still need work cissp Flashcards
nail down less know cards
RSA, cypher type, keys generated by…, key sizes, provides what services (4), common use
Rivest Shamir Adleman,
RSA
block cipher, (Roblox)
block size in general is 1024 but is dependent on the number of bytes in the rsa modulus
new keypair using very large prime numbers, (Supersized prime number keys)
1094-4096 bit keys ( of Amount)
services
authentication, key encryption, digital signatures, encryption
uses
AES symmetric encryption
PGP used for 4 things and uses what model
used for:
file encryption,
directory encryption &
whole disk encryption,
email,
uses Web of Trust model (if you trust me you trust those I trust)
TCP/IP - PDU - OSI mapped
OSI TCP PDU
1 physical 1 link & physical bits
2 data link 1 link & physical frames
3 network 2 internetwork packets
4 transport 3 transport segments
5 session 4 application / data data
6 presentation 4 application / data data
7 application 4 application / data data
IPv4 Header
Very Intelligent Quarterbacks Identify Top Pass Catchers Strethcing Defense Out
Version
IHL/IP Header Length
QoS
ID/Flags/Offset for fragmentation
TTL
Protocol number
Checksum
Source address
Destination address
Options
IPv6 Header
Vicious Tacklers Frighten Passers Needing To Score Deep
Version
Traffic class/ Priority
Flow label (QoS)
Payload length
Next header
TTL
Source address
Destination address
EDRM process (9 steps)
Internet-Games Involve People Chanting Pretentious R A P P
(Electronic Discovery Reference Model)
Information Governance
Identification
Preservation
Collection
Processing
Review
Analysis
Production
Presentation
Change Management Process steps (9)
In Practice All Players Try Something Not In Playbook
IPA PT SNIP
Identify
Propose
Assess risk, impact
Provisional change approval
Test the change
Schedule the change
Notification of change
Implementation of change
Post implementation reporting
DRP Lifecycle (4 phases)
Preparation
Response
Recovery
Mitigation
Developing BCP/DRP (10 steps)
prepare salvation by instituting real plans in the tomorrow mindset
P S B I R P I T T M
Project Initiation
Scoping Project
BIA (business impact analysis)
Identify Preventive Controls
Recovery Strategy
Plan Design
Implementation
Training
Testing
Maintenance
OWASP current Top 10
Best Coaches Intend Immediate Success Visionary Inspire Spur Stimulate Sacrifice
Broken Access Control
Cryptographic Failures
Injection
Insecure Design (new)
Security Misconfiguration
Vulnerable and Outdated Components
Identification and Authentication Failures
Software and Data Integrity Failures (new)
Security Logging and Monitoring Failures
Server-Side Request Forgery (new)
Agile Software Development Umbrella of Methodologies, Principles (12), how does it work (5)
Principles:
(FF PEWT CCC SSS)
1 Face to Face communication is best
2 Frequent delivery
3 Primary measure of progress is working software
4 Early continuous delivery
5 Welcome changes
6 Trusted individuals
7 Cooperation between business and developers
8 Continuous attention to good design
9 Continuous improvement
10 Self-organizing teams produce best results
11 Simplicity
12 Sustainable development at constant pace
How it works:
CFUIL
Agile does not deliver prototypes, but breaks product down to individual features and features are Continuously delivered
does not follow rigid processes, but focuses on getting the product Finished Faster
focus on User stories,
small Incremental deliveries
Less documentation, more focus on delivering right software
Extreme Programming Characteristics (7), relation to Scrum, result
(PU CAFFE) - only somebody EXTREMEly stupid would eat at the pu caffe)
Pair programming (continuous code reviewing, or taking code reviews to the EXTREME)
Unit testing
Code clarity and simplicity
Avoidance of features until they are needed
Flat management
Frequent communication between dev and bus
Expecting changes as problem is better understood
“take away regularity of scrum and add alot of code reviewig you get Extreme Programming”
Results in less errors, better code
Spiral Model phases, what does angular aspect represent, what does diameter of spiral represent
PREE
Planning
Risk Analysis
Engineering
Evaluation
angular aspect is progress
diameter of spiral is cost
Secure Coding Techniques (12)
VOMIT SCiEnCE DB
Validation Points
Obfuscation / Camouflage
Memory Management
Input Validation
Third Party Libraries and SDKs
Stored Procedures
Code Reuse / Dead Code
Encryption
Code Signing
Error and Exception Handling
Data Exposure (Applications)
Balancing Time and Quality
CSF what does it mean, phases (5)
Cybersecurity Framework NIST
(industrious physiques don’t ruin reputations)
Identify
Protect
Detect
Respond
Recover
RMF process NIST 800-37, 7 steps
Risk Management Framework (RMF)
NIST 800-37 Steps
(Perilous Cases Start In An Angry Mob)
Prepare - establish context and priorities
Categorize - based on impact of loss
Select - set of controls for a system based on risk assessment
Implement - controls and describe how they fit
Assess - controls for propiety
Authorize - system of controls to determine if risk is acceptable / reasonable
Monitor - system and controls for changes
DRM Tools (3)
Digital Rights Management
Tools:
[CAP]
Continuous Audit Trail
Automatic Expiration
Persistent Online Authentication
Supported Digital Signature Standards
NIST
DSA (FIPS 186-4)
RSA (ANSI x9.31)
ECDSA (ANSI x9.62)
Authorizing Official Decisions (RMF) (4)
[ACAD]
ATO authorization to operate
CCA common control authorization - used for inheritance when risk is acceptable
ATU authorization to use - used when third party providers servers are acceptable risks or for reciprocity of another AO’s ATO
DOA denial of authoriztion
Heirarchical MAC, grants … using predefined … for specific …
MAC is based on a … model. The … is based on … …
All users are assigned a … or … level.
All objects are assigned a … … Users can only access resources that correspond to a … … … to or … than theirs in the hierarchy.
grants access using predefined labels for specific labels
MAC is based on a hierarchical model. The hierarchy is based on security level. All users are assigned a security or clearance level. All objects are assigned a security label. Users can only access resources that correspond to a security level equal to or lower than theirs in the hierarchy.
