Sunflower PDF Flashcards
CIA
Confidentiality, Integrity, Availability
CIA - Negative
Disclosure, Alteration, destruction
Confidentiality
Prevent unauthorized disclosure, need to know, and least privilege. Assurance that information is not disclosed to unauthorized programs, users, processes, encryption, logical and physical access control
Violations - Disclosure - most are a result of human error, oversight, or ineptitude.
Integrity
no unauthorized modifications, consistent data, protecting data or a resource from being altered in an unauthorized fashion. ensures that data is not altered without authorization
Availability
reliable and timely, accessible, fault tolerance and recovery procedures, WHEN NEEDED
IAAA
requirements for accountability.
Identification, Authentication, accountability, Authorization
Identification
user claims identity, used for users access control
Authentication
testing of evidence of users identity
Verifies the claimed identity of system users and is a major function of cryptosystems
Accountability
determine actions to an individual person
Authorization
rights and permissions granted
Privacy
Level of confidentiality and privacy protections.
protecting personal information from disclosure to any unauthorized individual or entity
Risk
Not possible to get rid of all risk. Get risk to acceptable/tolerable level
ISO 27005
risk management frame work
ISO Respnsibilities
Written Products - ensure they are done CIRT - Implement and Operate Security Awareness - Provide leadership Communicate - Risk to higher management Report to as high a level as possible Security is everyone's responsibility
Control Frameworks
Consistent - Approach & application Measurable - way to determine progress Standardized - All the Same Comprehension - examine everything Modular - to help in review and adaptive. layered, abstraction
Due Care
to do all that you could have reasonably done to try and prevent security breach/ compromise / disaster, and took the necessary steps required as countermeasures / controls (safeguards). The benefit of “due care” can be seen as the difference between the damage with or without “due care” safeguards in place. AKA doing something about the threats, failing to perform periodic security audits can result in the perception that due care is not being maintained
Due Diligence
means that the company properly investigated all of its possibly weaknesses and vulnerabilities AKA understanding the threats
What is a man-in-the-middle attack
an attack in which a malicious user is positioned between the the 2 endpoints of a communication’s link
what is a reply attack
a malicious user records the traffic between a client and a server and then retransmits them to the server with slight variations of the timestamp and source ip address. it is similar to hijacking
What is a sniffer attack
Any Activity that results in a malicious user obtaining information about a network or the traffic over that network. Data is captured using a sniffer or protocol analyzer.
What is a spamming attack
Directing floods of messages to a victim’s email inbox or other messaging system. Suck attacks cause DoS issues by filling up storage space and preventing legitimate messages from being delivered
List the security features offered by the Network layer of the OSI model.
The Network layer (layer 3) offers confidentiality, authentication, and integrity.
What are the five generation types of firewalls?
Static packet filtering, application-level gateway, stateful inspection, dynamic packet filtering, and kernel proxy
What is a Proxy
Any system that performs a function or requests a service on behalf of another system. Proxies are most often used to provide clients with Internet access while protecting their identity.
What are network and protocal security mechanisms
everything we just reviewed
Protocol services used to connect to LAN and WAN communication Technologies
Frame Relay, SMDS, SDH, SONET, X.25, ATM, SDLC, HDLC, ISDN
How are PVC, SVC, DTE, and DCE used in a Frame Relay network
Frame relay requires the use of a DTE and a DCE at each connection point. PVC is always available; SVC is established using the best paths currently available.
Remote access authentication mechanisms
Radius, Diameter, Tacacs, Tacacs+
What is tunneling, and why is it used?
A process that protects the contents of packets by encapsulating them in another protocol. This creates the logical illusion of a communications tunnel through an untrusted intermediary network.
What is a VPN?
A virtual private network (VPN) is a communication tunnel that provides point-to-point transmission of both authentication and data traffic over an intermediary network.
What are some common VPN protocols?
PPTP, L2TP, SSH, and IPsec (Note: SSL/TLS is a valid VPN protocol as well, but it’s not necessarily recognized on the exam as such.)
What are the two modes available through IPsec, and what do they do?
In transport mode, the IP packet data is encrypted, but the header is not. In tunnel mode, the entire IP packet is encrypted, and a new header is added to govern transmission through the tunnel.
What is NAT?
Network Address Translation (NAT) allows the private IP addresses defined in RFC 1918 to be used in a private network while still being able to communicate with the Internet.
What is transparency?
A characteristic of a service, security control, or access mechanism that ensures it is unseen by users
What are some important aspects to consider when designing email security?
Nonrepudiation, access control, message integrity, source authentication, verified delivery, acceptable use policies, privacy, management, and backup and retention policies
What are possible mechanisms for adding security to email?
S/MIME, MOSS, PEM, and PGP
What are elements of effective user training against social-engineering attacks?
Always err on the side of caution whenever communications are odd or unexpected. Always request proof of identity. Identify what information can be conveyed via voice communications by classifying the information. Never change passwords over the phone.
What are the most common threats against communication systems?
Denial of service, eavesdropping, impersonation, replay, and modification
What are some countermeasures to eavesdropping?
Maintaining physical access security, using encryption, employing one-time authentication methods
What is an ARP attack?
The modification of ARP mappings. When ARP mappings are falsified, packets are not sent to their proper destination. ARP mappings can be attacked through spoofing. Spoofing provides false MAC addresses for requested IP addressed systems to redirect traffic to alternate destinations.
What is privacy?
Prevention of unauthorized intrusion, knowledge that information deemed personal or confidential won’t be shared with unauthorized entities, freedom from being observed without consent
What are the requirements for accountability?
Identification, authentication, authorization, and auditing
What is nonrepudiation?
Nonrepudiation prevents a subject from claiming not to have sent a message, not to have performed an action, or not to have been the cause of an event.
Prevents masquerading
What is layering?
Layering is the use of multiple controls in a series. The use of a multilayered solution allows for numerous controls to be brought to bear against whatever threats occur.
How is abstraction used?
Abstraction is used to collect similar elements into groups, classes, or roles that are assigned security controls, restrictions, or permissions.
What is data hiding?
