Security Concepts Flashcards
CIA Triad
Confidentiality: Certain information only known by certain people
Integrity: Data is stored and transferred was intended without modification
Availabilty: Information is accessible to those authorized to access it
Vulnerability
- Weakness that could be accidentally triggered or intentionally exploited to cause security breach
Threat
- Potential for vulnerability to be exploited and security breached
- Intentional or unintentional
- Thing posing threat is threat actor or agent
- Pather or tool used is attack vector
Risk
Likelihood and impace of threat actor exercising vulnerability
Risk Management
- Process for identifying, assessing and mitigating vulnerabilities and threats.
- ERM: Enterprise Risk Managment policies based on published frameworks
Security Controls
- Procedures, activities and tools designed to give a system or data asset the CIA properties
- Aim is to mitigate risk factors to affordable level
Risk Posture
- Overall status of risk management
- Shows which risk response options can be identified and prioritized
Posture Assessment
- Used ot assess organizations maturity level in its use of security policies and contols
MEF
Mission Essential Function
- Function org must be able to perform as close to continually as possible
- If there is disruption, must be restored with priority
BIA
Business Impact Analysis
- Process of assessing what losses might occur from a range of threat scenarios
- Gives context for making decisions on what security controls are worth investment
Exploit
- Specific code or method of using vulnerability to gain control of or damage system
Zero-Day
- Vulnerability that is exploited before it is patched or known
- Can be extremely destructive
Vulnerability Assessment
- Evaluation of a system’s security and ability to meet compliance requirements based on configuration state of the system.
- How close it is to ideal configuration.
CVE
Common Vulnerabilities and Exposures
- Dictionary of vulnerabilities that is published
TTP
Tactics, Techniques and Procedures of threat actors
Behavioral threat research
- Narrative commentary describing examples of attacks and TTPs
Reputational threat intelligence
- Lists of IP addresses and domains associated with malicious behavior
- signature of file based malware
Threat Data
- Computer data that can correlate events observed on customers own networks and logs with known TTP indicators
SIEM
Security Information and Event Management
- Security Control designed to integrate assessment efforts with automated collection and analysis
- Links events or data points to indicators of risk or compromise
- Can drive an alert system based on findings
Penetration Testing
- Authorized hacking techniques to discover exploitable weaknesses
- Active test of security controls
Vendor Management
- Process of selecting supplier companies and evaluating risks inherent in relying on third party products or services.
- Risk cannot be fully transferred to vendors
ACL
Access Control List
- List of subjects and rights or permissions they have access to
Local Authentication provider
Software architecture and code that underpins the mechanism by which the user is authenticated before starting a shell.
- Microsoft or Linux sign in
Hash
- Function that converts any string to a unique, fixed-length code
- Cannot be converted back to plaintext string
- Passwords are stored in the credential database as hash
- One-way cryptographic function
SSO
- Allows user to authenticate once to local device and be otherized to access compatible application servers without having to authenticate again
- In Windows, usually provided by Kerberos Framework
Kerberos
- Provides SSO authentication to active directory
- Authentication service approves user logon requests
- KDC (Key Distribution Center) presents user with Ticket Granting Ticket
- To access domain resources, client requests Service Ticket by supplying Ticket Granting Ticket to Ticket Granting Service
Digital Certificate
- Used to authenticate server machines when using TLS
- Can be installed on web or email server to validate identity and secure transmission channel
Public Key Cryptography
- Key pair is generated
- Private key only you know
- Public Key can be transmitted to other subjects
- Private key cannot be derived from public key
- Messages sent with public key can only be decrypted with your private key
- Can also be used to authenticate yourself by creating unique signature, which only you could have made
PKI
Public Key Infrastructure
- Aims to solve issue with public key by proving owner of public key
- Anyone issuing public keys should obtain a digital certificate
- Wrapper for entities public key
EAP
Extensible Authentication Protocol
- framework for deploying multiple types of authentication protocols and technologies
- Many use digital certificates on the server and client machines
- Used to establish trust relationship and secure tunnel to transmit other credentials
NAC
IEEE 802.X Port-based Netwrok Access Control
- Means of using EAP method when device connected to ethernet switch port, WAP or VPN gateway.
- Uses Authentication, Authortization and Accounting (AAA) architecture.
RADIUS
Remote Authentication and Dial-in User Service
- Widely used for client access over switches, wireless and VPNs.
- Uses port 1812 and 1813
- Each client must have IP of radius server and shared secret
TACAS+
Terminal Access Controller and Access Control System
- Similar to RADIUS, but more flexible and reliable
- Often used to authenticate administrative access to routers and switches
- Port 49
PAM
Privileged Account Management
- policies, procedures and technical controls to prevent malicious abuse of privileges accounts
- Identify and document privileged accounts, and manage the credentials used to access them
Least Privilege
- User is granted sufficient rights to perform job and no more
- Mitigates risk if account is compromised
- Should perform regular audits to prevent authorization creep
Role-based Access
- A set of organizational roles is defined and subjects are allocated to those roles
- Roles can only be modified by system owner
- Rights are given from role assignment, rather than directly
Zero Trust
- Based on idea that perimeter security is unlikely to be completely robust
- Use continuous authentication and conditional access to mitigate privilege escalation and compromise.
LDAP
Lightweight Directory Access Protocol
- Used to query and update x.500-like directory
- Used TCP and UDP port 389
X.500
- Main directory standard
- Each object has unique identifier called distinguished name
- Made of attributes=value pairs separated by commas.
- Most specific attribute is listed first and then get broader
Example:
CN: Jaime, OU: Admins, DC:corp, DC:515support, DC:Com
