Week 1

Question 1

Information Security?​

Answer 1

What is information security?​

Information security (also called computer security) is the act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure, corruption, and destruction or theft.​

It typically includes an in-depth plan on how to secure data, computers, and networks.​

Question 2

The Security Requirements Triad​

Answer 2

Confidentiality, Integrity, Availability

Question 3

The Security Requirements Triad​: There is a 4th security tenet. Any guesses?

Answer 3

Non-Repudiation

Question 4

Confidentiality

Answer 4

Efforts made to prevent unauthorized disclosure of information to those who do not have the need or right to see it. Ex: PII - Personal Identifyable Information. ​

Controls that help Confidentiality: ​

Encryption of data at rest (disk/ database) ​

Encryption of data at motion (SSL, SSH, IPSec, PPTP) ​

Access Control (physical and technical) ​

​

Question 5

Integrity

Answer 5

Two types of Integrity: ​

Data Integrity: Ex: Student gaining access to grades database.

System Integrity: ​Student introducing a malicious program on a windows machine to gain backdoor entry to data like grades database.

Opposite: Alteration

Controls that help Integrity: ​

Hashing (data integrity) ​

Configuration Management (system integrity) ​

Change Control (process integrity) ​

Access Control (physical and technical) ​

Software digital signing Transmission CRC functions.

Question 6

Availability

Answer 6

Efforts made to prevent disruption of service and productivity. DOS Attack - Denial Of Service Attack, denies service (availability) of a system. ​

​

Controls that help availability: ​

RAID - Redundant Array of Inexpensive Disks. ​

Clustering ​

Load Balancing​

Redundant data and power lines. ​

Software and Data backups ​

Disk shadowing ​

Co-location and offsite facilities ​

Rollback functions ​

Fail-over configurations. ​

Question 7

Scope of System Security​

Answer 7

1. Access to the data must be controlled (protection)
2. Access to the computer facility must be controlled (user authentication)
3. Data must be securely transmitted through networks (network security)
4. Sensitive files must be secure (file security)

Question 8

The following examples affect which TRIAD of IT Security?

Equipment Stolen of Disabled thus affecting users from using the system.

Answer 8

Availability​

Question 9

The following examples affect which TRIAD of IT Security?

Programs Deleted denying access to users.​

Answer 9

Availability​

Question 10

The following examples affect which TRIAD of IT Security?

A program was modified to cause it to fail or do unintentional actions​

Answer 10

Integrity

Question 11

The following examples affect which TRIAD of IT Security?

An unauthorized copy of the software is made​

Answer 11

Confidentiality

Question 12

The following examples affect which TRIAD of IT Security?

A program was modified to cause it bring the systems down. What has been compromised?​

Answer 12

Integrity

Question 13

The following examples affect which TRIAD of IT Security?

An unauthorized data read is performed and data is being analyzed.​

Answer 13

Confidentiality​

Question 14

The following examples affect which TRIAD of IT Security?

Messages are passively interpreted and directed to a remote location

Answer 14

Confidentiality​

Question 15

The following examples affect which TRIAD of IT Security?

Messages are passively interpreted and directed to a remote location

Answer 15

Confidentiality​

Question 16

Categories of Attacks​

Answer 16

Passive attacks​

Attempts to learn or make use of information from the system but does not affect system resources.​

Are in the nature of eavesdropping on, or monitoring of, transmissions.​

Goal of attacker is to obtain information that is being transmitted.​

Difficult to detect because they do not involve any alteration of the data.​

Emphasis is on prevention rather than detection.​

Two types:​

Release of message contents​

Prevent an opponent from learning the contents of a transmission.​

Traffic analysis ​

Encrypting the contents of a message so even if an opponent captures the message, they cannot extract the information.​

Question 17

Categories of Attacks​

Answer 17

Active attacks​

Involve some modification of the data stream or the creation of a false stream​

Goal is to detect them and to recover from any disruption or delays​

Four categories:​

Replay​

Masquerade​

Modification of messages​

Denial of service​

​

Question 18

Intruder Behavior Patterns​

Answer 18

Hackers​

Organized group of intruders who hack into a computer for the thrill or for status​

Criminals​

Usually have specific targets or classes of targets in mind​

Once a site is penetrated, the attacker acts quickly, scooping up as much valuable information as possible and exiting​

Insider Attacks​

Difficult to detect and prevent​

Employees have access to and knowledge of the structure and content of databases​

Can be motivated by revenge or a feeling of entitlement​

Question 19

Zero Day Attacks​

Answer 19

APT attackers conduct their own vulnerability assessment and store vulnerabilities detected for later use. They do not disclose these.​

Dangerous, because the product owners are not aware of these vulnerabilities. No corrective measures are available for these attacks as vendors are not aware of these.​

