Introduction to Security

Question 1

The three protections that must be extended over information are :

Hint : CIA

Answer 1

Confidentiality : It is important that only approved individuals are able to access important information.

Integrity : Intergrityensures that the information is correct and on unauthorized person or malicious software has altered the data.

Availability : Availability ensures that the data is accessible to authorized users.

Question 2

Set of protections that must be implemented to secure information.

Hint : AAA

Answer 2

Authentication : Authentication ensures that the individual is who she claims to be and not an imposter.

Authorization : Authorization is providing permission or approval to a specific technology/space.

Accounting : Accounting provides tracking of events.

Question 3

Information Security Ranking Layers

Answer 3

Information

1. CIA
2. Hardware, Software, Communication
3. Products ( Physical Security )
4. People ( Personnel Security )
5. Procedures ( Organizational Security )

Question 4

Threat

Answer 4

A type of action that has the potential to cause harm.

Question 5

Threat Agent

Answer 5

A person or element that has the power to carry out a threat.

Question 6

Vulnerability

Answer 6

A flaw or weakness that allows a threat agent to bypass security.

Question 7

Threat vector

Answer 7

The means by which an attack could occur.

Question 8

Threat likelihood

Answer 8

The probability that a threat will actually occur.

Question 9

Risk

Answer 9

A situation that involves exposure to danger.

Question 10

How is Risk Calculated?

Answer 10

Risk = Consequence * Vulnerablility * Threat Likelihood

Question 11

Risk Avoidance

Answer 11

Identifying the risk and making the decision to not engage in the activity.

Question 12

Acceptance

Answer 12

Acknowledging a risk but taking no action to address it.

Question 13

Mitigation

Answer 13

Addresing a risk by making it less serious.

Question 14

Deterrence

Answer 14

Understanding the attacker and then informing him of the consequences of the action.

Question 15

Transference

Answer 15

Transferring the risk to a third party.

Question 16

APT

Advanced Persistent Threat

Answer 16

Multi year intrusion campaign that targets highly sensitive economic, proprietary, or national security information.

Question 17

Cyber Kill Chain

Answer 17

Reconnaissance : The first step in an attack is to probe for any information about the system; The type of hardware used, version of operating system software, and even personal information about the users. This can reveal if the system is a viable target for an attack and how it could be attacked.

Weaponization : The attacker creates an exploit and packages it into a deliverable payload that can be used against the target.

Delivery : At this step the weapon is transmitted to the target, such as by an email attachment or through an infected web server.

Exploitation : After the weapon is deliverd to the victim, the exploitation stage triggers the intruders’ eploit. Generally the exploitation targets an application or operating system vulnerability, but it also could involve tricking the user into taking a specific action.

Installation : At this step the weapon is installed to either attack the computer or install a remote “backdoor” so the attacker can access the system.

Command and Control : Many times the compromised system connects back to the attacker so that the system can be remotely controlled by the attacker and receive future instructions.

Actions on Objectives : Now the attackers can start to take actions to achieve ther original objectives, such as stealing user passwords or launching attacks against other computers.

Question 18

Five fundamental Security Principles

Hint : LOw LSD

Answer 18

Layering, Obscurity, w, Limiting, Simplicity, Diversity.

Question 19

Layering

Answer 19

If one layer is penetrated - such as the thief getting into the building - several more layers must still be breached, and each layer is often more difficult or complicated than the previous. A layered approach has the advantage of creating a barrier of multiple defences that can be coordinated to thwart a variety attacks.If only one defense mechanism is in place, an attacker only has to circumvent that single defense. Instead, a security system must have layers, making it unlikely that an attacker has the tools and skills to break through all the layers of defenses. A layered approach also can be useful in resisting a variety of attacks. Layered security provides the most comprehensive protection.

Question 20

Limiting

Answer 20

Limiting access to information reduces the threat against it. This means that only those personnel who must use the data should have access to it. In additional, the access should be limited.

What level of access should users have?

The correct answer is the least amount necessary to do their jobs, and no more.

Question 21

Diversity

Answer 21

Just as imporatnt as it is to protect data with layers of security, the layers must also be different ( diverse ). This means that if attackers penetrate one layer, they canont use the same techniques to break through all the layers. An attacker who can circumvent a security device from Manufacturer A could then use those same skills and knowledge to defeat all of the same devices used by the organization. However, if devies from Manufacturer A and similar devices form Manufacturer B were both used b the same organization, the attacker would have more difficulty trying to break through both types of devices because they would be different.

Question 22

Obscurity

Answer 22

Obscuring to the outside world what is on the inside makes attacks much more difficult. An example of obscurity in information security would be not revealing the type of computer, version of operating system, or brand of software that is used. Sometimes the design or implementation of a device is kept secret. These secrets are also reffered as “Black Box”.

Question 23

Simplicity

Answer 23

Complex systems allow many oppurtunities for something to go wrong. In short, complex systems can be a theif’s ally. Complex security systems can be hard to understand, troubleshoot, and even feel secure about. As much as possible, a secure system should be simple for those on the inside to understand and use. Complex security schemes are often compromised to make them easier for trusted users to work with, yet this can also make it easier for the attackers. In short, keeping a system simple from the inside, but complex on the outside, can sometimes be difficult but reaps a major benefit.