Security + Flashcards
what are the three parts to any form of authentication ?
Identification - usually a username
Password - or something you know
Authorization - what you can do
what is MFA ?
more than one factor to authenticate
what are the different factors that can be used when authenticating someone with MFA
something you know, password
Something you have, keyfob
Something you are - biometrics
what are some of the different authentication attributes ?
Something you do
Your signature
Something you exhibit
Typing speed
Someone you know
Certificates from a server
Somewhere you are
Physical location
what is identification ?
claiming an identity
what is authentication?
proving an identity
what is authorization?
permitting specific actions once a user has been authenticated
what does it mean when we hear the word accounting in security ?
essentially auditing, we want to be able to account for or audit the activity that the user executed when they were signed in
when can authorization occur ?
authorization can only occur after the authentication
what do we need to do proper accounting and auditing ?
To do these we need to have separate user accounts or else it will look like the same user id doing everything
what are some different type of auditing ?
Resource access, such as signings into a system
Failed login attempts
Changes to files or database records, has it been tampered with ?
why is username and password security risky ?
Security risk because they are both something you know and can be guessed
Mitigation for this is to use different passwords for different resources
what is a password vault ?
A way of storing passwords something like last pass is an example of this
what are the characteristics of one time passwords ?
- Unique password generated for single use, static code sent via email or SMS text
- TOTP stands for time-based one-time password,
○ this means the password is only valid for a certain amount of time - HOTP stands for HMAC one-time password
HMAC encrypts a hash to ensure authenticity
- TOTP stands for time-based one-time password,
what are the characteristics of certification based authentication ?
PKI certificates are issued by a trusted authority to an individual entity
what are the characteristics of SSH public key encryption
This means you would sign in with a username and password as well as a private key
The public key is stored on the server
The private key is stored with you on your station
what are some of the characteristics of bio metrics ?
- This is something that is unique to you as an individual
- Fingerprints
- Retina scan
- Iris scans
- Facial recognition
- Voice recognition
- Vein analysis
- Gait analysis how you move or walk
what are some mistakes that can happen with biometrics ?
False acceptance - makes a mistake
False rejection rate
Cross over error rate
what are some of the characteristics of credential policies ?
defines who gets access to what, like what employees get access to what in an ORG
- We might have a credential policy that is related to contractors
- Device policies, example need to use a VPN tunnel
- Credential policies for service accounts
We can have credential policies for administrator or root accounts, this is sometimes called PAM or privileged access management
what is attribute based access control ?
Looks at the attributes of a user or device to determine what permissions they have to a resource Example Date of birth, or maybe we will look at the device type
what is role based access control ?
A role is a collection of related permissions
Example we could create a roll to have someone access files in the cloud
What is rule based access control ?
Uses conditional access policies
For example have to be signed in using MFA have to be using an iPhone have to be signing in from Canada
what is Mandatory access control ?
- We assign labels or identifiers to resources
○ Devices, files, databases, network ports etc
- Permission assignments are based on resource labels and security clearance
what is discretionary access control ?
Data custodian sets permissions at their discretion
what are some things we can use for Physical access control
- Limited facility access
- Vestibules
- Door locks
- Proximity cards
- Key fobs
What are some best practices for account management ?
- We should assign permissions to groups
- Principle of least privilege should be assigned to user accounts
- Audit user accounts
Make sure to disable user accounts when they are terminated or leave
what are some different types of account policies ?
- employee onboarding policies
- Password policies
○ Here we can define password complexity policies
○ Password history - Account lockout policies to protect against bruteforce attacks
- Geolocation
○ Where a user is located - Geofencing
○ Users geolocation determines resource access - Geotagging
○ Adding location metadata to files and social media posts - Impossible travel time
Moving locations so fast it’s impossible
- Password policies
where are public keys stored on a linux machine ?
User home directory on the Linux server. SSH public keys must be stored on the server in the user home directory in a file called “authorized_keys”
what is geotagging ?
Geotagging uses GPS coordinates or IP address block information to add detailed location information to social media posts and pictures.
what are some of the different network authentication protocols ?
Pap or password authentication protocol
MS-Chap Microsoft challenge handshake authentication protocol
NTLM Microsoft new technology Lan Manager NTLM
Kerberos
EAP
IEEE 802.1x
Radius
what are some of the characteristics of PAP ?
Outdated
Sends passwords in the clear over the network
what are some of the characteristics of MS-Chap ?
Client requests authentication from a server
Then the server sends a challenge to the client
Client responds to challenge by hashing the response with a users password
Server compares response to its own computed hash and authenticates if they match
what are some of the characteristics of NTLM ?
NTLM is used on workgroup computers
A workgroup computer is one that is not joined to an active directory domain
Password hashes with NTLM are not salted
NTLM v2 passwords are salted
what are some of the characteristics of Kerberos ?
Microsoft active directory authentication
Kerberos uses a key distribution center or KDC
Authentication service AS
Ticket granting service TGS
Ticket Granting Ticket TGT
Once you are authenticated you are granted a ticket from the ticket granting service , that ticket is what you present when you try to access resources in the AD domain and if you should have access to that resource you get let in without having to sign in again
what are some of the characteristics of EAP ?
Network authentication framework
Lets us authenticate using more methods
PKI certificate authentication
Smart card authentication
Often EAP uses TLS as a transport mechanism
Applies to wired and wireless networks
what are some of the characteristics of IEEE 802.1x ?
port based network access control
This protocol hands off authentication to a centralized RADIUS server for authentication
This applies to wired and wireless network edge devices
The devices that can authenticate users to the network include
Ethernet switches
Routers
VPN appliances
what are some of the characteristics of RADIUS ?
centralized authentication server
This could be a domain controller
○ Radius clients are network edge devices
§ Network switches
§ VPN appliances
§ Wireless routers
We call actual users trying to connect to the network the radius supplicant
what are the characteristics of single sign on ?
- User credentials are not requested after initial authentication
- Protocols used with single sign on
○ OpenID
○ Oauth
- Protocols used with single sign on
What are the characteristics of identity federation
- Identity federation is when multiple resources trust a single authentication source
○ With this we have a centralized trusted identity provider IDP- Protocols we can use with identity federation
○ Security assertion markup language SAML
A Saml token is a digital security token that proves your identity
- Protocols we can use with identity federation
explain a virus
Program that can replicate through user interaction
Activates once a user clicks or downloads
what is a file-less Malware or Virus
No file lives only in memory
Difficult for anti malware to detect
explain Ransomeware
Also known as crypto malware and crypto ransomware
Uses encryption to lock a user out of a system
Attacker hides your data until you pay your Ransome
explain a worm
A virus that once it gets started will use networking or the internet to self-replicate
More like a pathway for replication
explain a trojan horse
A program that looks like one thing but does another usually nefarious
No replication
Remote access trojans or RAT’s
Maliciously takes control of a system remotely
explain a backdoor
Created by developers as an easy maintenance entry point
Can be exploited by attackers if left open by developers
Can be created in a program by hackers to gain access
explain a PUP or potentially unwanted program
Software that may have negative or undesirable effects
Crapware adware spyware bloatware
what are the characteristics of Bots/Botnets
Distributed attack using remotely-controlled malware controlling several computers
Often running some kind of RAT
Hosts are called bots or zombies
One kind of Botnet is a distributed denial of service attack or DDOS attack
Trying to overload traffic from a number of sources that makes resources unavailable for legitimate users
Usually have a C2 or command or control
what is a key logger
Can be hardware
Device that plugs in between keyboard and computer to log keystrokes
Can be software
Programs that logs keystrokes
what is a rootkit
Can often be somewhat invisible
Goal to get root access to the system
Usually installed on the boot of the systems they are attacking
what is a logic bomb ?
Often a script is set to execute
Created with a timer to go off at a specific time or during a specific event on a system
what are some bad security configurations relating to open permissions ?