Data hiding is preventing data from being known by a subject. Keeping a database from being accessed by unauthorized visitors is a form of data hiding.
What is change control or change management?
A mechanism used to systematically manage change. Typically, it involves extensive logging, auditing, and monitoring of activities related to security controls and security solutions.
What are the goals of change management?
Implementation of changes in an orderly manner, formalized testing, ability to reverse changes, ability to inform users of changes, systematical analysis of changes, minimization of negative impact of changes
What is data classification?
Data classification is the primary means by which data is protected based on categories of secrecy, sensitivity, or confidentiality.
What criteria are used to classify data?
Usefulness, timeliness, value or cost, maturity or age, lifetime or expiration period, disclosure damage assessment, modification damage assessment, national or business security implications, storage
What is the government/military data classification scheme?
Top secret, secret, confidential, sensitive, and unclassified
What is the commercial business/private sector classification scheme?
Confidential, private, sensitive, public
What are the elements of a termination procedure policy?
Have at least one witness; escort terminated employee off the premises immediately; collect identification, access, or security devices; perform exit interview; disable network account
What is the function of the data owner security role?
The data owner is responsible for classifying information for protection within the security solution.
What is the data custodian security role?
The data custodian is assigned the tasks of implementing the prescribed protection defined by the security policy and upper management.
What is the function of the auditor security role?
The auditor is responsible for testing and verifying that the security policy is properly implemented and the derived security solutions are adequate.
What should the documents that make up a formalized security structure include?
Policies, standards, baselines, guidelines, and procedures
What is generally involved in the processes of risk management?
Analyzing an environment for risks, evaluating each risk as to its likelihood and damage, assessing the cost of countermeasures, and creating a cost/benefit report to present to upper management
What should be considered when establishing the value of an asset?
Cost of purchase, development, maintenance, acquisition, and protection; value to owners/users/competitors; equity value; market valuation; liability of asset loss; and usefulness
What are the basics distinctions between qualitative and quantitative risk analysis?
Quantitative risk analysis assigns real dollar figures to the loss of an asset. Qualitative risk analysis assigns subjective and intangible values to the loss of an asset.
What are the four possible responses by upper/senior management to risk?
Reduce/mitigate, assign/transfer, accept, or reject/deny
What is residual risk?
Once countermeasures are implemented, the risk that remains is known as residual risk. Residual risk is the risk that management has chosen to accept rather than mitigate.
What is total risk?
The amount of risk an organization would face if no safeguards were implemented. A formula for total risk is threats * vulnerabilities * asset value = total risk.
What is the controls gap?
The difference between total risk and residual risk. The controls gap is the amount of risk that is reduced by implementing safeguards.
What are the three learning levels of security?
Awareness, training, and education
What are the three types of plans employed in security management planning?
A strategic plan is a long-term plan that is fairly stable. The tactical plan is a midterm plan that provides more details. Operational plans are short term and highly detailed.
How many primary keys may each database row have?
One - A primary key is a key which has been chosen to be the principal (or primary) representative attribute for that row of data. The primary key is unique and that attribute is then used throughout the database and is accessed and passed around to other tables as the representative attribute for the data in question.
In practice, the primary key attribute is also marked as NOT NULL in most databases, meaning that attribute must always contain a value for the record to be inserted into the table.
What type of malicious code spreads through the sharing of infected media?
Viruses
What term is used to describe intelligent code objects that perform actions on behalf of a user?
Agent
What term is used to describe code sent by a server to a client for execution on the client machine?
Applet
What type of database key enforces relationships between tables?
Foreign key
What security principle ensures that multiple records are created in a database table for viewing at different security levels?
Polyinstantiation
What process evaluates the technical and nontechnical security features of an IT system?
Certification and accreditation
What type of accreditation evaluates the systems and applications at a specific, self-contained location?
Site accreditation
In which phase of the Software Capability Maturity Model do you often find hardworking people charging ahead in a disorganized fashion?
Initial
What system mode requires that the system process only one classification level at a time and all system users have clearance and need to know that information?
Dedicated security mode
What can antivirus programs do when they encounter a virus infection?
Delete the file, disinfect the file, or quarantine the file.
What type of virus modifies itself each time it infects a new system in an attempt to avoid detection?
Polymorphic virus
Where are passwords stored in a Unix or Linux system?
In the /etc/shadow file, much older systems may still use /etc/passwd.
What is the cornerstone of computer security?
Education
what are the Symmetric Encryption Algorithms
32BRAIDS
3DES, 2fish, Blowfish, RC4-6, AES, IDEA, DES, Serpent
What are the Asymmetric Encryption Algorithms
DEERQ
Diffe-Hellman, ElGamal, Elliptic curve, RSA, Quantum
What are the three phases of the three-way handshake used by TCP/IP?
SYN, SYN/ACK, ACK
How does the teardrop attack operate?
It sends overlapping packet fragments to the victim machine.
A teardrop attack is a denial-of-service (DoS) attack that involves sending fragmented packets to a target machine. Since the machine receiving such packets cannot reassemble them due to a bug in TCP/IP fragmentation reassembly, the packets overlap one another, crashing the target network device.
What is the term used to describe a secret method used by a programmer to gain access to the system?
Trap door (or back door) or maintenance hook
XOR
1 XOR 1 = 0
1 XOR 0 = 1
0 XOR 0 = 0
What term describes a mathematical function that easily produces output values for each possible combination of inputs but makes it impossible to retrieve the input values?
One-way function also a hash
hashes are also known as the following: message digest, hash value, hash total, CRC, fingerprint, checksum, and digital ID
What is the purpose of a Cipher
Obscure the meaning of a message
True or false? All codes are meant to obscure the meaning of a message.
False - Code Words and help provide the meaning of a message
What occurs when a change in the plain text results in multiple changes spread throughout the cipher text?
Diffusion
What type of cipher is the Caesar cipher?
Simple substitution
Kerckhoffs’s principle
A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
– Auguste Kerckhoffs
What is the length of the key used by the standard DES algorithm?
56 bits (8bits are used for parity (error correcting)
How many rounds of encryption does DES utilize?
