Principles of Cyber Security Flashcards

Question

CAPEC

Answer 1

An Attack Technique Knowledge Base Describes common techniques employed by adversaries Focuses on application security by enumerating exploits against vulnerable systems (including Social Engineering and Supply Chain Attacks) CAPECxploits. Lists exploits of vulnerable systems

Answer 2

An Attack Technique Knowledge Base Describes phases in an adversary's lifecycle and specific TTPs that APTs use. Focuses on network defence by providing a contextual understanding of malicious behaviour. Focuses on adversaries interactions with the system, not the tools used ATT&ACK P T

Answer 3

Tactics, Techniques, and Procedures

Answer 4

A UK cybersecurity certification scheme designed to help businesses protect themselves against the most common cyber threats

Answer 5

Ensure only necessary network services can be accessed from the internet to reduce exposure to attacks All inbound connections are blocked by default except those towards services meant to be accessed from the internet and every inbound rule that accepts connections must be motivated and documented

Answer 6

Ensures devices are configured to reduce vulnerabilities and provide only strictly required services All unnecessary software is removed/disabled, auto-run features are disabled, default/guessable passwords are changed

Answer 7

Ensures user accounts are only for authorised individuals and only provide access to required resources Requires - Setup of a process and approve a new user account - Always authenticate users before granting access to applications and devices - Remove/disable accounts when no longer required - Use 2FA - Use admin accounts only for admin activities

Answer 8

Ensures untrusted software is restricted and known malware is restricted Requires - Anti-malware software that is up to date with daily checks. It should automatically scam when files are downloaded, opened, or accessed from a network folder. Web pages should be automatically scanned with blacklisting of malicious and suspicious websites - Application whitelisting - Application sandboxing for code of unknown origins

Answer 9

Ensures devices and software are not vulnerable to known security issues for which fixes are available All software is updated, licensed and supported

Answer 10

Encrypt, fragment, backup, sanitise data to prevent data leaks

Answer 11

Have more than one person required to complete a critical task. More accounts need to be compromised to undermine it

Answer 12

Split up network infrastructure based on business process, necessary exposure and risk levels. Firewalls used between boundaries Use intrusion detection systems to observe network traffic and detect malicious traffic. Signature or anomaly based Machine learning helps with accuracy Can suffer from false positives

Answer 13

Decoys to lure in attacks for analysis High-Interaction Honeypots: Close mimic, extensive interaction & analysis Low-Interaction Honeypots: Simulate a few services, reduces risk of compromise

Answer 14

Authorised attacks aimed at identifying how an attacker can compromise the system

Answer 15

Penetration Testing Execution Standard Comprehensive framework for effective and consistent pentesting

Answer 16

Guide security principles Efficient for driving adoption Compliance-driven security risks shifting focus to meeting regulations rather than tackling security risks, giving a false sense of security

Answer 17

Reconnaissance Initial Compromise Post-Exploitation (Repeated until goal accomplished)

Answer 18

Achieved through malware (backdoors, rootkits, remote access trojans (RATs), keyloggers) or stolen credentials (allowing maintained access if other vulnerabilities are patched)

Answer 19

Encrypt data using non-standard communication protocols or use innocent-looking traffic to hide malicious activity

Answer 20

Attacker sends commands to C&C control hub which relays them to the compromised system

Answer 21

Attacker leaves commands at the hub, the compromised system periodically polls the hub, the machine leaves outputs at the hub and the attacker periodically polls the hub

Answer 22

Seek new systems to compromise within the network via analysis of compromised machines (to gather credentials), network analysis (to find targets), and stealing credentials (using social engineering)

Answer 23

Exfiltrate sensitive information to an external system. Staging servers can accumulate and transform data to reduce data size and help avoid detection. Faster transfer speeds risk detection Data is hidden in other data using steganography, the practice of hiding information in other data

Answer 24

The practice of secure communication in the presence of an adversarial third party

Answer 25

The same key is used to encrypt and decrypt data. Requires N(N-1)/2 keys

Answer 26

A sender encrypts data using the recipients public key and the recipient decrypts the data using their private key. Requires N x 2 keys where N is the number of communicating nodes

Answer 27

Used to verify the authenticity and integrity of data. Generated by creating a hash of the data and encrypting the hash when transferring the data. The recipient can then decrypt the hash and the data and compare the received data’s hash with the received hash.

