Memory Deck Flashcards
1
Q
SLE = AV * EF
A
Single Loss Expectancy (SLE) - Negative impact for one-time occurrence
Asset Value (AV)
Exposure Factor (EF) - If a flood will damage 40% of your data center, EF is 40%
ARO
Annual Rate of Occurance
ALE = ARO * SLE
🍺 = 😍 (get it?)
Ale makes arousal
Annual Loss Expectancy = Rate of Occurrence - Single Loss Expectancy
===
(Mario saying): “I’ve got something up my sleav-ef”.
2
Q
STRIDE - Microsoft threat modeling tool
A
S poofing
T ampering
R epudiation - attacker can deny participation
I nformation disclosure
D enial of service
E levation of privilege
3
Q
Due Diligence
A
: Do Detect
Imagine you have a pool. To protect children and animals from drowning in your pool, you exercise due care by building a fence around the pool. Regularly checking the fence for vulnerabilities and correcting them demonstrates due diligence.
4
Q
ISC2 Ethics: PAPA
A
Protect, Act, Provide, Advance.
5
Q
Due Care
Due Care:
A
Do correct.
A vendor engaging in a reasonable and expected manner for the circumstance
Imagine you have a pool. To protect children and animals from drowning in your pool, you exercise due care by building a fence around the pool. Regularly checking the fence for vulnerabilities and correcting them demonstrates due diligence.
6
Q
PTA keeps the children safe!
A
P hysical - Tangible. Locks, guards, alligator moats, etc.
T echincal/Logical - Automated or electronic systems.
A dministrative - Policy, signage.
7
Q
Security through obscurity:
A
Data Hiding.
8
Q
RMF:
A
“Proper Crime Scene Investigators Always Act Modestly” = Prepare, Categorize,
Select, Implement, Assess, Authorize, Maintain.
9
Q
ALE= SLE x ARO:
A
ArROw SLEd = ALE is beer, so “A Drunk guy shooting
arrows on a sled”.
10
Q
ISO:
A
“Raging Crackheads Risk Health” = Requirements, Code of practice, Risk
Management, Health (ISO27001, 27002, 27005, 27799).
11
Q
Security Models:
A
Simple/R = read ; */W = write ; U = UP ; D = DOWN
12
Q
Bell LaPadula:
A
Confidentiality – Simple N R U || * N W D || Strong * N R/W
U/D.
13
Q
Biba:
A
Integrity – Simple N R D || * N W U || Invocation N R/W U.
14
Q
Hashing:
A
HA or MD in the name.
15
Q
Asymmetric:
A
DEREK-Q = D=Diffie-Hellman E=ElGamal R=RSA E=ECC K=Knapsack Q=Quantum.
16
Q
Symmetric:
A
23BRAIDS = 2=Twofish 3=3DES B=Blowfish R=RC5 A=AES I=IDEA D=DES S=Skipjack.
17
Q
Fire Extinguisher Classes:
A
A - Ash -> Combustible
B - Boil -> Liquid
C - Current -> Electrical
D - Dent -> Metal
K - Kitchen -> Oil/Fat
18
Q
CPU Pipelining order:
A
FDEW = Fetch, Decode, Execute, Write.
19
Q
OSI Model:
A
Physical, Datalink, Network, Transport, Session, Presentation, Application.
Layer 1-7: Please Do Not Throw Sausage Pizza Away.
Layer 7-1: All People Seem To Need Data Processing.
Helpful mnemonics (for the OSI from top to bottom or 7 to 1):
All People Seem To Need Data Processing
All People Should Try New Dairy Products
All People Studying This Need Drastic Psychotherapy
As Pauly Shore Tweeted, “Nice Dress, Pops!”