OIDC, uses … , provides (2), is built on …
uses JSON web tokens
provides authentication and profile information for internet SSO,
it is built on OAuth 2.0 framework
Kerberos Process (6 steps), port, benefits (3)
Kerberos process:
See diagram
port 88
Easy for end users;
centralized control and
easy to administer.
KERBEROASTING
a …-… attack technique that attempts to obtain a … … of an … … account that has a … … … (“…”).
In such an attack, an … domain user requests a … ticket for an … , solutions (4)
a post-exploitation attack technique that attempts to obtain a password hash of an Active Directory account that has a Service Principal Name (“SPN”).
In such an attack, an authenticated domain user requests a Kerberos ticket for an SPN.
Prevention: HER G (Hygiene, Extraction, Restrict, Governance)
Practice good password hygiene for service accounts
Use long passwords (at least 25 characters) for service accounts
Regularly rotate passwords every 30 days
Implement group managed service accounts (gMSAs) or third-party solutions for automated password management
Institute proper governance for service accounts
Keep track of service accounts and their usage
Enforce the principle of least privilege for all service accounts
Follow NIST guidelines for password security, prioritizing password length over complexity and avoiding frequent password changes
Restrict access to the KRBTGT account password
Limit access to the KRBTGT password hash to minimize vulnerability to Golden Ticket attacks
Identify accounts with rights to extract password hashes and remove unnecessary permissions
Regularly change the KRBTGT password to invalidate any existing Golden Tickets
Use Microsoft’s KRBTGT account password reset script every 180 days
Prevent the extraction of service accounts
Create an inventory of all service accounts and their details
Maintain documentation for when accounts should be reviewed, deactivated, or deleted
Grant minimum privileges necessary for each service account
Change default passwords of service accounts
Use automated password management solutions to regularly rotate passwords
Use separate accounts for different services
Avoid using the same password for multiple service accounts
Promptly decommission service accounts that are no longer needed
Use tools to detect and manage inactive service accounts
Monitor service accounts for suspicious activity
Use a real-time auditing solution with machine learning for anomaly detection and response
Kerberos User Enumeration (attack), solution
brute-force attack on Kerberos
has a distinct advantage over attacks on other authentication methods: no domain account is required to perform the attack, just a connection to the KDC
there is a u in both enumeration and brute force and unrealistic
solution: detect unrealistic amounts of AS-REQ requests without follow-up requests
AS-REP Roasting, solution
attackers steal encrypted parts of a AS_REP message from user accounts in order to then crack them offline
AS-REP ends with P and preauthentication starts with P
solution: make sure all accounts in your domain have the Kerberos pre-authentication enabled
Golden Ticket Attack, what is it, solutions (6)
A golden ticket in Active Directory — much like its namesake for Willy Wonka’s chocolate factory — grants the bearer unlimited access. A Golden Ticket attack abuses the Kerberos protocol, which depends on the use of shared secrets to encrypt and sign messages.
P. L. Kurl is an oomploompa
solution: PLKURL
Protect against phishing attacks by training staff to identify suspicious emails and avoid sharing credentials.
Limit user privileges to necessary roles and only use admin accounts for administrative tasks.
Keep operating systems updated and disable plain text password storage in Active Directory to prevent Mimikatz-style attacks.
Use a real-time auditing solution to respond to failed login attempts with custom scripts to disable accounts, stop processes, change firewall settings, or shut down servers to prevent brute force attacks.
Regularly change the password for the KRBTGT user, doing it twice around 12-24 hours apart to avoid service disruptions.
Look for signs of a Golden Ticket attack, such as nonexistent usernames, username and RID mismatches, modified group memberships, weaker encryption types, and ticket lifetimes exceeding the domain maximum.
Secure VOIP practices (6)
US VAPI
disable Unnecessary ports and services
the use of SIPS and SRTP, both secure protocols that will keep VoIP traffic encrypted
a dedicated VLAN for VoIP devices to help separate them from other networked devices
Authentication implementation
Patching / updates
IDS / IPS
AIO book conflicts and says to use IDS / IPS
Best Authentication out of EAP, LEAP, PEAP and EAP-TLS without complexity
PEAP is the best solution. It encapsulates EAP in a TLS tunnel, providing strong encryption.
EAP is not protected
LEAP is a Cisco proprietary protocol that was originally designed to help deal with problems in WEP. LEAP’s protections have been defeated, making it a poor choice.
EAP-TLS is secure but requires client certificates, making it difficult to deploy and manage.
best option for providing free wireless to customers without need for accounts / passwords
WPA3 SAE (simultaneous authentication of equals) is new and best, if need to worry about older devices, WPA2 PSK should be used
SDWAN advantages (3)
PCS
predefined rules to optimize performance
continuous monitoring to support better performance
self-learning techniques to respond to changes in the network
802.1x authentication type and can be used with, supported by 3 802.1 standards
port based authentication (can be used on both wired and wireless)
can be used with EAP technologies
supported by 802.1AE, 802.1AR, 801.1AF
security concerns using SMS (4)
MESS
can be received by More than one phone,
messages are not Encrypted
messages can be Spoofed,
messages are typically Stored on the recipient’s phone
most common VPN protocols (5)
PPTP,
L2F,
L2TP,
IPsec
TLS
BCP Team Roles / Members (12)
HeLPS IT COMMAnD (e,n not used)
Human Resources
e
Legal Affairs
Procurement - Equipment and Supplies
Security
IT members from each major area
Transportation & Relocation
Crisis Management
Operations Assessment
Management
Media Relations
Administrative Support
n
Damage Assessment
Company Acquisition Concerns for Security (3)
the acquiring company usually acts like a DICk
DIC
Documentation of security policies
Integration of security tools
Consolidation of security functions
list of supply chain risks (6), 2 examples from practice tests
NIST 800-53
TPC VCS
Third party service providers or vendors – from janitorial services to software engineering -‐-‐ with physical or virtual access to information systems, software code, or IP. Poor information security practices by lower-‐tier suppliers. Compromised software or hardware purchased from suppliers. software security Vulnerabilities in supply chain management or supplier systems. Counterfeit hardware or hardware with embedded malware. Third party data Storage or data aggregators.
