Módulo 06 - Resiliency and Site Security Flashcards
Define:
Environmental Design (Physical Security)
Security approach that uses the built environment to enhance security
List:
Environmental Design options
- Barricades and Entry/Exit point
- Fencing
- Lights
- Bollards (Coisa de ferro ou cimento controlado remotamente que impede a passagem de veículos)
List:
Lock types
- Physical
- Electronic
- Biometric
Define:
PACS - Physical Access Control System
Designed to control who can access specific locations within a building, essential to protect access badges (NFC cards)
List:
The use of AI and camera systems
- Motion Recognition
- Object Detection
- Drones/UAV
List:
Type of alarms
- Circuit
- Motion Detection
- Noise Detection
- Proximity
- Duress
List:
Types of sensors
- Infrared
- Pressure
- Microwave
- Ultrasonic
Acronym:
RFID
Radio Frequency ID
List:
Common Physical Attacks
- Brute Force
- Environmental
- RFID Cloning
What’s the fundamental concept in network monitoring?
Know which computer are the big receivers and senders of information in the network.
List
Network Monitoring Tools
ping
tracert/traceroute
pathping
netstat
route
arp
nslookup/dig
ipconfig/ifconfig
hping
netcat
IP scanners
nmap
Define:
Passive reconnaissance
Gathering information on the target with no direct interaction
List:
Passive reconnaissance methods
- Packet sniffing
- Eavesdropping
- OSINT - Open Source Intelligence
- Network Traffic analysis
Acronym:
OSINT
Open Source Intelligence
Define:
OSINT - Open Source Intelligence
Collecting data from public sources
Define:
Active reconnaissance
Gathering information on a target by probing and interacting
List:
Active reconnaissance techniques
- Port scanning
- Service enumeration
- OS fingerprinting
- DNS enumeration
- Web Application Crawling
List:
Type of reconnaissance
- Passive
- Active
List:
Target information to extract
- Security posture (Physical and network)
- Narrow the focus for attack
- Potential vulnerabilities
- Create a network map
List:
Reconnaissance tools
- OSINT framework
- theHarvester
- Shodan
- DNSenum
- curl and wget
- Scanless
- Nessus
Acronym:
IPS
Intrusion Prevention System
Acronym:
IDS
Intrusion Detective System
Define:
Intrusion Prevention System
Detects attacks and suspicious activity and automates responses to the malicious actitivity
Define:
Intrusion Detection System
Detect attacks and suspicious activity
List:
Threat traffic label
- Positive
- False positive
- Negative
- False negative
List:
Detection methods
- Signature-based
- Heuristic-based
List:
IDS/IPS implementation types
- Host-based H(IDS)
- Network-based (NIDS)
Acronym:
HIDS
Host-based IDS
Acronym:
NIDS
Network-based IDS
Define:
Trend Analysis
Consists on understanding an environment over time, identifying patterns.
Easily identifying false positives or unnecessary alerts.
Define:
Q: Protocol analyzer
A tool (hardware or software) used to monitor and analyze network traffic, also known as packet sniffer or network analyzer.
List:
Q: Common protocol analyzer tools
- Wireshark.
- Tcpdump.
- Ettercap.
- Dsniff.
- Cain and Abel.
- Windump.
Define:
Q: SecOps protocol analyzer usage
Identifies network vulnerabilities, such as malformed packets, open ports, or sensitive data sent in cleartext.
Define:
Q: System fingerprinting
Identifying a system’s operating system by analyzing how it responds to different types of network traffic.
Define:
Q: TCP handshake flags
Indicators within TCP packets that help identify the state of a connection during the handshake process.
Define:
Q: Packet sniffing
Using a protocol analyzer to capture and analyze network packets.
Acronym:
NIC
Network Interface Card
True or false:
A protocol analyzer is always capable of listening to every packet on the collision domain
False.
Except when the NIC is on p-mode (Promiscous mode)
Define:
Q: Network attack
A: A strategy or technique used by threat actors to disrupt or gain unauthorized access to systems via a network.