Helpful mnemonics (for the OSI from the bottom up or 1 through 7):
Pete doesn’t need to sell pickles anymore
Please Do Not Take Sales People’s Advice
Please Do Not Touch Slimy Purple Algae
Programmers Do Not Throw Stale Pizza Away
Please Do Not Teach Stupid People Acronyms
7 Application; Service Protocols, DNS, FTP, HTTP/s, WAF 6 Presentation; Data formats, GIF, JPG, MOV 5 Session; Auth/crypto, establishes and terminates connections between apps, RPC, PAP, Circuit level fw. 4 Transport; Ports, L2TP, TCP, UDP, SSL, TLS can be done at L3, *Stateful and Packet FW 3 Network, PPTP, chap, IP, RIP, IPSEC, Routers, Brouter, *Stateful and Packet FW 2 Data Link; Host to host links, PPP, Ethernet. Contains, Bridges, Switches, Stateful fw. i Logical Link Control ii MAC 1 Physical; Fibre, Eth Cable, Hub
20
Q
TCP/IP Model:
A
NITA - Network access, Internet, Transport, Application.
Armadillos Take In New Ants
21
Q
DREAD:
A
Damage, Reproducibility, Exploitability, Affected users, Discoverability.
22
Q
Evaluation Assurance Level (EAL):
FSMM-SSF:
A
FSMM-SSF: For Sure My Mother-So Sweet Forever.
Fun Stress Method Medical-Doctors Seem Somewhat Verifiably Foolish.
Functionally, Structurally, Methodically, Methodically Designed, Semi-formally,
Semi-formally Designed, Verified, Formally Verified.
23
Q
Incident Response Forensics:
A
PDRMR3L =People in Canada Eat Raw Lettuce = Prepare, Detect, Response, Mitigate,
Reporting, Recovery, Remediation, Lesson Learned.
24
Q
IDEAL:
A
Initiating, Diagnosing, Establishing, Acting, Learning.
25
The Ring Model: Zero KODU
-VM KODU = -1 VM hosts, 0 Kernel, 1 Operating System, 2
Drivers, 3 User.
26
DHCP:
DORA - Discover, Offer, Request, ACK.
27
Digital forensics model:
I Prefer Coffee Everytime Anyone Provides
Donuts = Identification, Preservation, Collection, Examination, Analysis,
Presentation, Decision.
28
Change Management Steps:
RRA/RTID Request, Review, Approve or
Reject, Test, Implement, Document.
29
The 7 steps of a cyber-attack:
RSA ESA O = Reconnaissance, Scanning,
Access and Escalation, Exfiltration, Sustainment, Assault, Obfuscation.
30
SW-CMM:
I Ran Down My Ostrich = Initial, Repeatable, Defined,
Managed, Optimized.
31
BCP Steps:
BCP policy → BIA → Identify preventive controls → Develop
recovery strategies → Develop DRP → DRP training/testing → BCP/DRP
maintenance
32
SDLC1:
IDIOD - Don’t be an IDIOD = Initiation, Design, Implement,
Operations, Disposal
33
SDLC2:
“I Reckon All Dem Dere Taters’ Really Delicious” = Initiation,
Requirements, Architecture, Design, Develop, Testing, Release,
Disposal.
34
ACID:
Atomic, Consistency, Isolation, Durability.
35
Evidence must be:
Authentic,
Complete,
Admissible,
Convincing,
Accurate
36
Type 2 errors
are FAR away.
37
PGP
is a good IDEA.