Open wireless networks
guest user accounts, we need to disable these
No intruder lockout settings, nothing to block failed logon attempts
Too many file or app permissions assigned by default
what are some security best practices for linux instances
Don’t sign in with a root account
Use sudo to run privileged commands
Disallow remote access as root
Use su to temporarily switch to root
what are some insecure cryptographic solutions
WEP is weak
DES digital encryption standard
Use AES instead
Secure Sockets Layer
Use TLS
SSL uses a PKI certificate for encryption
TLS
Not secure 1.0 and 1.1
Secure versions 1.2 and 1.3
what are some security settings to be aware of with default settings ?
Change IP address
Don’t have ports open that don’t need to be listening
Don’t install everything in the default space with a webserver
Don’t use usernames and password that come default
what are some characteristics of zero day attacks ?
An exploit unknown by the vendor and the public
ZDI zero day initiative
This encourages the private reporting of vulnerabilities to vendors
what are some common attacks ?
DNS sinkholing
Privilege escalation
Replay attacks
Pointer / object dereference
Error handling
Dynamic link Library DLL injection
Resource Exhaustion
Race condition
Explain DNS sinkholing ?
This attack returns false DNS query results
explain privilege escalation
Attacker acquires a higher level of access
Example - compromising an admin account that has a weak password
Explain replay attacks
Capturing something that happens on the network and replaying it
Common in MITM attacks
what is Pointer / object dereference
Attacker manipulates memory pointers to point to unexpected memory locations
Normally causes software to crash
what is error handling
Improper handling can crash a system
These errors might disclose to much information
explain Dynamic Link library
Attacker places malicious DLL’s in the file system
Legitimate running processes call malicious code within the DLL
what is resource exhaustion
Dos or DDOS
Can result in memory leaks
explain a race condition
Actions might occur before security control in in effect
These are based on timing
what are two driver attacks
driver shimming
driver refactoring
what is driver shimming ?
Normally used to allow legacy software to run
This can be installed by a malicious user
If an attacker has access to a device they can install malicious drivers
This can happen in the supply chain injected in the software development stage
Intercept API calls to run the malicious code
explain driver refactoring
Restructures internal code while maintaining external behavior
Can evade signature based AV
what are two types of overflow attacks ?
integer overflow
Buffer overflows
what is an integer overflow ?
Less memory than expected is allocated
This can lead to
Sensitive information disclosure
Remote exploit privilege escalation
Application crash
what is a buffer overflow
Less memory than expected is allocated
This can lead to
Sensitive information disclosure
Remote exploit privilege escalation
Application crash
what are the two different categories of password attacks ?
Online vs offline attacks
what are some tools for password cracking ?
John the ripper
Cain and Abel
Hydra
what is a password dictionary attack ?
Uses common username and password files
Tries thousands or millions of likely possibilities to login to a user account
what is a brute force attack ?
Try every possible combination of characters
Multiple attempts should trigger an account lockout
explain what password spraying is
Blast many accounts with a best guess common password before trying a new password
Slower than traditional attacks
Less likely to trigger account lockout settings
what are the characteristics of bots or botnets
Bot - single infected device under attacker control
Botnet - collection of infected machine under control
how are bots controlled in a botnet?
Periodically talks to a command and control C2 attack server
We can mitigate this with IDS
Attackers might have directions stored in a DNS TXT record
explain a raid
Group disks together to work as one
We would do this for better performance
Provides high availability
Hardware Raid controller
Software Raid
This is slower and less reliable than software RAID
what is a storage area network ?
Storage out on a network
what is RAID 0
The benefit of raid 0 is better performance
what is Raid 1 ?
Data in its entirety is written to two sperate disks
We get better performance with this
We also get higher availability because if one disk fails the other one is up to date
what is Raid 5 ?
Better performance
Parity is stored on separate disks
If one disk fails we can use the parity info on the other disks to rebuild the disk
what is RAID 6 ?
Requires at least 4 disks
Stores 2 parity stripes on each disk
This means raid 6 can tolerate two disk failures
what is raid 10 ?
This is a combination of Raid level 1 and 0
Disk mirroring then disk stripping
Requires at least 4 disks
what are some ways we can secure hardware ?
Limit physical access to the servers or hardware
Alarms, sensors, locks
Card cloning / skimming
Use vendor diversity
Limit USB storage device use
Apply firmware updates
Use USB data blocker
Allows recharging but not data transfer
explain what TPM is
Used as basis for hardware root of trust
This check for boot integrity of the machine
UEFI secure boot
Has the boot order changed ?
Check the hash of each file to make sure it matches that of the vendor
Can encrypt and decrypt disk volumes and store keys in the TPM
Microsoft Bitlocker is an example of this
what are some reasons a machine has failed to boot
Causes
Corrupt OS file
Malware
Failing disks
Misconfiguration
Remediation
Boot from alternative media
Live boot media
Revert to known state or last known good configuration
how can we achieve hardware redundancy ?
RAID
NIC teaming
UPS
PDU
How can we achieve cloud redundancy ?
Multiple network connections to the cloud
Load balancing
Cross region storage replication
what are some of the different ways we can secure endpoints ?
EDR
Host based firewall
NGFW
Allow lists
what is EDR or endpoint detection and response ?
Alarms for detected anomalies or malware infections
what is a HIDS or host intrusion detection system
Looks for suspicious activity
Analyze log files
Detect and alert on anomalies
explain the characteristics of a NGFW
Packet filtering firewall
Up to OSI layer 4
Deep packet inspection firewall
Up to OSI layer 7
IDS/IPS built in
explain what the physical layer does
- What cabling do we use
- What frequency do we use with wireless
Getting 1s and 0s from one layer to another
- What frequency do we use with wireless
what does the preamble do in an Ethernet frame
Preamble in an Ethernet frame warns the network card that there is an incoming frame
what is the purpose of the data link layer
Allow individual systems to address ethernet frames and send them to the right spot based on MAC address
The data link layer checks out the source destination parts of the ethernet frame
what is the point of the network layer
MAC address’s are great for moving data on individual systems on a LAN
But when you need data to leave the LAN you use logical addressing like IP addresses
This layer inspects the destination and source IP address
what is the point of layer 4 the transport layer
The transports layer job is to assemble and disassemble packets as they come in
what is the point of layer 5 the session layer
this is where the connections are established
what is the point of layer 6 the presentation layer
used for converting data and encoding it
what is arp used for in a network ?
used to map IP addresses in a network
ARP traffic is really only local to the LAN
what are the characteristics of ARP cache poisoning
- type of man in the middle attack
- a malicious actor has to have access to the network
- Victim traffic is sent through the attacker station
- Attacker can view the victim traffic
what are the steps of an arp poisoning attack
- Attacker has gained access to the network
- Attacker sends a request saying please update your ARP cache for the IP change the mac address to my attacker machine
- Victim devices update their arp cache
what are the mitigations for arp cache poisoning
- Use static ARP cache entries
a. This means hosts will not accept ARP cache updates- Limit access to the network
a. Use MFA
b. Use NAC network access control
c. Limit based on device type
- Limit access to the network
what are the characteristics of a mac address flooding attack
- attacker sends traffic with forged source MAC address’s to a switch port.
- Switch memory is filled, new incoming traffic is sent out to all switch ports
what are broadcast storms or switching loops
- Excessive amounts of broadcast traffic on a network
- Caused by Failing equipment
what are some layer 2 attack mitigations ?
- Mac address filtering for network access
- Static MAC address assignments
- Disable unused switch ports
explain the zero trust security model ?
- internal network should be untrusted
- Make sure employees can recognize scams
- Use a network IDS/IPS for internal network
explain network configuration management
- Network and data flow diagrams
○ Need to know what we have so we can deal with security incidents- Standard naming conventions
IP address ranges need to be mapped and consistent
- Standard naming conventions
explain a screened subnet ?
