General Security Concepts Flashcards
1
Q
Technical Control Category
A
-Controls implemented using systems.
- Operating System controls
Examples of technical controls include firewall rules, intrusion prevention systems (IPSs) and intrusion detection systems (IDSs), and encryption standards, anti-virus
2
Q
Managerial Control Category
A
-Admin controls associated with security design and implementation.
-Security Policies, Standard Operating Procedures
Examples of managerial controls include organization-wide security policies, organizational best practices, periodic risk assessments, and security-aware change management.
3
Q
Operational Control Category
A
Operational controls focus on the day-to-day policies implemented by peopled instead of systems.
Examples of operational controls include security guards checking ID badges, user access reviews, and employee awareness training.
4
Q
Physical Control Category
A
-Limit Physical Access
Physical controls include bollards, fencing, access control vestibules, video surveillance, security guards, access badge, lighting, sensors (pressure, microwave, infrared, ultrasonic)
5
Q
Preventive Control Type
A
Block access to a resource.
-You shall not pass.
- For example, a firewall prevents access to a network by stopping suspicious traffic. Follow security policy, Guard shack checks all identification. Enable door locks.
6
Q
Deterrent Control Type
A
-Discourage an intrusion attempt
-Does not directly prevent access.
- Make an attacker think twice. Application splash screens, threat demotion, front reception desk, posted warning signs.
7
Q
Detective Control Type
A
-Identify and log an intrusion attempt
-May not prevent access
- Find the issue. Collect and review system logs, review login reports, regularly patrol the property, enable motion detectors.
8
Q
Corrective Control Type
A
-Apply a control after an event has been detected
-Reverse the impact of an event
-continue operating with minimal downtime.
-Correct the problem. Restoring from backups can mitigate a ransomware infection. Created policies for reporting security issues. Contact law enforcement to manage criminal activity. Use a fire extinguisher.
9
Q
Compensating Control Type
A
-Control using other means.
-Existing controls aren’t sufficient.
-May be temporary.
-Prevent the exploitation of a weakness.
-Firewall blocks a specific application instead of patching the app, Implement a separation of duties. Require simultaneous guard duties. Generator used after power outage.
10
Q
Directive Control Type
A
-direct a subject towards security compliance.
-relatively weak security control
- Do this please:
Store all sensitive files in a protected folder
Create Compliance policies and procedures
Train users on proper security policy
Post a sign for “Authorized Personnel Only”
11
Q
The CIA triad
A
Combination of principles.
-Fundamentals of of security.
12
Q
(CIA)
Confidentiality
A
Prevent disclosure of info to unauthorized individuals or systems.
Certain info should only be known to certain people.
13
Q
(CIA)
Integrity
A
Messages can’t be modified without detection
Data is stored and transferred and intended.
14
Q
Integrity
Hashing
A
Map data of an arbitrary length to data of fixed length.
15
Q
Integrity
Digital Signatures
A
Mathematical scheme to verify the integrity of data
16
Q
Integrity
Certificates
A
combine with a digital signature to verify an individual
17
Q
(CIA)
Availability
A
Systems and networks must be up and running.
Information is accessible to AUTHORIZED users.
Always at your fingertips.
18
Q
Availability
Redundancy
A
Build services that will always be available.
19
Q
Availability
Fault Tolerance
A
System will continue to run, even when a failure occurs.
20
Q
Availability
Patching
A
Stability, Close security holes.
21
Q
Confidentiality
Encryption
A
Encode messages so only certain people can read it.
22
Q
Confidentiality
Access Controls
A
Selectively restrict access to a resource. Who has access to what.
23
Q
Confidentiality
Two-factor Authentication
A
Additional confirmation before information is disclosed.
24
Q
Integrity
Non-repudiation
A
provides proof of integrity (Verify data does not change), can be asserted to be genuine.
You can’t deny what you’ve said.
25
# Proof of Integrity
Cryptography
Hash - Represent data as a short string of text.
- A message digest, a fingerprint.
if data changes, hash changes.
(person changes, different fingerprint)
26
Proof of Origin
-integrity
-authentication
-non-repudiation
-sign with private key
-verify with public key
27
# (AAA)
Security Framework
Authentication, Authorization, and Accounting
28
# (AAA)
Authenticating People
-Identification, who you claim to be, usually your username
- Authentication, prove who you are, password and other factors
29
# (AAA)
Authenticating Systems
How to authenticate a device?
-Put a digitally signed certificate on the device.
30
Certificate Authority
device or software that is responsible for managing all of the certificates in our environment.