38
SPF-B
B(urn) Transport Layer—Segments (TCP) (SOME) DATAGRAM (UDP) Network Layer—Packets (PEOPLE) Data Link Layer—Frames (FEAR) Physical Layer— Bits (BIRTHDAYS)
39
IDEAL -
Initiating, Diagnosing, Establishing, Acting, Learning
40
SCMM -
Initial, Repeatable, Defined, Managed, Optimized
I RAN DOWN MY OSTRICH
41
SDLC
PADDTIM - Planning, Analysis, Design, Development, Testing, Implementation, Maintenance
42
BCP:
Inguannas In Paris Really Cant Teach Me = Iniitation, Impact, Preventative, Recovery, Continuity, Test, Manage
43
Blackout
Fault
Brownout
Sag
Inrush
Spike
Surge
Complete loss of power Blackout
Brief/Moementary Loss of Power Fault
Prolonged/Extended drop in voltage Brownout
Brief drop in voltage Sag
Initial power rush
(i.e., after an outage) Inrush
Momentary rush of power Spike
Prolonged/Extended rush of power Surge
Big Fat Bears Sleep in Snoring Slumber
Before Face Book Some Introverts Stayed Silent
Blue Falcons Bring Simply Incredible Soaring Sights
Best Friends Believe Silence Is Simply Silly
44
20,21
- FTP, File Transfer Protocol
45
22
- ssh, secure shell
46
23
- Telnet
47
25 -
SMTP, Simple Mail Transport Protocol
48
53 -
DNS
49
69 -
TFTP, Trivial File Transfer Protocol
50
80 -
HTTP, HyperText Transfer Protocol
51
110 -
POP3, Post Office Protocol (version 3)
52
119
- NNTP, Network News Transport Protocol
53
124 -
NTP, Network Time Protocol
54
143
- IMAP, Internet Message Access Protocol (version 4)
55
161
- SNMP, Simple Network Management Protocol
56
3389
dedicated to Remote Desktop Protocol (RDP)
57
6000- X-Windows
58
How Kerberos Work
1. You go to the Amusement Park and Buy a Ticket from the Main Entrance Counter to Enter into the Amusement Part to Enjoy The Rides, whichever you have paid for. (Which we call TGT - Ticket Granting Ticket)
2. He goes to the first rider and says I want to ride MarygoRound and present the Ticket (TGT) to the Rider. But the rider says, show me the ticket that you have to ride this ride.
3. Rider suggest him to go to the different counter to get the ticket for this Ride (Call it Service Ticket). He goes to that counter and shows his Ticket (TGT) and gets Service Ticket for the MarrygoRound Ride.
4. After getting the Service Ticket, he shows it to the Rider and he allows him for this Ride. He Enjoys the Ride.
5. Overview
6. In Reality How it Happens
- User Sends a Authentication Service Request to Domain Controller
- Domain Controller Sends Back Authentication Service Response along with TGT Key
- User Send an Application Request along with the TGT Key to the Domain Controller
- Domain Controller Sends Back TGT Response along with the Service Ticket to Access the Requested
Application
- User sends a Request to the Application Server along with the Service Key
- Application Server Validates it and Grant Permission to Access it
59
Patent
= 20 years. Notice there is the word "ten" in Patent. 10 fits better into 20, than it does 70 (Copyright).
60
Take-Grant:
Take Grant to the Colorado Rockies (Take/Grant/Create/Remove). The OSG is also light on this, as you only need to know what it is, and how it compares to the other models.
61
Clark-Wilson -
it's an integrity model.
62
IPS
IaaS
– Many hosts Infrastructure. Best if your app really requires complex infrastructure (such as 5 databases, 10 firewalls, etc).
63
IPS
PaaS
– One host. Best if: your app can run on 1 host, and you are concerned about: liability, security, time, and money wasted configuring code and infrastructure. PaaS is much more liability-optimal than IaaS. PaaS is the easiest to administer. PaaS your code – so IaC is PaaS.
64
IPS
SaaS
– Service. Service is the most affordable, has least liability to the customer and the cheapest, but it takes time to configure code to work with SaaS and cloud.
65
BPA
– BiPlane Joint-Venture agreement
66
OLA
– Like Windows OLE (internal, under-the-hood) – under-the-hood 'SLA' internal agreement between (C)SP and its brokers.
67
MOU
– Completely different beast – Confirms understanding of each-other's "moo" (talk).
68
SOW
– Slave (small) Jobs Worked-on.
69
MSA
– Master Services Provided. Masters of Airlines.
70
Sarbanes Oxley (SOX)
(Sarbanes Oxley, 2002) – [say in British accent] ENRON really SOX. Its transaction flow really SOX.