16
IDEAS
International Data Encryption Algorithm Block cipher and free for public use 128-bit key 64-bit block used in PGP Intended as a replacement for DES
What encryption algorithm was selected for the Advanced Encryption Standard (AES)?
Rijndael
AES
Advanced Encryption Standard or Rijndael
128, 192, 256-bit key, 128-bit block
first and only publicly accessible cipher approved by the US NSA for top secret information
What is the Diffie-Hellman algorithm most commonly used for?
Key exchange
HMAC
Hashed Message authentication code implements a partial digital signature - it guarantees the integrity of a message during transmission. It does not provide nonrepudiation HMAC-SHA256 ... Variable Hash value length adds Authentication and Integrity
What are the three encryption algorithms supported by the Digital Signature Standard?
DSA - Digital Signature Algorithm
RSA - Rivest-Shamir-Adleman
ECDSA - Elliptic Curve Digital Signature Algorithm
Think Asymmetric Encryption Algorithms
What ITU standard describes the contents of a digital certificate?
X.509
What is the process by which you are issued a digital certificate?
Enrollment
Who issues digital certificates?
Certificate authorities (CAs)
What is PEM
Privacy Enhanced Mail - An email encryption mechanism that provides authentication, integrity, confidentiality, and nonrepudiation. PEM is a layer 7 protocol
What protocol uses the RSA encryption algorithm to provide encrypted mail support for a number of common commercial email packages?
S/MIME
S-HTTP vs HTTPS
Secure Hypertext Transfer Protocol (S-HTTP) - encrypts only the served page data and submitted data like POST fields, this leaving the initiation of the protocol unchanged. Port 80 since headers are unencypted
Hypertext Transfer Protocol Secure (HTTPS) - Provides authentication and integrity using SSL/TLS encryption on port 443.
What is SET
Secure Electronic Transaction - a communications protocol standard for securing credit card transactions over networks. A set of security protocols and formats that enabled users to employ the existing credit card payment infrastructure on an open network in a secure fashion.
Cryptographic methods used: RSA public key cryptography and DES private key cryptography in connection with digital certificates
What are the four components of IPsec?
Authentication Header (AH), Encapsulating Security Payload (ESP), IP Payload Compression protocol (IPComp), and Internet Key Exchange (IKE)
What type of cryptographic attack is used against algorithms that don’t incorporate temporal protections?
Replay attack
What are some common reasons a certificate might need to be revoked?
The certificate was compromised, the certificate was erroneously issued, the certificate details changed, the private key was exposed, or there was a change of security association.
What type of cryptography relies on the use of public and private keys?
Asymmetric
What is Multithreading
technology allows multiple users to make use of the same process without interfering with each other.
The ability of a CPU to provide multiple threads of execution concurrently sharing the resources of a single core. parallel execution
Multitasking
Concurrent execution of multiple tasks (or processes). This is not parrallel execution.
Multiprocessing
using 2 or more CPUs (not cores)
What are some of the terms used to describe the CPU mode that gives access to the full range of supported instructions?
System mode, privileged mode, supervisory mode, and kernel mode.
Ring 0
Register Addressing
When the CPU needs information from one of its registers to complete an operation.
Immediate Addressing
Not a memory addressing scheme but a way of referring to data that is supplied to the CPU as part of an instruction
Direct Addressing
CPU is provided with an actual address of the memory location to access
Indirect Addressing
The memory address supplied to the CPU as part of the instruction doesn’t contain the actual value that the CPU is to use as an operand.
Base+Offset Addressing
uses a value stored in one of the CPU’s registers as the base location from which to begin counting. CPU than adds the offset supplied with the instruction to that base address and retrieves the operand from the computer memory location
ROM
Read only memory. PC cannot change once written
PROM
Programmable read-only memory. Similar to a ROM chip but allows the end user to “burn in the chip’s content at a later date.” Once burned in no further changes are possible
EPROM
Erasable Programmable Read-Only Memory - 2 subcategories UVEPROM and EEPROM
UVEPROM - Ultraviolet EPROMs can be erased with a light.
EEPROM - Electronically EPROM - Uses electric voltages delivered to the pins of the chip to force erasure.
WORM (memory)
Write Once Read Many
Real Memory
Also known as main memory or primary memory is typically the largest RAM storage resource available to a computer and normally composed of DRAM chips.
Cache RAM
Fastest and closest memory to the CPU. Can be referenced as Registers
Registers
CPU onboard memory. All data used by the ALU must be loaded in to a register. It is part of the ALU
Sensitivity
quality of information, which could cause harm or damage if disclosed
Discretion
Act of decision where an operator can influence or control disclosure in order to minimize harm or damage
Criticality
The level to which information is mission critical is its measure of criticality.
Concealment
Act of hiding or preventing disclosure.
Secrecy
act of keeping something a secret or preventing the disclosure of information
Privacy
keeping information confidential that is personally identifiable or that might cause harm, embarrassment, or disgrace to someone if revealed.
Seclusion
Storing something in an out-of-the-way location
Isolation
Act of keeping something separated from others
Concepts of Confidentiality
Sensitivity, Discretion, Criticality, Concealment, Secrecy, Privacy, Seclusion. Isolation
Concepts of Integrity
Accuracy, Truthfulness, Authenticity, Validity, Nonrepudiation, Accountability, Responsibility, Completeness, Comprehensiveness
Accuracy
Being correct and precise
Truthfulness
Being a true reflection of reality
Authenticity
Being authentic or genuine
Validity
Being factually or logically sound
Nonrepudiation
Not being able to deny having performed an action or activity or being able to verify the origin of a communication or event
Accountability
Being responsible or obligated for actions and results
Completeness
having all needed and necessary components or parts
Comprehensiveness
Being complete in scope; the full inclusion of all needed elements
Concepts of Availability
Usability, Accessibility, Timeliness
Usability
The state of being easy to use or learn or being able to be understood and controlled by a subject
Accessibility
Assurance that the widest range of subjects can interact with a resource regardless of their capabilities or limitations
Timeliness
Being prompt, on time, within a reasonable time frame, or providing low-latency response
Identification
Claiming to be an identity when attempting to access a secured area or system
Authentication
Proving that you are the identity (password, pin, …)
Authorization
Defining the permissions (allow/grant or deny) of a resource and object access for a specific identity
Auditing
Recording of log of the events and activities related to the system and subjects
Accounting
AKA Accountability Reviewing logs files to check for compliance and violations in order to hold subjects accountable for their actions
Layering
Also known as defense in depth. key concepts Abstraction, Data hiding, Encryption
Abstraction
Use for efficiency. Similar elements are put into groups, classes, or roles that are assigned security controls, restrictions, or permission as a collective.