-SIGNED BY ROOT
31
Certificate Authentication
Organization has
-trusted CA
-creates certificate for a device (digitally signs with org's CA)
-Cert can now be included on a device as an authentication factor ( CA's digital signature is used to validate the cert)
32
# (AAA)
Authorization Models
- Authorization, based on your identification and authentication,
-what access do you have?
-add abstractions to reduce complexity - create clear relationship between user and resource.
33
# (AAA)
Accounting
- Accounting, resources used: login time, data sent and received, logout time.
34
Gap Analysis Security Framework
-Where you are compared with where you want to be
-the gap between the two
- This is an extensive study with numerous participants.
35
Zero Trust Security Framework
Zero trust is a holistic approach to network security
- covers every device, every process, every person.
- NOTHING is trusted - everything must be verified.
-MFA, encryption, system permissions, additional firewalls, monitoring and analytics
36
# Zero Trust /
Control Plane
-Manages the actions of the data plane
-define policies and rules
- determines how packets should be forwarded
-routing tables, sessions tables, NAT tables
37
# Zero Trust / Control Plane /
Adaptive Identity
-Where we are examining the identify of the individual and apply security controls based on not just which the user is telling us but info we are gathering =>
-Consider the source and the requested resources
-multiple risk indicators -relationship to the organization, physical location, type of connection, IP address, etc.
- Once we examine all these resources we can Make the authentication stronger if needed.
38
# Zero Trust / Control Plane /
Threat Scope Reduction
-Another way to limit this trust is to decrease the number of possible entry points in the network.
-Entry points could be limited by VPN or inside of the building for example
39
# Zero Trust / Control Plane /
Policy-Driven Access Control
Once you have Adaptive Identity and Threat scope reduction in place
- Puts them all together and determines if the person is who they say they are.
40
# Zero Trust / Data Plane/
Policy Enforcement Point (PEP)
- the gatekeeper between subject and system.
- Allow, monitor, and terminate connections, can consist of multiple components working together.
Does not make decisions to allow or disallow traffic but does gather info and provides it to Policy Decision Point.
41
# Zero Trust / Control Plane /
Policy Decision Point (PDP)
includes the Policy Admin and Policy Engine.
- There's a process for making an authentication decision.
42
# Zero Trust / Control Plane /Policy Decision Point (PDP)
=>
Policy Administrator
Communicates with the Policy Enforcement Point
-Takes decision from PEP and generates access tokens or credentials
- Tells the PEP to allow or disallow access.
43
# Zero Trust / Control Plane /Policy Decision Point (PDP)
=>
Policy Engine
Evaluates Each access decision based on policy and other information sources
- Grant, deny, or revoke.
44
# Zero Trust /
Data Plane
-part of the device that is performing the actual security process (switch, router, or firewall)
-Process the frames, packets, and network data
- Processing, forwarding, trunking, encrypting, NAT
45
# Zero Trust / Data Plane/
Subject/System
The subject or system is the user or device that is requesting access to the resources.
46
# Zero Trust /
Security Zones
- another way to qualify the identity of a person is WHERE they are connecting from
- and where we are connection to
-ex: untrusted to trusted, internal to external, VPN1 to VPN5, Marketing to IT.
47
# Zero Trust / Security Zones /
Implicit Trust
Trusted to Internal Zones
- and inherited trust from one location to another
48
Honeypot
- way to attract attackers to your system and keep them involve
- see what type of tactics they are using
- what type of automation they are using and what systems they are trying to attack
- honeypots are Virtual worlds
49
Honeynet
multiple honeypots turn into a honeynet
- network that is more than a single device
- servers, workstations routers, switches, firewalls.
- make it look real to an attackers
50
Honeyfile
attract the attacker with more honey
- files with fake info
- bright and shiny - important or sensitive info (fake)
-an alert is sent if the file is accessed -virtual trap
51
Honeytoken
- traceable data
- if copied or distributed you'll know where it came from
- example - fake API credentials , database records, browser cookies.
52
Change Management
Change before, during, and after implementation to reduce potential impacts that the change may incur.
-WHAT needs to change
53
# Change Management Process
Approval Process
| 3 steps
* formal process for managing change
-avoid downtime, confusion and mistakes
* Typical approval process
-request **request** forms
-purpose for the change
-**review phase**
-identify the scope of the change
- schedule a date and time of the change
- determine affection systems and the impact
- analyze the risk associated with the change
- get **approval/reject** from the change control board
- get end-user acceptance after the change is complete
54
# Change Management Process
Ownership
-refers to the primary person who is responsible for overseeing the change process.