71
Gramm-Leach-Bliley Act (GLBA)
– banks, lenders, insurance. Think about some fat banker Gramm (or Graham)
72
COPPA
– Protects minors 13 or younger online. If you are an online pedo, then you cop it
73
FERPA
– Protects Student data for over 18. Think about Phineas and FerP. They have to grow up eventually and go to college. It would be really unfortunate for Phineas and FerP fans if FerP's student card is leaked to public!
74
FISMA
– U.S. Government information security is under prisma. [NIST SP 800-53 is used for FISMA]
75
PCI DSS –
Credit Card Security – Visa, MasterCard and American Express. What else is a card other than a credit card? – Your PCI card.
Note: PCI DSS is a Standard, not a law.
76
Digital Millenium Copyright Act (DMCA)
– Copyright. Who hadn't heard of the DMCA strikes on Youtube?
77
Computer Fraud and Abuse Act – CFAA 1986
– First major legislation to fight cybercrime. Think: CFAA – F for First.
78
Electronic Communications Privacy Act – ECPA 1986 –
Makes it illegal to invade electronic privacy of an individual.
79
Communication Assurance for Law Enforcement Act – CALEA 1994 – Amends ECPA to make wiretaps possible for law enforcement, regardless of technology used.
Think of ECPA and CALEA – as a seed and a flower. Yes, calea is a plant, but let's make CALEA a CAULIPOWER with sour taste. ECPA grows into CALEA flower. Then terrorists come, and the garden of CALEA has to be destroyed. Like the privacy had to be destroyed.
80
USA PATRIOT Act of 2001 –
Broadened wiretapping authorizations, no thanks to 9/11 in 2001.
81
Export Administration Regulation (EAR)
– restricting export of civilian items that may have military applications, such as EARphones.
82
International Traffic in Arms Regulations (ITAR)
– restricting export of war items. Think "ITAR is war". Russia has a century-old pro-war newsagency of ITAR-TASS, and when Russia started its full-scale war, U.S. already had Russia added to ITAR list.
83
California Consumer Privacy Act – CCPA
– in California only, require Privacy Statements from organizations. Similar mandatory effects to the EU's GDPR. Remember California=Privacy.
84
USPTO
– Patents and Trademarks – (U.S. Patent & Trademark Office)
85
LOC
– Copyright – (Library of Congress)
86
NIST SP 800-37
Steps
Prepare.
Categorize (systems)
Select (controls) [for systems]
Implement (controls) [+documentation]
Assess (controls) [take a step back]
Authorize (controls) [stamp of approval]
Monitor.
Mnemonic device 1
PC SIA AM (PC of SIA in ArMenia)
For SIA to run a rogue PC in Armenia is pretty RISKy
https://img.youtube.com/vi/JKbVmjan3bQ/mqdefault.jpg
Mnemonic device 2
PCS IAAM (PC-s I aam)
[Being non-human is RISKy]
87
NIST SP 800-34
DC I DD PP
NSFL but rememberable memorization trick, oh boy will you need DRP and thus BCP after this
Develop (policy)
Conduct BIA (Business Impact Analysis)
Identify (preventative controls)
Develop DRP strategies
Develop IT contingency (plan)
Plan Training
Plan maintenance
88
Bell-LaPadula –
(Confidentiality model) Like a BELL 🛎️: No Read Up↑, no Write Down↓.
Compiled: NoR↑🛎NoW↓.
89
Biba
– (Integrity model) Opposite of Bell-LaPadula: No Read↓, no Write Up↑.
Compiled: NoR↓▽NoW↑.
90
Brewer&Nash:
Think Chinese Brew tea – Chinese Wall. Walls off conflict-of-interest.
91
Clark-Wilson
– (Integrity model) Use software to access data. Clerk uses WinStone software to access business data.