- Some people call this a DMZ
- Public services are in the DMZ
- Firewall rules must be configured for this to work.
○ Only allow HTTPS from the internet to the DMZ web server
- Rules blocking traffic from the internet from getting farther into our internal network
what are the key elements of load balancing ?
- Increases service availability
- Improves service performance
- Load balancing is multiple backend servers providing the same service
- Load balancing can also use horizontal scaling which is adding more VM’s as the load increases
- Session persistence
○ Clients remain connected to the same backend server - Active / Active
○ All servers are up and running at the same time
○ Round / Robin
▪ Each request goes to the next backend server
○ Least connections
▪ Each request is sent to the least busy backend server - Active/Passive
○ Backend server status
▪ Some are active some are in a standby state
A standby server is activated when an active server fails
explain network access control ?
- Limit endpoint access to a network
○ We can limit by OS type
○ We can see the device location and where the connection is coming from
○ Make sure there is a host based firewall
○ Make sure that the AV is up to date - Nac can be agent based or agentless
what is IEEE 802.1x
- Port based network access control
802.1x is configured to send authentication request to a radius server
what is the mitigation for rogue DHCP servers
- DHCP snooping can block rogue DHCP servers
○ Untrusted DHCP server responses are blocked- DHCP snooping is enabled on network switches
- This means we specify trusted DHCP ports
- DHCP snooping is enabled on network switches
whats a jump server ?
- Also called jump box or bastion host
- Has a public interface for us to connect to and a private interface for connecting to internal hosts
- Jump servers sit between server admins and target servers
- Has a public interface for us to connect to and a private interface for connecting to internal hosts
what is a honeypot ?
- A decoy system or server made to look vulnerable so we can track attacks against it
- Only deploy a honeypot on an isolated network
- Implement logging so we can track the attacks
what is a honey file ?
- Fake files made to look attractive to hackers
Implement logging to see what actions are taken on the file
what is a honey net?
a honeynet is a network of honey pots
what are the basics of firewalls ?
- Hardware appliance
- VM that acts as a firewall
- Host based firewall
- Firewalls essentially allow or deny incoming / outgoing traffic
- Firewalls use access control lists
what is a packet filtering firewall ?
- This applies to OSI layer 4 or the transport layer
- Stateful firewall track entire sessions instead of only individual packets
- Packet filtering firewalls can be based on
○ Source / destination port numbers
○ Source / Destination IP addresses- MAC addresses
what is a content url filtering firewall
- Runs on OSI layer 7
- Rules can be based on
○ The direction of the traffic incoming vs outgoing
○ Packet filtering firewall conditions
○ These firewalls can look at specific protocols
- Rules can be based on
what is a waf ?
- OSI layer 7
Protects against common web application attacks
what layer of the OSI model do packet filtering firewalls apply to ?
OSI layer 4
what layer of the OSI do content URL filtering firewalls apply to ?
OSI layer 7
what do web application firewalls protect against ?
common web app attacks
what is a forward proxy ?
- fetches internal content for internal users
- Hides IP address of internal machines, the machines make the request to the proxy server and the server makes the request for them
- user device uses the proxy as the default gateway
- another benefit of a proxy is fetched content can be cached this speeds up subsequent requests
what is a reverse proxy ?
A reverse proxy is a type of proxy server. Unlike a traditional proxy server, which is used to protect clients, a reverse proxy is used to protect servers. A reverse proxy is a server that accepts a request from a client, forwards the request to another one of many other servers, and returns the results from the server that actually processed the request to the client as if the proxy server had processed the request itself. The client only communicates directly with the reverse proxy server and it does not know that some other server actually processed its request.
how would you describe a forward proxy ?
forward proxy fetches internal user requesting content from the internet and interal client IPs are hidden
forward proxy enables computers isolated on a private network to connect to the public internet,
how would you describe a reverse proxy ?
Reverse proxy provides external user access to internal services and internal server IPs are hidden
what is port address translation ?
- This can be a hardware or software solution
○ This is normally enabled on a router
○ It can also be called PAT or NAT gateway- Multiple internal IP’s share a single public IP
Requests are tracked by internal IP and unique port number
- Multiple internal IP’s share a single public IP
how do PAT routers remember where things are ?
pat router maintains a table in its memory
what layer does NAT operate at
OSI layer 4
what layer does a reverse proxy operate at ?
OSI layer 7
explain PAT
pat enables multiple internal clients to gain internet access using a single public IP
explain NAT
NAT maps public IP’s to private IPS to allow external clients access to servers
what is IPSEC ?
- suite of network security protocols
- IPSEC has to do with network traffic encryption and authentication
- IPSEC can be configured to secure some network traffic or all network traffic
what is IPSEC tunnel mode
- Normally used for site to site VPN’s
- With IPSEC tunnel mode the entire original packet is encrypted and placed inside a new IP packet
A new IP header is added when the packet is encapsulated
- With IPSEC tunnel mode the entire original packet is encrypted and placed inside a new IP packet
what is IPSEC transport mode ?
- Normally used for host to host encryption on a LAN or WAN
- In transport mode the original packet header doesn’t get changed like it does in tunnel mode, there is also no packet encapsulation
With transport mode we protect traffic by encrypting it
- In transport mode the original packet header doesn’t get changed like it does in tunnel mode, there is also no packet encapsulation
what is the AH or authentication header used in IPSEC ?
- This provides us with integrity and origin authentication
- This is done with hashing algorithms
The entire IP packet is authenticated with this mode
- This is done with hashing algorithms
what is the ESP or encapsulation security payload in IPSEC?
- With this mode we get integrity and origin authentication
- We also gain confidentiality through encryption with this mode
Only the packet payload or data within the packet is encrypted
- We also gain confidentiality through encryption with this mode
what are two VPN tunneling protocols ?
- Layer 2 tunneling protocol L2TP
○ Normally uses IPsec to provide encryption- TLS
○ Firewall friendly vpn solution because it uses 443
-With this you access resources through a web browser
- TLS
explain the characteristics of a client to site remote access VPN ?
- Individual client devices that makes a secure connection to a remote network
○ Working from home
○ Traveling
- Client device requires a VPN software to establish the connection
what are some common VPN configuration options?
- Always on VPN
○ VPN tunnel is established if device is internet connected
○ This helps with deploying updates- Split tunnel
○ Requests for remote network resources go through the VPN
- Other requests use client internet connection
- Split tunnel
what is a site to site VPN ?
- Securely link sites together over the internet
- For this to work each site needs a VPN device
- VPN tunnel is established between the two VPN devices
- For this to work each site needs a VPN device
explain an IDS in-depth ?
- Watches for suspicious activity
- Detect
○ Writes anomalous activity to a log
○ Sends an alert - Prevent
○ Block suspicious activity - Must detect anomalies in the context of the individual network
○ What is strange on my network might not be strange on your network
○ We will need to tweak this tool to our specific environment
○ We do this to try to reduce the amount of false positives - IDS is often enable directly on routers
- The network placement is crucial with these devices ‘
- It can be hard for these devices to detect anomalies with encryption
- Signature based
- Looking for known patterns of attacker traffic
- Detect
explain what a UTM is ?
- Also called a secure web gateway
- Includes things like
○ Firewalls
○ Proxy servers
○ IDS/IPS
○ WAF
○ Virus scanning
○ Spam filtering
Data loss prevention
- Includes things like
what are the characteristics of DDOS attacks?
- Botnets are used
- Usually flooding networks or apps
- Mitigation
○ Throttling
○ Blackhole routing - Routing the traffic to nowhere
what is URL hijacking and redirection ?
- This attack can stem from user typos that result in redirection to similar URL
○ Also called typo squatting- Tainted search results redirect to a malicious site
- DNS poisoning
- Tainted search results redirect to a malicious site
explain a session replay attack ?
attackers can take over the sessions
1. attackers can do this with stealing cookies
2. form a url and trick the user to click it
Mitigation
1. Set HTTPOnly flag
2. disallow javascript cookie access
what are pass the hash attacks ?
