Lesson 12

Question 1

Hardware root of Trust

Answer 1

•Hardware root of trust/trust anchor
•Attestation
•Trusted Platform Module (TPM)
     •Hardware-based storage of cryptographic data
     •Endorsement key
     •Subkeys used in key storage, signature, 
 and encryption operations
     •Ownership secured

Question 2

Hardware Root of Trust or Trust Anchor

Answer 2

A hardware Root of Trust (RoT) or trust anchor is a secure subsystem that is able to provide attestation.

Attestation means that a statement made by the system can be trusted by the receiver.

  For example, when a computer joins a network, it might submit a report to the network access control (NAC) server declaring, "My operating system files have not been replaced with malicious versions." The hardware root of trust is used to scan the boot metrics and OS files to verify their signatures, then it signs the report. The NAC server can trust the signature and therefore the report contents if it can trust that the signing entity's private key is secure.

Question 3

Attestation

Answer 3

(Hardware RoT provides this)

Attestation means that a statement made by the system can be trusted by the receiver.

  For example, when a computer joins a network, it might submit a report to the network access control (NAC) server declaring, "My operating system files have not been replaced with malicious versions." The hardware root of trust is used to scan the boot metrics and OS files to verify their signatures, then it signs the report. The NAC server can trust the signature and therefore the report contents if it can trust that the signing entity's private key is secure

Question 4

Trusted Platform Module (TPM)

Answer 4

• Hardware-based storage of cryptographic data
• Endorsement key
• Subkeys used in key storage, signature, and encryption operations
• Ownership secured via password

The RoT is usually established by a type of cryptoprocessor called a trusted platform
module (TPM). TPM is a specification for hardware-based storage of encryption keys,
hashed passwords, and other user and platform identification information. The TPM is
implemented either as part of the chipset or as an embedded function of the CPU.

Each TPM is hard-coded with a unique, unchangeable asymmetric private key calledthe endorsement key. This endorsement key is used to create various other typesof subkeys used in key storage, signature, and encryption operations. The TPM alsosupports the concept of an owner, usually identified by a password (though this isnot mandatory). Anyone with administrative control over the setup program can take
ownership of the TPM, which destroys and then regenerates its subkeys. A TPM canbe managed in Windows via the tpm.msc console or through group policy. On anenterprise network, provisioning keys to the TPM might be centrally managed via theKey Management Interoperability Protocol (KMIP).

Question 5

Boot Integrity

Answer 5

• Unified extensible firmware interface (UEFI)
• Secure boot
  * Validate digital signatures before running boot loader or OS kernel
• Measured boot
  * Use TPM to measure hashes of boot files at each stage
• Boot Attestatio Attestation
  
  • Report boot metrics and signatures to remote server

Question 6

•Unified extensible firmware interface (UEFI)

Answer 6

(supports boot integrity) Most PCs and smartphones implement the unified extensible firmware interface
(UEFI). UEFI provides code that allows the host to boot to an OS. UEFI can enforce a number of boot integrity checks.

Question 7

Secure Boot

Answer 7

• Secure boot
  * Validate digital signatures before running boot loader or OS kernel (requires UEFI but not TPM)

Secure boot is designed to prevent a computer from being hijacked by a malicious OS.
UEFI is configured with digital certificates from valid OS vendors. The system firmware
checks the operating system boot loader and kernel using the stored certificate to
ensure that it has been digitally signed by the OS vendor. This prevents a boot loader
or kernel that has been changed by malware (or an OS installed without authorization)
from being used. Secure boot is supported on Windows and many linux platforms

Question 8

Measured boot

Answer 8

• Measured boot
  * Use TPM to measure hashes of boot files at each stage

A trusted or measured boot process uses platform configuration registers (PCRs)
in the TPM at each stage in the boot process to check whether hashes of key system state data (boot firmware, boot loader, OS kernel, and critical drivers) have changed

.This does not usually prevent boot, but it will record the presence of unsigned kernellevel
code.

Question 9

Boot Attestation

Answer 9

• Boot Attestatio Attestation
  
  • Report boot metrics and signatures to remote server

Boot attestation is the capability to transmit a boot log report signed by the TPM via a
trusted process to a remote server, such as a network access control server. The boot
log can be analyzed for signs of compromise, such as the presence of unsigned drivers.
The host can be prevented from accessing the network if it does not meet the required
health policy or if no attestation report is received.