92
Fault – short – (Technical) Faults don't last forever
Blackout – (obviously) long
LO Electricity
Sag – short-term – sag even sounds short – sag sac
Brownout – alike to blackout – long-term
HI Electricity
Spike – Spikes are momentary
Surge – Like insurgencies, they can last long!
Fault – short – (Technical) Faults don't last forever
Blackout – (obviously) long
LO Electricity
Sag – short-term – sag even sounds short – sag sac
Brownout – alike to blackout – long-term
HI Electricity
Spike – Spikes are momentary
Surge – Like insurgencies, they can last long!
93
Magnetic – low security
Proximity – signal can be stolen
RFID – Distance
Microchip / SmartCard – Secure
Magnetic – low security
Proximity – signal can be stolen
RFID – Distance
Microchip / SmartCard – Secure
94
Class A: 10.0.0.0 – 10.255.255.255
Class B: 172.16.0.0 – 172.31.255.255
Class C: 192.168.0.0 – 192.168.255.255
Class A: 10.0.0.0 – 10.255.255.255
Class B: 172.16.0.0 – 172.31.255.255
Class C: 192.168.0.0 – 192.168.255.255
95
Private IP ranges' subnet masks
Easy trick: class letter defines the number of 255's from left to right. For example, class B (2) would have 255.255.0.0
Private IP ranges' subnet masks
Easy trick: class letter defines the number of 255's from left to right. For example, class B (2) would have 255.255.0.0
96
Rejection" is a "positive" for authN systems.
FRR – Type 1 Error
FAR – Type 2 Error
CER – Intersection between FAR and FRR. Optimal configuration.
Mnemonic device: FRR FAR, CER (meaning Freier's far, sire)
Rejection" is a "positive" for authN systems.
FRR – Type 1 Error
FAR – Type 2 Error
CER – Intersection between FAR and FRR. Optimal configuration.
Mnemonic device: FRR FAR, CER (meaning Freier's far, sire)
97
Open / Third-party logon
Think: Google, Github, Microsoft logon.
OpenID – Identity → Authentication
OAuth – (stands for) Open Authorization
98
XML-based-languages
SAML – AuthN and AuthZ, open source, good for ADFS.
SPML – Service Provisioning
XACML – Access control (AuthZ but not AuthN)
SOAP – messaging over network
SCAP – Security Content (Automation Protocol) – Share threat intel
SAML – AuthN and AuthZ, open source, good for ADFS.
SPML – Service Provisioning
XACML – Access control (AuthZ but not AuthN)
SOAP – messaging over network
SCAP – Security Content (Automation Protocol) – Share threat intel
99
SOC 1 – Finance First
SOC 2 – Trust Second/Trust is Two
SOC 3 – SOC 2 lite for public eyes.
SOC Type
Type 1 – One point in time
Type 2 – Two points – timeline
SOC 1 – Finance First
SOC 2 – Trust Second/Trust is Two
SOC 3 – SOC 2 lite for public eyes.
SOC Type
Type 1 – One point in time
Type 2 – Two points – timeline
100
Static
– Code [Static testing – is a subtype of white-box testing by definition]
101
Dynamic
– Runtime
102
Evidence
By format
Real – Real physical Objects
Documentary – Docs
Testimonial – Witness
By reliability
Primary – Originals
Secondary – Certified copies
By quality
Hearsay – "he said she said" – bad
Direct – Very good
Corroborative – Supportive
Conclusive – so good, that we can adjourn court after it.
Evidence Rules
Best – Original evidence is best (not photocopies)
Parol – Written signed agreements can only be amended by written signed agreements (not parol evidence)
Hearsay – Anti-hearsay evidence rule. Evidence-giver must present themselves and not through a third-party.