- ensures the process is followed and acceptable
- process updates are prided to the owner
- they don't OWN the process and don't usually perform the actual change
55
# Change Management Process
Stakeholders
-they are who are imapcted by this change
- they will want to have some input on the change management process.
-
56
# Change Management Process
Impact Analysis
* determines the risk value
- high, medium, low
57
# Change Management Process
Test Results
* Sandbox testing envirnomnet (testing in controllable environment)
-no connection to real world or production system
-a technological safe space
* Use before making changes to the production
-try the upgrate, the apply the patch
-test and confirm before deployment
* Confirm the backout plan
58
# Change Management Process
Backout Plan
* A plan to revert back to your original configuration
-prepare for the worst and hope for the best.
59
# Change Management Process
Maintenance Window
* What time frame to implement the change with the least impact on business operations.
* Can be the most difficult part of the process.
60
# Change Management Process
Standard Operation Procedures (SOP)
* Process must be well documented
* Should be available on the Intranet along with all standard processes and procedures.
-request
-review
-approve/reject
-test
-schedule and implement
-document
61
Technical Change Management
* Putting the change management process into acting / executing the plan
* HOW to change it
62
# Technical Change Mangement Process
Allow List / Deny List
* Security policy that can control app execution.
-Allow list- nothing runs unless approved, very restrictive
-Deny List - nothing on the bad list can be executed - anti virus, anti malware
63
# Technical Change Mangement Process
Restriced Activities
* During change, certain activities may need to be restricted.
* These restrictions on activity might affect business processes and should be considered when developing a change management strategy to reduce the impact on business processes.
64
# Technical Change Mangement Process
Downtime
* Services will eventually be unavailable.
-usually scheduled during non-production hours.
* if possible prevent downtime
-switch to secondary system, upgrade primary, switch back.
* If downtime - send emails and calendar updates.
65
# Technical Change Mangement Process
Restarts
* Implement the new configuration, reboot the OS, power the switch, bounce the service.
* Services
-Stop and restart the service/daemon, may take seconds or mins
* Apps
-Close the app completely, launch new app instantly
66
# Technical Change Mangement Process
Legacy Application
* No longer supported by the manufacturer or vendor
* May not be compatible with the change or create a vulnerability in the system, threatening confidentiality.
67
# Technical Change Mangement Process
Dependencies
* To complete A, you must complete B
-modifying one componenet may require changing or restarting other components.
* Dependencies may occure across systems.
68
# Change Management Process
Documentation
* Required with the change management process
* can become outdated very quickly
69
# Change Management Process / Documentation
Updating Diagrams
* Modifications to network configs
* traffic flow diagrams, physical diagrams, logical, or business flow diagrams.
70
# Change Management Process / Documentation
Updating Policies and Procedures
* Policies are statements of intent
* Procedures ate step by step guides the define the process to be followed based on circumstances.
* Policies and procedures may not be the same after the change.
71
# Change Management Process
Version Control
* Process that all users and systems are using the latest software or apps.
* also tracks how and when an update is applied during change.
- router config, windows os patches, app registry entrires
72
Cryptographic Solutions
* changing data from one form to another to protect it.
73
# Cryptographic Solutions
Public Key Infrastructure (PKI)
* Policies and procedures (hardware/software/people)
-Responsible for creating, distributing, managing, storing, revoking associated with Digital Certificates.
* PKI for people or devices for Certificate Authority - all about trust, who they say they are.
74
# Cryptographic Solutions / PKI
Public Key
* Share with public during communication
* key is predefine set of characters, used in an encryption algorithm to change indecipherable state back to plan text data.
75
# Cryptographic Solutions / PKI
Private Key
* Only known and avaiable for use by the user.
76
# Cryptographic Solutions / PKI
Key Escrow
* storage of cruptographic keys by third party.
* owner to recover keys in case of loss.
77
# Cryptographic Solutions / Encryption
Symmetric Encryption
* Single, shared key.
* encrypt/decrypt with same key.
* Secret Key Algorithm - shared secret.
* Often combined with asymmetric
* DES (Data Encryption Standard) - Highly insecure 64 bit, Triple DES, more secure, and (AES) Advanced Encryption Standard - most widely used, 3 lengths: 128, 192, 256 bit.
78
# Cryptographic Solutions / Encryption
Asymmetric Encryption
* two or more mathmatically related keys.
* private key- only key that can decrypt - can't derive the private key from the public key.
* public key - if they gain access to info, they cannot decrypt with public key, they have to have private key.