Question 10

Drive (disk) encryption

Answer 10

Drive Encryption
•Full disk encryption (FDE)
•Encryption key secured with user password
•Secure storage for key in TPM or USB thumb drive

• Self-encrypting drives (SED)
  
  • Data/media encryption key (DEK/MEK)
  • Authentication key (AK) or key encrypting key (KEK)
  • Opal specification compliant

Question 11

Full disk encryption (FDE)

Answer 11

• Full disk encryption (FDE)
  
  • Encryption key secured with user password
  • Secure storage for key in TPM or USB thumb drive

Full disk encryption (FDE) means that the entire contents of the drive (or volume), including system files and folders, are encrypted. OS ACL-based security measuresare quite simple to circumvent if an adversary can attach the drive to a different host
OS. Drive encryption allays this security concern by making the contents of the drive
accessible only in combination with the correct encryption key. Disk encryption can be
applied to both hard disk drives (HDDs) and solid state drives (SSDs).

FDE requires the secure storage of the key used to encrypt the drive contents.
Normally, this is stored in a TPM. The TPM chip has a secure storage area that a disk
encryption program, such as Windows BitLocker, can write its keys to. It is also possible
to use a removable USB drive (if USB is a boot device option). As part of the setup
process, you create a recovery password or key. This can be used if the disk is moved
to another computer or the TPM is damaged.

Question 12

Self-encrypting drives (SED)

Answer 12

• Self-encrypting drives (SED)
  
  • Data/media encryption key (DEK/MEK)
  • Authentication key (AK) or key encrypting key (KEK)
  • Opal specification compliant

One of the drawbacks of FDE is that, because the OS performs the cryptographic
operations, performance is reduced. This issue is mitigated by self-encrypting drives
(SED), where the cryptographic operations are performed by the drive controller. The
SED uses a symmetric data/media encryption key (DEK/MEK) for bulk encryption and
stores the DEK securely by encrypting it with an asymmetric key pair called either the
authentication key (AK) or key encryption key (KEK). Use of the AK is authenticated by
the user password. This means that the user password can be changed without having
to decrypt and re-encrypt the drive. Early types of SEDs used proprietary mechanisms,
but many vendors now develop to the Opal Storage Specification

Question 13

Data/media encryption key (DEK/MEK) [for SED)

Answer 13

SED uses a symmetric data/media encryption key (DEK/MEK) for bulk encryption and
stores the DEK securely by encrypting it with an asymmetric key pair called either the
authentication key (AK) or key encryption key (KEK).

Question 14

Authentication key (AK) or key encrypting key (KEK)

Answer 14

SED uses a symmetric data/media encryption key (DEK/MEK) for bulk encryption and
stores the DEK securely by encrypting it with an asymmetric key pair called either the
authentication key (AK) or key encryption key (KEK). Use of the AK is authenticated by
the user password.

Question 15

USB and flash drie security

Answer 15

• BadUSB
  
  • Exposes potential of malicious firmware
  • Malicious USB cabl
  • Malicious flash drive
• Sheep dip
  
  • Sandbox system for testing new/suspect devices
  • Isolated from production network/data

Question 16

Bad USB

Answer 16

• BadUSB
  
  • Exposes potential of malicious firmware
  • Malicious USB cabl
  • Malicious flash drive

As revealed by researcher Karsten Nohl in his BadUSB paper, exploiting the firmware of external
storage devices, such as USB flash drives (and potentially any other type of firmware),
presents adversaries with an incredible toolkit. The firmware can be reprogrammed
to make the device look like another device class, such as a keyboard. In this case it
could then be used to inject a series of keystrokes upon an attachment or work as
a keylogger. The device could also be programmed to act like a network device and
corrupt name resolution, redirecting the user to malicious websites.