103
MTTF
MTTR
MTBF
MTTF – Failure
MTTR – Repair. Similar to WRT
MTBF – Between failures. MTBF = MTTF + MTTR
104
RAID
Basic
RAID operations
Striping – Speed
Mirroring – Redundancy
Remember this array,
0 1
S M
SM – Like "Samsung" or "storage management",
Samsung old-style logo
RAID 01 – (At drive level) 0 Striping, (At drive-set level) 1 Mirroring
Let's try one more for fun,
RAID 100 – (At drive level) 1 Mirroring, (At drive-set level) 0 Striping, (At set of drive-sets level) 0 Striping
105
raid-100
RAID 100
The trick is to read nested RAID from bottom to the top. First digit from the left defines the drive level,
105
RAID 0
– Striping – 2x speed
106
RAID 1
– Mirroring – 2x redundancy
Speed over reliability
107
RAID 2
– Byte striping for speed
108
RAID 3
– Block striping for speed. Block is bigger than byte, therefore RAID 3 > RAID 2.
Error-corrective
109
RAID 5
– Data and parity striped
110
RAID 6
– Same as RAID 5, but configuration is safer with little overhead over RAID 5
Nested
111
Lockheed Martin – Cyber Kill Chain
Mnemonic 1: Story
Trojan War gives a good analogy:
Recon – Greeks analyze Trojan city, culture, forces to find vulnerabilities, and find that Trojans are superstitious.
Weaponization – Greeks design and build an exploit – a Trojan Horse
Delivery – Greeks discreetly deliver a Trojan Horse to the Trojan gates
Installation – Trojan Horse is interacted with and installed inside Troy.
Exploitation – Under the cover of the night, the Greek warriors disembark Trojan Horse and walk on small Trojan streets to avoid early detection.
Command & Control – Greeks establish command and control over Troy
Maintain – Greeks take measures to maintain control of the city as well as to seize the treasury of the previous king.
Mnemonic 1: Story
Trojan War gives a good analogy:
Recon – Greeks analyze Trojan city, culture, forces to find vulnerabilities, and find that Trojans are superstitious.
Weaponization – Greeks design and build an exploit – a Trojan Horse
Delivery – Greeks discreetly deliver a Trojan Horse to the Trojan gates
Installation – Trojan Horse is interacted with and installed inside Troy.
Exploitation – Under the cover of the night, the Greek warriors disembark Trojan Horse and walk on small Trojan streets to avoid early detection.
Command & Control – Greeks establish command and control over Troy
Maintain – Greeks take measures to maintain control of the city as well as to seize the treasury of the previous king.
112
Best
– Original evidence is best (not photocopies)
113
Parol
– Written signed agreements can only be amended by written signed agreements (not parol evidence)
114
Hearsay
– Anti-hearsay evidence rule. Evidence-giver must present themselves and not through a third-party.
115
SW-CMM
SoftWare Capability Maturity Model
Somewhat reminiscent of common criteria.
Mnemonic: IRDMO (THIRDMOON [of SW-CMM hell])
Moon
Lvl 1: Initial: No plan
Lvl 2: Repeatable: Basic lifecycle
Lvl 3: Defined: Formal and documented DevOps
Lvl 4: Managed: Quantitative measures (recall quantitative risk analysis)
Lvl 5: Optimized: CI/CD
116
IDEAL Model
Initiating (everything for DevOps)
Diagnosing (what needs to be fixed/changed)
Establishing (plan)
Acting (on plan → DevOps)
Learning (lessons)
117
Gantt chart
– like timelines on Wikipedia, (example).
118
PERT Chart
– Project management modelling graph
119
Dedicated mode
- have a security clearance, access approval, and valid need to know for ALL data processed by Dedicated system
120
System High mode
- have a security clearance and access approval for ALL data processed by System high mode system. Also, valid need to know for data PERSONALLY accessed.
121
Compartmented mode
- have a security clearance for ALL data processed by compartmented mode system. Also, access approval and a valid need to know for data PERSONALLY accessed.
122
Multilevel mode
- have a security clearance, access approval, and valid need to know for data PERSONALLY accessed. (Requirements are enforced primarily by hardware or software on the system, not by limiting physical access)
123
RAID 10
– (At drive level) 1 Mirroring, (At drive-set level) 0 Striping
124
NIST 800-37 Risk Management Framework
Prepare your business
Categorize business needs
Select controls
Implement controls
Asses controls
Authorize controls
Monitor controls
125
Risk Maturity for interacting with aliens: Alien Pizza Doesn't Ingest Oganically
Risk Maturity Model
Ad-Hoc - Chaotic Starting Point
Preliminary - Loose attempts at a risk management framework
Defined - a risk management framework is defined
Integrated - a risk framework is integrated into business strategy
Optimized - a risk framework is optimized for the business and is not reactive
126
MRS.H:
Most common hashing algorithms
MD5
RIPEMD
SHA
HAVAL
127
23BRAIDS:
Most common Symmetric cryptography algorithms
TwoFish
3DES
Blowfish
Rivest Cipers
AES
IDEA
DES
SkipJack
128
If you're key is going through hell
then protect it with Diffie-Hellman!
The Diffie-Hellman algorithm allows you to exchange session keys through insecure channels
128
DEREK:
Most common Asymmetric cryptography algorithms
Diffie-Hellman
El Gamal
RSA
Elliptic Curve
Knapsack
129
I need to change something again? RRATS! Darnit!
Change Management Model.
Request a change
Review the change
Approve the change
Test the change
Schedule the change
Document the change
130
Create data in Class, then Store it, then Use it, then Archive it, and finally Destroy it
Information Lifecycle.
Create the data
Classify the data so we know how to protect it
Storage such as encryption
Usage such as access control and secure transmission
Archival and when to choose when data should be archived
Destruction in terms of when do we get rid of data and how do we do it securely
130
When we are attacked and headed into battle listen for the DRMRRRL
Incident Response Framework
Detect the attack
Respond to the attack
Mitigate the damage of the attack
Report the attack to senior management
Recover from the attack and return to normal ops
Remediate and find the root analysis
Lessons Learned and how do we keep this from happening again
131
Save your BPA by creating a BCP
The BCP Process
Scope your BCP
BIA, perform your Business Impact Analysis
Plan your BCP
Approve your BCP
132
When you learn to program you initialize your variables, repeat your loops, define your methods, manage your pointers, and optimize your code
Capability Maturity Model
Initial, just starting out your CCM journey
Repeatable, now have repeatable procedures
Defined, now you have defined procedures
Managed, you now have quantifiably managed procedures
Optimized, you are now optimizing your procedures for your business
133
To be IDEAL you need to initiate change, diagnose your problems, establish a plan, act on the plan, and learn from your past
IDEAL Software Framework
Initiate your IDEAL framework
Diagnose the problems you're trying to solve
Establish a plan to solve your problems
Act on your plan and solve your problems
Learn from the entire process
134
Real Developers Ideas Take Effort
Software Development Life Cycle (SDLC)
Requirements
Design
Implement
Test
Evolve
135
Martial Arts is Fire: All Boys Crave Doing Karate
Fire extinguisher categorizations
Class A: "All Purpose" in the way that it means general purpose
Class B: Boiling liquids
Class C: Computers and electronics
Class D: Death metals
Class K: Kitchen and cooking
136
Don't Don't Don't Stop Pouring Free Beer
Alternative OSI Model Protocol Data Unit
Layer 7: Data
Layer 6: Data
Layer 5: Data
Layer 4: Segments
Layer 3: Packets
Layer 2: Frames
Layer 1: Bits
136
Don’t don’t don’t stop pouring free beer
OSI Model Layer Protocol Data Unit
Layer 5,6,7: Data
Layer 4: Segments
Layer 3: Packets
Layer 2: Frames
Layer 1: Bits
137
Drinking Brew can cause you to get into a conflict
Brewer-Nash security model intends to prevent conflict of interest
138
When you Go get a massage make sure your Masseuse has integrity
Goguen-Meseguer security model intends to protect integrity
139
Human Rights Uhsignment
Harrison-Ruzzo-Ullman focuses on subject object access rights
140
To be Superman, Clark Kent must have lot of integrity
Clark-Wilson security model intends to protect Integrity
140
Superman is strong enough to be able to care for 3 children at a time
The Clark-Wilson security model describes the access control triple of Subject/Program/Object to prevent unauthorized subjects from modifying an object.
