this?

Not at all

Perfectly

Certificate Stapling vs Pinning

Stapling - web server downloading OSCP response from certificate vendor before providing to browsers

Pinning - public key/certificate has been seen for specific host/pinned to host

How well did you know this?

Not at all

Perfectly

Quick formatting leaves _____ ?

Files remain

File indexes are removed

How well did you know this?

Not at all

Perfectly

Bluesnarfing vs bluejacking

Bluejacking - pushing unsolicited messages (annoyance)

Bluesnarfing - data theft

How well did you know this?

Not at all

Perfectly

Vertical scaling vs Horizontal scaling

Vertical - add resources to existing machine

Horizontal - add additional machines

How well did you know this?

Not at all

Perfectly

OAuth vs OpenID

OAuth (authorization) - open standard for authorization - allow using third party accounts without exposing password

OpenID (authentication) - open standard providing decentralized authentication - log in to multiple websites with one set of credentials

How well did you know this?

Not at all

Perfectly

Security concerns of IPv6

Scanning sequential IP addresses no longer viable on many networks

Blocking ICMP can cause significant problems

Devices may have more than one IP stack

How well did you know this?

Not at all

Perfectly

Security concern of SSH keys

Inadvertent exposure of private key

Weak passwords/passphrase

SSH key sprawl

How well did you know this?

Not at all

Perfectly

NIST SP 500-292

Cloud reference architecture

Understand interactions between different services/organizations in cloud deployment

How well did you know this?

Not at all

Perfectly

Account permissions for credentialed scan

Read-only

Follow principle of least privilege

How well did you know this?

Not at all

Perfectly

Component of cryptographic system responsible for secrecy

Key

How well did you know this?

Not at all

Perfectly

Method to identify rootkit

Mount drive on another system in read-only mode

Boot from USB drive/scan using known good OS

How well did you know this?

Not at all

Perfectly

Most likely path for macro virus infection

User intentionally enabled macros for file

How well did you know this?

Not at all

Perfectly

Method to prevent application DoS attacks

Use CAPTCHA to confirm user is human

How well did you know this?

Not at all

Perfectly

Common measures to assess threat intelligence

Timeliness

Accuracy

Relevance

How well did you know this?

Not at all

Perfectly

NIST Framework core security functions

Identify

Protect

Detect

Respond

Recover

How well did you know this?

Not at all

Perfectly

Best CASB solution for interacting directly with CSP

API-based CASB

Forensic toolkit that includes memdump

Volatility

Method of improving SNMP security

Change public community name

What is used in Windows to identify a user account?

security identifier (SID)

Type of attack in which JavaScript is entered into text area that will be viewed by other users

XSS

What is validated when verifying certificate chain?

Users can verify that the site + CAs in chain are all trustworthy

What does Kerberos use to issue tickets?

Key distribution center (KDC)

What does Kerberos use to generate tickets?

Ticket granting service (TGS)

Capability not common in UTM

MDM

Best way to mitigate CSP not supporting same security controls as internal network

CASB

Simplest/quickest method to secure weak protocols

SSH tunneling

Tool to ensure attacker can't introduce new switch in STP with lower bridge ID

Enable Root Guard

What information is placed in CN field for CSR?

FQDN

What does port security do?

Filters by MAC address

Method for content filtering (not firewall based)

Proxy server

Cloud system that stores/manages/allows auditing of API keys/passwords/certificates

Secrets manager

Best method for providing RTOS security

Use secure firmware

2 techniques most commonly associated with pharming attack

Modifying host's file on a PC Exploiting DNS vulnerability on trusted DNS server

Best option for verifying no unnecessary ports/services are available when vulnerability scanner can't be used

Configuration review

What function does counter mode perform in a cryptographic system?

Turns block cipher into stream cipher

Reflected XSS attack

Script inserted into input field Non-persistent

Stored (persistent) XSS attack

Embedded in a website post Not specific to a particular user

What size wrapper TKIP places around WEP encryption with key based on things i.e. MAC address of machine/serial number of the packet?

128-bit

STIX vs TAXII

STIX - standard for communicating threat information (motivations/abilities/capabilities/response information) TAXII - secure method for sharing STIX data (think taxi cab) Fall under Automated Indicator Sharing (AIS)

Data sources to gather to address file storage volatility

Partition data Temporary file systems

Security control associated with login banner

Deterrent

Part of PC startup process that verifies digital signature of OS kernel

Trusted boot

Best way to confirm secure baseline of deployed application instance

Perform integrity measurement

DNS sinkhole

Distributes incorrect DNS information Redirect known malicious domains to benign address Clients connecting to known malicious domains indicate certain malware infections Usually built in to NGFW/IDS systems Prevents communication with command + control

Edge vs fog computing

Edge - local processing at IoT device Fog - intermediate to local device and cloud (decide what data is transported to cloud for processing)

VPC + transit gateway

VPC (virtual private cloud) - pool of resources collected in public cloud Transit gateway - connect VPCs to each other + clients to VPCs Security benefits - VPCs commonly on different subnets + connected to via VPN

Banner grabbing

Actively connecting to server using Telnet or netcat Collect server's response Banner usually contains the OS version

Data sanitation method of degaussing

Purging (not destruction)

SAML

Solution for providing SSO + federated identity management Allows service provider (SP) to establish trust relationship with IdP SP can trust principal without principal having to authenticate directly with SP

SPI in GDPR

Sensitive Personal Information Race/ethnic origin Opinions/beliefs

Zigbee

Communication standard for IoT devices Longer range than Bluetooth Less power consumption than Wi-Fi

Dupont FM-200

Chemical fire suppression for electronics

Key stretching algorithms

bcrypt Password-Based Key Derivation Function 2 (PBKDF2)

Secure cookies

Will only be sent over HTTPS

HTTP Secure Headers

Enforce HTTPS communication Only allow scripts/images/stylesheets from local site (prevent XSS) Prevent data from loading into an inline frame (prevent XSS)