Midterm Flashcards
confidentiality
Ensuring thatonly those who are authorized have access to specific assetsand thatthose who are unauthorized are actively prevented from obtaining access
Integrity
Ensuring that data have not been tampered with and, therefore, can be trusted. It is correct, authentic, and reliable
Availability
Ensuring thatauthorized users have timely, reliable access to resources when they are needed - networks, systems, and applications are up and running
Cyber Hygiene
Patch your systems regularly
Non repudiation
Only installed signed software updates
Data Integrity
Source code changes virtually undetectable
5 pillars of cybersecurity
- governance
- secure systems engineering
- tools development
- OCO/DCO
- Test and Eval
what is governance
policy regulations/compliance standards (NIST, IEEE) norms/conventions audits procedures leadership oversight best practices
2 roles of CISO
King/Queen of NO
Empowered CISO
king/queen of NO
success= compliance
auto response with NO
primary focus is prevent liability in event of breach
wraps self in blanket of policy documentation
Empowered CISO
Leans in to address risk
collaboration with team to seek solution
primary focus is enable the business/mission
governance best practice:
least privilege
The principle that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function
governance best practice:
2 person integrity
Requirement for multiple people to authenticate in order to perform certain administrative tasks
governance best practice:
network separation
Separation of network into separate mini-networks/segments with distinct security boundaries and protection profiles to limit ability to “pivot” from entry point
governance best practice:
enclave
A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.
Discussion: Where in the waterfall does cybersecurity usually enter in the system?
usually in realization : solution validation right before delivery
Discussion: Where SHOULD cybersecurity enter the system?
Operational need (before requirements)
Systems security engineering
specialty engineering discipline of systems engineering
applies scientific, mathematical engineering and measurement principles, concepts and methods to coordinate, orchestrate, and direct the activities of various security engineering and other contributing engineering specialties
offensive cyber operations (OCO)
Cyberspace operations intended to project power by the application of force in or through cyberspace.
Defensive Cyber Operations (DCO)
Passive and active cyberspace operations intended to preserve the ability to utilize friendly cyberspace capabilities and protect data, networks, net-centric capabilities, and other designated systems
Continuity of Operations Plan (CooP):
A predetermined set of instructions or procedures that describe how an organization’s mission-essential functions will be sustained within 12 hours and for up to 30 days as a result of a disaster event before returning to normal operations.
1-10-60 Challenge
Combating sophisticated adversaries requires a mature process that can prevent, detect and respond to threats with speed and agility.
To effectively combat sophisticated cyberthreats:
Detect intrusions in under one minute.
Investigate and understand threats in under 10 minutes.
Contain and eliminate the adversary from the environment in under 60 minutes.
Advanced Persistent Threat
Advanced Persistent Threat (APT) attack uses continuous, clandestine, and sophisticated hacking techniques to gain access to a system and remain inside for a prolonged period of time, with potentially destructive consequences.
Modeling the APT Attack
Five Stages of an Evolving APT Attack Gain Access Establish a Foothold Deepen Access Move Laterally Look, Learn, and Remain
APT: Gain Access
Like a burglar forcing open a door with a crowbar, cybercriminals usually gain entry through a network, an infected file, junk email, or an app vulnerability to insert malware into a target network
APT: Establish Foothold
Cybercriminals implant malware that allows the creation of a network of backdoors and tunnels used to move around in systems undetected.
The malware often employs techniques like rewriting code to help hackers cover their tracks.
APT: Deepen Access
Once inside, hackers use techniques such as password cracking to gain access to administrator rights so they can control more of the system and get even greater levels of access.
APT: Move Laterally
Deeper inside the system with administrator rights, hackers can move around at will. They can also attempt to access other servers and other secure parts of the network.
APT:Look, Learn, and Remain
From inside system, hackers understand how it works and its vulnerabilities
Harvest the information they want at will.
Hackers keep this process running indefinitely or withdraw once they accomplish a specific goal.
They often leave a back door open to access the system again in the future.
APT Attackers are Ninjas, not Tanks
Dwell Time: The time an attack goes undetected (i.e., the delta between intrusion and detection) around 90 min
Test & Evaluation: 3 types of testing
Test types:
Functional Testing:
Performance/Load Testing
Penetration Testing:
Functional Testing:
Test cases performed to confirm the system operates as it was designed/specified and meets all functional requirements – Availability and Integrity
Performance/Load Testing:
Test cases performed to confirm the system operates as it was designed/specified and meets performance requirements under a real or simulated load - Availability
Penetration Testing
Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)
Incident Response
Preparation Detection Analysis containment eradication/recovery post incident activity
Mitre Defend vs Incident response (how does incident response fit into mitre defend)
Harden -> preparation Detect -> Detection and Analysis Isolate-> Analysis and containment Deceive -> Containment Evict-> Eradicate and recover All Defend strategy -> post-incident activity
Incident Response step 1. Preparation
Without good preparation, any subsequent incident response is going to be disorganized and has the potential to make the incident worse.
Create incident response plan
Train the team
Acquire tools (altering systems, workflow apps, SIEM, ad hoc/automated reports) and make them available to the team
Prepping the environment for defense (hardening) and altering
Tourist to busker: How do you get to Carnegie Hall?