- take advantage of knowing user password hashes and passing them around the network
- attacker compromises systems with user login session
- attackers use the hash to gain access to other resources on the network
explain application containers
- app components are managed as a single unit
virtual machines contain an entire operating system, application containers do not all they contain is the files to run the app
what is SDN or software defined networking ?
- facilitates network management from a gui or the command line
- this simplifies and hides the underlying network configuration complexities
- Vnets
- Subnets - VPN’s
- Vnets
what is a hypervisor ?
- operating system that manages virtual machine guests
- on premise hypervisor - we have full control over this
- Cloud hypervisors can also be deployed
what is a type 1 hypervisor ?
- a type one hypervisor is also called a bare metal hypervisor
- in this instance the hypervisor is the OS, ESXI is an example of this
What is a type 2 hypervisor ?
- this hypervisor runs as an app within the OS
- vmware workstation is an example of a type 2 hypervisor
How do you harden a virtual machine ?
you harden virtual machines the same way you would harden a host
you still have to install patches
disable un-used accounts / services
what is VM sprawl ?
un-used forgotten VM’s
what does cloud computing mean in simple terms ?
all this really means is we are running IT services on somebody else’s equipment over a network
what is fog or edge computing ?
this is when an on-premise server caches files stored in the cloud, the benefit here is local users have access to that content, this is going to be quicker than accessing it over the internet where it is stored in the cloud.
cloud computing: broad access ?
accessing the cloud over a network from any type of device
Cloud computing: self service provisioning ?
spinning up resources yourself
cloud computing: rapid elasticity ?
grow our cloud resources quickly
cloud computing: metered usage?
usage of cloud resources is tracked
what is the public cloud ?
AWS, Azure are examples of this
Anybody can sign up for an account
cloud tenant isolation - isolated environments in the cloud
what is the private cloud ?
cloud is owned and used by a single org
requires an upfront capital investment
organization assumes full hardware / software responsibility
what is a hybrid cloud ?
- combines public and private cloud
- public clouds can be used for redundancy and disaster recovery
what is a community cloud ?
- cloud computing for organizations / agencies with similar cloud computing needs
Example is the government cloud in AZURE
what are some common cloud service models ?
- Infrastructure as a service IAAS
- Platform as a service PaaS
- Software as a service SaaS
- Platform as a service PaaS
explain IAAS cloud model
this can be a variety of services such as storage, network devices
Do not expose to the internet when possible
in this model the cloud service provider is responsible for the underlying infrastructure
the cloud tenant is responsible for
- deploying VM’s
- deploying storage
- hardening the system
explain the platform as a service cloud model ?
these are usually databases, software developer tools.
in this model the underlying VM’s are managed by the provider
explain the SaaS or software as a service cloud model
this is usually productivity software
the cloud service provider is responsible for the hardware, VMs and the software installation and patching
what are the cloud service providers security responsibilities ?
everything related to the hardware in there data centers
- power
- HVAC
- hardware configuration
- firmware updates
Responsible for the security of software in the Paas and Saas models
what are some cloud security controls ?
CASB cloud security broker
Next generation secure web gateway
firewall solutions
Policies
what is CASB ?
- this enforces security policies when accessing cloud security resources
- this is normally done via proxying
what is next generation secure web gateway ?
CASB functionality plus additional security features such as:
- web content filtering
- Data loss prevention
Describe code injection attacks
- Adding your own information into a data stream
- This is often enabled because of bad programming within an application
○ The application should properly handle input and output - There are many different types of injection attacks including:
HTML, SQL, XML, LDAP, etc
- This is often enabled because of bad programming within an application
explain SQL injection attacks
- SQL stands for structured query language
- SQL injection allows modifying SQL requests
Your application really shouldn’t allow this
- SQL injection allows modifying SQL requests
explain XML injection attacks ?
- XML stands for extensible markup language
○ XML is a set of rules for data transfer and storage
XML injection attacks you modify the XML requests – a good application will validate these requests
what is LDAP injection ?
- LDAP was created by the telephone companies and now used by almost everyone
LDAP is used to store information about authentication
what is DLL injection ?
- Dynamic link library
○ A windows library containing code and data
○ Many applications can use this library
Inject a DLL and have an application run a program
explain a buffer overflow attack
a buffer overflow attack occurs when one section of memory is able to overwrite a different section of memory
what are the mitigations for a buffer overflow attack ?
Developers need to perform bounds checking to make sure no one is able to overwrite certain sections of memory
what are some of the characteristics of Replay attacks
- Useful information is transmitted over the network, a crafty attacker will take advantage of this
- An attacker will need raw access to the raw network data
○ They can achieve this with a network tap, ARP poisoning, or malware on the victim computer - The gathered information may be replayed across the network to appear as someone else
Session ID’s or credentials are what attackers are usually after with replay attacks
- An attacker will need raw access to the raw network data
what are the characteristics of a pass the hash attack ?
- This is a common replay attack
- Attacker captures the hash and replay’s it through the network and this can allow them to gain access to resources
- Mitigation
○ Avoid this type of replay attack with salt or encryption
what do we have to keep in mind with browser cookies and session ID’s?
- Cookies can provide useful information for attackers trying to do replay attacks
- Cookies are used for tracking, personalization, and session management
○ These can be a security risk if someone gains access to them
Session ID’s are often stored in cookies
- Cookies are used for tracking, personalization, and session management
what is session hijacking ?
- Attacker gains access to the session ID
- First the attacker needs to get the information
○ They can do this with a tool like wireshark
Then they need to modify the headers
- First the attacker needs to get the information
what are the mitigations for replay and session attacks ?
- Encrypt end to end
- They cant capture your session ID if they cant see it
Use HTTPS
- They cant capture your session ID if they cant see it
what are some security concerns with DNS?
- DNS
○ TCP/UDP port 53- DNS can be susceptible to domain hijacking
- DNS can fall victim to URL redirection attacks
Cache poisoning is when an attacker poisons a DNS cache
what is DNSSEC ?
is the secure version of DNS because all zones use forests
what are security considerations to be aware of with SNMP ?
- UDP port 161/162
- SNMP version 1 was all unencrypted
- Version 2 and 3 is encrypted
Version 3 is the most secure
what is FTP over ssl called and what port does it run on ?
this runs through an SSL tunnel on TCP port 990
what is SFTP and what port does it run on ?
SFTP is SSH FTP – runs through SSH on TCP port 22
what is SRTP and what port does it run on ?
secure real time transport protocol – for encrypting VOIP calls UDP port 5004
what are some ways we can secure web apps ?
- Hide true Web Server IP address
○ Load balancer can achieve this because they are connecting to the load balancer IP
○ Reverse proxies can also do this
○ NAT will hide the IP address as well- Run HTTPS
○ This is enabled on the web server
○ Requires a server PKI certificate
○ HTTPS is port 443
○ TLS – network security protocol
○ TLS works together with PKI
Need to use TLS version 1.2 or higher
- Run HTTPS
what are some of the characteristics of SSL LDAPS?
○ Directory service access protocol
○ Supported by Microsoft active directory
○ Requires a server PKI certificate
LDAPS uses TCP port 636
what is SMTP used for ?
SMTP is used to send mail
what are the characteristics of cross site request forgeries ?
This attack targets users and unchanging session tokens
This attack is designed to hijack authenticated sessions between a client and a server
what is server side request forgery ?
This happens on the server side as opposed to the CSRF which happens on the client side
This attack targets web servers, hoping to compromise the webserver
Designed to have server make HTTP requests to other services
walk through a cross site request forgery ?
