Fichas
Info Sec Notes
Fichas del conjunto (80)
- 1People who impose threats- Hacktivists
- State-Sponsored
- Cybercriminals
- Script Kiddies - 2All orgs should be expected to be attacked from- External Threats
- Internal Threats - 3How can we best defend against internal attackers:- Hire better people
- Vetting Checks - 4CIA Triage:- Confidentiality: keeping data secret from attackers
- Integrity: Ensuring that data and processes are timely, accurate and trustworthy
- Availability: Ensuring that critical business operations be accessed
- All Three are good
- Network Based Defenses (Firewalls)
- Internal Defense (Host based Security)
- Defense in depth (Strong perimeter, If breached harden all servers internally) - 5Risk Management:- Money and resources are not infinite
o Priority is needed
- You need to understand the orgs specific risk structure:
o Sources of attacks
o Key Targets
o Critical systems
o What needs funding
- At some point you need to say we have done what we can and must endure the residual risk
- How would you prioritize risks in a corporate environment? What are the key aspects to look for?
o History of the company
o Other orgs in the same industry
o Risk significance
o How often these risks happen
o Likelihood
o Severity - 6What is an example of a low likelihood but high severity:- Fire in the office
- Loss of business records
- Loss of data - 7High likelihood and low severity:- Automated attacks from the internet
- Script Kiddies
- NMAP Scan
- Scanning of the network - 8Risk Computation LifeCycle:1. Agree on scope
2. Identify threat
3. Estimate severity
4. Estimate likelihood
5. Compute impact
6. Rank all threats in terms of impact
7. Identify cost and countermeasures to reduce risk
8. Accept residual risk when budget is expended - 9Virus Lifecycle:A typical virus goes through the following four phases:
1. Dormant phase: the virus remains idle waiting to be activated by some events
not all viruses have this stage
2. Propagation phase: the virus embeds a replicated copy of itself into another program or certain system areas on the disk
3. Triggering phase: the virus is triggered by certain event meaning it is activated to perform the function for which it was intended
4. Execution phase: the virus executes causing harmful ( deleting files) or harmless action (messages on the screen) - 10Detecting Insider Attacks:- Greek work Crypto
- Protect data
- Authentication
- Data integrity
- Confidentiality
- Digital Signature
- Privacy
- Encryption
- Hash Function - 11Encryption 5 components:- Plaintext – The original message
- Ciphertext – The transformed coded message
- Encryption algorithm – Algorithm that transforms plaintext to ciphertext
- A secret key – Information used by the algorithm and known only to sender and receiver
- Decryption algorithm – Encryption algorithm in reverse, retrieve original message from coded message - 12Permutation:- A binary word has its bits reordered (permute)
- Also known as P-box
- First bit may become 7th bit - 13Firewall Limitations:- Cannot protect from attacks bypassing it
- Cannot protect against internal threats
- Cannot protect against access via WLAN
- Cannot protect against malware imported via laptop, PDA or storage infected inside - 14Packet filtering Advantages:- Fast
- No additional configuration
- Inexpensive
- Scale better than other types of firewall
Uses:
- Source IP
- Destination IP
- Source and dest TCP number - 15Disadvantages of packet filter firewalls:- Cant prevent attacks from application specific vulnerabilities
- Lack advanced user authentication
- Defining rules can be complex
- Difficult to test
- Prone to DOS attacks - 16Attacks on Packet Filter:- IP address spoofing – Fakes source address
- Source routing attacks – Attacker sets a route other than default
- Tiny fragment attacks – Split header info over several tiny packets - 17SSL/TLS:- A new layer between the transport layer and application layer
- Developed by Netscape
- Transport Layer security
- Secure socket layer
- 2 sublayer protocols
- Server authentication
- Confidentiality
- Integrity
- Client authentication - 18SSL Architecture:- SSL Connection
o A Transient, peer to peer communications link
o Associated with 1 SSL Session
- SSL Session:
o An association between client and server
o Created by the Handshake protocol
o Define a set of parameters
o May be shared with multiple SSL connections - 19SSL Components:- SSL Record Protocol
- SSL Handshake Protocol
- SSL Alert Protocol
- SSL Change Cipher Spec Protocol - 20SSL Record Protocol:- Transfers the data
- Provides confidentiality
- Defines a set of formats and procedures
- Encrypted record are forwarded to TCP layer
- Fragmentation
- Compression
- Integrity protection
- Encryption - 21SSL Handshake Protocol:- Authenticate server and client
- Negotiate encryption and MAC algorithms
- Negotiate cryptographic keys to be used
- Comprise a series of messages in phases
- Establish Security capabilities - 22TLS – Transport Layer Security:- SSL Version 3
- Uses HMAC for MAC
- A pseudo random function expands secrets
- Additional alert codes
- Changes in certificate types - 23HTTPS – Secure Hypertext Transfer Protocol- HTTP over SSL
- Combination of HTTP and SSL/TLS protocols
- To achieve safe communication - 24Secure Shell (SSH)- Protocol for secure network communications
- Secure remote logon
- Most OS support
- Method of choice for remote login - 25Port Forwarding- SSH supports 2 types of port forwarding
- A way to convert an insecure port to a secure port - 26What firewalls do:- Manage access between the internal and external network
- Overall security is only as good as the weakest link
- Allow the network admin to define a centralized choke point
- Simplify security management
- NAT (Network Address Translator) can be deployed at the firewall
- Creates a single point of failure
- Security of individual host systems can still be hacked due to security negligence - 27HASH Function:- One way function
- Takes only the message and not the key
- Detect changes in message
- Can be used with symmetric and asymmetric encryption
- Can be applied to any sie message
- Fixed length output
- Is easy to compute - 28Terminology:- Plaintext - original message
- Ciphertext - coded message
- Cipher - algorithm for transforming plaintext to ciphertext
- Key - info used in cipher known only to sender/receiver
- Encipher (encrypt) - converting plaintext to ciphertext
- Decipher (decrypt) - recovering ciphertext from plaintext
- Cryptography - study of encryption principles/methods
- Cryptanalysis (code breaking) - study of principles/methods of deciphering ciphertext without knowing key
- Cryptology - field of both cryptography and cryptanalysis - 29CSP Types:- Three different types of policy
- Organizational policy – What are the security decisions that affect the whole organization
- Issue-specific policy – What decisions are made for individual problems
- Entity specific policy – What decisions are made for specific systems or networks? - 30Cipher:2 Types:
- Block Cipher
o Process one input block at a time
o Produce one output for each input block
- Stream Cipher:
o Process input element continuously - 31Insider Attacks:- Employees
- Cleaners
- Unfriendly termination
- 59% of companies don’t even have the means to detect insider attacks
- Takes time to be discovered - 32High Likelihood High Severity:- Phishing
- Ransomeware!!