Question 17

Sheep dip

Answer 17

• Sheep dip
  
  • Sandbox system for testing new/suspect devices
  • Isolated from production network/data

A modified device may have visual clues that distinguish it from a mass manufactured
thumb drive or cable, but these may be difficult to spot. You should warn users of the
risks and repeat the advice to never attach devices of unknown provenance to their
computers and smartphones. If you suspect a device as an attack vector, observe a
sandboxed lab system (sometimes referred to as a sheep dip) closely when attaching the device

Question 18

Third-party Risk Management

Answer 18

• Supply chain and vendors
  
  • End-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer
  • Could malicious actors within supply chain introduce backdoor access via hardware/firmware components?
  • Most companies must depend on governments/security services to ensure trustworthiness of market suppliers
  • Consider implications of using second-hand equipment
• Vendors versus business partners

Question 19

•Vendors versus business partners

Answer 19

When assessing suppliers for risk, it is helpful to distinguish two types of relationship:
• Vendor—this means a supplier of commodity goods and services, possibly with
some level of customization and direct support.
• Business partner—this implies a closer relationship where two companies share
quite closely aligned goals and marketing opportunities.

Question 20

End of Life Systems and Lack of Vendor Support

Answer 20

• Support lifecycles
• End of life (EOL)
  
  • Product is no longer sold to new customers
  • Availability of spares and updates is reduced
• End of service life (EOSL)
  
  • Product is no longer supported
• Lack of vendor support
  
  • Abandonware
  • Software and peripherals/devices

Question 21

•End of life (EOL)

Answer 21

• Product is no longer sold to new customers

* Availability of spares and updates is reduced

Question 22

•End of service life (EOSL)

Answer 22

•Product is no longer supported

Question 23

•Lack of vendor support

Answer 23

• Abandonware

* Software and peripherals/devices

Question 24

MOU

Answer 24

Intent to work together

Question 25

Business partnership agreement (BPA)

Answer 25

Establish a formal partner relationship

Question 26

Non-disclosure agreement (NDA)

Answer 26

Govern use and storage of shared confidential and private information

Question 27

Service level agreement (SLA)

Answer 27

Establish metrics for service delivery and performance

Question 28

Measurement systems analysis (MSA)

Answer 28

Evaluate data collection and statistical methods used for quality management

Question 29

Host Hardening

Answer 29

• Reducing attack surface
• Interfaces
  
  • Network and peripheralconnections and hardware ports
• Services
  
  • Software that allows client connections
• Application service ports
  
  • TCP and UDP ports
  • Disable applicationservice or use firewall to control access
  • Detect non-standard usage
• Encryption for persistent storage

Question 30

least functionality (attack surface)

Answer 30

The essential principle is of least functionality;
that a system should run only the protocols and services required by legitimate users
and no more. This reduces the potential attack surface.

Question 31

Interfaces (hardening)

Answer 31

Network and peripheralconnections and hardware ports

Interfaces provide a connection to the network. Some machines may have more than one interface.

***if any of these interfaces are not required, they should be explicitly disabled
rather than simply left unused.

Question 32

Services (hardening)

Answer 32

Software that allows client connections

Services provide a library of functions for different types of applications. Some
services support local features of the OS and installed applications. Other services
support remote connections from clients to server applications.

***Unused services
should be disabled.

Question 33

Application service ports

Answer 33

• Application service ports
  
  • TCP and UDP ports
  • Disable applicationservice or use firewall to control

allow client software to connect to applications over a
network. These should either be disabled or blocked at a firewall if remote access
is not required

Question 34

Encryption for persistent storage

Answer 34

Persistent storage holds user data generated by applications, plus cached
credentials. Disk encryption is essential to data security. Self encrypting drives can
be used so that all data-at-rest is always stored securely.

Question 35

Baseline Configuration and Registry Settings

Answer 35

You will have separate configuration baselines for desktop clients, file and print
servers, Domain Name System (DNS) servers, application servers, directory services
servers, and other types of systems.

• OS/host role
  
  • Networkappliance, server, client, …
• Configuration baseline template
• Registry settings and group policy objects (GPOs)
• Malicious registry changes
• Baseline deviation reporting

Question 36

•Registry settings and group policy objects (GPOs)

Answer 36

In Windows, configuration settings are stored in
the registry.

On a Windows domain network, each domain-joined computer will receive
policy settings from one or more group policy objects (GPOs).

Question 37

• Malicious registry changes

* Baseline deviation reporting

Answer 37

just need to repeat this as part of Baseline Configuration and Registry Settings

Question 38

Patch update poliicies and schedule

Answer 38

• Update policies and schedule
  
  • Apply all latest –auto-update (used for SOHO)
  • Only apply specific patches
  • Third-party patches

Question 39

Scheduling updates

Answer 39

It can also be difficult to schedule patch operations, especially if applying the patch
is an availability risk to a critical system. If vulnerability assessments are continually
highlighting issues with missing patches, patch management procedures should
be upgraded. If the problem affects certain hosts only, it could be an indicator of
compromise that should be investigated more closely.