* most common is RSA public key algorithm, based on factoring prime numbers.
79
# Cryptographic Solutions / Encryption / Stored Data
Full-Disk Encryption (FDE)
* encrypts all data on a disk including OS, system files, user files.
* BitLocker/FileVault/etc
80
# Cryptographic Solutions / Encryption / Stored Data
Partition Encryption
* encryption to specific partition on disk
* commonly used on dual-booted systems
* BitLocker/FileVault/etc
81
# Cryptographic Solutions / Encryption / Stored Data
Volume Encryption
* Encryption to specific section of disk.
* Large number of files but don't want entire partition or full disk.
* BitLocker/FileVault/etc
82
# Cryptographic Solutions / Encryption / Stored Data
Files Encryption
* Or file-level encryption , specific files
* Encryption File System (EFS)
* third-party utilites.
83
# Cryptographic Solutions / Encryption / Stored Data
Database Encryption
| Has 2 primary forms.
* protects stored data and transmission of that data
* Transparent Data Encryption (TDE)
-encrypts entire database with symmetric key
* Record Level Encryption / Column Level Encryption (CLE)
-encrypts specified column in database.
-uses separate symmetric keys for each column.
84
# Cryptographic Solutions
Transport Encryption
* encrypt data in transit / protect data traversing the network.
* VPN
-client based VPN using SSL/TLS
- Site to site VPN using IPsec
85
# Cryptographic Solutions / Encryption
Encryption Algorithms
* convert plaintext to ciphertext using key.
* key value is inserted into encryption algorithm, applied to data resulting in cyphertext that can be deciphered by reversing encryption algorithm with key.
86
# Cryptographic Solutions / Encryption
Key Lengths
* the larger the key the more secure
* symmetric encryption
-128 bit or larger are common, larger and larger as time goes on
* asymmetric encryption
-complex calculations of prime numbers
-largery keys than symmetric encryption
-common to see key lengths of 3072 bits or larger
87
# Cryptographic Solutions / Encryption
Key Stretching
* make a weak key stronger by performing multiple processes
-hash a password, hash the hash, hash the hash of the hash. etc.
-key stretching is key strengthening.
88
# Cryptographic Solutions / Encryption
Key Exchange
* securely distributing keys needed for cryptographic algorithms
* Out of band exchange/
-telephone exchange, courier, or in-person/Offline distribution (physical distribution)
* In-band exchange
-on the network, protect with additional encryption
-asymmetric encryption to deliver a symmetric key.
89
# Cryptographic Solutions / Encryption / Tools
Trusted Platform Module (TPM)
* module/chip with built-in cryptoprocessor functions.
* Persisten Memory
-Unique keys burned in during manufacturing.
* Versatile Memory
-Storage keys, hardware config info
-Securely store BitLocker Keys.
* Password Protected
90
# Cryptographic Solutions / Encryption / Tools
Hardware Security Module (HSM)
* used in large environments
* securely creates, manages, stores thousands of cryptographic keys.
* Cryptographic accelerator
91
# Cryptographic Solutions / Encryption / Tools
Key Management System
* Services are everywhere, on premises, cloud-based.
* Manages all keys from centralized manager.
* provdes security of cryptographic keys.
-How keys are encrypted
-composition requirements of keys
-validity length of keys
-retirement of keys
-distribution of keys
-storage of keys
92
# Cryptographic Solutions / Encryption / Tools
Secure Enclave
* a protected area for our secrets
* implemented as hardware processor
* isolated from main processor
*
93
Obfuscation
* take something that is normally easy to understand and you make it much more difficult to understand.
* hide info in plain sight.
-hide info within an image: steganography
94
# Obfuscation
Steganography
* used to hide data inside other data
* not encrypted but hidden using obfuscation
* can be detected by comparing hash files.
- data can be hidden in audio, video and image, etc.
- embed messages in tcp packets (network based)
- or invisible watermarks (yellow dots on printers)
95
# Obfuscation
Tokenization
* replace sensitive data with a non-sensitve placeholder
-is not encryption or hasing, since original data and token aren't mathmatically related.
96
# Obfuscation
Data Masking
* Data Obfuscation
-hiding some of the original data
* Protects PII
* May only be hidden from view
-substituting, shuffling, encrypting, masking out
-"are the last four digits of your social "****____"
97
Hashing
* represent data as a short string of text
-message digest, a fingerprint
* Impossible to recover the original message from the digest
* Confidentiality -used to store passwords
* Integrity - verify downloaded document is the same as original
* Can be a digital signature - authentication, non-repudiation, and integrity.