Targets can easily be compromised with a zero-day exploit​

Ex: Stuxnet attack traced to the U.S. and Israeli Governments. A worm that was targeted at Iran’s nuclear facility.​

Question 20

Threat Vectors – Where threat agents can gain access from ?​

Answer 20

Email and social media​

Phishing messages and spam​

Victims are targeted directly on social media or social media is used to harvest information about users and an attack could be carefully crafted using that information.​

Direct Access​

Attacker could boldly enter public access areas of a building (ex: lobby, customer store) and use unsecure wireless networks to gain access to system or identify vulnerabilities.​

They could attempt to gain physical access to facility using stolen access cards.​

Could identify unsecured computer terminals or systems after they gain illegal access to the building. ​

Key to addressing this is having a good physical security measures in place.​

Removable media​

Cloud​

Third-party risks​

Question 21

Malicious Software​

Answer 21

Malware​

Malicious software that exploits system vulnerabilities​

Designed to cause damage to or use up the resources of a target computer​

Frequently concealed within or masquerades as legitimate software​

Two categories​

Those that need a host program​

Those that are independent (parasitic)​

May or may not replicate​

Question 22

Malicious Programs​

Answer 22

Back door (also known as a trap door)​

Secret entry point into a program that allows someone who is aware of the back door to gain access without going through the usual security access procedures.​

A maintenance hook is a backdoor inserted by a programmer to aid in testing and debugging.​

​

Logic Bomb​

One of the oldest types of program threats​

Code embedded in some legitimate program that is set to “explode” when certain conditions are met.​

Question 23

Malicious Programs​

Answer 23

Trojan Horse​

A useful, or apparently useful, program or command procedure containing hidden code that, when invoked, performs some unwanted or harmful function​

Can be used to accomplish functions indirectly that an unauthorized user could not accomplish directly​

Question 24

Trojan horses fit into one of three models:​

Answer 24

Continuing to perform the function of the original program and additionally performing a separate malicious activity​

Continuing to perform the function of the original program but modifying the function to perform malicious activity or to disguise other malicious activity​

Performing a malicious function that completely replaces the function of the original program

Question 25

Ransomware​

Answer 25

What is ransomware?​ Ransomware is a type of malware that restricts access to a computer system and demands that a ransom be paid.​ Personal files are encrypted and the user is locked out.​ The malware then informs the user that in order to decrypt the files, or unlock the computer to regain access to the files, a payment would have to be made to one of several banking services, often overseas.​ An example of ransomware is CryptoLocker.​ CryptoLocker encrypts certain files on the computer’s drives using a public key.​ ​

Question 26

Malicious Programs​

Answer 26

Spyware and Adware are types of Trojans.​ Spyware monitors what happens on a target computer.​ An example of spyware is the Internet Optimizer.The Internet Optimizer redirects Internet Explorer error pages out to other websites’ advertising pages.​ Adware monitors user actions and displays pop-up ads on the user’s screen.​ Grayware​ Grayware is another general term that describes applications that are behaving improperly but without serious consequences.​ ​ ​ ​

Question 27

Rootkit​

Answer 27

A rootkit is a type of software designed to gain administrator-level control over a computer system without being detected.​ It is used to perform malicious operations on a target computer at a later date without the knowledge of the administrators or users of that computer.​ Rootkits can target the UEFI/BIOS, boot loader, kernel, and more.​ Rootkits are difficult to detect because they are activated before the operating system has fully booted.​ Sony spyware rootkit example.​ To track users who might be illegally copying and distributing copies of CDs.​ Used a rootkit on audio CDs sold in 2005 that can conceal its existence to users.​ The Federal Trade Commission ruled in 2007 that Sony had violated Federal laws and had to reimburse consumers upto $150.​ ​

Question 28

Viruses ​

Answer 28

Software that can “infect” other programs by modifying them​ The modification includes injecting the original program with a routine to make copies of the virus program, which can then go on to infect other programs​ Typical hosts for viruses in a computer are:​ EXE files in Windows Machine​ Book sectors of disk partitions.​ Script files for system administrators​ BAT files in Windows and SH files in Unix.​ Documents that are allowed to contain macros​ Word, Excel, Access database, etc.​ Could also be fileless. Can directly inject themselves into the memory. No local storage is needed.​ ​

Question 29

Worms​

Answer 29

A worm is much like a virus, except that it self-replicates, whereas a virus does not. It does this in an attempt to spread to other computers.​ Programs that can replicate themselves and send copies from computer to computer across network connections​ In addition to propagation the worm usually performs some unwanted function​ Worms take advantage of security holes in operating systems and applications, including backdoors.​ Actively seek out more machines to infect and each machine that is infected serves as an automated launching pad for attacks on other machines​ A network worm: ​ Exhibits the same characteristics as a computer virus​ May attempt to determine if a system has previously been infected before copying itself​

