Karteikarten
Information Security Deep Dive
Karten in diesem Stapel (76)
- 1What is Broken Access Control?Coding failures in an application that lead to information leakage, modification or destruction.
- 2What is Injection?Sending invalid user supplied data to a web application with the intention to make it do something that the application wasn’t intended to do.
- 3What is Owasp "Cryptographic Failure"?Failure to take into account the types of data being managed and putting cryptographic considerations in place for protection.
- 4What is Owasp "Insecure Design"?A relative lack of thoughtfulness or robust process surrounding the implementation of security in an environment, a lack of understanding related to what security is needed for a particular environment
- 5What is Owasp "Security Misconfiguration"?Lack of hardening of new hardware or systems when introduced to the environment
- 6What is Owasp "Vulnerable or Outdated components"?Open source or third party components with issues or from untrusted sources.
- 7What is Owasp "Identification and authentication failures"?Application that allows brute forcing, doesnt govern the strength of passwords, “forgotten password” processes are ineffective.
- 8What is "Software and Data Integrity Failures"?Situations where applications rely on libraries or modules from untrusted sources, or failure to have process that validate the integrity of items like third party libraries.
- 9What is Owasp "Insufficient Logging and Monitoring"?Having systems that report issues but not enough people or the process to monitor those alerts.
- 10What is Owasp "Server Side Request Forgery"?When a web application retrieves an object from a remote location without validating the URL provided by the user. This allows the hacker to manipulate the app to send requests to a destination it wasn’t meant to.
- 11What are some examples of Broken Access Control?directory path traversal, storage of file with sensitive data, CSRF - a page that captures information/creds from a legit user and allows an attacker to reuse
- 12What are some examples of Injection?Cross Site Scripting (Reflected and Stored)
SQL Injection (classic and blind) - 13What are some examples of Cryptographic Failure?Weak encoding of passwords, transmitting information in clear text, use of a key past its expiration date
- 14What are some examples of Insecure Design?- error messages containing sensitive information
- storing passwords in a recoverable format
- unprotected storage of credentials.
- not understanding and accounting for trust boundaries between resources that are to share sensitive information - 15What are some examples of Security Misconfiguration?CORS (Cross Origin Resource Sharing)
XML External Entities
Deprecated TLS version
Weak cryptgraphic ciphers - 16What are some examples of Vulnerable or Outdated components?Unpatched Libraries
- 17What are some examples of Identification and authentication failures?Missing 2 factor authentication
Missing password complexity requirements
Authentication login limits - 18What are examples of Software and Data Failures?Insecure Deserialization
Lack of support for integrity checks
Lack of verification of data authenticity - 19What are some examples of Insufficient Logging and Monitoring?Omission of Security relevant information
Including sensitive data into logs
Generally insufficient log monitoring/review process - 20What are possible solutions for Broken Access Control?Forcing 2 factor authentication,
Least privilege,
Disable accounts that aren’t needed - 21What are possible solutions for Injection?Using APIs to gather and handle data
Input validation, escaping user input
Prepared statements and parameterized queries - 22What are possible solutions for Cryptographic Failure?- Protecting data at rest and in transit (AES encryption, TLS 1.2 or better)
- Disable any ciphers that operate under 128-bit encryption
- Remove all versions of SSL
- Don’t store sensitive data where its not needed, discard when possible
- Use Perfect Forward Secrecy
- No FTP of SMTP - 23What are some solutions for Insecure Design?Threat Modeling
Secure design patterns - 24What are some solutions for Security Misconfiguration?Repeatable hardening process
Segmentation and containerization to minimize damage of breach - 25What are some solutions for Vulnerable outdated components?Open source scanners (XRay, WhiteSource)
Remove dependencies that are not necessary
Only retrieve libraries from official sources - 26What are some solutions for Identification and authentication failures?Multi Factor authentication
No default credentials
Implement weak password checks
Session timeouts
Account lockouts or time delays - 27What are some solutions for Software and data integrity failures?Digital Signatures for software
SAST scanning - 28What are some solutions for Insufficient logging and monitoring?Ensure log review process
Effective log format generation (time, user, IP, resource accessed, failed login in attempts, high val trx) - 29What are some solutions for Server side request forgery?Use deny by default firewall policies
Sanitized user input
Utilize allow list and avoid regular expressions - 30What is hashing?One way summary of data which cannot be reversed (SHA512)
- 31What is encoding?Changing data into a new format that can be reversed (Base64)
- 32What is encryption?Securely encoding data so that only authorized users with a key can decrypt and get access to original contents. (AES 256)
- 33What is GitLab?A repository hosting service.
- 34If you access GitLab via the CLI what prefix do you need to use?"git"
- 35What does CVCS stand for? (repository)Centralized version control server
- 36What is a CVCS?A version control server is a system that records changes to files so you can recall previous iterations when needed.