Data Hiding
Preventing data from being discovered or accessed. Act of intentionally positioning data so that it is not viewable or accessible to an unauthorized subject.
Encryption
art and science of hiding the meaning or intent of a communications from unintended recipients
Security Governance Principles
The collection of practices related to supporting defining, and directing the security efforts of an organization. The implementation of a security solution and a management method that are tightly interconnected. Security needs to be managed and governed throughout the organizations, not just in the IT department. NIST 800-53, 800-100
Alignment of Security
Top-down - Senior management is responsible for initiating and defining policies for the organization. Middle management to flesh out the security policy into standards, baselines, guidelines, and procedures. Operational managers or security professionals must then implement the configurations prescribed in the security management documentation and end users must comply with all the security policies of the organization
Key factor in a security plan
Senior management must approve.
Strategic Plan
Long term 5 years that is stable
Tactical Plan
midterm - 1 year- provides more details on accomplishing the goals set forth in the strategic plan or can be crafted ad hoc based upon unpredicted events.
Operational Plan
Short-term, highly detailed plan based on the strategic and tactical plans. Only useful or valid for a short time.
Organizational processes
Needs to address every aspect of an organization this includes the organizational processes of acquisitions, divestitures, and governance committees.
Change control/Management
is to ensure that any change does not lead to reduced or compromised security
Request for change (RFC)
1) Implement changes in a monitored or orderly manner.
2) Formalized testing process is included to verify that a change produces expected results.
3) All changes can be reversed (backout or rollback)
4) Users are informed of changes before they occur to prevent loss of productivity
5) effects of changes are systematically analyzed to determine whether security or business processes are negatively affected.
6) Negative impact of changes on capabilities, functionality, and performance is minimized
7) Changes are reviewed and approved by a change advisory board (CAB)
Data Classification
Primary means by which data is protected based on its need for secrecy, sensitivity, or confidentiality
Declassification
required once an asset no longer warrants or needs the protection of its currently assigned classification or sensitivity level.
Top Secret
drastic effects and cause grave damage to national security
Secret
significant effects and cause critical damage to national security
Confidential
noticeable effects and cause serious damage to national security
Sensitive but Unclassified
FOUO
Unclassified
used for data that is neither sensitive nor classified.
mnemonic for 5 levels of government classification
U.S. Can Stop Terrorism
U - Unclassified
S - Sensitive …
Confidential or Proprietary
Extremely sensitive and for internal use only
Private
personal nature and intended for internal use only
Sensitive
Negative impact could occur for the company if disclosed
Public
lowest used for data that does not fit in Sensitive, Private or Confidential
mnemonic for the 4 levels of corporate classification
People Should Prevent Communism
P - Public
S - Sensitive …
Security Professional/ Information Security (infoSec) officer, or Computer incident response team (CIRT)
Trained and experienced network, system, and security engineer. functional responsibility for security, including writing the security policy and implementing it. Often filled by a team that is responsible for designing and implementing security solutions based on the approved security policy.
Data Owner
responsible for classifying information. typically a high-level manager
Data Custodian
implementing the prescribed protection defined by the security policy and senior management
User
any person who has access to the secured system
Auditor
Reviewing and verifying that the security policy is properly implemented and the derived security solution are adequate
Security Control Frameworks
COBIT, Open Source Security Testing methodology Manual (OSSTMM), ISO/IEC 27002 (replaced ISO 17799), Information Technology Infrastructure Library (ITIL)
COBIT
Documented set of best IT security practices crafted by the Information systems Audit and Control Association (ISACA).
Principle 1: Meeting stake holder needs
P 2: Covering Enterprise End to End
P 3: Applying a single, Integrated Frame work
P 4: Enabling a Holistic Approach
P 5: Separating Governance from Management
Open Source Security Testing Methodology Manual (OSSTMM)
Peer reviewed guide for the testing and analysis of a security infrastructure
ISO/IEC 27002
International and replaced ISO 17799 the basis of implementing organizational security and related management practices
Information Technology Infrastructure Library (ITIL)
Initially crafted by the British government, set of recommended best practices for core IT security and operational processes and is often used as a starting point for crafting of a customized IT security solution.
Due Care
Using reasonable care to protect the interests of an organization. The Action
Due Diligence
Practicing the activities that maintain the due care effort. Research
Prudent man rule
showing both due care and due diligence is the only way to disprove negligence in an occurrence of loss.
Organizational security Policy
Focuses on issues relevant to every aspect of an organization.
regulatory policy
Required whenever industry or legal standard are applicable to your organization
Advisory Policy
Discusses behaviors and activities that are acceptable and defines consequences of violations
Informative Policy
is designed to provide information or knowledge about a specific subject, such as company goals, mission statements, or how the organization interacts with partners and customers
Security Standards
Must! Define compulsory requirements for the homogeneous use of hardware, software, technology, and security controls. They provide a course of action by which technology and procedures are uniformly implemented throughout an organization.
Baseline
Minimum level of security that every system throughout the organization must meet. Operationally focused . Goals of the security policy and requirements of the standards and defines them specifically. Used to compare IT systems
Guideline (Manual)
offers recommendations on how standards and baselines are implemented and serves as an operational guide for both security professionals and users.
Standard Operating Procedure (SOP)
Step by step document describes actions to implement a specific security mechanism, control, or solution.
Microsoft Security Development Lifecycle (SDL)
Implement security at each stage of a product’s development.
