Updated - INFO 310 FINAL Flashcards
Protection of Assets, Prevention Detection, and Recovery
Goal of Cybersecurity
confidentiality, Integrity, Availability.
CIA
the concealment of information or resources
Confidentiality (CIA)
the trustworthiness of data or resources
Integrity (CIA)
the ability to use information or resources
Availability (CIA)
Deception, Disruption, Disclosure, Usurpation
Categories of Threats
The acceptance of false data
Deception (Category of threat)
the interruption or prevention of correct operation
Disruption (Category of threat)
The unauthorized access to information
Disclosure (Category of threat)
the unauthorized control of some part of a system
Usurpation (Category of threat)
the unauthorized interception of information, is a form of disclosure
Snooping or eavesdropping (Type of threat)
an unauthorized change of information is a form of usurpation, deception, and disclosure.
Modification or alteration (Type of threat)
an impersonation of one entity by another, is a form of both deception and usurpation.
Masquerading or spoofing (Type of threat)
a false denial that an entity sent (or created) something, is a form of deception.
Repudiation of origin
a false denial that an entity received some information or mes- sage, is a form of deception
Denial of receipt
a temporary inhibition of a service, is a form of usurpation, al- though it can play a supporting role in deception.
Delay
a long-term inhibition of service, is a form of usurpation often also used as a mechanism of deception.
Denial of service
Asset, Threat, Vulnerability, Risk
The Core of Cybersecurity
People, property, and information of value
Asset
Anything that can exploit a vulnerability, intentionally or acciden- tally, and obtain, damage, or destroy an asset.
Threat
Weaknesses or gaps in a security program that can be exploited by threats to gain unauthorized access to an asset.
Vulnerability
The potential for loss, damage or destruction of an asset as a result of a threat exploiting a vulnerability.
Risk
Asset + Threat + Vulnerability = Risk.
Formula for calculating risk
Any cipher based on substitution, using multiple substitution alphabets.
Polyalphabetic Ciphers
message wrapped around a rod of a certain size then can be read.
Scytale Encryption
A method of encryption by which the positions held by units of plaintext […] are shifted according to a regular system, so that the ciphertext constitutes a permutation of the plaintext.
Transposition Ciphers
The study of the frequency of letters or groups of letters in a ciphertext. The method is used as an aid to breaking classical ciphers.
Frequency Analysis
s the art or better yet, science, of skillfully maneuvering human beings to take action in some aspect of their lives.
Social Engineering
The practice of sending emails appearing to be from reputable sources with the goal of influencing or gaining personal information.
Phishing (SE)
The practice of eliciting information or attempting to influence action via the telephone, may include such tools as phone spoofing.
Vishing (SE)
The practice of pretexting as another person with the goal of obtaining information or access to a person, company, or computer system
Impersonation (SE)
· Ensures Authentication · Ensures Non-Repudiation · Ensures Confidentiality · Ensures Integrity
Properties of encryption
Uses a single key for both encryption and decryption
Secret Key Cryptography (SKC) (AKA Symmetric Encryption)
Uses one key for encryption and another for decryption
Public Key Cryptography (PKC) (AKA Asymmetric Encryption)
Uses a mathematical transformation to create a digital fingerprint or message digest
Hash Functions (AKA Checksum)
Physical, Link, Network, Transport, and Application
The Layers of the Internet Protocol Model
Wire, open air, optic fibers
Physical layer IPM
Ethernet, Wifi, 4G
Link layer IPM
Internet protocol, inter control ICMP (nter Control Messaging Protocol)
Network layer IPM
Transmission Control Protocol (TCP) User Datagram Protocol (UDP)
Transport Layer (IPM)
Email > Simple Mail Transfer Protocol (SMTP) - Websites
>
HyperText Transfer Protocol (HTTP) -
File Sharing
>
File Transfer Protocol (FTP)
>
Server Message Block (smb)
Application Layer IPM
public domain on the internet. Created by Internet Service Providers (ISP) to connect to other ISPs around the world. Creates the internet.
Public IP
private to a Local Area Network (LAN). They are assigned in a LAN by the Dynamic Host Configuration Protocol (DHCP).
Private IP
it is a unique identifier. It has two components: the network address and the host address. A subnet mask then sep- arates the IP address into network and host addresses.
Internet Protocol (IP) Address
the process of verifying that an individual, entity or website is who it claims to be. This in the context of web applications is commonly performed by submitting a username or ID and one or more items of private information that only a given user should know
Authentication
An attestation of identity, qualification, competence, or authority issued to an individual by a third party
Credential
sequence of network HTTP request and response transactions associated to the same user. […] provide the ability to establish variables - such as access rights and localization settings - which will apply to each and every interaction a user has with the web application for the duration of the session.