Question 40

Managing unpatchablesystems

Answer 40

Patch management can also be difficult for legacy systems, proprietary systems, and
systems from vendors without robust security management plans, such as some types
of Internet of Things devices. These systems will need compensating controls, or some
other form of risk mitigation if patches are not readily available.

Question 41

Endpoint Protection

Answer 41

Another crucial step in hardening is to configure endpoint protection for automatic
detection and prevention of malware threats. There have been many iterations of
host-based/endpoint protection suites and agents.

Antivirus (A-V)/anti-malware
•Signature-based detection of all malware/PUP types

Host-based intrusion detection/prevention (HIDS/HIPS)
•File integrity monitoring and log/network traffic scanning
•Prevention products can block processes or network connections

Endpoint Protection Platform (EPP)
•Consolidate agents for multiple functions
•Combine A-V, HIDS, host firewall, content filtering, encryption, …

Data loss prevention (DLP)
•Block copy or transfer of confidential data
•Endpoint protection deployment

Question 42

Antivirus (A-V)/anti-malware

Answer 42

•Signature-based detection of all malware/PUP types

The first generation of anti-virus (A-V) software is characterized by signature-based
detection and prevention of known viruses. An “A-V” product will now perform
generalized malware detection, meaning not just viruses and worms, but also Trojans,
spyware, PUPs, cryptojackers, and so on. While A-V software remains important,
signature-based detection is widely recognized as being insufficient for the prevention
of data breaches.

Question 43

Host-Based Intrusion Detection/Prevention (HIDS/HIPS)

Answer 43

• File integrity monitoring and log/network traffic scanning
• Prevention products can block processes or network connections

Host-based intrusion detection systems (HIDS) provide threat detection via log and
file system monitoring. HIDS come in many different forms with different capabilities,
some of them preventative (HIPS). File system integrity monitoring uses signatures to
detect whether a managed file image—such as an OS system file, driver, or application
executable—has changed. Products may also monitor ports and network interfaces,
and process data and logs generated by specific applications, such as HTTP or FTP.

Question 44

Endpoint Protection Platform (EPP)

Answer 44

• Consolidate agents for multiple functions
• Combine A-V, HIDS, host firewall, content filtering, encryption, …

Endpoint protection usually depends on an agent running on the local host. If multiple
security products install multiple agents (say one for A-V, one for HIDS, another for
host-based firewall, and so on), they can impact system performance and cause conflicts, creating numerous technical support incidents and security incident false
positives. An endpoint protection platform (EPP) is a single agent performing multiple
security tasks, including malware/intrusion detection and prevention, but also other
security features, such as a host firewall, web content filtering/secure search and
browsing, and file/message encryption.

Question 45

Data loss prevention (DLP)

Answer 45

•Block copy or transfer of confidential data

Many EPPs include a data loss prevention (DLP) agent. This is configured with policies
to identify privileged files and strings that should be kept private or confidential, such
as credit card numbers. The agent enforces the policy to prevent data from being
copied or attached to a message without authorization.

Question 46

Endpoint protection deployment

Answer 46

i skipped this one

Question 47

Next-Generation Endpoint Protection

Answer 47

Where EPP provides mostly signature-based detection and prevention, next-generationendpoint protection with automated response is focused on logging of endpointobservables and indicators combined with behavioral- and anomaly-based analysis.

Endpoint detection and response (EDR)
•Visibility and containment rather than preventing malware execution
•User and entity behavioranalytics driven by cloud-hosted machine learning

Next-generation firewall integration
•Use endpoint detection to alter network firewall policies
•Block filelessthreats and covert channels
•Prevent lateral movement

Question 48

Endpoint detection and response (EDR)

Answer 48

• Visibility and containment rather than preventing malware execution
• User and entity behavioranalytics driven by cloud-hosted machine learning

An endpoint detection and response (EDR) product’s aim is not to prevent initial
execution, but to provide real-time and historical visibility into the compromise, contain
the malware within a single host, and facilitate remediation of the host to its original
state.