SD3+C
Secure by Design, Secure by Default, Secure in Deployment and Communication.
what is a proactive approach to threat modeling
Takes place during the early stages of systems development, specifically during initial design and specifications.
What is a reactive approach to threat modeling
takes place after a product has been created and deployed.
3 threat Identifying approaches
Focused on Assets - identify threats to the valuable assets.
Focused on Attackers - Identify Potential attackers and identify the threats they represent base on attack goals
Focused on Software - Identify Potential threats against the software.
STRIDE
Threat categorization scheme developed by Microsoft. Spoofing Tampering Repudiation Information disclosure Denial of Service Elevation of Privilege
PASTA
Process of Attack Simulation and Threat Analysis.
Risk centric 7 stage threat modeling methodology.
Stage 1: Definition of the Objectives (DO) for the Analysis of Risks
Stage 2: Definition of the Technical Scope (DTS)
Stage 3: Application Decomposition and Analysis (ADA)
4: Threat Analysis (TA)
5: Weakness and Vulnerability Analysis (WVA)
6: Attack Modeling & Simulation (AMS)
7: Risk Analysis & Management (RAM)
Trike
Risk-based threat modeling methodology approach. a method of performing a security audit in a reliable and repeatable procedure.
VAST
Visual, Agile, and Simple Threat
Threat modeling concept based on Agile project management and Programming principles. Goal is to integrate threat and risk management into an Agile Programming environment on a scalable basis.
DREAD
Damage potential, Reproducibility, Exploitability, Affected users, Discoverability.
Qualitative and flexible rating solution for Prioritizing and Responding to risk
What is the weakest element in any security solution
Humans
In regards to a secure network what should a job description define
The type and extent of access the position requires on the secured network.
Separation of Duties
Security concept in which significant and sensitive work tasks are divided among several individual administrators or high-level operators.
This acts as a protection against collusion.
Collusion
Occurrence of negative activity undertaken by two or more people often for the purpose of fraud, theft, or espionage.
Job Rotation
Rotating employees among multiple job positions, is simply a means by which an organization improves its overall security
Nondisclosure agreement (NDA)
Used to protect the confidential information within an organization from being disclosed by a former employee
Noncompete agreement
Prevent an employee with special knowledge of secrets from one organization from working in a competing organization in order to prevent that second organization from benefiting from the worker’s special knowledge of secrets.
Onboarding
Is the process of adding new employees to the identity and access management (IAM) system of an organization
Offboarding
It is the removal of an employee’s identity from the IAM system once that person has left the organization
How should terminations take place
with at least one witness, preferably a higher-level manager and/or a security guard.
Firing an employee steps and order
1) Inform the person that they are relieved of their job
2) Request the return of all access badges, keys… Property
3) Disable the person’s electronic access to all aspects of the organization
4) Remind the person about the NDA obligations
5) Escort the person off the premises
When is the best time to remove electronic access to a former employee
At the start of the exit interview
Service-level agreement (SLA)
Policy used to define the levels of performance expectations, compensations, and consequences for entities, persons, or organizations that are external to the primary organization. Common items addressed in SLAs: System up time. Maximum consecutive downtime, Peak load, Average load, Responsibility for diagnostics, Failover time
Compliance
The act of conforming to or adhering to rules, policies, regulations, standards, or requirements
PCI-DSS
Payment Card Industry Data Security Standard.
Privacy
Active prevention of unauthorized access to information that is personally identifiable.
Freedom from unauthorized access to information deemed personal or confidential
Freedom from being observed, monitored, or examined without consent or knowledge
Security governance
The collection of practices related to supporting, defining, and directing the security efforts of an organization
Third party Governance
the system of oversight that may be mandated by law, regulation, industry standards, contractual obligation, or licensing requirements.
Documentation review
The process of reading the exchange materials and verifying them against standard and expectations and is typically performed before any on-site inspection takes place. If the documentation is incomplete, inaccurate, or otherwise insufficient, the on-site review is postponed until the documentation can be updated and corrected.
what is the primary goal of risk management
reduce risk to an acceptable level
Asset
is anything within an environment that should be protected. It is anything used in a business process or task. examples: computer file, network service, system resource, process, program, product, IT infrastructure, database, hardware device furniture, product recipes/formulas, intellectual property, personnel, software, facilities and so on.
Asset Valuation
Dollar value assigned to an asset based on actual cost and nonmonetary expenses
Threats
any Potential occurrence that may cause an undesirable or unwanted outcome for an organization or for a specific asset.
Vulnerability
The weakness in an asset or the absence or the weakness of a safeguard or countermeasure.
Exposure
is being susceptible to asset loss because of a threat; there is the possibility that a vulnerability can or will be exploited by a threat agent or event
Risk
possibility or likelihood that a threat will exploit a vulnerability to cause harm to an asset. Risk = Threat * vulnerability
Safeguards
can also be called security control, or countermeasure
Is anything that removes or reduces a vulnerability or protects against one or ore specific threats
Attack
is the exploitation of a vulnerability by a threat agent
Breach
is the occurrence of a security mechanism being bypassed or thwarted
What are the 6 major elements of quantitative risk analysis?
Assign Asset Value (AV)
Calculate Exposure Factor (EF)
Calculate Single loss expectancy (SLE)
Assess the annualized rate of occurrence (ARO)
Derive the annualized loss expectancy (ALE)
Perform cost/benefit analysis of countermeasures
Exposure Factor (EF)
Percentage of loss that an organization would experience if a specific asset were violated by a realized risk.
Single Loss Expectancy (SLE)
= Asset Value (AV) * Exposure Factor (EF)
Annualized Rate of Occurrence (ARO)
is the expected frequency with which a specific threat or risk will occur within a single year
Annualized Loss Expectancy
Possible yearly cost of all instances of a specific realized threat against a specific asset.
