Weak Points Flashcards
RFC
Request for Comments:
Published by ISOC
Not all RFCs are standards documents (experimental, best practice, standard track)
Many informal RFCs analyze threats
An RFC is authored by individuals or groups of engineers and computer scientists in the form of a memorandum describing methods, behaviors, research, or innovations applicable to the working of the Internet and Internet-connected systems
AIS
Automated Indicator Sharing:
A US government initiative for real-time sharing of cyber threat indicators
Intelligence industry needs a standard way to share important threat data (share info freely)
Ex: STIX & TAXII
STIX
Structured Threat Information Expression:
A standardized XML programming language for conveying data about cybersecurity threats in a common language that can be easily understood by humans & security tech
Describes cyber threat info (motivations, capabilities, response info)
Designed to be shared via TAXII (but can be shared by other means)
TAXII
Trusted Automation Exchange of Intelligence Information:
Defines how cyber threat information can be shared via services and message exchanges
Securely shares STIX data
SRTP
Secure Real-Time Transport: RTP for delivering A/V over IP networks Uses AES Authentication, integrity, & replay protection HMAC-SHA1
SFTP vs. FTPS
SFTP: SSH FTP
FTPS: FTP over SSL/TLS
CE vs. SE vs. Zero-Fill
Cryptographic Erase:
Sanitizes a self-encrypting drive by erasing the media encryption key and then reimaging the drive
Secure Erase:
Used to perform the sanitization of flash-based devices (such as SSDs or USB devices) when cryptographic erase is not available
Zero-Fill:
Relies on overwriting a storage device by setting all bits to the value of zero (0), but this is not effective on SSDs or hybrid drives, and it takes much longer than the CE method
SPI
Sensitive Personal Information:
Information about a subject’s opinions, beliefs, and nature afforded specially protected status by privacy legislation
Rules of Engagement (Pentesting)
Can state things like no social engineering is allowed, no external website scanning, etc
IoC
Indicator of Compromise:
An artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.
Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or botnet command and control servers’ domain names
First action after forensically imaging a hard drive for evidence
The first thing that must be done after acquiring a forensic disk image is to create a hash digest of the source drive and destination image file to ensure they match.
A critical step in the presentation of evidence will be to prove that analysis has been performed on an identical image to the data present on the physical media and that neither data set has been tampered with.
Protecting Data Center Servers: 4 Best Features
FM-200 (gas), Biometric Locks, Mantrap, Antivirus
DPO (Data Protection Officer)
The primary role of the data protection officer (DPO) is to ensure that her organization processes the personal data of its staff, customers, providers, or any other individuals (also referred to as data subjects) in compliance with the applicable data protection rules.
They must understand how any privacy information is used within business operations
EDM (Exact Data Match)
A pattern matching technique that uses a structured database of string values to detect matches. For example, a company might have a list of actual social security numbers of its customers.
Since it is not appropriate to load these numbers into a DLP filter, they could use EDM to match the numbers’ fingerprints instead based on their format or sequence
Ex: xxx-xx-xxxx
Identifying rogue devices on a wired network
The best option is MAC address reporting from a source device like a router or a switch.
If the company uses a management system or inventory process to capture these addresses, then a report from one of these devices will show what is connected to the network even when they are not currently in the inventory.
GLBA
Gramm-Leach-Bliley Act:
A United States federal law that requires financial institutions to explain how they share and protect their customers’ private information
Data Sovereignty
Refers to a jurisdiction (such as France or the European Union) preventing or restricting processing and storage from taking place on systems that do not physically reside within that jurisdiction. Data sovereignty may demand certain concessions on your part, such as using location-specific storage facilities in a cloud service.
Staging
Staging environments can mimic the actual production environment, leading to a realistic test environment that minimizes the risk of failure during a push to the production environment
LDAP: Shared Authentication?
LDAP can be used for single sign-on but is not a shared authentication protocol. OpenID, OAuth, and Facebook Connect are all shared authentication protocols.
Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields. OAuth is designed to facilitate the sharing of information (resources) within a user profile between sites.
Which protocol is paired with OAuth2?
OpenID Connect:
OAuth 2 is explicitly designed to authorize claims and not to authenticate users.
The implementation details for fields and attributes within tokens are not defined. Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields.
Investigating Spam: Most important info
You should first request a copy of one of the spam messages, including the full email header.
By reading through the full headers of one of the messages, you can determine where the email originated from, whether it was from your email system or external, and if it was a spoofed email or a legitimate email
Banner Grabbing
Banner grabbing is conducted by actively connecting to the server using telnet or netcat and collecting the web server’s response.
This banner usually contains the server’s operating system and the version number of the service being run.
Hping
Hping is a handy little utility that assembles and sends custom ICMP, UDP, or TCP packets and then displays any replies. It was inspired by the ping command but offered far more control over the probes sent. It also has a handy traceroute mode and supports IP fragmentation.
Hping is particularly useful when trying to traceroute/ping/probe hosts behind a firewall that blocks attempts using the standard utilities.
Hping also allows you to map out firewall rule sets. It is also great for learning more about TCP/IP and experimenting with IP protocols.
Hping does not support IPv6 (NMAP creators made Nping to make up for this)
Call List/Escalation List
This list should detail who should be called, what order, and how high up the organizational leadership chart a particular issue would reach.
In almost every case, the incident response team lead should be contacted before the CEO or CIO is notified of the incident