98
# Hashing
SHA256 Hash
* 256 bits, 64 hexadecimal
99
# Hashing
Collision
* different inputs should never create the same has.
* Duplicated hashes create a collision
* MD5 has a collision problem
-found in 1996 - don't use for anything important.
100
# Hashing
Practical Hashing
* Verify a DL
-hashes may be provided on the dl site
-compare the dl file hash with the posted hash value.
* Password storage
- don't store passwords, store salted (hash plus extra info) hash
- compare hashes during authentication process
- noone knows actual password.
101
Salt
* random data added to password when hashing
* every user gets their own random salt
* rainbows tables won't work with salted hashes
* slows things down with brute force process
102
Digital Signature
* proves message was not changed
-integrity
* proves source of the messgae
-authentication
* makes sure signature isn't fake
-non repudiation
* sign with private key
-doesn't need to be encrypted
* verify with public key
-any change in message will invalidate
103
Blockchain
* distributed ledger - public
-keeps track of transactions
* everyone in the blockchain network maintins the ledger
-records and replicates to anyone and everyone.
* Many practical applications
-payment processing
-digital identification
-supply chain monitoring
-digital voting
104
Blockchain Process
* transaction is requested
* transaction is sent to every computer (or node) in a decentralized network to be verified.
* Verified transaction is added to a new block of data containing other recently verified transactions.
* To complete to block, a hash is calculated from the previous blocks of transaction data in the block chain. Hash is added to the new block of verified transactions.
* Block is added to the end of the Blockchain, which is then updated to all nodes in the nework for security. Transaction is complete.
* If any blocks are altered, it's hash and all following hashes in the chain are automatically recalculated.
* The altered chain will no longer match the chains stored by the rest of the network, and will be rejected.
105
Digital Certificate
* file that contains public key and digital signature.
-digital versions of ID card.
* Digital signature adds trusts
-PKI uses CA (certificate authority) for additional trust.
- Web of Trust adds other users for additional trust.
* Certificate creation can be built into the OS
- part of windows domain services
- many third party options
* X.509 format
* Certificate Details
-serial number
-version
-signature algorithm
-issurer
-name of the cert holder
-public key
-extensions
106
Root of Trust (RoT)
* third party vouch that something is trustworthy.
- can be hardware, software, firmware or other component.
- HSM (hardware security module), Secure Enclave, Certificate Authority, etc.
107
# Certificates
Certificate Authorities
* third party that digitally signs certificates stored on websites signifying we can trust them.
* real time verification
108
# Certificates
Third-Party Certificate Authorities
* built into your browswer
* purchase your website certificates
* CA is responsible for vetting the request
-CA confirms the certificate owner, additional veritification info may be required by the CA.
109
# Certificates
Certificate Signing Request (CSR)
* Create key pair, send the public key (with applicant identifying info) to CA to be signed
-called Certificate Signing Request (CSR)
* CA validates the request
-confirms DNS emails and website ownership.
* CA digitally signs the cert
-returns to the applicant.
110
# Certificates
Private Certificate Authorities
* YOU are your own CA
-build it in house
-your devices must trust the internal CA
* Needed for medium to large organizations
-may web servers and privacy reqs.
* Implement as party of your overal computing strategy
-example: Windows Certificate Services, OpenCA
111
# Certificates
Self-Signed Certificates
* Internal Certs don't need to be signed by a public CA
- your company is the only one going to use it.
- no need to purchase trust for devices that already trust you.
* Build your own CA
-Issue your own certificates signed by your own CA
* Install the CA cert/trusted chain on all devices
- they'll now trust any certs signed by your internal CA
- Works exactly like a cert you purchased.
112
# Wildcard Certificates
Subject Alternative Name (SAN)
* Subject Alternative Name (SAN)
-Extension to an X.509 cert
-Lists additional identification information
- Allows a cert to support many different domains.
113
# Wildcard Certificates
Wildcard Domain *
* Certificates are based on the name of the server
* will apply to a server names in a domain.
114
# Certificates
Certificate Revocation List (CRL)
* Maintained by the CA
* Can contain many revocations in a large file
-revoked by issuing CA prior to expiration date - cannot be trusted.
* Heartbleed is an example
115
# Certificates
Online Certificate Status Protocol (OCSP)
* Provides scalability for OCSP checks
* alt. way of checking certs validity.
* instead of CRL, OCSP provides real-time check of cert's validity.
* IN the SSL/TSL handshake - OCSP handshake.
-signed by the CA digitally.