- 37One positive and one negative of a CVCS.Administrators can dictate who can access what and when.
Single point of failure - 38What is GitHub?A repository hosting service that provides an interface, access control and task mgmt for devs.
- 39What language is most closely associated with Git?"C" - used for reduced runtime and overhead found in other high level languages
- 40What is a bare repo?Repository that contains information and version control and no working files.
- 41Name 3 basic Git commandsgit init - used to create a new local repo
git status - list the files that you have changed or need to add to commit
git clone - create a working copy of a local repository
git commit - commits any files that you have added with the add command and commits any files you have changed since then
git commit - - amend - fit a broken commit - 42What is Artifactory?Repository service that supports artifacts.
- 43What does Artifactory do?Collects latest version of libraries
shares them among team members
analyzes third party licenses
Cleans unused outdated modules and unused libraries - 44What is a container?A form of operating virtualization, built on a piece of hardware.
- 45What do you use a container for?Single containers can be used to run anything from small micro services to larger applications and software processes.
- 46Whats the difference between VM and containers?VMs require larger amounts of statics resources and an OS per unit to run.
- 47Describe the architecture of a container setup.Hardware
Kernel
OS
Container - 48Describe the architecture of a VM.Hardward
Host OS
Hypervisor
OS/VM - 49What is located in the kernel that allows the customization and appearance that they have their own OS?Namespaces
- 50What in a container is responsible for monitoring or metering the resources to ensure that they never tax the foundation resources?Cgroups (control groups)
- 51What happens to resources when a container is not using them?They become available to other containers.
- 52What is a Docker file?File that contains the lines of text that describe how to build a container, how to run the container, what libraries and steps are necessary.
- 53Why are Docker files good?They allow for portability of containers and the applications they support
- 54What are the 3 basic commands needed to build a docker file/image?FROM - OS
RUN - command get executed during the build of the image
CMD - executed only after the image is created - 55What does AAA stand for?Authorization - ensuring you have access to only what you need
Authentication - make sure you are who you say you are
Accounting - ensure that all actions have a trail associated with them - 56What is OpenAM?Open source access mgmt, entitlements and federation plaform
- 57What two tenets of AAA does OpenAM handle?Authentication and Authorization
- 58OpenAM software requirements?Apache HTTP server
Apache Tomcat (web container)
OpenAM java web app
OpenAM core server - 59What is SAML stand for?Security Assertion Markup Language
- 60What does SAML 2.0 refer to?Federation access mgmt across the organizations boundaries. Federation allows the organization to share identities and services without giving away organizations info and services
- 61What does OIDC stand for?OpenID Connect
- 62What is OIDC?Thin layer that sits on top of OAuth 2.0 that adds functionality around login and profile info about the person that logged in.
- 63What is the name of the ID token used in OIDC?JWT (json web token)
- 64What are the characteristics of a JWT?Formatted string of characters.
Client can extract info therein
-ID, name, ID token expir, potential tamper - 65What is OAuth 2.0?Security standard where you provide consent for one application to access your data in another app.
- 66In OAuth 2.0 what is the resource owner?The person who owns the data being accessed.
- 67In OAuth 2.0 what is the client?The application that wants to access the data.
- 68In OAuth 2.0 what is the authorization server?The application that knows the person providing the consent.
- 69In OAuth 2.0 what is the resource server?Service the client wants to use on your behalf
- 70How does SAML 2.0 work?By passing information about users, logins, and other information between the identity providers and service providers.
- 71What are the 3 entities associated with SAML 2.0?User agent - service that authenticates to IDP
Identity Provider -
Service Provider - 72What are the part of the SDLC lifecycle?Project initiation > requirements definition > design specs > development/implementation > documentation > testing > transition to production
- 73What are the part of the DevOps cycle?Plan > code > build > test > release > deploy > operate > monitor
- 74Describe the relationship between Threats, Vulnerabilities and Risks.Threat x Vulnerability = Risk
- 75Describe what a Threat, Vulnerability and Risk are.Threat - describes and attacker or element that would take advantage of an exploit
Vulnerability - is a weakness in a system that provides an entry point to an attacker
Risk - the combination of a threat actor and a vulnerability - 76What does STRIDE stand for?Spoofing, Tampering, Repudiation, Information Leakage, Denial of service, Elevation of privileges
Informationen
- Beschreibung
- OWASP Top 10 Repositories Containers SSO - OAuth 2.0 Identity and Access Mgmt Dev LifeCycles DevOps Network Security Secure Coding Best Practices API Threat Modeling
- Erstellt von
- Durrell Smoot
- Aufrufe
- 8
- Bewertung