User authenticates to legitimate banking website
While logged into banking web site, user is tricked into visiting a fake site
User unknowingly sends malicious requests/instructions to the legitimate banking web site using existing authenticated session
what are the mitigations for request forgeries
Harden client devices
Use web application firewall or WAF
explain request forgery attacks simply
Request forgeries involve hijacking existing sessions to run malicious user commands
explain CSRF’s simply
Cross site request forgeries CSRFs attack victims that already have authenticated sessions
Explain SSRF’s
Server side request forgeries SSRFs attack server sessions to other hosts such as backend databases
Explain an XSS attack
Cross site scripting attacks start with a web app that doesn’t properly validate or sanitize input
All user input must be untrusted
Attacker injects malicious code into a vulnerable web site
Javascript is commonly used in xss attacks
Web site visitors unknowingly execute malicious code
how does an XSS attack work ?
In an XSS attack, attackers inject malicious code into a web app, then victims visit the web app and malicious code executed on their device in the web browser
what are the characteristics of injection attacks
Malicious user input is accepted by the web app
Types
SQL injection
LDAP injection
XML injection
Mitigation - Sanitize user input
what are the characteristics of secure coding ?
Developers need to adhere to software development security best practices
Input validation
Secure web browsing cookies
HTTP headers
Code signing
what are the steps in the software development lifecycle ?
Planning
Defining
Designing
Building
Testing
Deployment
what is continuous integration or continuous delivery also known as CI / CD
Automate developer code changes
Test for quality assurance
Send update notifications to users for code version control
Security issues
Attackers could make changes and inject them into the update
explain infrastructure as code or IAC
VM templates
Able to deploy a vm from a baseline
Cloud templates
Deploy rapidly from the cloud
These methods allow for rapid and consistent provisioning/deprovisioning
what is software testing
Static testing
Often called code review
Manually scanning code
Dynamic testing
Observe runtime behavior
One way to do this is with fuzzing
Fuzzing is throwing unexpected data at an application
what does S/MIME stand for ?
Secure multipurpose internet mail extensions S/MIME
zero day attacks
- a vulnerability without a patch
- never seen this vulnerability before, its brand new.
what are the issues with open permissions ?
- Very easy to leave a door open
This is becoming more common with cloud storage
what are the issues with unsecured root accounts ?
- Can be misconfigured, or the password is weak
- You can disable the admin or root account as a security best proactive
- Its best to protect root or admin accounts
- You can disable the admin or root account as a security best proactive
why would we need to make sure our applications dont give out verbose errors
Error messages can provide useful information to an attacker
what are the risks associated with weak encryption ?
- Use strong encryption protocols such as AES or 3DES
- Make sure the hashes don’t have any vulnerabilities
- Some cipher suites are easier to break than other
- Make sure the hashes don’t have any vulnerabilities
what are some of the common insecure protocols ?
- Some protocols aren’t encrypted these are
○ Telnet
○ FTP
○ SMTP
- IMAP
what are the risks associated with default settings ?
every application and network devices has a default login, they need to be changed
what are the risks associated with open ports and services ?
- Services will open ports its important to manage access
- Often managed with a firewall
○ Manage traffic flows- Allow or deny based on port number or application
- Often managed with a firewall
what are the risks of improper patch management ?
- Often centrally managed
○ The update server determines when you patch
○ Test all your apps then deploy
○ Efficiently manage bandwidth- Many different types of patches
○ Firmware associated with the BIOS of the device
○ Operating system patches
Application provided by the manufacturer
- Many different types of patches
what are some of the impacts of exploited vulnerabilities ?
- Data loss
- identity theft
- reputation impacts
- availability loss
what is the goal of threat hunting ?
Threat hunting is a constant game of cat and mouse the goal is to find the attacker before they find you.
what is the first step in threat hunting ?
- The data comes from logs and sensors, network information, internet events and intrusion detection
- Then we can add data from external sources
Threat feeds, government alerts, advisories, bulletins, and social media
- Then we can add data from external sources
what are some of the basics with vulnerability scans ?
- Port scans
○ Poke around and see what’s open- Identify all the devices on the network
It’s important to test from the outside and the inside
- Identify all the devices on the network
what are some of the different types of vulnerability scans ?
- Non-intrusive scans or passive scans
○ Gather information, don’t try to exploit a vulnerability- Intrusive scans
○ You will try out the vulnerability and see if it works - Non credentialed scan
○ The scanner cant login to the remote devices - Credentialed scan
- You are a normal user, this emulates an inside attack
- Intrusive scans
what are false positives with vulnerability scans ?
False positives – a vulnerability is identified that doesn’t really exist
what are false negatives with vulnerability scans ?
Indicating you don’t have a vulnerability when you really do
what is a SIEM ?
- Collects logs of security alerts
- Usually includes advanced reporting features
- Data correlation
- Link diverse data types
why is it important for companies to have good documentation of assets and systems
With good documentation of our systems its easier to rebuild those systems if a disaster occurs
what are the different diagrams we should have as a business ?
- Network diagrams
○ Documents the physical wire and device- Physical data center layout
Can include physical rack locations
- Physical data center layout
what is a baseline configuration ?
- The security of an application environment should be well defined
- All application instances must follow this baseline
- The baseline configuration should include firewall settings, patch levels, os file versions
These will probably require constant updates
what is IP schema
- An ip address plan or model
○ Consistent addressing for network devices
○ Helps avoid duplicate IP addressing
Might assign different IP ranges to different locations
how do we protect data in our organizations ?
- Use encryption
- Security policies
- Data permissions
- Who has access to what
what does data sovereignty mean ?
- Data that resides in a country is subject to the laws of that country
- GDPR general data protection regulation
Data collected on EU citizens must be stored in the EU
- GDPR general data protection regulation
what is data masking ?
- This means hiding some of the original data
- Protects PII
Many different techniques for masking, encrypting, shuffling substitution
- Protects PII
when we are using encryption what is the different data called as it is encrypted ?
The original information is called plaintext the encrypted form of that data is called cypher text
what is diffusion as it is related to encryption ?
If you change one character in the plaintext then the resulting cipher text is going to be dramatically different
what is data at rest ?
- Encrypt the data
- Whole disk encryption
- Database encryption
- Apply access control lists
Only authorized users can access the data
what is data in transit ?
- Data transmitted over the network
- Also called data in motion
- Usually we protect this data with a firewall or IPS
- We can also provide transport layer security
○ Using TLS
- Using Ipsec
what is data in use ?
- Data is actively processing in memory
○ System RAM, CPU registers and cache- This data is almost always decrypted, otherwise you couldn’t do anything with it
- This data is useful for attackers because they can pick the decrypted information out of RAM
what is tokenezation as it relates to security ?
- Replace sensitive data with a non sensitive placeholder
- This practice is common with credit card processing
what is information rights management or IRM
- Control how data is used
- This is common in Microsoft documents especially email messages and PDF’s
- Restrict data access to unauthorized persons
○ Prevent copy and paste
○ Control screenshots
○ Manage printing
- Restrict editing
what are DLP systems ?
Prevent loss of data from company systems
- Endpoint DLP resides on the endpoint - DLP technologies on the network that are inspecting packets - DLP systems on the servers
what systems are USB blocking techniques common in ?
DLP systems can block USB drives
how does cloud DLP work ?
- These are located between the users and the internet
- Block custom defined data strings
- Manage access to URL’s
- Prevent file transfers to cloud storage
what are some of the characteristics of DLP and email ?
- Smart to have DLP on your email so data is not sent out
- Inbound
○ Block keywords, identify imposters, quarantine email messages - Outbound
- Fake wire transfers, W-2 Transmissions, employee information
- Inbound
what is offsite recovery ?
- when recovery systems are hosted in a different location outside the scope of the disaster
what are some of the characteristics and goals of incident response
the incident response plan should already be established in the event of a disaster
○ Documentation is critical with IR ○ The goal is to identify the attack and then contain the attack After we have identified an attack we want to limit data exfiltration and limit access to sensitive data
what are some characteristics of ssl/tls inspection ?
