Threats, Vulnerabilities, Mitigation 6

Question 1

What is a ACL?

Answer 1

Access Control List

• Allow or disallow traffic
  Via: Grouping of traffic, Source/destination IP, port number etc.
• Restrict access to network devices
  Limit by IP address or other identifier

Question 2

What is an Application Allow List?

Answer 2

• Set up rules to allow or disallow particular application in OS
• Allow/Deny List - Black/White listing

Examples:
* Anti-virus, Anti-malware are deny lists

Decided by:
* Application path
* Hash
* Network Zone
* Signature

Question 3

What is Isolation?

Answer 3

• Seperating parts of the network or system
• Prevent Malware to spread, limit access, or contain security breaches
• Isolation through network segmentation

Question 4

What is configuration enforcement?

Answer 4

• Perform posture Assesments
  Every time device connects

** Extensive Checks:**
* OS patch version
* EDR
* Status of Firewall
* Certificate status

Question 5

What is Decomissioning?

Answer 5

• Process of retiring or discontinuing a system, technology equitment or infrastructure
• Systematically shutting down, removing or phasing out these resources in a controlled and structured manner
• Memory transer or destruction

Question 6

What are hardening techniques and which ones are there?

Answer 6

Refer to OS specific techniques to make system more secure
* Updates
* User accounts
* Network access and security
* Monitor and secure
* Encryption
* The Endpoint
* EDR
* Host-based firewall
* Open Ports and Services
* Default password changes
* Removal of unnecessary software

Question 7

Expolain hardening technique: User Accounts

Answer 7

• Minimum password lengths and complexity
• Limited Access

Question 8

Explain EDR

Answer 8

• Signature Analysis, behavioural analysis, machine learning and process monitoring tool
• Investigation of threat
  Root cause analysis
• Respond to threats
  Isolate system, quarantine threat
  API driven

Question 9

What is HIPS

Answer 9

Host-based Intrusion System
* Recognize and block known and unknown attacks
* Secure OS and application configs
* Often built into EDR

HIPS Identification:
* Signatures, heuristics, behavioural
* Buffer Overflows, regisrty updates, writing files to windows folder
* Access to non-encrypted data