Question 49

Next-Generation Firewall Integration

Answer 49

• Use endpoint detection to alter network firewall policies
• Block filelessthreats and covert channels
• Prevent lateral movement

An analytics-driven next-gen antivirus product is likely to combine with the perimeter
and zonal security offered by next-gen firewalls. For example, detecting a threat on an
endpoint could automate a firewall policy to block the covert channel at the perimeter,
isolate the endpoint, and mitigate risks of the malware using lateral movement
between hosts.

Question 50

Antivirus Response

Answer 50

Signature-based detection and heuristics

Malware identification and classification
•Common Malware Enumeration (CME)

Manual remediation advice

Advanced malware tools
•Manually identify file system changes and network activity

Sandboxing
•Execute malware for analysis in a protected environment

Question 51

Signature-based detection and heuristics

Answer 51

Scanner scans for malware

If the code matches a signature of known malware or exhibits malwarelike behavior that matches a heuristic profile, the scanner will prevent execution and
attempt to take the configured action on the host file (clean, quarantine, erase, and so
on).

An alert will be displayed to the user and the action will be logged (and also may generate an administrative alert).

The malware will normally be tagged using a vendor
proprietary string and possibly by a CME (Common Malware Enumeration) identifier.
These identifiers can be used to research the symptoms of and methods used by
the malware.

Question 52

Common Malware Enumeration (CME)

Answer 52

when a prevention system detect/prevents malware….

The malware will normally be tagged using a vendor
proprietary string and possibly by a CME (Common Malware Enumeration) identifier.
These identifiers can be used to research the symptoms of and methods used by
the malware.

Question 53

Advanced malware tools

Answer 53

•Manually identify file system changes and network activity

Malware is often able to evade detection by automated scanners. Analysis of SIEM and
intrusion detection logs might reveal suspicious network connections, or a user may
observe unexplained activity or behavior on a host. When you identify symptoms such
as these, but the AV scanner or EPP agent does not report an infection, you will need to
analyze the host for malware using advanced tools.

Question 54

Sandboxing

Answer 54

Execute malware for analysis in a protected environment

Question 55

Embedded Systems

Answer 55

Embedded system is in a static environment. PC is in a dynamic envionrment (you can add or remove applications, etc etc)

• Computer system with dedicated function
• Static environment
• Cost, power, and compute constraints
  
  • Single-purpose devices with no overhead for additional security computing
• Crypto, authentication, and implied trust constraints
  
  • Limited resource for cryptographic implementation
  • No root of trust
  • Perimeter security
• Network and range constraints
  
  • Power constrains range
  • Emphasize low data rates, but minimize latency

Question 56

Logic Controllers for Embedded Systems

Answer 56

• Programmable logic controller (PLC)
• System on chip (SoC)
  
  • Processors, controllers, and devices all provided on single package
  • Raspberry Pi
  • Arduino
• Field programmable gate array (FPGA)
  
  • End customer can configure programming logic
• Real-time operating system (RTOS)
  
  • Designed to be ultra-stable
  • Prioritizes real-time scheduling

Question 57

Programmable logic controller (PLC)

Answer 57

Embedded systems are normally based on firmware running on a programmable
logic controller (PLC). These PLCs are built from different hardware and OS
components than some desktop PCs.

Question 58

System on Chip (SoC)

Answer 58

• System on chip (SoC)
  
  • Processors, controllers, and devices all provided on single package
  • Raspberry Pi
  • Arduino

Desktop computer system architecture uses a generalized CPU plus various other
processors and controllers and system memory, linked via the motherboard. System
on chip (SoC) is a design where all these processors, controllers, and devices areprovided on a single processor die (or chip). This type of packaging saves space and is
usually power efficient, and so is very commonly used with embedded systems.

Question 59

Types of SoC

Answer 59

• Raspberry Pi

* Arduino

Question 60

Field Programmable Gate Array (FPGA)

Answer 60

• Field programmable gate array (FPGA)
  
  • End customer can configure programming logic

A microcontroller is a processing unit that can perform sequential operations from
a dedicated instruction set. The instruction set is determined by the vendor at the
time of manufacture. Software running on the microcontroller has to be converted
to these instructions (assembly language). As many embedded systems perform
relatively simple but repetitive operations, it can be more efficient to design the
hardware controller to perform only the instructions needed. One example of this
is the application-specific integrated circuits (ASICs) used in Ethernet switches. ASICs
are expensive to design, however, and work only for a single application, such as
Ethernet switching.