Question 30

Bots​

Answer 30

Also know as a zombie or drone​ Program that secretly takes another Internet-attached computer, then uses it to launch attacks that are difficult to trace to the bot’s creator​ A botnet is a collection of bots capable of coordinating attacks​ ​

Question 31

Credential Theft, Keyloggers, and Spyware​

Answer 31

Keylogger​ Captures keystrokes on the infected machine to allow an attacker to monitor this sensitive information​ Spyware​ Subverts the compromised machine to allow monitoring of a wide range of activity on the system​ May include monitoring the history and content of browsing activity​ Redirecting certain Web page request to fake sites controlled by the attacker​ Dynamically modifying data exchanged between the browser and certain Web sites of interest​

Question 32

Phishing and Identity Theft​

Answer 32

Phishing​ Exploits social engineering to leverage user’s trust by masquerading as communications from a trusted source​ Spam e-mail may direct a user to a fake Web site controlled by the attacker, or to complete some enclosed form and return to an e-mail accessible to the attacker, which is used to gather a range of private, personal information on the user​ Spear-phishing​ E-mail claiming to be from a trusted source, however, the recipients are carefully researched by the attacker and each e-mail is carefully crafted to suit its recipient specifically, often quoting a range of information to convince them of its authenticity​

Question 33

Review Slide 53 Week 1

Answer 33

Review Slide 53 Week 1

Question 34

Review Slide 20 Week1

Answer 34

Review Slide 20 Week1

Question 35

Introduction

Answer 35

Security has always been a major business concern​ Physical assets are protected with locks, barriers, guards.​ Information assets are protected with passwords, coding, certificates, encryption.​ Computers and Internet have redefined the nature of information security​ Laws and enforcement in cyber crime​ Slow to catch-up​ Breaking into a computer is now a federal crime in the U.S.​ New laws against cyberborder crimes, yet difficult to enforce, sentences are typically very light​

Question 36

Computer Security Incidents​

Answer 36

Computer security increasingly important​ More sophisticated tools for breaking in​ Viruses, worms, credit card theft, identity theft leave firms with liabilities to customers​ Incidents are escalating at increasing rate​ Computer Emergency Response Team (CERT) was formed at Carnegie Mellon University with US DoD support​ responds and raises awareness of computer security issues, www.cert.org​ Worldwide annual information security losses may be $2 trillion​ ​

Question 37

Financial Impact of Security​

Answer 37

Security issues can impact consumer confidence​ 70% of all email sent worldwide was spam in 2006. Today ???​ New laws on data privacy and financial information include Sarbanes-Oxley Act (SOX) and Health Insurance Portability and Accountability Act (HIPPA)​ ​ ​

Question 38

Why Networks Need Security​

Answer 38

Organizations vulnerable due to dependency on computing and widely available Internet access to its computers and networks​ ​ Business loss potential due to security breaches​ $3.92 million average loss per incident of data breach​ Cost per lost record is $150 ​ Time to identify and contain a breach – 279 days​ Most impacted country – USA, Highest industry average - Healthcare​ Reduced consumer confidence as a result of publicity​ Loss of income if systems offline​ Costs associated with strong laws against unauthorized disclosures (California: $250K for each such incident)​ ​ Protecting organizations’ data and application software​ Value of data and applications far exceeds cost of networks​ Firms may spend about $1500/employee on security awareness​ ​

Question 39

Breach Impact

Answer 39

Financial Risk​ Ex: Cost of rebuilding a datacenter after being physically destroyed.​ Cost of contracting experts for incident response and forensic analysis.​ Loss of assets and revenue​ Reputational Risk​ Loss of goodwill among customers, employees, suppliers and other stakeholders.​ Loss of brand value, image, reputation​ Identity Theft​ Exposure of PII (Personally Identifiable Information)​ Ex: SSN, bank accounts, Credit card data, Driver’s license numbers, passport data, and similar sensitive identifiers.​ ​ ​

Question 40

Consequences of a breach:​

Answer 40

Strategic Risk: Potential that an organization will become less effective in meeting its goals after a breach​ Ex: Stolen laptop containing new development plans or a new prototype of an initiative.​ What if competitors get a copy of these plans? ​ Operational Risk: Organization's ability to carry out day to day operations.​ May lead to developing manual work-arounds to handle operations that could be quicker and better handled using automated systems.​ Ex: Customers unable to login to a bank website after it has been shut off due to a denial-of-service attack.​ Compliance Risk​ HIPAA compliance – requires health-care providers to protect the CIA triad of personal health information (PHI). If patient records are stolen, HIPAA compliance has been violated.​ Can lead to sanctions and heavy fines.​ ​