Fichas
235
Fichas del conjunto (28)
- 1MalwareSoftware programs designed to damage or commit unwanted actions on a computer system
- 2APT CharacteristicsAdvanced:
• Using a variety of intrusion technologies and malware
Persistent:
• Attacking consistently over a period
Threats:
• Threats to specific targets - 3Virus ComponentsInfection mechanisms:
• Means by which a virus spreads or propagates
Trigger:
• Condition that determines when a payload is activated
Payload:
• What it does - 4Virus TargetsBoot Sector infector:
• Infects a boot record and spreads when a system is booted
File infector:
• Infects files that the OS or shell may execute
Macro virus:
• Infects files that the OS or shell may execute
Multipartite virus:
• Infects files in multiple ways - 5Virus Concealment StrategyEncrypted virus:
• Creates a random encryption key
• Encrypts the remainder of the virus
Stealth virus:
• Designed to hide itself from detection
Polymorphic virus:
• Changes itself with every infection
Metamorphic virus:
• Mutates and rewrites itself at each iteration
• May change behaviour or appearance - 6Virus Prevention• Antivirus
System recovery:
• Keep backup copies of executables
• Store a system image
Data recovery:
• Backup work
Behaviour blocks:
• Stored in memory
• Intercept potential virus' - 7WormsSeeks out machines to infect. Each machine is used to search for an infect other machines
• Exploit software vulnerabilities
○ In client or server programs
• Spread through network connections
• Spread through hardware media
• Spread through macro or script code in email attachments
Upon activation may replicate and propagate again - 8BackdoorsA secret entry point to a program
• Allows the attacker to bypass normal security controls
• Gaining access on attackers own terms
• Can come back at a later time - 9RootkitA set of tools that modify system software. Allow attacker to keep access and hid on the machine
Detection:
• Using an alternative and trusted OS
• Behavioural based methods
• Signature scanning
• Difficult - rootkit may be able to subvert the software that is intended to find it
Removal:
• Complicated or practically impossible
• Reinstallation of the OS
• Firmware rootkits may require hardware replacement - 10Cross-site Scripting (XSS)Computer security vulnerability. Typically found in we applications. Allows attackers to inject client-side script into web pages
Prevention:
• Redirect invalid requests
• Detect simultaneous login
• Only show last few digits of card details
Non-persistent:
• Targets the user running script
• Malicious code stored in database
Persistent:
• Targets the user - 11CryptographyCryptography -the science of designing cipher systems
• Cryptanalysis -The process of deducing information about the plaintext from the • ciphertext without knowledge of the key
• Encryption - Hiding a message
• Plaintext - Information to be concealed
• Ciphertext - The encrypted plaintext
• Encryption algorithm - Set of rules used to encrypt the plaintext
• Encryption key - Used to allow the encryption operation
• Interceptor - Someone who intercepts the ciphertext - 12One Time Pad• Cannot be cracked
• Encryption technique
• Key created using random shifts
• Key should be as long as plain text to avoid repetition - 13Asymmetric vs Symmetric KeyAsymmetric:
• Cipher key is non-deducible from the encryption key
Symmetric:
• Decryption key can be deduced from the encryption key
• Keys are often identical - 14Public-key cipher (symmetric)• One key is used to encrypt/decrypt message
- 15Message Authentication• Public key is published
• Private key is applied to the message
• Message becomes the signature
• Receiver applies the public key to the signature
• Only the sender could generate the signature as only they know the public key
• Confirms that the message was genuine - 16ChecksumA digit representing the sum of the correct digits. Can be compared to message later to detect errors in message.
Simple Checksum:
• The sum of all bytes of data
Cryptographic checksum:
• Creates a hash value
• Created through a complex series of maths operations
• Translates the data in file to a fixed string of digits - 17DES• Key size - 56
• Breakable through brute-force
• Uses a symmetric key
• Uses algorithm (More convenient) - 18Triple DES• Key size - 56 * 3
• Triple encrypts
• Stronger than DES
• Slower than DES
Requires more space/power than DES - 19AES• 128, 192, 256 bit key-length
• Faster than DES & TDES
• Harder to crack than DES & TDES
• Stronger than DES & TDES
• Symmetric
• Ideal for software/firmware
• Good for low latency high throughput such as firewalls and routers
• Industry standard
• Can be used to encrypt passwords - 20RSA• 1024, 2048, 4096 bit key length
• Public key cryptography
• Safe for users
• Uses complex mathematics
• Harder to crack since involves factorisation of prime number
• Easy to save public key
• Can be slow when large data needs to be encrypted
• Asymmetric
• Can be used to encrypt passwords - 21Security GoalsConfidentiality:
• Recourses are only viewd by authorised users
• Printing
Integrity:
• Resources can only be modified by authorised users
• Creating, modification & deletion
Availability:
• Resources are accessible to authorised users
• Unauthorised user cannot prevent an authorised user form accessing - 22Attack TerminologyVulnerability:
• A weakness in a system
• Can cause a problem
Threat:
• A source of danger
Control:
A protective measure that removes a vulnerability - 23Methods of defence against an attackPreemption:
• Stop it before it happens
Prevention:
• Make it impossible
Deterrence:
• Make it difficult to crack
Detection:
Detect attacks as they occur - 24Methods of defence against an attackPreemption:
Stop it before it happens
Prevention:
• Make it impossible
Deterrence:
• Make it difficult to crack
Detection:
• Detect attacks as they occur - 25Risk Analysis:Quantitative risk analysis:
• Uses costs and probabilities
Qualitative risk analysis:
• Uses non-numerical grades - 26Qualitative Attacks• Identify Assets
• Determine vulnerabilities
• Estimate likelihood of exploitation
• Compute loss in case of an attack
• Select new controls
• Determine project savings - 27User Authentication:Individual knows:
• Passwords pins
Individual possess (token):
• Smartcard, electronics, key card
Individual is (static biometrics):
• Fingerprint, retina
Individual does(dynamic biometrics):
• Voice pattern, handwriting - 28Buffer overflow• Where a running program attempts to write data outside the memory buffer
• Stores additional data outside of the intended data
• Program may become unstable and crash
Información
- Descripción
- Fichas sobre 235, creado por B O U Y B O Y el 16/05/2019.
- Creado por
- B O U Y B O Y
- Visitas
- 10
- Valoración