- Commonly used to examine outgoing SSL/TLS traffic
- This can make a defenders job harder because information on the network is encrypted so its harder to see what is going out and what is going in
- With SSL inspection we are able to put ourselves in the middle of the conversation and inspect the traffic while maintaining trust on the client side and the server side
- To inspect this traffic we usually use a firewall to decrypt the data
what is SSL trust ?
- Your browser contains a list of trusted CA’s
- Your browser doesn’t trust a website unless a CA has signed the web servers encryption certificate
- Before giving a CA to a site it makes sure the site is legitimate
what is hashing ?
- Represents the data as a short string of text
- One way trip impossible to recover the original message from the digest
- Hashing is used to store password and achieve confidentiality
- You can use hashing to verify a downloaded document is the same as the original
what are some security considerations we have to take into account with API’s ?
- API’s are used to control software or hardware programmatically
- On path attacks can target API’s and replay API commands
- API injection
Inject data into an API message
what are some basics of API security ?
- Authentication is an important part of API security
○ We want to limit API access to legitimate users
○ Only use API’s over secure protocols- Authorization is another important part of API security
○ API should not allow extended access
○ Each user should have a limited role in what they can do
A read only user should not be able to make changes
- Authorization is another important part of API security
what are some common examples of embedded systems ?
- Traffic light controllers
- Digital watches
- Medical imaging systems
- Digital watches
what do embedded systems usually run on ?
Often embedded systems are running on a Soc or system on a chip
what are some security considerations with embedded systems ?
- Difficult to upgrade hardware
- Limited off the shelf security option
what is a field programmable gate array ?
- This is an integrated circuit that can be configured after manufacturing
- With these devices a problem doesn’t require a hardware replacement
- These devices are common in infrastructure devices
○ Firewalls
○ Switches
- routers
what is SCADA/ICS ?
- With SCADA systems the PC manages equipment
○ Power Generation, refining, manufacturing equipment
○ Common to find this in different facilities
▪ Industrial
▪ Energy
- Logistics
explain what IOT devices are ?
- Sensors are IOT devices
○ Heating and cooling, lighting- Smart devices
○ Home automation, video doorbells - Wearable technology
○ Temperature, air quality, lighting- IOT devices usually have weak defaults
- Smart devices
what are some specialized embedded systems devices ?
- Medical devices
- Vehicles commonly have embedded systems in them
- Embedded systems are also common on aircraft
- Vehicles commonly have embedded systems in them
what telephone system is an embedded system ?
- Voip is also an embedded system
- Each VOIP device is a standalone computer
what are the characteristics of 5G?
- Significant performance improvements
- Operates at higher frequencies
- 5G has a dramatic impact on IOT devices
○ We can do larger data transfers
○ Faster monitoring and notifications
- Additional cloud processing
what are the characteristics and details of SIM cards ?
- To connect to cellular networks you need a SIM card
- IOT devices will need a sim card to use cellular technology
- The sim card contains a lot of details
○ Authentication information
- Contact information
what is narrowband technology ?
- If an ITO device is not using cellular technologies its probably using narrow band
- Narrowband allows many IOT devices to communicate over longer distances
- You might find narrowband in
○ SCADA equipment
- Sensors in oil fields
what are some of the constraints of an embedded systems ?
- May not have access to a main power source
- Batteries may need to be replaced and maintained
- Low power CPU’s and are limited in speed
- May not have the option for a wired link
- Wireless is a limiting factor
- Limited cryptography features
- Inability to patch or very hard to patch
- No authentication or very limited
what are some secure protocols with voice and video ?
- SRTP secure real time transport protocol
- SRTP adds security features to RTP and keeps conversations private
- The encryption used for SRTP is AES
- Additional security features od SRTP
○ Authentication
○ Integrity
○ replay protection
○ These additional features ^ are accomplished using HMAC-SHA1 which is hashed based message and authentication code
what is the secure version of NTP?
- Classic NTP has no security features
- NTPsec
○ Secure network time protocol
- Cleaned up the code base
- NTPsec
what are some secure protocols used with email ?
- S/MIME
○ Secure multipurpose internet mail extensions
○ Features public key encryption and digital signing of mail content
○ Requires a PKI or similar organization of keys- Secure POP and secure IMAP
○ Uses a starttls extension to encrypt POP3 with ssl or use imap with SSL
SSL/TLS
- Secure POP and secure IMAP
what are some secure web protocols ?
- SSL/TLS secure sockets layer / transport layer security
- SSL is older TLS is newer if someone says SSL they are actually referring to TLS
- HTTPS over TLS
○ HTTPS uses public key encryption
○ Private key on the server
- Symmetric session key is transferred using asymmetric encryption
what are the characteristics of IPSEC?
- This is security for OSI layer 3
- IPSEC provides authentication and encryption for every packet
- IPSEC includes packet signing for integrity and anti-replay features
- One of the benefits of IPSEC is it is very standardized its common to use multi vendor implementations
- The two core Ipsec protocols
○ Authentication header AH
Encapsulation security payload ESP
what are secure protocols that deal with file transfers ?
- FTPS - file transfer protocol secure / FTP over SSL FTP-SSL
○ This is not to be confused with SFTP- SFTP is the SSH file transfer protocol
○ Provides file system functionality
FTP uses SSL to provide the encryption SFTP uses SSH to provide the encryption
- SFTP is the SSH file transfer protocol
what is the ldap protocol ?
- Protocol for reading and writing directories over an IP network
○ An organized set of records, like a phone directory
- Commonly used in Microsoft AD
what is LDAPS?
a nonstandard implementation of LDAP over SSL
what is SASL or simple authentication and security layer ?
a nonstandard implementation of LDAP over SSL
what is a secure protocol for remote access ?
- SSH
○ Encrypted terminal communication
○ Replaces telnet
- Provides secure terminal communication and file transfer features
what was the security holes in the original DNS ?
- Originally created without security in mind
-Very easy to perform DNS poisoning attacks on the original DNS
What is DNSSEC?
○ Domain name system security extensions
○ DNSSEC lets us validate the information we are getting from a DNS server using:
▪ Origin authentication
▪ Data integrity
○ DNSSEC also uses public key cryptography
▪ DNS records are signed with a trusted third party
Signed DNS records are published in DNS
what are some secure protocols that are common with routing and switching ?
- If you are querying your routers and switches then you will use the SNMP protocol
- SNMP v3 is the most secure and offers the following features
○ Confidentiality – encrypted data
○ Integrity – no tampering of the data
- Authentication – verifies the source
- SNMP v3 is the most secure and offers the following features
what are some of the ways to secure DHCP ?
- Dhcp does not include any built in security
- Within active directory you can avoid rogue DHCP servers because DHCP servers must be authorized
CISCO uses something called DHCP snooping which blocks DHCP requests not coming from trusted interfaces
- Within active directory you can avoid rogue DHCP servers because DHCP servers must be authorized
what are some of the security concerns with cellular networks ?
- Some of the security concerns with cell networks
○ Traffic monitoring
- Location tracking
what are some security considerations to be aware of with WIFI ?
encrypt your data so it cant be captured
we need to be concerned about on path attacks with WIFI
where is RFID common ?
- Access badges
- Inventory / assembly line tracking
- Pet / animal identification
- Anything that needs to be tracked
where is NFC or near field communication common ?
- Two way wireless communication
- Builds on RFID
- Payment systems use this
○ Google Wallet
○ Apple Pay
- NFC helps with Bluetooth pairing
what are some security concerns with NFC ?
- Remote capture
- Frequency jamming
- Relay / replay attacks
- Frequency jamming
what does MDM stand for and what does it do
Mobile device management
* Manage company owned and user owned mobile devices
* MDM gives us centralized management of the mobile devices
- Set policies on apps, data, camera, etc
MDM application management ?