Answer 28

To send a private key, asymmetric (public key) encryption. The recipient can send a public key used to encrypt the data. Vulnerable to Man in the Middle Attacks where the adversary intercepts the public key from the recipient and sends it on their own to the sender.

Answer 29

Two parties agree on public parameters including a large prime number and primitive root modulo. Uses a property of modulus to send the keys Susceptible to Man in the Middle Attacks

Answer 30

Recipient needs to know with certainty the sender’s public key to validate a digital signature or to encrypt messages so they can avoid man in the middle attacks

Answer 31

Consist of a public key and a user ID both signed by a trusted third party

Answer 32

The infrastructure needed to create, manage, distribute and revoke digital certificates to enable secure and efficient acquisition of public keys

Answer 33

Certification Authority Responsible for issuing, distributing, and revoking public key certificates. The CA uses a well-protected private key to add a digital signature to mark it as authentic. User’s have public keys for the CA’s digital signature built into operating systems

Answer 34

Registration Authority The CA uses the RA to authenticate applicants for digital certificates

Answer 35

Stores all certificates

Answer 36

stores certificates revoked before the scheduled expiration date. It is not issued frequently enough to be effective against attackers. It is expensive to distribute and vulnerable to DoS attacks Certificates can be revoked because of - Compromised Private Key - Expiration - Human Resources - Changes to Company Name, Physical Address, DNS

Answer 37

A widely accepted standard format for digital certificates. Instead of CRL, the Online Certificate Status Protocol (OCSP) is used to query if the certificate is still valid

Answer 38

Use of psychological manipulation to deceive people into compromising security or divulging sensitive information

Answer 39

Reasons to comply * Friendships * Commitments / Consistency * Scarcity (Exclusive opportunity) * Reciprocity (Obligation to return a favour) * Social Validation (Admiration of other’s actions) * Authority (Requests from those with power)

Answer 40

* Direct Communication * Bidirectional Communication: Both target and attacker exchange information * Unidirectional Communication: Only attack communicates * Indirect Communication: Attacker uses third-party channels to communicate such as fake website

Answer 41

Information Gathering: Gathering of personal information for malicious purposes, gathered from: * Company Websites * Social Networks * Dumpster Diving * Shoulder Surfing Prevented by using shredders and educating employees on being aware of their social presence Interaction with Target: Contacting the target to establish trust or instil fear * Phishing: Fraudulent emails designed to trick recipients into divulging sensitive data * Spear Phishing: Targeted phishing * Whaling: Spear phishing of high-level individuals with access to company funds * Vishing: Voice Phishing e.g. fraudulent bank call * Smishing: SMS Phishing Physical Impersonation: Attacker impersonates maintenance worker, delivery driver, etc. Prevented by filtering emails by analysing links, spelling, grammar. Not downloading attachments. Not providing personal information. Education, be wary of demanding language Tailgating: Attacker follows someone with legitimate access into a restricted area Baiting: Attacker offers incentive such as a USB drive to entice the target into downloading malware

Answer 42

* Cost-Effective: Cheap, openly available tools instead of expensive troops and weapons * Anonymity: Use of false IP addresses, foreign servers, and aliases make tracing attack origins difficult * Attribution is Near Impossible: Attacker has plausible deniability, claiming their computer has been hacked * Cyber Deterrence: Retaliation against the wrong actor is unjust and could be a crime of war * No Casualties * Disruption over Destruction * Extremely Quick * Hard to Detect & Neutralise * Exploitable Vulnerabilities Increase as Technology Evolves

Answer 43

Stores public/private keys required to access and manage funds

Answer 44

* Public keys generate addresses used to receive payment * One address per payment, so that the amount of information publicly available on a user is reduced * Provides pseudo-anonymity

Answer 45

References to previous transactions. Must not already be spent, tracked Unspent Transaction Outputs (UTXOs) against a wallet

Answer 46

Determine where bitcoins will be sent

Answer 47

* Transactions are digitally signed to prove ownership and ensure integrity before being broadcast across the bitcoin network. Nodes then verify the digital signature and the funds required, the transaction is then included in blocks by miners. * Transaction blocks have a reference to the hash of the previous block. Changing any block would require updating all subsequent blocks

Answer 48

Decentralised, trustless, pseudo-anonymity, immutable transaction history

Answer 49

High transaction fees reduce profits and makes it less attractive to customers, slow transaction confirmation, not a stabilised currency, lack of regulations