= Single Loss Expectancy (SLE) * Annualized Rate of Occurrence (ARO)
techniques for Qualitative Risk Analysis
Brainstorming, Delphi technique (anonymous feedback-and-response process used to enable a group to reach an anonymous consensus), Storyboarding, Focus groups, Surveys, Questionnaires, Checklists, One-on-one meetings, Interviews
What are the responses to risk
Reduce or mitigate Assign or transfer Accept Deter Avoid Reject or ignore
What does the NIST 800-37 cover
Risk management Framework
What is Risk Framework
a guideline or recipe for how risk is to be assessed, resolved, and monitored
Steps included in a Risk Management Framework (RMF)
1 Categorize - The information system and the information processed, stored and transmitted by that system
2 Select - an initial set of baseline security controls for the information system based on the security categorization; tailoring the supplementing the security control baseline as needed.
3 Implement - security controls and describe how the controls are employed within the information system and its environment of operation
4 Assess - Security controls using appropriate assessment procedures to determine the extent to which the controls are implemented correctly
5 Authorize - information system operation based on a determination of the risk to organizational operations and assets, individuals, other organizations, and the Nation resulting from the operation of the information system and the decision that this risk is acceptable
6 Monitor - the security controls in the information system on an ongoing, basis including assessing control effectiveness, documenting changes to the system or its environment of operation
Can Sara Implement Assurance At MonkeyJoe’s
Business Continuity Planning (BCP) what is it for
keep the business making money.
Business Continuity Planning (BCP) steps
1 Project scope and planning
2 Business impact assessment
3 Continuity Planning
4 Approval and Implementation
Please bring candy apples
Project scope and planning involves what
Structured analysis of the Business’s Organization from a crisis planning point of view
Creation of a BCP team approved by senior management
Assessment of resources available to participate in business continuity activities
Analysis of the legal and regulatory landscape that governs and organization’s response to catastrophic event
Business Organization Analysis
Should include all departments and individuals who have a stake in the BCP process
Operational departments - core services the business provides to its clients
Critical support services - IT, facilities, maintenance personnel, groups responsible for upkeep of the Operational departments
Corporate Security teams - physical security
Senior executives/key individuals - essential for the ongoing viability of the organization
Business Impact assessment
Quantitative and Qualitative Decision making
Identify Priorities Risk Identification Likelihood Assessment Impact Assessment Resource Prioritization
Is Risk Likely In Research
MTD/MTO
Maximum tolerable downtime or Maximum tolerable outage
Maximum length of time a business function can be inoperable without causing irreparable harm to the business.
A Disasters is declared after the MTD/MTO
RTO
Recovery time objective
Amount of time you can feasibly recover the function in the event of a disruption.
Recovery only begins after the MTD/MTO has passed.
Why Document the Business Continuity Planning process
Ensures BCP personnel have a written coninuity document to reference in the emergency.
Provides a historical record of the BCP process.
Forces the team members to commit their thoughts to paper.
Continuity Planning
1 Strategy development - Bridges the gap between the buiness impact assessment and the continuity planning phases of BCP development
2 Provisions and Processes - Develops Documents and designs procedureas and mechanisms that will mitigate the risks.
3 People - First priority make sure they are safe.
Types of Law
1 Criminal law
2 Civil
3 administrative
Criminal law
Preserve the peace and keep our society safe. acts such as murder, assault, robbery, and arson. Penalties for violating include community service, monetary penalties (fines) and deprivation of civil liberties (prison)
Civil Law
Bulk of all laws. designed to provide for an orderly society and govern matters that are not crimes but require an impartial arbiter to settle. Penalties usually include severe financial penalties
Administrative Law
Executive Branch of our government. FCC, FDA, …
CFAA
Computer Fraud and Abuse Act - 1984 - cover all “federal interest” computers. Malicious damage in excess of $1,000 later changed to $5,000
Amendments - 1994 - Outlawed the creation of any type of malicious code that might cause damage to a computer system.
- covered any computer used in interstate commerce rather than just federal
- Allowed for the imprisonment of offenders, regardless of whether they actually intended to cause dame
- Provided legal authority for the victims of computer crime to purse civil action to gain injunctive relief and compensation for damages.
Amendment again in 1996, 2001, 2002, and 2008 now covers International.
National Information Infrastructure Protection Act of 1996
Amendments to the CFAA - covers systems used in international commerce
- Extends similar proctections to portions of the national infrastructure other than computing systesm, (railroads, gas pipelines, electric power grids, and telecommunications cirucitys.
- Treats any intentional act that causes damage to national infrastructure as a felony
FISMA
Federal Information Security Management ACT - 2002- requires that federal agencies implement an information security program that covers the agency operations.
Federal Cybersecurity Laws of 2014
2014 - series of bills into law.
- Federal Information Systems Modernization Act which Modified the rules of FISMA by centralizing federal cybersecurity responsibility with the Department of Homeland Security
- Cybersecurity Enhancement Act - which charges the NIST with responsibility for coordinating nationwide work on voluntary cybersecurity standards including NIST SP 800-53: Security and Privacy Controls for Federal Information systems and Organizations. NIST SP 800-171, NIST Cybersecurity Framework (CSF)
- National Cybersecurity Protection Act - Charged the Department of Home Security with establishing a national cybersecurity and communications integration center.
Copyright (c)
Works of art until 70 years after death of last person or 75 after a corporation
DMCA
Digital Millennium Copyright Act
- prohibition of attempts to cirumvent copyright protection mechanisms placed on a protected work by the copyright holder. Penalties of $1,000,000 and 10 years in prison for repeat offenders.
- Limits liability of Internet service providers when their circuits are used by criminals violating the copyright law.
Trademarks
Small TM symbol to show you intend to protect words or slogans. Official recognition requires registration with United States Patent and Trademark Office (USPTO) and uses the (R) symbol.
- granted for 10 years but can be renewed for unlimited successive 10-year periods
Patents
20 years from initial application
- Must be new
- must be useful
- must not be obvious
Trade Secrets
You must implement adeqate controls within your organization to ensure that only authorized personnel with a need to know the secrets have access to them and that they are bound by a NDA.
Economic Espionage Act of 1996
Protects Trade Secrets
- Imprisonment for 15 years and $500,000 fine for Intention of benefiting a foreign government
- Imprisonment for 10 years and $250,000 for other circumstances
ITAR
International Traffic in Arms Regulations - Controls the export of items that are specifically designated as military and defense items. Items covered appear on a list called the United States Munitions List (USML).