- Managing mobile apps are a challenge
- Not all applications are secure
○ Some are malicious
○ Android malware is a rapidly growing security concern - A good way to manage application use is through allow lists
○ Only approved applications can be installed
- Not all applications are secure
mobile content management MDM ?
- Secure access to data
- Protect data from outsiders
what is remote whip ?
- Remove all the data from your mobile device
- Often managed from MDM
what is context aware authentication ?
- Combines different characteristics to create a profile on who might be trying to authenticate
- Combine multiple contexts
○ Where your normally login - IP address
- Combine multiple contexts
- Where you normally frequent - GPS information
what is a MicroSD HSM and what is it used for ?
- HSM stands for hardware security module
- Provides security services
○ Encryption
○ Key generation
○ Digital signatures
○ Authentication - We can also store information securely in HSM’s
○ Protect private keys
○ Crypto storage
- Provides security services
unified endpoint management ?
- UEM is used to manage mobile and non-mobile devices
- UEM is an evolution of the mobile device manager
mobile application management MAM ?
- Provision, update, and remove apps
- Keeps everyone running at the correct version
- We can use this to create an enterprise app catalog
- Users can choose and install the apps they need
availability zones or AZ in the cloud ?
- Isolated locations within a cloud region
- AZ’s commonly span across multiple regions
- Each AZ has independent power, HVAC and Networking
- AZ’s commonly span across multiple regions
how do we build applications to be highly available ?
- Build an application to be active in one AZ and be on standby in another AZ
- The application will then be able to recognize an outage and move to another AZ
- Use load balancers to provide seamless High Availability
- The application will then be able to recognize an outage and move to another AZ
explain the characteristics of Identity and access management or IAM ?
- Identity and Access Management
○ Who gets access
○ What do they get access to- IAM allows us to create different groups and map job functions to those roles
○ We can combine users into groups - We can also use IAM to provide access to cloud resources
○ Set granular policies
Group, IP address, date and time
- IAM allows us to create different groups and map job functions to those roles
Secrets management ?
- Cloud computing includes many secrets
○ API Keys, Passwords, Certificates- The amount of secret keys can easily become overwhelming
○ Its difficult to manage and protect all these - Provide an audit trail
Know exactly who accesses secrets and when
- The amount of secret keys can easily become overwhelming
how do permissions help us secure the cloud ?
- A significant cloud storage concern
- One permission mistake can cause a breach
- Many different options for managing cloud storage access
○ Identity and access management
○ Bucket policies
○ Globally blocking public access
Don’t put data into the cloud unless it really needs to be there
how do we use encryption to secure the cloud ?
- Cloud data is more accessible than non-cloud data
- Server side encryption
○ Encrypt the data in the cloud
○ Data is encrypted when stored on disk - Client side encryption
○ Data is already encrypted when its sent to the cloud
○ This is performed by the application
Encrypting the data locally then sending it to the cloud
- Server side encryption
how does replication help us secure the cloud ?
- Copy data from one place to another
○ Real time data duplication in multiple locations- Replication is common for disaster recovery and high availability
○ Plan for problems
○ Maintain uptime if an outage occurs
○ Hot site for disaster recovery
Having a backup is a good reason to use replication
- Replication is common for disaster recovery and high availability
what are the two primary ways users communicate to the cloud ?
- Users communicate to the cloud in two primary ways
○ From the public internet
Over a VPN tunnel
what are virtual networks ?
- Virtual switches, virtual routers
○ Build the network from the cloud console
You can use the same configurations as a physical device
what is a private cloud ?
○ All internal IP addresses
○ Connect to the private cloud over a VPN
No access from the internet
what is a public cloud ?
○ External IP addresses
Connect to the cloud from anywhere
what is a hybrid cloud ?
○ Combine internal cloud resources with external
○ May combine both public and private subnets
how does segmentation help us secure cloud networks ?
- Some cloud may have segmentation separate VPC’s, containers, and microservices
○ Application segmentation is almost guaranteed- Virtualized security technologies
○ Web application firewall WAF
Next generation firewall NGFW
- Virtualized security technologies
what is dynamic resource allocation ?
- Provision resources when they are needed
○ Based on demand- Scale up and down
○ Allocate compute resources where and when they are needed
○ This is called rapid elasticity
Pay for only what’s used
- Scale up and down
what are virtual private cloud endpoints ?
- VPC gateway endpoints
○ Allow private cloud subnets to communicate to other cloud services- VPC endpoints allow us to keep private resources private
Internet connectivity is not required
- VPC endpoints allow us to keep private resources private
what is a CASB?
- A CASB will help us enforce the security policies in the cloud
This can be implemented as client software, or a local security appliance, or cloud based security solutions
what are the characteristics of a CASB?
○ Visibility
▪ Determine what apps are in use?
▪ Determine what users are authorized to use those applications
○ Compliance
▪ Are users complying with HIPPA ? PCI ?
○ Threat prevention
▪ Allow access by authorized users prevent access from everyone else
○ Data Security
▪ Ensure that all data transfers are encrypted
Protect the transfer of PII with DLP
how does application security go in the cloud ?
- Secure cloud based applications
○ Complexity increases in the cloud- Application misconfigurations
○ One of the most common security issues
○ Especially cloud storage - API security
Attackers will try to exploit interfaces and API’s
- Application misconfigurations
what is a next generation secure web gateway or SWG ?
- Used to protect users and devices
○ Regardless of location and activity- SWG’s go beyond URLS and GET requests
○ Examine the applications and API - Also able to examine JSON strings and API requests
Allows or disallows certain activities
- SWG’s go beyond URLS and GET requests
what is an identity provider or IDP ?
- a service that can vouch for who a person happens to be
- Think of this as authentication as a services
-Commonly used by SSO applications or any authentication process
- Think of this as authentication as a services
what are attributes mean when dealing with identity
- To be able to understand an identity we have to gather attributes
- Personal attributes
○ Name, email address, phone number, employee ID - Other attributes
Department name, job title
- Personal attributes
how do certificates help with identity ?
- Digital certificate
○ Assigned to a person or device- Binds the identity of the certificate owner to a public and private key
- Encrypt data create digital signatures
- Binds the identity of the certificate owner to a public and private key
what are the characteristics of SSH keys ?
- With SSH you can use a key instead of a username and password
○ Public/Private keys
○ Critical for automation- Key management is critical
- The command for creating a public private key pair on Linux is
- Ssh-keygen
what are the characteristics of user accounts ?
- Shared account
○ Used by more than one person
○ Guest logins or anonymous logins- With these accounts it is very difficult to create an audit trail
○ No way to know exactly who was working
○ Difficult to determine the proper privileges - Password management becomes difficult
○ Password change requires notifying everyone
-Difficult to remember so many password changes
- With these accounts it is very difficult to create an audit trail
what are the characteristics of guest accounts ?
- Access to a computer for guests
○ No access to change settings, modify applications, view other users files and more
○ Usually no password on a guest account- Guest accounts bring significant security challenges
○ Access to the user space is one step closer to an exploit
- Guest accounts bring significant security challenges
- Must be controlled
what are the characteristics of service accounts ?
- Used exclusively by services running on a computer
○ No interactive / user access- Access can be defined for a specific service
○ Web server rights and permissions will be different than a database server - Service accounts commonly use usernames and passwords
You will need to determine the best policy for password updates
- Access can be defined for a specific service
what are the characteristics of privileged accounts ?
- Elevated access to one or more systems
○ Administrator, Root- Privileged accounts have full access to the OS
- This account should not be used for normal administration
○ User accounts should be used - Needs to be highly secured
- Strong passwords
what is the purpose of account policies ?
- Control access to an account
- The authentication process
○ Password policies
○ Authentication factor policies
Permissions after the login
- The authentication process
what are some of the auditing we can do with accounts in our network ?
- Permission auditing
○ Does everyone have the correct permissions ?- Usage auditing
○ How are resources used ?