A field programmable gate array (FPGA) is a type of controller that solves this
problem. The structure of the controller is not fully set at the time of manufacture.
The end customer can configure the programming logic of the device to run a
specific application.

Question 61

Real-time operating system (RTOS)

Answer 61

Real-time operating system (RTOS)
•Designed to be ultra-stable
•Prioritizes real-time scheduling

Many embedded systems operate devices that perform acutely time-sensitive tasks,
such as drip meters or flow valves. The kernels or operating systems that run these
devices must be much more stable and reliable than the OS that runs a desktop
computer or server. Embedded systems typically cannot tolerate reboots or crashes
and must have response times that are predictable to within microsecond tolerances.
Consequently, these systems often use differently engineered platforms called realtime
operating systems (RTOS). An RTOS should be designed to have as small an
attack surface as possible. An RTOS is still susceptible to CVEs and exploits, however.

Question 62

Operational Technology (OT) networks

Answer 62

•Serial data and Industrial Ethernet

A cabled network for industrial applications is referred to as an operational technology
(OT) network. These typically use either serial data protocols or industrial Ethernet.
Industrial Ethernet is optimized for real-time, deterministic transfers. Such networks
might use vendor-developed data link and networking protocols, as well as specialist
application protocols.

Question 63

•Cellular networks/baseband radio

Answer 63

• Cellular networks/baseband radio
  
  • Narrowband-IoT (NB-IoT)
  • LTE Machine Type Communication (LTE-M)
  • 4G versus 5G
  • Subscriber identity module (SIM) cards
  • Encryption and backhaul

Question 64

baseband radio

Answer 64

A cellular network enables long-distance communication over the same system that
supports mobile and smartphones. This is also called baseband radio, after thebaseband processor that performs the function of a cellular modem. There are severalbaseband radio technologies:

• Narrowband-IoT (NB-IoT)—
• LTE Machine Type Communication (LTE-M)—

Question 65

NB-IoT vs LTE-M

Answer 65

• Narrowband-IoT (NB-IoT)—this refers to a low-power version of the Long Term
Evolution (LTE) or 4G cellular standard. The signal occupies less bandwidth than
regular cellular.
- Narrowband also has greater penetrating power, making it more suitable
for use in inaccessible locations, such as tunnels or deep within buildings, where
ordinary cellular connectivity would be impossible.

• LTE Machine Type Communication (LTE-M)—this is another low-power system, but
supports higher bandwidth (up to about 1 Mbps).

Question 66

5g vs 4g

Answer 66

While not yet completely standardized, both NB-IoT and LTE-M are designed to be
compatible with 5G networks. This means they do not interfere with 5G signaling and
can use tower relays developed for 5G. They may support higher data rates, though
latency and reliability tend to be more important considerations.

Question 67

Subscriber identity module (SIM) cards

Answer 67

Any LTE-based cellular radio uses a subscriber identity module (SIM) card as an
identifier. The SIM is issued by a cellular provider, with roaming to allow use of other
suppliers’ tower relays. As a removable card is not really a suitable form factor for
embedded, an eSIM incorporates the same function as a chip on the system board or
SoC design.

Question 68

Encryption and backhaul

Answer 68

Encryption of frames between the endpoint and the cell tower and within the backhaul
to Internet routers is the responsibility of the network operator. Over the air encryption
is performed by encryption schemes devised by the cellular standards body 3GPP.
Backhaul security is usually enforced using IPSec. The embedded system can use
application layer encryption for additional security.

Question 69

Z-Wave and Zigbee

Answer 69

Z-Wave and Zigbee are wireless communications protocols used primarily for home
automation. Both create a mesh network topology, using low-energy radio waves to
communicate from one appliance to another..

Zwave - evices can be configured to
work as repeaters to extend the network but there is a limit of four “hops” between a
controller device and an endpoint.

Zigbee - Zigbee has similar uses to Z-Wave and is an open source competitor technology to it.
The Zigbee Alliance operates certification programs for its various technologies and
standard

Question 70

Industrial Control systems (ICS)

Answer 70

Industrial systems have different priorities to IT systems. Often, hazardouselectromechanical components are involved, so safety is the overriding priority.
Industrial processes also prioritize availability and integrity over confidentiality—
reversing the CIA triad as the AIC triad.