EAR
Export Administration Regulations - Covers a broader set of items than ITAR and are commercial in nature but has military applications. Items are listed in the Commerce Control List (CCL)
Computer Export Controls
Cannot export high-performance computing systems to counties that are classified as state sponsors of terrorism. Cuba, Iran, North Korea, Sudan, and Syria
Encryption Export Controls
Controls the release of encryption products outside the US.
- Submit products for review by the Commerce Department. will take no longer than 30 days.
Fourth Amendment
basis for privacy rights in the US.
Privacy Act of 1974
Maintain only the records that are necessary for conducting their business and that they destroy those records when they are no longer needed for a legitimate function of government.
ECPA
Electronic Communications Privacy Act of 1986- A crime to invade the electronic privacy of an individual. Increased Federal Wiretap Act to include unauthorized access of electronically stored data.
CALEA
Communications assistance for Law Enforcement Act of 1994. Amended the Electronic Communications Privacy Act of 1986 to require all communications carriers to make wiretaps possible for law enforcement with an appropriate court order, regardless of the technology in use.
HIPAA
Health Insurance Portability and Accountability Act of 1996 - Strict security measures for hospitals, physicians, Insurance companies, and other organizations that process or store private medical information about individuals.
HITECH
Health Information Technology for Economic and Clinical Health Act of 2009.
Amended HIPAA which updated many of HIPAA’s privacy and security requirements and was implemented through the HIPAA Omnibus Rule in 2013
- Any relationship between a covered entity and a business associate must be governed by a written contract known as a business associate agreement (BAA) and must protect Protected Health Information (PHI)
2019 Amendment - new data breach noticication requirements with the HITECH breach Notification Rule
COPPA
Children’s Online Privacy Protection Act of 1998 - April of 2000
- Parents must give verifiable consent to collection of information about children younger than the age of 13
- websites must have a privacy notice that clearly states the types of information they collect.
- Parents must be provided with teh opportunity to review any information collected from their children and permanently delete it.
GLBA
Gramm-Leach-Bililey Act of 1999
- Banks, insurance companies, and credit providers were severely limited in the services they could provide and share.
- Financial institutions must provide written privacy policies to all their customers
USA PATRIOT Act of 2001
Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism.
- wiretapping easier
- blanket authorization for a person and then monitor all communications to or from that person under the single warrant.
FERPA
Family Educational Rights and Privacy Act
- Parents/students have the right to inspect any educational records maintained by the institution
- Right to request correction of records they think are erroneous and the right to include a statement in the records contesting anything that is not corrected
- Schools may not release personal information from student records without written consent.
Identity Theft and Assumption Deterrence Act
1998 - identity theft a crime against the person whose identity was stolen and provides server criminal penalties for anyone found guilty. 15 year prison and/or $250,000
GDRP
European Union General Data Protection Regulation 2016
- Data breach notification 72 hours
- centralized data protection authorities in each EU member state
- individuals will have access to their own data
- data portability for transfer of personal information between service providers at the individual’s request
- right to be forgotten
PII
Personally Identifiable Information
Any information that can identify an individual.
National Institute of Standards and Technology (NIST) Special Publications (SP) 800-122
PHI
Protected health information
- HIPAA mandates the protection of PHI
- Health information means any information, whether oral or recorded in any form or medium, that
1 - Created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse
2 - relates to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual, or the past, present, future payment for provision of health care to an individual
Proprietary Data
Trade Secrets
- refers to any data that helps an organization maintain a competitive edge.
APT1
Advanced persistent threat 1 - Group operating out of China that stole lots of data from commercial industry
Fancy Bear and Cozy Bear
APT 28 and APT 29
U.S. Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI) analysis report documenting Russian malicious Cyber activity targeting US government entities and politics.
Class 3, Class 2, …, Class 0
Some nongovernment organizations use labels for classifying data. Class 3 is the highest (Confidential or Proprietary and Class 0 the lowest public.
Civilian organizations aren’t required to use any specific classification labels.
Encryption
Converts cleartext into scrambled ciphertext and makes it more difficult to read.
Data at Rest
data stored on media such as system hard drives, external USB drives, storage area networks (SANs), and backup tapes
Data in Transit
also known as Data in motion any data transmitted over a network
Data in Use
data in memory or temporary storage buffers, while an application is using it. RAM, Cache, Registries …
DLP
Data loss prevention systems. Can use headers, footers, and watermarks (data labels) to identify documents that include sensitive information and apply the appropriate security controls.
Guidelines for Media Sanitization
NIST SP 800-88r1
How to destroy SSDs
Approved disintegrator which shred the SSDs to a size of 2 millimetres or smaller.
Erasing
Simply performing a delete operation against a file
Clearing
is a process of preparing media for reuse and ensuring that the cleared data cannot be recovered using traditional recovery tools
Purging
more intense form of clearing that prepares media for reuse in less secure environments
Degaussing
creates a strong magnetic field that erases data on some media in a process called degaussing. Degaussing a hard disk will normally destroy the electronics used to access the data.
Destruction
Final stage in the lifecycle of media and is the most secure method of sanitizing media
Record retention
involves retaining and maintaining important information as long as it is needed and destroying it when it is no longer needed. Organization’s security policy or data policy typically identifies retention timeframes.
Symmetric encryption
uses the same key to encrypt and decrypt data
AES
Advanced Encryption Standard
Symmetric
128, 192, 256 bits key size
Triple DES
3DES Replacement for DES Symmetric 56-bit keys (112 or 168 also available) 8-bits for parity (error correction)
Blowfish
Symmetric First to use salt 32 to 448 bits bcrypt is based on Blowfish Bcrypt adds 128 additional bits as a salt to protect against rainbow table attacks
POODLE
Padding Oracle On Downgraded Legacy Encryption
Discovered by Google and showed SSL is susceptible.
