Security Operations 4.5 Flashcards
Given a scenario, modify enterprise capabilities to enhance security
Firewall
Filter traffic by port number or application.
Traditional - filter by port number
NGFW - Filter by application.
Encrypt traffic - VPN between sites.
Most firewalls can be layer 3 devices. Often sits on the ingress.egress of the network.
NGFW
Most advance firewall which sits at the top of the OSI model - application layer
Layer 7 firewall.
Performs deep-packet inspection adding application level inspection as a core feature.
Ports and Protocols
Traditional firewall which makes forwarding decisions based on TCP or UDP port numbers.
They either allow or disallow traffic based on destination protocol and port.
What is the the ingress egress of the network?
The point that separates the internet from the internal part of the internet.
Screened subnet
Commonly holds data that needs to be accessed by people on the internet. But keeps private data separate on the internal network.
IPS
Intrusion prevention system
Host based firewalls
Monitor traffic going in and out of a single host.
Network based firewall
Protect an entire network
Stateless firewall
Uses rules implemented in ACL’s to identify allowed and blocked traffic. Rules are based on
- Permission
- Protocol
- Source
-Port or protocol
Stateful Firewalls
Inspects traffic and makes decisions based on the traffic context or state.
Layer 4 firewalls
Operate on the transport model of the OSI model. They inspect traffic and make decisions based on the traffic context or state.
Web application firewall
Specfically designed to protect a web application. A web server hosts the web application, and the WAF is place between the web server and web server clients.
Level 7
URL Scanning.
Allow or restrict based on Uniform resource location.
Agent Based
Installed on client software on the user’s device. Usually managed from a central console.
Proxies
Sit between the users and the external network. Control of traffic managed through the proxy.
The proxy makes requests on behalf of the user. The proxy makes a decision based on what it receives on whether it wants to pass that response onto the end user.
Forward Proxy
The user and the proxy are internal network of the organisation.
Block Rules
Based on specific URL or Category of content.
Different Dispositions - different rules for different types of website. EG block gambling, send alert if home and garden.
Reputation
Filter URL’s based on perceived risk based on the reputation of the website.
DNS filtering
Before connecting to a website, it get the iP address and performs a DNS look up.
Harmful sites are not provided.
Operating system Security - Group Policy
Configuration management tool.
Security Enhanced Linux
Security patches added to the Linux kernel which allow for enhanced security.
The patches give the central access control discretion over rights and permissions used in the Linux Operator as opposed to the individual user.
MAC - Mandatory access control
DAC - Discretionary Access Control.
Secure Protocols - protocol selection
Make sure that when you an application you are not using insecure protocols which do not contain encryption.
Telnet - SSH
HTTP - HTTPS
IMAP - IMAPS
FTP - SFTP
Port number Selection
you can tell whether an application secure of insecure based on the port number its using.
Port 80 - HTTP (Sent in the clear).
Port 443 HTTPS (Encrypted)
Port number usage does not guarantee security
Transport Method
Transport method impacts security because. If transport is Open access - there is no transport level encryption
WPA3: All user data is encrypted.
VPN - Encrypted. Good choice for data transfer.
SPF Protocol
Used DNS record to define which IP addresses are authorised to send emails on behalf of a domain.
DKIM
Domain Keys identified mail
Digital signatures added to the transport process.
DMARC
Builds on top of SFP by allowing domain owners to set policies for how to handle emails that fail authentication checks and providing, reporting mechanisms to monitor and improve email authentication performance.
Three INSECURE data in transit methods
File Transfer Protocol
Trivial File Transfer Protocol
Secure Sockets Layer SSL
FTP - File Transfer Protocol
Uploads and Downloads files to and from an FTP sever. In cleartext (NOT SECURE).
Trivial File Transfer Protocol
Is used to transfer smaller amounts of data. Many attacks are done on TFTP. Most administrators commonly disable it.
Secure Sockets layer
Was the primary method use to secure HTTP traffic as Hypertext transfer protocol. SSL can also encrypt other types of traffic such as SMTP. However, SSL has been compromised and is not recommended for use.
Secure alternative data in transits protocols.
Transport Layer Security TSL - replacement for SSL
Internet Protocol Security (IPsec).
SSH /SCP (based on SSH) encrypts
SFTP Secure implementation of FTP. It is an extension fo secure shell using SSH to transmit the files in an encrypted format.
FTPS is another secure implementation of FTP is used TSL to encrypt FTP traffic.
Remember me location 3958
Look it up
Which three protocols create framework for email authentication
SPF, DKIM and DMARC
File Integrity Monitors
File Integrity Monitors detect modified system files. A file integrity checker calculates hashes on a system files as a baseline. Then it periodically recalculates the hashes on these files and compares them with the hashes on the baseline. If the hashes are different then the system has been modified.
SFC - Windows FIM
Tripwire - Linux FIM
Data Exfiltration
The unauthorised transfer of data outside of an organisation.
Example of network based DLP.
Configure a DLP to look for specific words phrases or character strings. Any outgoing data, within an email or attachment containing this code word will be recognised by the DLP and blocked.
Software based DLP
Installed on an individual system indetifying data exfiltration attempts and blocking them from succeeding.
Network access control (NAC)
Inspects a computer and does not allow it to join the network if it does not pass the inspection.
XDR
Extended detection and Response includes other types of devices and systems.
Goes beyond endpoint to include other types of devices and systems, such as network devices, cloud infrastructure and Iot Devices. Providing a more comprehensive view of the entire IT environment.
EDR
Endpoint detection and response provides continuous monitoring of endpoints
Often uses advanced behavioural analysis techniques to identify suspicious activity and contain threats before they cause damage.
User behaviour Analytics
XDR commonly includes user behaviour analytics. Watch users, hosts network traffic, data repositories