List:
Q: Stages of the cyberattack lifecycle
- Reconnaissance.
- Credential harvesting.
- Denial-of-service (DoS).
- Weaponization, delivery, and breach.
- Command and control (C2).
- Lateral movement and privilege escalation.
- Data exfiltration.
Define:
Q: Reconnaissance
A: The stage where threat actors gather information about the network, including host discovery, service discovery, and fingerprinting.
Define:
Q: Credential harvesting
A: Reconnaissance activity where attackers attempt to learn passwords or cryptographic secrets for authenticated access.
Define:
Q: Denial-of-service (DoS)
A: An attack that reduces the availability of a resource by overwhelming it with excessive requests or exploiting vulnerabilities.
Define:
Q: Distributed Denial-of-Service (DDoS)
A: A type of DoS attack launched from multiple hosts, often using a botnet to overwhelm the target.
Define:
Q: Command and control (C2)
A: Techniques and malicious code enabling attackers to remotely operate and maintain access to compromised systems.
Define:
Q: Lateral movement
A: The process where attackers move from host to host or network segment to escalate privileges and expand access.
Define:
Q: Data exfiltration
A: The unauthorized transfer of sensitive data from a system to an attacker’s remote machine.
Define:
Q: SYN flood attack
A: A DoS attack exploiting the TCP handshake by withholding the ACK packet, causing resource exhaustion on the victim
Define:
Distributed reflected DoS (DRDoS)
A DDoS attack where the attacker spoofs the victim’s IP, causing third-party servers to overwhelm the victim with responses.
Define:
Amplification attack
A reflected attack exploiting application protocols to force targets to respond with large amounts of data, consuming bandwidth.
List:
Protocols commonly targeted in amplification attacks
- DNS (Domain Name System).
- NTP (Network Time Protocol).
- CLDAP (Connectionless Lightweight Directory Access Protocol).
- Memcached.
Define:
Asymmetric threat
A situation where attackers achieve effective attacks despite having fewer resources than the victim.
Define:
Botnet
A network of compromised devices used by attackers to launch DDoS attacks or other malicious activities.
Define:
DDoS indicators
Traffic spikes without legitimate explanation, often mitigated with high-availability services like load balancing or cluster services.
Define:
On-path attack
A threat actor intercepts, monitors, relays, and potentially modifies communication between two hosts.
MITM - Man In The Middle
Define:
ARP poisoning
An attack using unsolicited ARP replies to associate the attacker’s MAC address with a target IP, redirecting network traffic.
Define:
DNS poisoning
A technique to compromise DNS name resolution by inserting false domain-to-IP mappings.
Define:
DNS client cache poisoning
Modifying a client’s HOSTS file to redirect traffic by placing false name-to-IP address mappings.
Define:
DNS server cache poisoning
Corrupting records held by a DNS server, often via spoofed responses to recursive queries or DoS attacks.
Define:
DNS-based on-path attack
A combination of ARP poisoning and spoofed DNS responses to redirect victim traffic to malicious servers.
Define:
Typosquatting
A technique where attackers create malicious sites mimicking legitimate ones to exploit users’ typographical errors.
Define:
Amplification attack (DNS)
An attack exploiting DNS protocol weaknesses to force a target to respond with a large amount of data, consuming bandwidth.
Define:
DNS attack indicators
Anomalies in DNS logs, such as spikes in lookup failures or communication with suspicious domains.
List:
Examples of DNS attack indicators
- Unusual DNS queries.
- Suspicious IPs or domains.
- DNS lookup failure anomalies.
Define:
Recursive DNS query
A query where a DNS server retrieves an answer from an authoritative server on behalf of a client.
Define:
Memcached attack in amplification
Exploiting the Memcached database caching system to perform large-scale DDoS attacks.
List:
Common DNS attack methods
- DNS poisoning (client and server).
- DNS-based on-path attacks.
- DRDoS attacks using DNS.