Question 71

Availability, integrity, confidentiality (AIC triad)

Answer 71

Industrial processes also prioritize availability and integrity over confidentiality—reversing the CIA triad as the AIC triad.

Question 72

Workflow and process automation for ICS

Answer 72

Industrial control systems (ICSs) provide mechanisms for workflow and process automation. These systems control machinery used in critical infrastructure, like
power suppliers, water suppliers, health services, telecommunications, and national security services.

Question 73

Plant devices and embedded PLCs (ICS)

Answer 73

An ICS comprises plant devices and equipment with embedded PLCs.

Question 74

• Workflow and process automation
  
  • Industrial control systems (ICSs)
  • Plant devices and embedded PLCs
  • OT network
  • Electromechanical components and sensors
  • Human machine interface (HMI)
  • Data historian

Answer 74

I skipped most of this

Question 75

Industries that use ICS/SCADA systems

Answer 75

Energy
•Power generation and distribution

Industrial
•Mining and refining raw materials

Fabrication and manufacturing
•Creating components and assembling them into products

Logistics
•Moving things

Facilities
•Site and building management systems
•Heating, ventilation, and air conditioning (HVAC)

Question 76

Internet of Things

Answer 76

• Machine to Machine (M2M) communication
• Hub/control system
  
  • Communications hub
  • Control system for headless devices
  • Smart hubs and PC/smartphone controller apps
• Smart devices
  
  • IoT endpoints
  • Compute, storage, and network functions and vulnerabilities
• Wearables
• Sensors
• Vendor security management
  
  • Weak defaults
  • Patching and updates

Question 77

•Machine to Machine (M2M) communication

Answer 77

The term Internet of Things (IoT) is used to describe a global network of appliancesand personal devices that have been equipped with sensors, software, and networkconnectivity. This compute functionality allows these objects to communicate and
pass data between themselves and other traditional systems like computer servers.
This is often referred to as Machine to Machine (M2M) communication.

Question 78

Hub/control system—

Answer 78

• Communications hub
• Control system for headless devices
• Smart hubs and PC/smartphone controller apps

IoT devices usually require a communications hub to facilitate
Z-Wave or Zigbee networking. There must also be a control system, as most IoT
devices are headless, meaning they have no user control interface.

Question 79

Smart devices

Answer 79

• IoT endpoints
• Compute, storage, and network functions and vulnerabilities

Smart devices—IoT endpoints implement the function, such as a smart lightbulb
or a video entryphone that you can operate remotely. These devices implement
compute, storage, and network functions that are all potentially vulnerable to
exploits.

Question 80

Wearables

Answer 80

some IoT devices are designed as personal accessories, such as
smart watches, bracelets and pendant fitness monitors, and eyeglasses. Current
competing technologies are based on FitBit, Android Wear OS, Samsung’s Tizen OS,
and Apple iOS, each with their own separate app ecosystems.

Question 81

Sensors

Answer 81

IoT devices need to measure all kinds of things, including temperature,
light levels, humidity, pressure, proximity, motion, gas/chemicals/smoke, heart/
breathing rates, and so on.

Question 82

Vendor security management (IoT)

Answer 82

• Weak defaults

* Patching and updates

Question 83

Specialized Systems for Facility Automation

Answer 83

Building automation system (BAS)
•Smart buildings
•Process and memory vulnerabilities
•Credentials embedded in application code
•Code injection

Smart meters

Surveillance systems
•Physical access control system (PACS)
•Risks from third-party provision
•Abuse of cameras

Question 84

physical access control system (PACS)

Answer 84

is a network of monitored locks, intruder
alarms, and video surveillance.

Surveillance systems
•Physical access control system (PACS)
•Risks from third-party provision
•Abuse of cameras

Question 85

Building automation system (BAS)

Answer 85

• Smart buildings
• Process and memory vulnerabilities
• Credentials embedded in application code
• Code injection

building automation system (BAS) for offices and data centers (“smart buildings”)
can include physical access control systems, but also heating, ventilation, and air
conditioning (HVAC), fire control, power and lighting, and elevators and escalators.