VPN
Virtual Private Networks
allow employees to access the organization’s internal network from their home or while traveling
IPsec
Combined with Layer 2 Tunneling Protocol (L2TP) for VPNs. L2TP transmits data in cleartext, but L2TP/IPsec encrypts data and sends it over the internet using Tunnel mode to protect while in transit. includes AH and ESP
- When used in transport mode only the packet payload is encrtypted. This mode is designed for peer-to-peer communication.
- When used in tunnel mode the entire packet, including the header, is encrypted. This mode is designed for gateway to gateway communication.
AH
Authentication Header - Protocol 51
provides authentication and integrity
Transport mode only
ESP
Encapsulating Security Payload - Protocol 50
provides confidentiality
in Transport mode only that packet data is encrypted in tunnel mode entire IP packet is encrypted.
SCP and SFTP
are secure protocols used to transfer encrypted files over a network.
FTP
Transmit data in cleartext so not appropriate for transmitting sensitive data over a network
Data Owners
Person who has ultimate organizational responsibility for data. Chief Executive Officer (CEO), president, or department (DH)
Asset Owners
also System Owner
is the person who owns the asset or system that processes sensitive data. typically the same person as the data owner
Business/Mission Owners
Can be the same as System owner or can overlap responsibilities
Data Processors
Any system used to process data but can also be
A natural or legal person, public authority, agency, or other body, which processes personal data solely on behalf of the data controller
EU-US Privacy Shield
Program to replace Safe Harbor Program and makes sure the US is compliant with the EU GDPR.
Administered by the US department of commerce and International Trade Administration (ITA)
Pseudonymization
process of using pseudonyms to represent other data and can refer to several pieces of information on a single data point
Anonymization
process of removing all relevant data so that it is impossible to identify the original subject or person.
Data masking
form of anonymization that swaps data in individual data columns so that records no longer represent the actual data.
Administrators
responsible for granting appropriate access to personnel. They don’t necessarily have full administrator rights and privileges, but they do have the ability to assign permissions
custodians
helps protect the integrity and security of the data by ensuring that it is properly stored and protected. Responsible for the day-to-day tasks.
Users
any person who accesses data via a computing system to accomplish work tasks
CalOPPA
California Online Privacy Protection Act
Requires a conspicuously posted privacy policy for any commercial websites or online services that collect personal information of California residents
NIST SP 800-53
Security control baselines as a list of security controls
A single set of controls does not apply to all situations, but any organization can select a set of baseline controls and tailor it to its needs
Scoping
reviewing a list of baseline controls and selecting only those controls that apply to the IT system you’re trying to protect
Tailoring
Modifying the list of security controls within a baseline so that they align with the mission or the organization
Caesar Cipher
ROT3
ROTX
Shift the letter X places to the right. ROT3 (Caesar Cipher) A becomes D, B becomes E
Enigma
German WWII machine that used a series of 3 to 6 rotors to implement substitution
Purple Machine
Japanese WWII similar machine to the Enigma
Symmetric Crytosystems
uses a shared key
Asymmetric Crytosystems
uses individual combinations of public and private keys for each users of the system
Digital Signatures
enforce message integrity through the use of encrypted messages.
P
represents a message when encryption functions are described
Kerckhoffs’s Principle
a concept that makes algorithms known and public, allowing anyone to examine and test them. Cryptographic system should be secure even if everything about the system, except the key, is public knowledge. The principle can be summed up as “The enemy knows the system.”
Cryptovariables
Same as Cryptographic keys
Cryptanalysis
The study of methods to defeat codes and ciphers
Cryptology
Cryptography and cryptanalysis are commonly referred to as Cryptology
FIPS 140-2
Federal Information Processing Standard “Security Requirements for Cryptographic Modules,” defines the hardware and software requirements for cryptographic modules that the federal government uses.
Logical Operation for “AND”
V
Logical Operation for “OR”
~ or !
Logical Operation for “NOT”
XOR
Exclusive OR
Modulo Function
Remainder - remainder value left over after a division operation is preformed. Represented in equations by mod or %
Nonce
Random number that acts as a placeholder variable in functions
- must be unique each time it is used
- example initialization Vectors (IV)
IV
Initialization Vectors
- a random bit string that is the same length as the block size and is XORed with the message.
- are used to create unique ciphertext every time the same message is encrypted using the same key
Zero-Knowledge Proof
The magic door.
Split knowledge
M of N Control requires that a minimum number of agents (M) out of the total number of agents (N) work together to perform high-security tasks
Work Function
The strength of a cryptography system is measuring the effort in terms of cost and/or time.
Ciphers
Hide the true meaning of plain text
Transposition Ciphers
use an encryption algorithm to rearrange the letters of a plaintext message, forming the ciphertext message
Substitution Ciphers
use the encryption algorithm to replace each character or bit of the paintext message with a different character (Caesar Cipher)
Vigenere Cipher
uses a single encryption/decryption chart encrypt the paintext - Substitution Cipher
One-Time Pads
As so know as Vernam ciphers.
C = (P + K) mod 26
They are unbreakable if used properly
- Pad must be randomly generated.
- Pad must be physically protected against desclosure
- Pad may only be used once
- Key must be at least as long as the message to be encrypted.
Running Key Ciphers
Also known as a book cipher
Key is as long as the message and is often chosen from a common book.
Block Ciphers
Chunks or blocks of a message and apply the encryption algorithm to an entire message block at the same time
Stream Ciphers
RC4
operate on one character or bit of a message at a time
Confusion and Diffusion
Cryptographic algorithms rely on these 2 basic operations to obscure plaintext.
- Confusion occurs when the relationship between the plaintext and the key is so complicated that an attacker can’t merely continue altering the plaintext and analyzing the resulting ciphertext to determine the key
- Diffusion occurs when a change in the plaintext results in multiple changes spread throughout the ciphertext.
What are the weaknesses with Symmetric Key Cryptography
- Key Distribution
- Does not implement nonrepudiation (at least 2 people know the key)
- Algorithm is not scalable n(n-1)/2
- Keys must be regenerated often (each time someone leaves).
Asymmetric key Algorithms
Also known as Public Key Algorithms solve the symmetric key issues
- It also provides support for Digital Signatures