- Typosquatting.
Define:
Shellcode
A minimal program designed to exploit OS vulnerabilities to gain privileges or drop backdoors.
Define:
Credential dumping
Malware extracting credentials from files like SAM or processes like lsass.exe, or using DCSync to replicate domain credentials
Define: Persistence
A: A technique ensuring malware restarts after a reboot or logoff, often using registry keys, scheduled tasks, or WMI events
Define: Bash
A: A command shell and scripting language used in Linux and pre-Catalina macOS
Define: Macros
A: Scripts used in applications like Microsoft Office, often written in VBA, potentially opening shells for malicious attacks.
Acronym: VBA
A: Visual Basic for Applications.
Acronym: RAT
Remote Access Trojan.
True or False:
Python is unsuitable for developing malware because it cannot run on non-Windows systems.
False
Python can run on multiple operating systems, including Linux, macOS, and Android.
True or False:
PowerShell scripts require an executable to run, making them easy to detect.
False
PowerShell scripts can run directly in system memory, making them fileless and harder to detect.
True or False:
Macros are always disabled by default in all Microsoft Office versions.
False
Macros are disabled by default only in newer versions; users must manually enable them.
Define: Shellshock
A malware exploiting a flaw in Bash to inject malicious commands on Linux and macOS systems.
Define: Cmdlets
Tiny PowerShell scripts performing specific functions, often used to automate tasks in Windows.
Define: Python’s use in malware
A: Python is used to develop malware like RATs, allowing functions such as screenshots, remote webcam access, and web requests.
Q: Acronym: SAM
A: Security Account Manager.
Q: Acronym: WMI
A: Windows Management Instrumentation.
Define: Rainbow table
A: A precomputed table of passwords and their hashes used to quickly crack hashed passwords without brute-forcing.
Define: Salting
A: Adding random characters to the beginning or end of a password before hashing to create unique hashes and defend against rainbow attacks.
Define: Password spraying
A: A brute-force method where the attacker tries the same password across multiple accounts to avoid lockout policies.
Define: Dictionary attack
A: A password attack using a predefined list of common words and phrases to guess passwords.
Define: Social engineering
A: A manipulation technique where attackers exploit human behavior to obtain sensitive information, such as passwords
Define: Shoulder surfing
A: An attack where an attacker observes a user typing passwords or other sensitive information.
Q: Acronym: NTDS.DIT
A: Active Directory credential store.
True or False: Password spraying targets one account with many passwords to avoid lockout policies.
A: False: Password spraying uses the same password across many accounts to bypass lockout policies.
True or False: Salting hashes prevents rainbow table attacks.
A: True: Salting adds unique characters to hashes, making them immune to precomputed rainbow tables.
True or False: Dictionary attacks are ineffective against strong, complex passwords.
A: True: Dictionary attacks are only effective against weak, common passwords.
True or False: Online brute-force attacks are faster than offline brute-force attacks.
A: False: Offline attacks are faster since they do not interact with authentication systems or lockout policies.
True or False: A rainbow table must be generated for each specific hashing algorithm.
A: True: Different hash algorithms require distinct rainbow tables due to variations in hashing processes.
Define: Dumpster diving
A: A social engineering technique where attackers search through discarded items for sensitive information.
Q: Define: Offline password attack
A: An attack where password hashes are obtained and cracked without interacting with the authentication system.
Define: rcrack
A: A tool used to crack password hashes using rainbow tables
True or False:
Strong passwords are the best defense against brute-force and dictionary attacks.
A: True:
Complex, long passwords with mixed character types reduce the effectiveness of these attacks.
True or False:
Salting ensures two identical passwords produce different hashes.
A: True:
Salting adds unique values, making hashes distinct even for identical passwords.
True or False:
Lockout policies prevent all brute-force attacks.
A: False:
Password spraying and offline attacks can bypass lockout policies.
Acronym: Rtgen
Rainbow table generator
Acronym:
Rtsort
A program that sorts rainbow tables for binary search.