141
Use Graham crackers to create delicious s'mores and then delete them securely in your mouth
Graham-Denning security model works on secure object and subject create and deletion
142
Securely do the following: Create Subject, Create Object, Delete Subject, Delete Object, Read Access, Write Access, Delete Access, Transfer Access
Graham Denning has the 8 actions to securely control access. Also every time I eat s'mores I have a least 8 of them.
143
Kiefer Sutherland as Jack Bauer must protect the integrity of the US by stopping terrorists from interfering with our freedom
The Sutherland security model is meant to protect integrity by limiting interference of subjects.
144
When you use your microscope it lets you focus in on what's important
Scoping security frameworks lets you focus in on just the aspects of the security framework that apply to your situation or organization
145
Agile is VASTly applicable
VAST is a threat modeling framework based on Agile
146
When you take your clothes to the tailor, they are making the generic clothing fit you exactly
Tailoring is modifying or adjusting the security framework to fit your specific need
146
Common Criteria EAL
Evaluation Assurance Levels
EAL 1 & 2 - Simple
EAL 3 & 4 - Methodically tested
EAL 5 & 6 - Semi-formally designed
EAL 7 - Formally designed and tested
147
On my network, I run SCANS
Six types of Firewalls
Internal Segment: Placed between two internal segments of a network. Operates on layer 3 and up
Static Packet: Looks just at packet headers and applies static rules. Operates on layers 3 and 4
Circuit Level: Just creates a secure connection to another host. Does NOT look at packets. Operates on layer 5.
Application: Sits in front of an application and makes sure only sessions and protocols used for the application are used. Operates on layer 7
NGFW: The most advanced type of firewall that does UTM (unified threat management) including IDS/IPS, deep packet inspection, malware detection, and many other proprietary functions. Operates on Layer 3 and up
Stateful Packet Inspection: Looks at the context of the packets and sessions. Operates on layers 3 and 4
148
eDiscovery II PCP RAPP
eDiscovery Process
Information Governance: Formatting information to be included in the eDiscovery process
Identification: Finding relevant info
Preservation: Keeping info safe from deletion and modification
Collection: Centralizing info
Processing: The first pass and removing irrelevant info
Review: Attorney's reviewing and removing info that has attorney-client privilege
Analysis: Further review of info
Prodcution: turning over info to opposing counsel
Presentation: showing info in court
149
Patentent
A Patent is valid for 10+10=20 years
150
The BIA process is the PILAR of a BCP and DRP
BIA Process (This is from the Cybex, I've found conflicting info elsewhere so maybe skip this one)
Prioritize
Identify Risk
Likelihood Assesment
Analyze Impact
Resource Prioritization
151
If you don't remember the Fagan Inspection model you'll get a POP from MR. F
Software Testing
Plan
Objective
Preparation
Meeting
Rework
Follow-up
152
Cardinals sit on horizontal branches and you find degrees on your vertical thermometers
Database management
Cardinality refers to the number of tuples/rows in a table
Degree refers to the number of attributes/columns in a table
153
1)When Data move out of organization for any reason
= MOST Effective Protection Security is Encryption
154
2) When you introduce any new process /new Initiative
= Risk Assessment is most important
155
3) When you finalized any solution
= Most important thing is Cost and Security Effectiveness
156
4) Security Strategy you build First
5) Policy is Foundation
157
7) Top Down Approach follow when we implement any thing in the organization
8) BIA Drive BCP
158
9) Security Consider in Design Stage
10) Legal MUST be First to be Abide
159
11) Change Management Track Accountability
12) Incident Management reduce impact
160
13) Writing does not mean its happen go look and verify
4) Security Strategy you build First