examples from practice tests:
adversary tampering with hardware prior to shipment to end customer
adversary using social engineering to compromise an employee of SaaS vendor to gain access to customer accounts
NIST SP 800-88 / Validation purpose
Validation processes are conducted to ensure that the sanitization process was completed, avoiding data remanence
Data Owners responsibilities (5)
Co Cla Set AS IS
Control Selection
Classifying the Data
Sets the Rules for use and protection of data
assisting with or Advising the System owners on security requirements
data owners are likely to ask that those responsible for control selection to Identify a Standard to use
Data processors legal requirements
Data processors are required to perform specific actions under regulations like the EU GDPR.
data stewards definition
are internal roles that oversee how data is used.
system owner security responsibilities (4)
system owner is down in the PIIT
develops system security Plan
Id’s security controls
Implements security controls
ensures system users receive appropriate security Training
CaaS
Containers as a service (CaaS) is a cloud service that allows software developers and IT departments to upload, organize, run, scale, manage and stop containers by using container-based virtualization. A CaaS provider will commonly provide a framework which allows users to make use of the service.
Reduced cost – Using CaaS allows an organisation to pay for only the services used, such as load balancing, scheduling and compute instances. CaaS can also help clients reduce infrastructure, software licensing and operating costs.
OAuth2, what is it, provides the ability to access … from another …, focus on….
protocol
provides the ability to access resources from another service,
focus on authorization - you’ve never signed up before
OIDC what is it, what is it used for and how it works, entities (2), 3 flows
OpenID Connect
standard to allow the use of an account from another service with an application,
builds on oauth2 and adds authentication
uses JSON Web Tokens (JWT)
entitiies:
relying party (target of access)
IdP (identity provider)
flows:
authorization code flow - request -> IdP -> authorization token -> use consent request -> authorization code -> ID token *preferred and more secure [R>I>AT>C>AC>IDT]
implicit flow - relying party request includes scope values *good for javascript or other serverless / browser-based request, less secure because ID token can be manipulated by user [RPR(scope values)>IDT]
hybrid flow (combo of two above)
SAML,
Standardized way to tell external applications and services that a … is … … … … …
SAML makes … technology possible by providing a way to … a user once and then … that … to multiple applications
primary role in online security is that it enables you to access … … applications using … set of login credentials
used to make … and … data
Security Assertion Markup Language
Standardized way to tell external applications and services that a user is who they say they are. (SAM is who he says he is)
SAML makes single sign-on (SSO) technology possible by providing a way to authenticate a user once and then communicate that authentication to multiple applications (Sam can use SSO)
primary role in online security is that it enables you to access multiple web applications using one set of login credentials (Sam uses SSO to sign on many places with one credential set)
used to make authorization and authentication data
XSS attack, what is it, how to prevent
Cross site scripting
malware script in site (e.g. bulletin board) which is hidden but can be unintentionally run by others who access the site
use script tags to prevent
CSRF,what is it, how does it work, how is prevented
Cross site request forgery,
an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. CSRF attacks exploit the trust a Web application has in an authenticated user.
use session tokens / keys to prevent
XACML,what is it (2 items) and what is it used for (3 items), 2 elements
eXtensible Access Control Markup Language
Markup Language and a processing model
Uses:
DSE
used to Describe access controls,
used as a means to Send an individual’s authentication information in a standard format (password, key or certificate),
can also be used to enforce policies
elements:
subject element
resources element
SPML,what is it and what does it allow, 3 entities
service provisioning markup language
allow platforms to generate and respond to provisioning requests
entities:
RA - requesting authority
PSP - provisioning service provider (software)
PST - provisioning service target
SOAP,what is it, how is it used, what is required for it to be used, components (3)
simple object access protocol
used for the exchange of information in decentralized, distributed application environments using XML over HTTP
can transmit SOAP messages in any way that the applications require, as long as both the client and the server use the same method.
components:
message envelope - defines the messages allowed and how they will be processed by recipient
encoding rules used to define data types
conventions for remote procedures / how to interpret responses
NIST 800-12
introduction to computer security
NIST 800-34 contingency planning steps (7)
contingency planning
as a contingency, Please Buy Personal Self Care Toiletries Mama
develop Policy BIA Identify Preventive controls create contingency Strategies develop information system Contingency plan Testing and Training plan Maintenance
NIST 800-86
Guide to Integrating Forensic Techniques into Incident Response
86 should have been media sanitization (deleting data) which would prevent forensic techniques from working, but media santization is 88
NIST 800-53A
Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans - covers methods for assessing and measuring controls
RFC 1918
nonroutable IP addresses (internal IP addresses)
in 1918 we thought the moon was non-routable
RUM,what is it and what is it used for
Real User Monitoring
a passive monitoring technique that records user interaction with an application or system to ensure performance and proper application behavior
RUM is often used as part of a predeployment process using the actual user interface
SSAE 18 SOC Compliance report
is an … standard for … organizations.
It is … by many industries and organizations for … that provide them services.
The examinations and audits of these Standards are known as … reports.
Statement on Standards for Attestation Engagements no. 18 (SSAE 18),
is an auditing standard for service organizations.
It is required by many industries and organization for vendors that provide them services.
The examinations and audits of these Standards are known as SOC reports.
SCAP, meaning, use and individual specifications (6)
Security Content Automation Protocol
A suite of specifications that standardize the format and nomenclature by which software flaw and security configuration information is communicated, both to machines and humans. Note: There are six individual specifications incorporated into SCAP:
VCP VOX
CVE (common vulnerabilities and exposures);
CCE (common configuration enumeration);
CPE (common platform enumeration);
CVSS (common vulnerability scoring system);
OVAL (open vulnerability assessment language); and
XCCDF (eXtensible configuration checklist description format).
SCE, what does it mean, what is it designed to do
The Script Check Engine (SCE) is designed to make scripts interoperable with security policy definitions.
Statement coverage
verify that every line of code was executed during the test
Condition coverage
verifies that every logical test in the code was executed under all sets of inputs
Pair programming, description, is what type of development technique which comes from what other type of technique,
Pair programming is an Agile software development technique originating from Extreme programming (XP) in which two developers team together on one computer. The two people work together to design, code and test user stories.
CSIRT,meaning and members - core (6) extendend (4) minimum (5)
cybersecurity incident response team
members -
core:
DICCIT
CISO
Director of Security Ops
IR Team lead
Cybersecurity Analyst
IT support
Threat Intelligence Analyst
extended:
BHeLP
HR
Legal counsel
PR
Business Unit Lead
minimum:
(e lips)
engineering/technical staff
legal representatives,
information security professionals,
public affairs staff, and
senior management,
NIST SP 800-137, factors that should be used for assessment / monitoring frequency (10)
According to NIST SP 800-137, organizations should use the following factors to determine assessment and monitoring frequency:
monitoring should be 24X7 not 13X7
VV WORMCORT
Volatility of security controls,
Vulnerability information,
Weaknesses identified in security controls,
Organizational risk tolerance,
Risk assessment Results,
Monitoring strategy review output,
Categorizations/impact levels for system security controls or specific assessments
Objects providing critical functions,
Reporting requirements.
Threat information,
Fagan Inspection / Code Review, process (6 steps)
a process of trying to find defects in documents (such as source code or formal specifications) during various phases of the software development process
a process of trying to find defects in documents (such as source code or formal specifications) during various phases of the software development process
P O P Is Real Fedup [POPIRF]
(planning, overview, prep, inspect, rework, followup)
Threat Modeling Process Overview for applications (4 steps)
threat MOdeling prOcess Overview
threat MOdeling cOmmOnly involves:
Mooo at the dairy
DA IR y M AC (y not used)
Decomposing the Application to understand it and how it interacts with other components or users.
Identifying and Ranking threats allows you to focus on the threats that should be prioritized.
identifying how to Mitigate those threats finishes the process.
once complete, an organization can take action to handle the threats that were identified with Appropriate Controls.
How a NoSQL database stores data
allows to store data using a key-value store
graph database, type of db and how it works
another example of a NoSQL database, but it
uses nodes and edges to store data rather than keys and values
Stages of Information Life Cycle (ILC) 2 types 1 with 5 phases 1 with 6 phases
C/R DUM D/S
Create / Receive
Distribute
Use
Maintain
Dispose / Store
or
ASU SAD
Acquisition
Storage
Use
Sharing
Archival
Disposal
Security Modes List / criteria list
Modes:
D Size Cups Mama (DSCM)
Dedicated
System High
Compartmented
Multi-level
For Each Mode:
Nice Cans Face Nookie Ass (NCFNA or SCANU)
Signed NDA
Clearance
Formal Approval
Need to Know
All users
Dedicated Security Mode
Signed NDA All Data
Proper Clearance All Data
Formal Access Approval All Data
Valid Need to Know All Data
All users can access All Data
System High Security Mode
Signed NDA All Data
Proper Clearance All Data
Formal Access Approval All Data
Valid Need to Know Some Data
All users can access Some Data
Compartmented Security Mode
Signed NDA All Data
Proper Clearance All Data
Formal Access Approval Some Data
Valid Need to Know Some Data
All users can access Some Data
Multi-level Security Mode
Signed NDA All Data
Proper Clearance Some Data
Formal Access Approval Some Data
Valid Need to Know Some Data
All users can access Some Data
What are the protocol(s) (14) of the Application Layer?, function
communication, file transfer, network management
PISS DDMMP iN FiLTH
POP3, SMTP, IMAP, SNMP, FTP, Telnet, HTTP, MIME, PGP (app), S/MIME (app), HTTPS (app), DNS, DHCP, NTP
POP3 - Post Office Protocol version 3
IMAP - Internet Message Access Protocol
SMTP - Simple Mail Transfer Protocol
SNMP - Simple Network Management Protocol
DNS - Domain Name Service
DHCP - Dynamic Host Configuration
MIME, S/MIME - Multipurpose Internet Mail Extensions
PGP - Pretty Good Privacy
NTP - Network Time Protocol
FTP - File Transfer Protocol
LPD - Line Printer Daemon
Telnet
HTTP - HyperText Transfer Protocol
function: formats data from applications for transmission over a network
What are the protocol(s) of the Presentation Layer?, function
GET JAMUM
GIF, TIFF, JPG, MPEG, MIDI character encoding (ASCII, UNICODE, EBCDIC)
compression, encryption
function: formats (serializes) data in a manner the receiving computer can understand
not really network protocols, only layer without real network protocols
What are the protocols (9) of the Session Layer?, function
(LNNPPRRSS)
L2TP - Layer 2 Tunneling Protocol
NFS - UNIX stateless Network File System
NetBIOS - MS network basic input output system
PPTP - Point-to-Point Tunneling Protocol
RPC - Remote Procedure Call
RTCP - RTP (Real-time Transport Protocol) Control Protocol
SQL - Structured Query Language
PAP - Password Authentication Protocol
SIP - session initiation protocol
function: creates session receiving application can understand, creating session, maintaining session, releasing session
What are the protocols (4) of the Transport Layer?, function
TRANsport / TRANsmission control protocol (TCP)
TUSQ
TCP, UDP, SCTP, QUIC
TCP - Transmission Control Protocol
UDP - User Datagram Protocol
SCTP - Stream Control Transmission Protocol
QUIC
Function: creates session between two computers to enable communication
What are the protocols(s) (5) of the Network Layer?, function
IP, RIP, ICMP, IGMP, OSPF
ORIIIP
IP - Internet Protocol
RIP - Routing Information Protocol
ICMP - Internet Control Message Protocol
IGMP - Internet Group Management Protocol
OSPF - Open Shortest Path First
function: insert information into packet header for addressing and routing, isolate to broadcast domains
if it starts with “I” it’s probably network layer (IMAP is exception, it’s application layer)
What are the protocols(s) of the Data Link Layer? (13) functions (3, 2 are sub functions)
ARP, ATM, RARP, SLIP, PPP, L2TP, Ethernet, ISDN, Wi-Fi, FCoE, FDDI, Token Ring
I SLAPT A FFEW VV
ISDN - Internet Services for Digital Network
SLIP - Serial Line Internet Protocol
L2TP - Layer 2 Tunneling Protocol
ARP / RARP - (Reverse) Address Resolution
Protocol
PPP - Point-to-Point Protocol
Token Ring
ATM
FDDI
FCoE- Fiber Channel over Ethernet
Ethernet
Wi-Fi
VLAN
VxLAN
function:
formats data for the physical transmission media
2 functions
LLC - logical link control, interfaces with network layer, flow control and error checking
MAC - media access control, interfaces with physical layer adds last header / trailer [framing] to before it hits wire and what volts to put on the wire 1 is +.5 volt / 0 is 0 volts
What are the devices (5), protocols (9) and functions (5) of the Physical Layer?
PCRAV 10 RIDS C FEW CD LiST
devices:
PCRAV
Pinouts,
voltages,
cables,
antennas,
radio waves
protocols:
10 RIDS C FEW
10BaseX
RS/EIA/TIA-422,423,449,485
ISDN - Integrated Services Digital Network
DSL - Digital Subscriber Line
SONET - Synchronous Optical Networking
ethernet
wifi
Fiber Optics
coaxial
Functions:
CD LiST
Convert bits to electromagnetic signals for transmission,
Synchronization,
Data rates,
Line noise
and Transmission techniques
What are the encryption(s) of the Transport Layer?
SSL2, SSL3, TLS (therefore the encryption in support of HTTPS, POP3S, FTPS)
since IPSec is built into IP6 network protocols, and can be used with IP6, think of that to remember that it’s in the network layer
SSL - Secure Socket Layer
TLS - Transport Layer Security
What are the encryption(s) of the Data Link Layer? (3)
WEP, TKIP, CCMP
WEP - Wire Equivalent Privacy
TKIP - Temporal Key Integrity Protocol
CCMP - Counter-Mode/CBC-MAC Protocol
What are the encryption(s) of the Network layer?
IPSec Transport ESP
IPSec Tunnel ESP
(RC5, DES, AES)
What are the SW/HW of the Application Layer?
Gateways and Proxies
What are the encryptions (1 creates 4) of the Presentation Layer?
SSH (therefore, the encryption in support of S-FTP, S-HTTP, PGP, S/MIME)
What are the device(s) of the Network Layer?
Router, L3 Switch
What are the HW device(s) of the Data Link Layer?
L2 Switch, Bridge
What are the HW devices of the Physical Layer?
Hub, repeater
What is the firewall of the Application, Presentation, and Session Layer?
Proxy Firewall
What is the firewall of the Session and Transport Layer?
Circuit (SOCKS) Firewall
What is the firewall of the Network Layer?
Packet Filter Firewall
CHAP, what is it, how does it work, process (3 steps), how is password sent
A three-way handshake (challenge/response) authentication protocol used for remote access connections. Both devices are configured with a password called a shared secret. For unique user authentication, this value is associated with a user account. The challenge/response authentication mechanism occurs in three steps:
The server generates a challenge message and sends it to the client. The client responds with the username and a value created using a one-way hash function on the challenge message. The server checks the response against its own value created using the same hash. If the values match, the client is authenticated.
With CHAP, plaintext versions of the password are never sent; only the hashed challenge message is sent between devices.
RADIUS 2 benefits
Allows users to use Normal credentials across trusted networks.
Allows users in one organization to authenticate and access resources on another trusted organizations network using one set of credentials
CDN Benefits (4)
Lower latency for clients, especially for applications in which
multiple round-trips are required to load content.
Large scaling to better handle instantaneous high loads, such
as the start of a product launch event.
Reduce the traffic sent to the origin server, as requests are
handled by the edge servers.
Provides protection from DoS attacks
3 ways CDN provide DDoS protection
RAVing about CDN
A content delivery network provides DDoS protection by
design, by being able to absorb Volumetric attacks.
CDN also
include Always-on traffic monitoring,
and Real-time mitigation of
common network-level attacks.
zigbee, what it enables, designedfor, which IEEE specification, networks secured by…, rate of transmission, best suited for…
ZigBee speed range
ZigBee # of devices
ZigBee frequency
An IoT standard based protocol. Zigbee is a standards-based wireless technology that enables wireless machine-to-machine (M2M) and IoT networks.
It is designed for low-data rate, low-power applications, and is an open standard. Zigbee is a specification based on IEEE 802.15.4
Its networks are secured by 128-bit symmetric encryption keys. Zigbee has a defined rate of 250 kbps, best suited for intermittent data transmissions from a sensor or input device.
40-250 kbps
65,000
868 mhz to 2.4 ghz
Z-Wave, define, uses what encryption (same as zigbee), how many nodes permitted?
Z-Wave speed range
Z-Wave # of devices
Z-Wave frequency
IoT standard based protocol. Simpler and less expensive than Zigbee. Z-Wave was created by a Danish company named Zensys. It uses the same AES-128 symmetric encryption as Zigbee.
Like Zigbee, Z-Wave devices all link up together to form a mesh network. There’s one central hub that connects to the internet and then the devices themselves don’t have Wi-Fi at all, they use Z-Wave connectivity to talk to the hub either directly or through the mesh network. This is called a “source-routed mesh network topology.” Z-Wave allows up to 232 nodes on the mesh network.
9.8-100 kbps
232
908.42 mhz in North America
DKIM, what is it, what is it used for, how does it work
DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect forged sender addresses in email (email spoofing), a technique often used in phishing and email spam.
Works by leveraging PKI
DKIM allows the receiver to check that an email that claimed to have come from a specific domain was indeed authorized by the owner of that domain.[1] It achieves this by affixing a digital signature, linked to a domain name, to each outgoing email message.
DKIM is an Internet Standard.[3] It is defined in RFC 6376, dated September 2011, with updates in RFC 8301 and RFC 8463.
NAC captive portal definition / limitations (4)
captive portal is a web page accessed with a web browser that is displayed to newly connected users of a Wi-Fi or wired network before they are granted broader access to network resources
Limitations: CBDM
may be Circumvented
Dns tunneling
Mac spoofing
require web Browser
WPA3 security has new authentication mode known as what?,
benefit of this authentication mode?
Describe 3 operational modes with some technical detail and their benefits
WPA3-Personal (WPA3-SAE). This mode focuses on improving protection for individual users by providing better security using SAE. SAE increases security over WPA2, even when using a simple password.
Operational Modes: PEE (W PEE A THREE)
Personal mode lets users choose easy-to-remember passwords while still providing increased security using perfect forward secrecy to protect data traffic.
WPA3-Enterprise. Enterprise mode builds on top of the previous WPA2 Enterprise mode. However, enterprise mode requires the use of Protected Management Frames on all WPA3 connections. Enterprise mode also has multiple Extensible Authentication Protocol (EAP) methods for authentication, 128-bit authenticated encryption, 256-bit key derivation and confirmation, as well as 128-bit management frame protection.
Wi-Fi Enhanced Open. This extra mode focuses on increasing privacy in open networks. Enhanced Open mode prevents passive eavesdropping by encrypting traffic even when a password isn’t used. This mode uses 256-bit authenticated encryption, 384-bit key derivation and confirmation, as well as 256-bit management frame protection.
SAE, define, variant of x, based on y key exchange,
doesn’t use DH because DH has no z mechanism,
resulting key is influenced by a preshared key and what?
In cryptography, Simultaneous Authentication of Equals (SAE) is a password-based authentication and password-authenticated key agreement method
SAE is a variant of the Dragonfly Key Exchange defined in RFC 7664,[2] based on Diffie–Hellman key exchange using finite cyclic groups which can be a primary cyclic group or an elliptic curve.[1] The problem of using Diffie–Hellman key exchange is that it does not have an authentication mechanism. So the resulting key is influenced by a pre-shared key and the MAC addresses of both peers to solve the authentication problem.
WPA3 vs. WPA2, 5 points
BiG SIS (i not used)
Bigger session keys
GCMP WPA2 uses AES for encryption, while WPA3 uses the more secure GCMP
SAE protocol
Individualized data encryption
Stronger brute-force attack protection
GCMP, what does it mean, what type of cryptography, what makes it special, what is it used for (12 technologies)
Galois/Counter Modea mode of operation for symmetric-key cryptographic block ciphers which is widely adopted for its performance. GCM throughput rates for state-of-the-art, high-speed communication channels can be achieved with inexpensive hardware resources
used in:
MWATTS OSWIFT
MACsec (IEEE 802.1AE Ethernet security)
WiGig (ieee 802.11AD),
AES-GCM
TLS 1.2[9][10]
TLS 1.3.[11]
SSH,[8]
OpenVPN since version 2.4.
SoftEther VPN server and client,
WPA3-Enterprise Wifi security protocol,
IPsec standards
ANSI (INCITS) Fibre Channel Security Protocols (FC-SP),
Tape storage IEEE P1619.1 t
MAC flooding, how does it work, equipment note, solutions (3)
attack works by forcing legitimate MAC table contents out of the switch and forcing a unicast flooding behavior potentially sending sensitive information to portions of the network where it is not normally intended to go
solutions:
Mac davis flooding the airwaves at 8pm
network operators usually rely on the presence of one or more features in their network equipment:
port security
MAC filtering
IEEE 802.1X
VLAN hopping definition, types and mitigation of each type (2)
gain access to traffic on other VLANs that would normally not be accessible and is mitigated through proper vlan configuration
switch spoofing - mitigated by ensuring that ports are not set to negotiate trunks automatically by disabling DTP on ports that are not meant to be trunks and explicitly configured as access ports
double tagging - mitigated by not putting any hosts on VLAN 1 (The default VLAN). i.e., assign an access VLAN other than VLAN 1 to every access port, Change the native VLAN on all trunk ports to an unused VLAN ID and Explicit tagging of the native VLAN on all trunk ports. Must be configured on all switches in network autonomy
IP spoofing how and how to stop (2)
IP address spoofing or IP spoofing is the creation of Internet Protocol (IP) packets with a false source IP address, for the purpose of impersonating another computing system
solutions: packet filtering and do not allow authentication based on IP address1
IEEE 802.3
IEEE 802.3 is a working group and a collection of standards defining the physical layer and data link layer’s media access control (MAC) of wired Ethernet
IEEE 802.15
IEEE 802.15 is a working group of the Institute of Electrical and Electronics Engineers (IEEE) IEEE 802 standards committee which specifies Wireless Specialty Networks (WSN) standards. WPAN / Bluetooth
IEEE 802.15.5
Mesh networking
IEEE 802.15.7
7 is an inverted L (for LiFi)
Visible Light Communication / LiFi
IEEE 802.15.13
Multi-Gigabit/s Optical Wireless Communications
lay 3 on left side for M in Multi-Gigabyte
SRTP what does it stand for, what OSI layers, 4 services
Secure Real-time Transport Protocol
Secure Real-time Transport Protocol (SRTP) is a profile for Real-time Transport Protocol (RTP) intended to provide encryption, message authentication and integrity, and replay attack protection to the RTP data in both unicast and multicast applications
between transport and application layer
provides
CREM
confidentiality,
replay protection
encryption,
message authentication
SRTP (4 services) vs SIPS / SIP TLS (2 services), services provided
E AIR
SRTP is an RTP profile intended to provide Encryption, message Authentication and Integrity, and Replay attack protection to the RTP data.
PI
SIP TLS protocol aims primarily to provide Privacy and data Integrity between two or more communicating computer applications.
NAT vs PAT
NAT maps public to private via IP address
PAT maps public to private via port#
PAT more efficient as it can use one public address for many different internal devices
BIA process (5 steps)
Business Impact analysis
Business Is:
Protect Real Life Investment Revenue
(id Priorities, id Risks, Likelihood, Impact, Resource priorities)
Communication threats (5)
RIDEM
(Replay, Impersonation, Modification, Eavesdropping, Denial of service)
serverless, definition, benefits, aka
Like microservices, each function is made to work independently and
autonomously. It does not hold resources in volatile memory; computing in short bursts with the results
persisted to storage.
Cost is based on actual use. When the app is not in use, no compute resources are used.
Elasticity: resources expand, or contract based on the need.
Scalability: we scale resources to meet expected needs.
aka: FaaS (only functions)
Vigenere Cipher
uses a matrix (vigenere square) X axis is plain teXt / Y axis is keY
IPSec Modes (2)
Transport Mode (Only data encrypted)
Tunnel Mode (entire packet encrypted)
TCP Flags mnemonic
Nosetackles Can Easily Upend Any Puny Runningback Sneaking the Football or first 3 not used, Unskilled Attackers Pester Real Security Folks
NS (not used anymore)
CWR (not used anymore)
ECE (not used anymore)
URG urgent
ACK acknowledgement
PSH push
RST reset
SYN synchronizeing
FIN finish
CMM(I) levels (5 steps), aka
Capability Maturity Model Integration
I Rarely Develop My Own
1 Initial -undocumented and not consistent
2 Repeatable - some processes are repeatable, process might be strictly controlled
3 Defined - documented processes and standards
4 Managed - metrics used for performance measurement and process users are competent
5 Optimizing - focus on continuous improvement
SWMM
Authentication Header provides… (2)
provides integrity and non-repudiation
ABAC, often used in…?
Attribute Based Access Control
grants access based on attributes (often used in SDN’s)
network access server within RADIUS
is a client
ALE / SLE (formula)
ALE = ARO*SLE [Ale = A RO SlE]
SLE = AV * EF
SLE single loss expectancy
AV asset value
EF exposure factor
ALE = ARO * SLE
or
ALE = ARO * AV * EF
BCP high level processes (2 with 4 steps each)
SPAT
(strategy, provisioning, approval, training)
SICA
(scope, impact, continuity, approval)
Incident Response process (8 steps)
[Pathetic Dirty Rotten Mean REPublicans RECruit REMarkable Losers]
preparation
detection, search for indicators, declaration of incident
response, (initial response, contain damage)
mitigation, (eradicate threat actor, determine details of attack and how to mitigate and perform mitigation)
reporting,
recovery, (restore full functionality of business process)
remediation, (prevent future incidents)
lessons learned (continuous improvement)
PASTA steps (7)
Process for Attack Simulation and Threat Analysis
Pasta, It’s a bowl of alphabet soup
DO DTS ADA TA VA AMS RAM
(determine objectives,
define tech scope,
application decomp analysis,
threat anal,
vulnerability anal,
attack modeling simulation,
risk anal mngmt)
SAMM Elements (5), Each element has 3 security practices
Software Assurance Maturity Model - from OWASP focused on secure software development
Business functions:
[Giving Developers Incentive Via Offers]
Security practices
SPE, TRA, BDD, ART, IEO
Governance, (strategy / metrics, policy / compliance, education / guidance) SPE
Design, (threat assessment, security requirements, secure architecture) TRA
Implementation, (secure build, secure deployment, defect management) BDD
Verification, (architecture assessment, testing driven by requirements, security testing) ART
Operations (incident management, environment management, operational management) IEO
Application attack types (4)
RoBBoT
Rootkits
Buffer overflow,
Backdoors,
TImeofchecktotimeofuse TOCTOU (asynchronous attack)
Auditing activities (8)
A DAM LIAR
(alarm triggers,
data reduction,
analysis of logs,
monitoring,
logging,
IDS,
alert usage,
review of logs)
Authorization mechanisms (7)
IAACCCC (implicit deny, ACL, ACM, capability tables, constrained xfaces, content, context)
COBIT elements (6)
GOD HO ST GOS TA EN
(GOvernance is Dynamic,
HOlistic approach,
STakeholder value,
GOvernance Separate from mgmt,
TAilored to entity,
ENd to end)
Computer Crimes (6)
[The Mother Fuckers Better Takeoff Running]
(terrorism,
military,
financial,
business,
thrill,
revenge)
Control Classification (7)
CCDDDPR
(corrective,
compensating,
detective,
deterrent,
directive,
preventive,
recovery)
Data Classification Criteria (9)
DATa LIVe SUM
(disclosure damage,
age,
timeliness,
lifetime,
implications of disclosure to business or national security,
value,
storage,
usefulness,
modification damage, )
Elements of Cable Plant (5)
BEETH
(Backbone distribution,
Entrance facility,
Equipment room,
Telecommunication room,
Horizontal distribution)
Evaluating access control attacks involves what 3 total risk related things
VAT
(vulnerabilities,
assets,
threats)
Halon subs (8)
FF AI CLAN
(FM200,
FE13,
Argonite,
Inergen,
CEA410/308,
Low pressure water mist,
Aragon,
NAFSIII)
Memory addressing methods (5)
BIRDI
(base+offset,
immediate,
register,
direct,
indirect)
Processing States (5)
RRSSW
(ready,
running,
supervisory,
stopped,
waiting)
Sabotage prevention (4)
CAMO
(compensation / recognition of excellence,
auditing,
monitoring,
open communication)
Symmetric Encryption Modes (7)
Symmetric Encryption Modes with IV (3)
Authenticated Modes (2)
which modes propagate errors (2)
ECCCCOG
ECB, electronic code book - block is always encrypted using only the key, a certain plain text will always result in same cipher text
CBC, cipher block chaining - unencrypted text is xor’d with block of cipher text resulting from previous block before encyption, first block uses IV or ECB of key, errors DO propagate
CFB, cipher feedback - streaming version of cbc using memory buffers instead of blocks, errors DO propagate
CTR, similar to ofb but uses counter increments instead of seed value to XOR plaintext, errors DO NOT propagate
CCM, counter with cbc - ctr with confidentiality mode (used only with 128 bit block lengths) uses a nonce which is changed with each transmission, results in authenticity added
OFB, output feedback - similar to cfb but instead of using previous block, it uses a seed value to XOR the plaintext, IV is used to create first seed value, no chaining, errors DO NOT propagate