Busker: Practice, man. Practice.
Detection
Process where the organization first becomes aware of a set of events that possibly indicates malicious activity.
Depending on the size, an org may receive >100 million events per day.
Human analysts are inundated with data
Filter indicators of compromise (signals of interest) from records of legitimate actions (noise)
Security Incident andEvent Management(SIEM)tools lose effectiveness if heuristics not updated to identify potential incidents
AI/ML tools (e.g., Vectra.ai, Cylance, Darktrace, ExtraHop) are better than humans at detecting some incidents, but take time to learn what “normal” behavior is
Detection sources can include
Activity logs: A security analyst may receive an alert that a specific administrator account was in use during the time where the administrator was on vacation.
External sources: An ISP or law enforcement agency may detect malicious activity originating in an organization’s network and contact them and advise them of the situation.
I
nternal users: An employee contacting the help desk and informing agent that services are no longer available, or files are suddenly encrypted
Analysis
Personnel begin the task of collecting evidence from systems such as running memory, log files, network connections, and running software processes.
Depending on the incident, this can take a few hours or several days
Once the evidence is collected, data are be examined
Analysts attempt to ascertain what happened, what it affected, whether any other systems were involved, and whether any confidential data was removed/altered/destroyed
Determine the root cause of the incident and reconstruct the actions of the threat actor from initial compromise to detection
Containment
Organizations take measures to limit the ability for threat actors to continue compromising other network resources, communicating with command and control infrastructures, or exfiltrating confidential data
Alter system configuration: lock down ports and IP addresses on a firewall, applying security updates, even removing the network cable from the back of an infected machine
Have several options available to allow for flexibility in response
Stop the bleeding at the source if you can
Respond as quickly as possible to limit damage done
Eradication and recovery
Organization removes the threat actor from the impacted network
Organization may run an enhanced anti-malware solution
Infected machines may be wiped/reimaged or fresh OS installed
Remove or change compromised user accounts; ensure no new user accounts created by threat actors
Apply security patches
Restore to last known good backup
Comprehensive vulnerability scan
Steps align withbusiness continuity / disaster recovery
Post-incident activity
Complete review of the incident with all the principal stakeholders
Review of all the actions taken during the incident
Retrospective: What worked, and more importantly, what did not work, lessons learned
Written report: detailed and clear, focus on root cause and cause-effect relationships
Avoid jargon (or explain terms)
Vet language with contracts/legal to ensure compliance with regulatory and statutory requirements
What is the value of a thorough incident response process
CY6: cover for legal liability
Minimize risk of future breaches
Understand the risk
Build the “right” culture – problem solving vice blame, be aware of our surroundings
Incident response coordinator:
Individual often has overall responsibility for the security of the organization’s information; responsible for management of the CSIRT prior to, during, and after an incident
Chief Security Officer (CSO)
Chief Information Security Officer (CISO)
Information Security Officer (ISO)
CSIRT senior analyst(s):
Personnel with extensive training and experience in incident response, digital forensics, network data examination
Often take part in training junior personnel
Engage with other CSIRT members to acquire and analyze evidence, direct containment activities, and assist other personnel with remediation
CSIRT analyst(s):
Personnel with CSIRT responsibilities that have less exposure or experience in incident response activities
Take part in reviews and updates to the incident response plan
Gather evidence from potentially compromised hosts, network devices, or log files
Take part in analysis of evidence and assist team in remediation activities
Data scientists, network admins who want to roll into Cybersecurity
Security operations center analyst:
Analysts assigned to the 24/7Security
Operations Center(SOC) monitoring capability; serve as the point person when it comes to incident detection and alerting
In-House SOC
Outsourced: On-premises contractors, Remote monitoring, SOCaaS
IT security engineer(s) / analyst(s):
Personnel tasked with deployment, maintenance, and monitoring of security software or hardware
Preparation component of the incident
response process
Ensure security applications (e.g., antivirus) and devices (e.g., firewalls, SIEM) are properly configured to alert to possible incidents and to ensure devices properly log events to support post hoc analysis / reconstruction
Tech support personnel
May not be formal members of CSIRT, but have expertise or access to systems / processes that may be affected by an incident Network/Server Administrators Application Support Desktop Support Help Desk
Why is alert tuning critical
causes alert fatigue
Thousands of alerts emanating from security tools across the enterprise - it’s easy to become overwhelmed and miss important threats
Component configuration
mismatch control to threat need to devote time and resources to implement security controls that are irrelevant to the threats the organization is trying to mitigate
Mismatching Control to Threat (examples):
Using firewalls to prevent data theft from applications that are allowed to operate through the firewall
Using standard antivirus tools that to protect against zero-day attacks, APT
Using controls at the operating-system level to detect application-layer attacks
Using ingress-only firewall rules to protect against data exfiltration
Organizational support personnel
Assist with a variety of non-technical issues that fall outside those that are addressed by the CSIRT core and technical support personnel Legal Human Resources Marketing / Communications Facilities Corporate Security
What is an Incident Response Playbook
A well-documented IR Playbook contains clear steps/roles and responsibilities: Preparation Detection Analysis Containment Eradication Recovery Post-incident Activity