Are your systems and applications secure
- Usage auditing
what are some things we can do to make our passwords strong ?
- Make your password strong
- Increase password entropy
○ Entropy is a way to measure just how unpredictable a password might be
○ No single words, no obvious passwords
○ Mix uppercase and lowercase with special characters
Stronger passwords are at least 8 characters
- Increase password entropy
what are password keys ?
- Hardware based authentication
○ This is under the category of something you have
Helps prevent un-authorized logins and account takeovers even if they have your account password because they don’t have your hardware key
what are password vaults ?
- Password managers
○ All passwords in one location
○ A database of credentials- Secure storage
○ All credentials are encrypted
○ Cloud based synchronization options - Create unique passwords
Passwords are not the same across sites
- Secure storage
what is the TPM or trusted platform module ?
- Hardware to help us with encryption
- TPM provides us with a cryptographic processor
○ Which is random number generators and key generators
You can also securely store keys on a TPM module
- TPM provides us with a cryptographic processor
what is HSM or the hardware security module ?
- Hardware security module – if you are managing a large number of servers that are using encryption then you need some way to centralize the management of all these different keys, one way to that is with a HSM
- HSM is usually a server that has specialized hardware inside that allows it to perform cryptographic functions quickly.
HSM can be used for centralized storage of all our encryption and decryption keys
- HSM is usually a server that has specialized hardware inside that allows it to perform cryptographic functions quickly.
what is knowledge based authentication or KBA ?
- Using personal knowledge as an authentication factor
○ Something you know- Static KBA
○ Pre configured shared secrets
○ This is often used with account recovery
○ Example: what was the make and model of your first car ? - Dynamic KBA
Questions are based on an identity verification service or pulled from public records
- Static KBA
what is PAP or the password based authentication protocol ?
- A basic authentication method
○ Used in legacy operating systems
○ Rare to see singularly used- PAP is in the clear
○ Weak authentication scheme
○ Non – encrypted password exchange
It would fall on the application to provide the encryption
- PAP is in the clear
what is CHAP or the challenge handshake authentication protocol ?
- Encrypted challenge sent over the network
- CHAP uses a three way handshake
○ After a link is established, the server sends a challenge message
○ Client responds with a password hash calculated from the challenge and the password
○ Server compares received hash with stored - Challenge response
○ Not just at the beginning occurs periodically during the connection
User never knows it happens
- CHAP uses a three way handshake
what is MS-CHAP?
- Microsoft’s implementation of CHAP
○ Used commonly on Microsoft’s PPTP or point-to-point tunneling protocol
○ MS-CHAP vs is the most recent version
Relatively easy to brute force because it uses DES, Don’t use MS-CHAP
what is radius and what do we use it for ?
Radius – remote authentication dial in user service
* One of the more common AAA protocols
* Supported on a wide variety of platforms and devices
Centralized authentication for users
* Routers, switches, firewalls
* Server authentication
* Remote VPN access
802.1x network access
what is TACACS ?
terminal access controller access control system
Remote authentication protocol
what is TACACS+?
- TACACS+ the latest version of TACACS, not backwards compatible
More authentication requests and response codes
what is kerberos ?
- Kerberos is able to use single sign on
- We can authenticate one time and at that point are trusted by the system
- We can access different network resources all day without having to enter in our username or password
Kerberos provides mutual authentication so the server is also authenticating to you
how does the kerberos ticket process work ?
When you authenticate to a ticket granting service which would be your centralized authentication server. That ticket granting service gives you a service ticket. And then instead of having to put in a username and password every time you access a different resource you simply have to show the service ticket that device recognizes that you were properly authenticated by the ticket granting service.
what is IEEE 802.1x ?
- Port based Network access control NAC
- You don’t get access to the network until you authenticate
- EAP integrates with 802.1x
○ EAP is the extensible authentication protocol
802.1x prevents access to the network until the authentication succeeds
what are federated identities ?
- Allows us to use credentials that someone uses for a completely different services
- Third parties can establish a federated network
○ Authenticate and authorize between the two organizations
○ Aka login with your Facebook credentials
○ Login with your google credentials
- Third parties can establish a federated network
what is the security assertion markup language or SAML ?
- Open standard for authentication and authorization
- You can authenticate through a third party to gain access
- Not originally designed for mobile apps
This has been SAML’s largest roadblock
what is the SAML authentication flow ?
- User accesses application URL
- Sends signed / encrypted SAML request, redirects user to authorization server
- User logs in
- Authentication successful SAML token generated
User presents SAML token
what is OAUTH?
- Authorization framework
○ Determines what resources a user will be able to access
OAuth is a framework that allows us to control what types of resources a third party application may be able to access
what is OAuth usually used in conjunction with ?
OAuth is usually used in conjunction with OpenID connect, so Open ID connect is providing all the authentication functionality, and then OAuth is determining what types of data is accessible by that third party app once the authentication is complete
how is authorization paired with access control ?
- Authorization
○ The process of ensuring only authorized rights are exercised
○ Usually we enforce access control with policy enforcement
Users receive rights based on access control models
what is Mandatory access control or MAC?
- The operating system limits the operation of an object
- Every object gets a label
Confidential, secret, top secret
- Every object gets a label
what is discretionary access control or DAC?
- Used in most operating systems
- You create a spreadsheet, as the owner you control who has access, you can modify access at any time
- Very flexible access control
However this is pretty weak security
what is RBAC or rbac?
- You have a role in your organization
Manager, director, team lead, project manager
what does the Traceroute command do for us ?
- Determine the route a packet takes to a destination
- Tracert for windows
- Traceroute for Linux
- Takes advantage of ICMP time to live exceeded error message
what are the NSlookup and dig commands used for ?
- Lookup information from DNS servers
○ Canonical names, IP addresses, cache timers- Dig domain information groper
- More advanced domain information
- Dig domain information groper
what are the ipconfig and ifconfig commands used for ?
- Most of your troubleshooting starts with your IP address
○ Ping your local router or gateway- Determine TCP/IP and network adapter information
- Ipconfig – windows
Ifconfig – linux
what is the ping command used for ?
- Test reachability
- Determine round trip time
Uses ICMP
- Determine round trip time
what is the pathping command used for ?
- Combines ping and traceroute
- First phase runs a traceroute
- Second phase
Measures round trip time and packet loss at each hop
what is the netstat command used for ?
- Network statistics
○ Used on many different OS’s- Show all active connections
○ Netstat –a - Show binaries (windows)
○ Netstat –b - Do not resolve names
- Netstat -n
- Show all active connections
what is the arp protocol used for ?
- Determine a MAC address based on an IP address
○ You need the hardware address to communicate- To view your local ARP table
Use the arp -a command
- To view your local ARP table
what is the route command used for ?
- The route command is used to view the devices routing table
○ Find out which way the packets will go- Windows
○ Route print - Linux and Mac OS
- Netstat -r
- Windows
what is the curl command used for ?
- Client URL
○ Retrieve data using a URL
Used for enumerating and viewing the source code of webpages
what are IP scanners used for and how do they work ?
- Search a network for IP address
- Locate active devices
- IP scanners use many different techniques
○ ARP (if on the local subnet)
○ ICMP requests (ping)
○ TCP ACK
ICMP timestamp requests
what is the Hping command used for ?
- TCP/IP packet assembler and analyzer
- Ping command to the next level
Hping allows you to modify almost everything about the packet
- Ping command to the next level
what are some of the roles and responsibilities associated with incident response ?
- Incident response team
- The IR team might include
○ IT security management
○ Compliance officers
- Technical staff
- The IR team might include
what is the NIST SP800-61 ?
- This is a document made to help you handle security incidents
- This document outlines the entire lifestyle of a security incident
○ Preparation
○ Detection and analysis
○ Containment, Eradication, and recovery
Post incident activity
- This document outlines the entire lifestyle of a security incident