Question 86

Smart meter

Answer 86

A smart meter provides continually updating reports of electricity, gas, or water usage
to the supplier, reducing the need for manual inspections.

Question 87

Specialized Systems in IT

Answer 87

Multifunction printer (MFP)
•Hard drives and firmware represent potential vulnerabilities
•Recovery of confidential information from cached print files
•Log data might assist attacks
•Pivot to compromise other network devices

Voice over IP

Shodan

Question 88

Shodan

Answer 88

Shodan search results for sites responding to probes over port 9100 (TCP port for raw print data).

Question 89

Multifunction printer (MFP)

Answer 89

• Hard drives and firmware represent potential vulnerabilities
  
  • Recovery of confidential information from cached print files
  • Log data might assist attacks
  • Pivot to compromise other network devices

Question 90

Specialized Systems for Vehicles and Drones

Answer 90

• Unmanned Aerial Vehicles (UAV)/drones
• Computer-controlled or assisted engine, steering, and brakes
• In-vehicle entertainment and navigation
• Controller area network (CAN) serial communications buses
  
  • Onboard Diagnostics (OBD-II) module
  • Access via cellular or Wi-Fi

Question 91

Controller area network (CAN) serial communications buses

Answer 91

Modern vehicles are increasingly likely to have navigation and entertainment
systems, plus driver-assist or even driverless features, where the vehicle’s automated
systems can take control of steering and braking. The locking, alarm, and engine
immobilizer mechanisms are also likely to be part of the same system. Each of these
subsystems is implemented as an electronic control unit (ECU), connected via one
or more controller area network (CAN) serial communications buses. The principal
external interface is an Onboard Diagnostics (OBD-II) module. The OBD-II also acts as a
gateway for multiple CAN buses.

The CAN bus operates in a somewhat similar manner to shared Ethernet and was
designed with just as little security. ECUs transmit messages as broadcast so they
are received by all other ECUs on the same bus. There is no concept of source
addressing or message authentication. An attacker able to attach a malicious device
to the OBD-II port is able to perform DoS attacks against the CAN bus, threatening
the safety of the vehicle. There are also remote means of accessing the CAN bus,
such as via the cellular features of the automobile’s navigation and entertainment
system (wired.com/2015/07/hackers-remotely-kill-jeep-highway). Some vehicles also
implement on-board Wi-Fi, further broadening the attack surface.

Question 92

Specialized Systems for Medical Devices

Answer 92

• Used in hospitals and clinics but also at home by patients
• Potentially unsecure protocols and control systems
• Use compromised devices to pivot to networks
• Stealing Protected Health Information (PHI)
• Ransom by threatening to disrupt services
• Kill or injure patients

Question 93

Security for Embedded Systems

Answer 93

• Network segmentation
  
  • Strictly restrict access to OT networks
  • Increased monitoring for SCADA hosts
• Wrappers
  
  • Use IPSec for authentication and integrity and confidentiality
• Firmware code control
  
  • Supply chain risks
• Inability to patch
  
  • Inadequate vendor support
  • Time-consuming patch procedures
  • Inability to schedule downtime

Question 94

Network segmentation

Answer 94

• Network segmentation
  
  • Strictly restrict access to OT networks
  • Increased monitoring for SCADA hosts

Network segmentation is one of the core principles of network security. Network access
for static environments should only be required for applying firmware updates and
management controls from the host software to the devices and for reporting status and
diagnostic information from the devices back to the host software.

Question 95

Wrappers

Answer 95

•Use IPSec for authentication and integrity and confidentiality

One way of increasing the security of data in transit for embedded systems is through the
use of wrappers, such as IPSec. The only thing visible to an attacker or anyone sniffing
the wire is the IPSec header, which describes only the tunnel endpoints. This is useful
for protecting traffic between trusted networks when the traffic has to go through an
untrusted network to go between them, or between trusted nodes on the same network.

Question 96

Firmware Control Code

Answer 96

• Firmware code control
  
  • Supply chain risks
• Inability to patch
  
  • Inadequate vendor support
  • Time-consuming patch procedures
  • Inability to schedule downtime

Embedded systems demonstrate one of the reasons that supply chain risks must be
carefully managed. Programming logic implemented in FPGA and firmware code must
not contain backdoors. Firmware patching is just as vital as keeping host OS software
up to date, but for many embedded systems, it is far more of a challenge: