SSA Flashcards
(C) ISO
Information security officer – Highest - in charge of security policy. Informing, advising and alerting management on matters relating to information security. Essentially managerial (managing engineers and technicians) Must have good knowledge of networks, systems and InfoSec. Ensuring the company’s data is secure, as well as security awareness training.
Security Analyst
looking through logs or vizsec, security policies. Use of information in role implies that the role is more on the management side of things.
IDS purpose
IDS provide a better network security. It may achieve success in discovering incidents such as security policy violations, infections, information leakage, unauthorized clients all depending on how it is configured.
Is IDS everything?
IDS alert only make up a tiny bit of the data, other tools providing security and gathering data is: Firewalls, NIDS sensors, Routers & switches, server logs, host IDS, finger printing and honey pots.
Anomaly Detection 1
Anything that is not flagged is RIGHT must be flagged as WRONG. What if someone need to access email server after the “allowed” time set by the signatures? Or overtime?
Anomaly Detection 2
What happens if you do not have the right parameters and dataset? What if hackers are already in before profiling and malicious data are already going inbound\outbound? Så denne tester tempen I et vanlig nettverk og lar den kjøre en stund og det som kjører er det som er greit å kjøre. Obviously raises some issues.
Anomaly Detection Pros
- Can detect unknown attacks (zero day)
- Can detect wide ranging categories of known attacks
Anomaly Detection Cons
- Things may happen in the defining process
- No protection during the defining process
- Hard to define normal
- “Difficult to understand”
- Even with an optimal configuration it may generate high levels of false positives
Misuse Detection Pros
Well defined signatures to minimize false positives.
Based on known unacceptable behavior.
Systems are protected from day 0
Misuse Detection Cons
Signatures must be maintained
Cannot detect unknown attacks
Signatures often made too specific generating alot of false positives
Anomaly vs Misuse
Misuse most popular, easier to create and maintain. Especially if not fussy about quality or performance.
Anomaly are hard to create, especially without knowing specific about the system making them hard to train. Works against DDoS
Anomaly is also hard to maintain because of the profiling process requiring trained personnel to work on it so make a good signature.
Asymmetric Encryption
- Most advantages, because: it allows exchange of public keys and encryption algorithms without compromising secure transmission.
- However, it is computationally expensive meaning it is not suitable for real-time communication.
- Very difficult to crack, even with algorithm and the public key you cannot simply get the private key.
Relies on the difficulty associated with the factorization of large primes factors. - Large primes are hard to find, and they cannot be broken down to small prime factors. Meaning an attacker could not easily deduce all the prime factors in the time available.
- A secure solution for now.
- The public key is the number made by multiplying, however we do not know what numbers was multiplied to get the public key number. Impossible to work out what the numbers multiplied was, however if we had one of the two numbers we could work out the other one.
Symmetric Encryption
- Danger of key exchange
- Lot less resource intensive than asymmetric (Meaning it can be used for real-time communication)
- Symmetric is where the compromising is at (because of the principle and how it is implemented)
- In theory, as secure as asymmetric presuming its keys are not compromised
- It is whats used in the real world, meaning it is put through a lot of strain and people constantly looking for flaws in it
- People often do not prioritize quality when implementing it in the work world.
Ciphers
Two basic types of symmetric cipher:
Stream Cipher – operates on streams of data of unknown size one bit at a time
Block Cipher – operates on blocks of plaintext of known size
Data and Log analysis
By using scripts and regular expressions we can simplify the task of analysing security logs and large data sets. Perl is a great language for this type of work because it works best together with Regex and it is optimized for scanning arbitrary text files, and extracting information.
Data Visualisation/VizSec
Aims to provide an interface the human mind and the computer
Difficult to automate the analysis of complex data
2D vizsec tools are best for monitoring to avoid a constant attention need.
DAVIX OS with lots of tools for this
Security visualization can be broadly grouped into one of three types
Monitoring – Provides an overview of system, real-time updates, starting point for analysts when looking at unusual activity, suspicious activity is flagged
Analysis – provides greater detail of events than monitoring tools, increased level of interactivity
Response – even greater interactivity, ability to annotate events, save histories and group together related events