Web Session
is almost exclusively in Javascript (JS) runs with an interpreter. Makes web pages come alive. Credential information is stored and sent from the client
Client side code
Server side services listen for a request and then respond to that request part of the N-tier application design
Server Side
Presentation, logic, data
N-Tier Application
Translates data in to something the user can understand
Presentation tier
Coordinates the application, processes commands makes logical decisions and evaluations and performs calculations. Provides communication between the presentation and data tier
Logic Tier
Information is stored and retrieved from a database, datastore or filesystem. Provides information back to the logic tier
Data Tier
does nothing except provide a pathway for the electrical signals to travel along
Hub
are the connectivity points of an Ethernet network that forward data only to the port that connects to the destination device. It does this by learning the MAC address of the devices attached to it, and then by matching the destination MAC address in the data it receives.
Switch
ill normally create, add, or divide on the Network Layer as they are normally IP-based devices.Receives a packet of data, it reads the header of the packet to define the destination address
Router
use the wireless infrastructure network mode to provide a connection point between WLANs and a wired Ethernet LAN.
Wireless Access Point
Encrypted Connection over the internet from a device to a network
Virtual Private Network (VPN)
A networking device, either hardware or software based, that controls access to your organization’s network.
Firewall
implemented through software applications to monitor and control network traffic between a computer or a network of computers and the internet or other networks- Use network operating systems such as Linux/Unix, Windows Servers and Mac OS Servers
Software Firewalls
Dedicated network device Many routers and WAPs have this functionality built in
Hardware Firewalls
a 32-bit number that masks an IP address, and divides the IP address into network address and host address. network bits to all “1”s and setting host bits to all “0”s
Subnet Mask
allocates and manages IP addresses on the internet. is a set of Internet protocol (IP) standards that is used to create unique identifiers for networks and individual devices.
Classless inter-domain routing (CIDR)
A dictionary of CVE attempting to standardize across the industry
CVE - Common Vulnerabilities and Exposures
Maintain accurate inventory of assets Define and set stan- dards>Maintain awareness and detect new vulnerabilities>Reme- diate or mitigate identified vulnerabilities >Continuously monitor IT environment
Goals of Vulnerability Management Program (4)
Apply Patches -
Update configurations -
Deactivate unnecessary services and channels
Remediation
reducing, lessening, or minimizing the severity, impact, or likelihood of potential threats, risks, or vulnerabilities- Compensating Network Controls - Procedural or Physical Controls
Mitigation
tend to lack motivation and rely on script created by more ad- vanced hackers. They utilize easy to use software to do things such as port scanning. Blue hats are “vindictive “ - these.
Script Kiddies
newbie hackers. Unlike script kiddies, these hackers have the drive to become a more advanced hacker
Green Hat
malicious hacker who hacks for personal gain, typically financial
Black Hat
Use their skills in order to help individuals, businesses and gov- ernment.
White Hat/Ethical Hackers
: shifts between ethical and non-ethical hacking practices
Grey Hat
Digital vigilantes working to right a perceived wrong in the world
Hacktivists:
government employees who attempt to acquire classified informa- tion about other governments
Nation State Hackers (AKA APT)
: a disgruntled employee or corporate spy
Malicious Insider
1) Provide training 2)Define security requirements 3)Define met- rics and compliance reporting 4) Perform threat modeling 5) Establish design requirementsà6) Define and use cryptography standards 7)Manage the security risk of using 3rd party compo- nentsà8) Use approved tools 9) Perform SAST 10) Perform DAST 11)Perform penetration testing 12) Establish a standard incident response process
Microsoft secure development lifecycle 12 parts
Thesepermissions grants the right to read the contents of the file and read the permissions of a directory.
permission Read (r)
Implies the ability to change the contents of a file. Or create new files in a directory
Permission write(w)
the right to execute the files if they are programs. Regarding directories, it allows you to enter any directories and access files
Permission Execute (x)
exploiting a bug or design flaw to gain elevated access to re- sources that are normally protected from a user or application
Privilege escalation
o a lower level privilege user accesses functions or content revised for higher privilege users or applications
Vertical privilege escalation
o a normal user accesses functions or content reserved for other normal users
Horizontal privilege escalation
Type of permissions that only allow a person to have the permis- sions necessary to complete their role. For example, an employ will only be given permissions needed to complete their job. Pre- vents lower level employees from accessing additional information that is not relevant to them
Role Based Access Controls
a process by which potential threats, such as structural vulnera- bilities or the absence of appropriate safeguards, can be identi- fied, enumerated, and mitigations can be prioritized. This is about finding problems should be done early in the development.
Threat Modeling
lists all of the assets and considers how attacker could threaten them
Asset based approach (TM)
Talking about human threat agents can make the threat seem real
Modeling Attacker
