Lesson 11: Deploying Secure Host, Mobile, and Embedded Systems Flashcards
1
Q
Common Criteria (CC)
A
- secure systems design is usually guided by some sort of framework
- an ISO standard (ISO 15408) defining security frameworks
2
Q
Trusted OS (TOS)
A
- an OS that meets the criteria for a Common Criteria OS Protection Profile can be described as a Trusted OS (TOS)
- Trusted OS provides:
• Trusted Computing Base (TCB)—the kernel and associated hardware and processes must be designed to support the enforcement of a security policy (an access control model). This means it should be tamper-resistant, resistant to vulnerabilities, and not able to be bypassed (it provides complete mediation between users and resources). - Security features—such as support for multilevel security (Mandatory Access Control). A problem for many OSes is the means of restricting root or Administrator access to classified data. The process for patching security vulnerabilities is also critical.
- Assurance—such as secure design principles, availability of code reviews and audits, and so on
3
Q
Trusted Computing Group
A
- consortium of companies, including Microsoft®, Intel®, AMD, HP®, Cisco®, and Juniper®, set up to develop technologies to improve the security of computing systems
- one of the major initiatives of the group was the development of the Trusted Platform Module (TPM)
4
Q
hardware Root of Trust (RoT) or trust anchor
A
- a secure subsystem that is able to provide attestation (declare something to be true)
- example:
- when a computer joins a network, it might submit a report to the Network Access Control (NAC) server declaring, “My operating system files have not been replaced with malicious versions.”
5
Q
endorsement key
A
- each TPM microprocessor is hard-coded with a unique, unchangeable RSA private key (the endorsement key)
- endorsement key is used to create various other types of subkeys used in key storage, signature, and encryption operations
6
Q
supply chain
A
end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer
7
Q
Basic Input/Output System (BIOS)
A
- provides industry standard program code that operates the essential components of the PC and ensures that the design of each manufacturer’s motherboard is PC compatible
- newer motherboards use a different kind of firmware called Unified Extensible Firmware Interface (UEFI)
- UEFI provides support for 64-bit CPU operation at boot, a full GUI and mouse operation at boot, and better boot security
8
Q
secure boot
A
- a security system offered by UEFI
- designed to prevent a computer from being hijacked by a malicious OS
- under secure boot, UEFI is configured with digital certificates from valid OS vendors
- system firmware checks the operating system boot loader using the stored certificate to ensure that it has been digitally signed by the OS vendor
- this prevents a boot loader that has been modified by malware (or an OS installed without authorization) from being used
9
Q
Full Disk Encryption (FDE)
A
- means that the entire contents of the drive (or volume), including system files and folders, are encrypted
- drive encryption allays this security concern by making the contents of the drive accessible only in combination with the correct encryption key
- FDE requires the secure storage of the key used to encrypt the drive contents
- one of the drawbacks of FDE is that, because the OS performs the cryptographic operations, performance takes a hit | this issue is mitigated by Self-Encrypting Drives (SED), where the cryptographic operations are performed by the drive controller. The SED uses a Media Encryption Key (MEK) to encrypt data and stores the MEK securely by encrypting it with a Key Encryption Key (KEK), generated from the user password
10
Q
Electromagnetic Interference (EMI)
A
- the effect unwanted electromagnetic energy has on electronic equipment
- computers installed in “noisy” EMI environments, such as factory floors and power plants, often need shielding from EMI
11
Q
Electromagnetic Pulse (EMP)
A
- very powerful but short duration wave with the potential to destroy any type of electronic equipment. Electrostatic Discharge (ESD) can be classified as EMP
- possible to build EMP generators and deploy them with the intent of performing a DoS attack against a computer system
- risk of EMP cyber weapons being used by terrorists or hostile nation state actors or that a particularly strong solar storm could cause EMP effects
- an EMP cyber weapon is a nuclear or conventional explosive device designed to explode in the upper atmosphere in such a way that it causes widespread EMP effects across a wide area below the explosion
12
Q
external storage devices
A
- USB flash drives (and potentially any other type of firmware), presents adversaries with an incredible toolkit
- firmware can be reprogrammed to make the device look like another device class, such as a keyboard. In this case, it could then be used to inject a series of keystrokes upon an attachment or work as a keylogger
13
Q
mousejacking
A
- hackers can use radio transmitters to inject commands and keystrokes or read input
- principal security exploit of wireless input devices is snooping
- attack principally works because while keyboard input is often encrypted, mouse input is not, and the vulnerable devices can be tricked into accepting keyboard input via the mouse controller
14
Q
Multifunction Devices (MFD)
A
- printers or more generally Multifunction Devices (MFD), with fax and scan capabilities, represent a powerful pivot point on an enterprise network:
- Interfaces and code are not always kept as secure as OS code, making them potentially more vulnerable to compromise.
- An adversary can snoop on and copy highly confidential data in cleartext.
- The hard disk is a useful means of staging data for exfiltration.
- Network connectivity might bridge user and administrative network segments and allow wider network penetration.
15
Q
Wi-Fi-enabled MicroSD Cards
A
Wi-Fi-enabled MicroSD card can connect to a host Wi-Fi network to transfer images stored on the card.
16
Q
digital cameras
A
- may be equipped with Wi-Fi and cellular data adapters to allow connection to the Internet and posting of images directly to social media sites
- geotagging
- flash media storage used by a camera may also be infected with malware or used for data exfiltration, so cameras should be treated like any other removable USB storage and their connection to enterprise hosts subjected to access controls
17
Q
weak or misconfigured security configurations
A
- may leave administrative access protected with a default account or password that is publicly available, sensitive ports open to the Internet, or any number of other such weaknesses
- many breaches have taken place in recent years over exactly these sorts of security vulnerabilities
18
Q
default configurations
A
- means that the default installation is (theoretically) secure but minimal
- any options or services must explicitly be enabled by the installer
- not the case for older devices and software though; these would often be shipped with all the “bells and whistles” activated to make set up easier
- when installing any new device or software, you must use a security policy to determine the strongest possible configuration, and not just leave it to the default
19
Q
hardening
A
- process of putting an operating system or application in a secure configuration is called hardening
- hardening is implemented to conform with the security requirements in a defined security policy
- need for hardening must be balanced against the access requirements and usability in a particular situation
- checklist shows the sort of steps that are required to harden the OS of a workstation PC
1. Remove (or disable) devices that have no authorized function. These could include a legacy modem or floppy disk or standard optical disk drives, USB ports, and so on.
- Test and install OS and application patches and driver/firmware updates (when they have been tested for network compatibility) according to a regular maintenance schedule. Patches for critical security vulnerabilities may need to be installed outside the regular schedule.
- Uninstall all but the necessary network protocols.
- Uninstall or disable services that are not necessary (such as local web server or file and print sharing) and remove or secure any shared folders.
- Enforce Access Control Lists on resources, such as local system files and folders, shared files and folders, and printers.
- Restrict user accounts so that they have least privilege over the workstation (especially in terms of installing software or devices).
- Secure the local administrator or root account by renaming it and applying a strong password.
- Disable default user and group accounts (such as the Guest account in Windows) and verify the permissions of system accounts and groups (removing the Everyone group from a folder’s ACL, for instance).
- Install anti-virus software (or malware protection software) and configure it to receive virus definition updates regularly.
20
Q
host software baselining
A
an OS functioning in any given role, there will usually be a fairly standard series of steps to follow to apply a secure configuration to allow the OS and applications software to execute that role
21
Q
least functionality
A
- essential principle is of least functionality; that a system should run only the protocols and services required by legitimate users and no more
- reduces the potential attack surface
22
Q
interfaces
A
interfaces provide a connection to the network
23
Q
services
A
provide a library of functions for different types of applications
24
Q
application service ports
A
allow client software to connect to applications
25
Q
network servers
A
much of the same procedure applies to network servers, network appliances (switches and routers), and web applications, only more so
26
Q
Server Core
A
excludes most of the familiar shell tools, such as File Explorer and MMCs. Server Core also only supports a limited number of roles, including AD DS, file/print, IIS, Hyper-V®, DHCP, and DNS
27
Q
Administrative Templates
A
custom Registry settings
28
Q
Resultant Set of Policies (RSoP)
A
system of inheritance determines the Resultant Set of Policies (RSoP) that apply to a particular computer or user. GPOs can be set to override or block policy inheritance where necessary
29
Q
network appliances
A
- access points, switches, routers, and firewalls
- special case for hardening:
- often restricted to ensuring that the device is patched and appropriately configured
30
Q
kiosk
A
- computer terminal deployed to a public environment
- wide range of uses, such as providing ATM services or airport check-in, as well as informational kiosks used in shopping centers, art galleries, and museums
31
Q
baseline deviation reporting
A
- means testing the actual configuration of clients and servers to ensure that they are patched and that their configuration settings match the baseline template
- Windows networks, the Microsoft Baseline Security Analyzer (MBSA) tool was popularly used to validate the security configuration. MBSA can also be used to scan for weak passwords. MBSA and other Microsoft reporting tools have now been replaced by the Security Compliance Toolkit
32
Q
execution control
A
- process of determining what additional software may be installed on a client or server beyond its baseline. Execution control to prevent the use of unauthorized software can be implemented as either an application whitelist or a blacklist:
- Whitelist control means that nothing can run if it is not on the approved whitelist.
- Blacklist control means that anything not on the prohibited blacklist can run.
33
Q
unauthorized software
A
- if unauthorized software is found installed and/or running on a host, it should normally be removed. You will also want to investigate how the software was allowed to be installed or executed:
- Place the host system and software in a sandbox before analyzing its running state.
- Check event logs and browsing history to determine the source of the unauthorized software.
- Conduct an anti-malware scan to determine if the software is known to be malicious.
- Verify user privileges and access controls on the host system to re-secure permissions.
34
Q
No Execute (NX)
A
- No Execute (NX) technology are more resilient against so-called buffer overflow attack, where the virus tricks another program into executing it when the other program thinks it is just processing some data, because they prevent areas in memory marked for data storage from executing code (running a new program)
- Intel calls this feature Execute Disable (XD); in Windows, it is referred to as Data Execution Prevention (DEP)
35
Q
Address Space Layout Randomization (ASLR)
A
aims to frustrate attacks by making the exact position of a function or reference in system memory difficult for an attacker to predict and exploit
36
Q
data execution prevention
A
one issue is that applications might not work with these DEP security features enabled. In later versions of Windows, it is not possible for applications to ignore these settings, unless the administrator configures an override. If users are trying to run packages that do not support DEP-like technologies, you will need to investigate whether an exception should be made for that software. In Windows 10, this is configured via the Exploit protection pages in the Windows Security settings app
37
Q
patch management
A
- two approaches to applying updates:
- Apply all the latest patches to ensure the system is as secure as possible against attacks targeting flaws in the software.
- Only apply a patch if it solves a particular problem being experienced.
38
Q
updates
A
widely released fixes for bugs
