Security Notes

Seite 1

Security Basics

Vulnerability - A weakness in a security system i.e policy, procedure, design or implementation that may be exploited to cause loss or harm

Attack surface - Sum of all vulnerabilities in a given system that may be accessible to a hacker

Threat - Set of circumstances that have the potential to cause loss or harm. Can be -

Inside threat

Outside threat

Man made threat

Natural threat

Types of threats -

Interception

Interruption

Modification

Fabrication

MOM stands for Method, Opportunity and Motive

Three pillars of security (CIA) -

Confidentiality (C) - Only authorized persons have access to the data they need

Integrity (I) - Data has not been altered or modified by unauthorized persons (Trustworthiness of data)

Availability (A) - Authorized persons have access to the data whenever they need to

SIEM - Security Information and Event Management

Software products that provide real time analysis of security events generated by network hardware and applications. It does three things -

Aggregation of events

Correlation of events

Retention of events/logs

Types of attacks -

Reconnaissance attacks - Attacks that are meant to be unnoticed and only check the current network or system for vulnerabilities, so that the attacker can plan future attacks. No actual attacks are done during a reconnaissance attack, only vulnerabilities in defences are found.

Social Engineering attacks - Based on exploitation of human emotions rather than weaknesses etc. in network defences/firewalls etc.

Phishing attacks - e.g Phishing emails

Spear Phishing - The attacker sends a direct email to the victim and the email has familiar content (e.g taken from social media pages of the the victim)

Quid Pro Quo attack - Attacker pretends to be someone else and promises to do something for you in return for you doing something for them. e.g an attacker pretending to be an antivirus service provider, promising to provide free lifetime antivirus updates if you install their software.

Pretexting

NIST Framework -

NIST - National Institute of standards and technology

Seite 2

Splunk

Splunk presents unstructured machine data into useful structured form that provides business insights.

Splunk components -

Index Data -

Seite 3

Network Assurance

Firewalls - Needed to -

Stop unwanted/malicious traffic from entering the network or a particular subnet in your internal network

Allow desirable traffic to flow normally while keeping a careful watch on it

Types of firewalls -

Stateless firewalls/Static packet filtering firewalls/Static filtering firewalls - Usually done by an ACL, filters packets based on permit or deny rules only.

It does not check whether the incoming packet is a part of an already initiated connection or is the packet trying to initiate a new connection.

Since is is based on ACLs, it can only allow/deny connections from applications that use static port numbers. They cannot work with applications that use dynamic port numbers (eg. FTP)

It is prone to IP spoofing attacks as it does not maintain a history of IP addresses that is has filtered or passed through

Stateful firewalls - Monitors the overall TCP connection state including the TCP connection numbers

Allows internal hosts to initiate conversations with outside world, but does not allow outside hosts to initiate connections to inside hosts

Maintain state tables (also called session tables) that contain information on the state of the connections (the entries time out if the connection is closed or the idle timeout configured on the firewall expires). State tables include-

Source IP

Source port

Destination IP

Destination port

Connection state (Established/Closed)

They can support applications that use dynamic port ranges (like FTP)

However, stateful firewalls cannot protect against application layer attacks

What is included in 5-tuple?? -

Source IP

Destination IP

Source port

Destination port

Protocol

NAT and PAT -

Port forwarding -

Host based firewall or End point protection

Seite 4

Commands

Windows

To check source ports and destinations (can be used to check if there are malicious programs on your machine sending out requests - netstat -ab

TCP 192.168.86.126:59328 151.101.2.133:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59329 ec2-50-19-213-168:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59330 ec2-18-210-186-170:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59331 ec2-35-182-192-161:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59333 ec2-18-233-219-152:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59334 152.195.32.43:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59340 ec2-54-175-89-167:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59341 ec2-3-92-148-65:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59342 152.195.32.43:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59343 a23-52-80-85:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59344 a184-26-179-82:https ESTABLISHED

[chrome.exe]

TCP 192.168.86.126:59345 ox-173-241-242-143:https ESTABLISHED

Seite 5

Qualys Vulnerability Scanner

Vulnerability Management Life cycle stages (continuous process) -

Discovery

Organize assets

Assess

Report

Remediate

Verify

Three ways of scanning -

Through internal scanner deployed in the LAN to scan internal host devices

Through external (cloud based scanner) that can only be used to scan devices with a public IP (such as your instances on the cloud)

Through scanning agents deployed on hosts - the agents collect meta data from the hosts and send it to the cloud scanner for vulnerability tests. No tests are done on or by the agents - they only collect and send data

Supported OSs

Windows

Linux

Mac

IBM AIX

Ways to track hosts on Qualys -

In terms of IPs

In terms of DNS tracked hostnames

In terms of NetBIOS hostnames

Cloud agent hostnames (globally unique) - based on cloud agents installed on the hosts

Tracking host vulnerabilities by DNS name or by NetBIOS hostnames maintains a consistent and accurate vulnerability history, even if the IP address changes.

Knowledge base has a list of vulnerabilities (always updated) represented as QIDs.

See vulnerability legend - Fig 1 below

See vulnerability priority - Fig 2, 3 below

CVSS Scores - Common Vulnerability Scoring system is the de-facto standard for PCI-DSS

CVE - Common Vulnerability Exposure

Seite 6

Industry wise vulnerabilities and threats

Banks

Vulnerabilities