GCM, galois / counter mode - ctr + authenticity controls by using authentication tags to encryption process
ECB should be used on short mesages only
With IV
CCO
(CBC,
CFB,
OFB)
Authenticated Modes: (authenticity added - all other modes only provide confidentiality)
GCM,
CCM
propagation of errs:
CBC
CFB
Threat ranking methods (3)
PD HML DREAD
(Probability X Damage Potential,
H/M/L,
DREAD)
Threat rating model criteria (5)
DREAD
(damage,
reproducibility,
exploitability,
affected users,
discoverability)
Virus propagation (4)
BI FI MI SI
Bootsector Infection,
File Infection,
Macro Infection,
Service Injection,
Security Models List mnemonic
Bill Belichik Loves Great Head Coaches Big Nose Tackles
(Bell-La Padula,
BIBA,
Lattice,
Graham-Denning,
HRU,
Clark-Wilson,
Brewer-Nash,
Non-Interference,
Take / Grant)
DEP, what does it mean, what does it do
data execution prevention - prevents damage from malware by not allowing execution in Windows reserved memory locations
Number of Symmetric keys required:
n(n-1)/2, where n = number of users
Number of Asymmetric keys required
2n, where n = number of users
Digraph Attack
frequency analysis with two letter combos
SOC Type 1
review of description provided by management, specific point in time
RFC 1087
Privacy
High Level Cyber Supply Chain Security Principles (3)
Cyber Supply Chain Security Principles:
Since it’s high level it’s the BIG picture
BIG (breaches happen so develop defenses for them, IT isn’t only concern, Gaps will exist between physical and cybersecurity)
Develop your defenses based on the principle that your systems will be breached. When one starts from the premise that a breach is inevitable, it changes the decision matrix on next steps. The question becomes not just how to prevent a breach, but how to mitigate an attacker’s ability to exploit the information they have accessed and how to recover from the breach. Cybersecurity is never just a technology problem, it’s a people, processes and knowledge problem. Breaches tend to be less about a technology failure and more about human error. IT security systems won’t secure critical information and intellectual property unless employees throughout the supply chain use secure cybersecurity practices. Security is Security. There should be no gap between physical and cybersecurity. Sometimes the bad guys exploit lapses in physical security in order to launch a cyber attack. By the same token, an attacker looking for ways into a physical location might exploit cyber vulnerabilities to get access.
divestiture security risks (5)
CA CA SP RC IP
Which security measures will be in place for Continuity of Access?
How employees will Access Business-critical applications and systems as the divestiture proceeds. (Critical App access)
The buyer’s and seller’s Security Policies. Are their policies compatible, or will additional training be needed before employees transfer to the new business unit?
Are there Regulatory and IT Compliance issues requiring additional training before the divestiture concludes?
Are there issues with Intellectual Property custody and protection as per the divestiture agreement or not covered by the agreement.
SAML, most commonly used to
It is more commonly used to help enterprise users sign in to multiple applications using a single login (i.e. provide sso for enterprise users)
PaaS vs CaaS
PaaS focuses on code stack infrastructure, while CaaS offers more customization and control over applications and services. Pay for a period of time, no matter what is used.
As a result, CaaS is better suited to emerging frameworks, such as microservices. Pay as you use. Timed use. CaaS must be started, stopped
blind [IP Address] spoofing, what is it, most effective for…, solutions (3)
Peaky blindER packets - to remember the solutions
A type of network attack where the sequence ACK numbers cannot be attained. Packets are sent to the target to obtain a sampling of the sequence numbers so that the attacker can generate a valid sequence number for the attack. Mostly used to attack older machines. Newer machines use random sequence number generation.
Solutions:
PER
use Packet filtering;
use Encryption on routers for inbound traffic; and
Reject packets with incorrect network origin.
non-blind spoofing, what is it, prevented by (3)
A type of network attack which occurs when the attacker is on the same subnet as the victim. The attack sniffs the sequence and ACK numbers and uses them to hijack the session.
Solutions:
You don’t have to be blind to give some EFS
enable Encryption on a router for outside connections
use ingress Filters on packets to filter inbound traffic
use Secure protocols to connect to other systems
Man-in-the-Middle attack (MITM), what is it, can be accomplished how (2), solutions (4)
A type of network component attack where the attacker intercepts communications between two trusted hosts. The attacker gains the ability to view and change the information sent, and to forward it undetected.
The attack can be accomplished using ARP cache poisoning or ICMP redirect.
Solutions:
MITM might SEEM like he’s not there.
SEEM
prevented by using Secure connections (HTTPS, SSL, TLS, VPN),
Endpoint detections,
Education
MFA,
MAC Flooding attack, what is it, prevented by (4)
A type of network component attack in which the attack is connected to a switch and “floods” the switch with a large number of different fake MAC address sources.
Prevented by:
Hey MAC, avoiding a flood is SIMPle.
Segmentation of network
IDS
MAC address filtering:
Port security
802.1Q and Inter-Switch Link (ISL) protocol attack, solutions (2)
type of network component attack. It is a tagging attack that occurs when a user on a VLAN gets unauthorized access to another VLAN.
Solutions:
ISL (I Still Love) D FC (Deep Fried Chicken)
Dynamic Trunking Protocol (DTP) on all non-trusted ports
Following Configuration guidelines for the switch.`
Double-Encapsulated 802.1.Q nested VLAN attack
remember this one as it’s Nested which is starts with the same letter as Native
A type of network component attack where an attack can cause traffic to hop VLANS by injecting packets that are double-tagged in an 802.1Q VLAN.
Clear the native VLAN from all 802.1Q trunks or pick an unusual VLAN as the native VLAN.