- Spam Emails - 33Risks that are overcompensated for in orgs? (Low risk but a lot of effort)- Politically motivated organization
- Things in the news
- Things that are publisicsed a lot - 34Threats!!!(EXAM):- Insider Threats – People leaving the organization
- Technology enhanced – Fraud, Gain access from perception
- Technology enabled – Paper based is being ruled out, Encryption, Ransomeware attacks
- Damaging infrastructure – Natural Events, Fire, Floods , Attacks
- Seeking Knowledge –
- Criminal Acts – Laws Broken, Beyond Reasonable doubt, Evidence, Attacks
- Civil Cases – Defamed people, Ruin persons image, Claims for money, not as serious, Balance of probability
- Securing technology – Mathematic secure encryption, Firewalls, Physical
- Securing people – Threats towards people, Staff member has a bad gambling problem and sells company secrets for money. People can let go of the business secrets. - 35Organisational Responses:- Policy dictates how organisations work
- Good Policy:
o Goals
o Scope -
o Responsibilities
- Different between policy and procedure:
o Policy are broad statements
o Procedure is more in depth for certain departments
- Policies that affect computer security in org:
o Prohibition of talking about anything of the org outside the organizations
o Strict confidentiality
o Procedure: Lock screen every time you walk away - 36User Security:- Users are always going to be a weak point
- Just get their job done
- Two key concepts
o Separation of Duties – Setting up roles within an organization such that no individual can subvert a critical process
o Least Privilege – People only have the authority to do what they need to, and no more
- Example:
o Loan Manager did both
o Loan manager should have been divided into 2 roles
o Least Privilege: If someone didn’t have access to all information then wouldn’t all be leaked - 37Password Attack- Brute Force – Try Everything (Slow)
- Dictionary Attack – Try all words and some standard combination (Fast)
- Keylogging – Capture passwords as they are typed by the user (Very Fast)
- Password policies should be risk-based:
o Pointless to insist on longer passwords if they are written down or captured by malware
o Human memory not very good at longer password - 38Procedures for Securing Systems:- Incident handling needs to be managed before incident occure
o The process for the incident
o Who is responsible
- Software installation policies must have security at the forefront:
o Consider least privilege
o How they impact the other business operations
o Cost
o Time
- Tampering of systems must be monitored:
o What logging is in place - 39Threat Response:o Mark is hard to attack – Banks
o Make it easier for offenders to be caught – Reduce Crime -
o Make it harder to cash out (Reducing Rewards) -
o Reduce the motives for attacks – Good public relations
o Removing excuses – Hold individuals and groups accountable - 40Securing Systems- Multi-Factor authentication
- Fingerprint
- Something you know password
- Something you have phone
- Something you are fingerprint
- Situational crime prevention – Harder for people to break in - 41Symmetric Encryption- 1 key
- Plain Text – Meet me at the bridge (any text)
- Key
- Cipher Text – Encrypted Text - 42Symmetric Encryption Issues- Key management
- Key is secure
- Sending key
- Middle man attack
- Public key almost solves all these problems - 43- Asymmetric Cipher:o 2 Keys
o 1 for encryption
o 1 for decryption
o Public key cant be used for decryption
o Public key is used to encrypt and doesn’t matter whos hand it is in
o Mathematically linked key - 44Security Attacks – Taxonomy- Interruption – An attack on availability
- Interception – An attack on confidentiality
- Modification – An attack on integrity
- Fabrication – An attack on authenticity - 45Passive Attack- Sniffing Network traffic
- Gather data
- Getting passwords - 46Active Attacks- Modification of message
- Masquerade
- Replay
- Dos - 47Cover Your Tracks- Anti-forensics
- Removing logs
- Removing installed software
- Tor – Anonymous proxies – Internet Café
- Override all free space then delete it
- Scripts - 48Firewall Services- Service Control
o Disable unnecessary services
o Filter traffic
- Direction Control
o Limiting outgoing traffic
o Allowing some services to flow through the firewall
- User Control:
o Least Privledgre
o Seperation of duties
- Behaviour Control:
o Filterning emails to stop spam
o Only allowing limited information on the website - 49Firewall Limitations- Cannot protect attacks bypassing it - SSL
- Internal threats
- Access via WLAN – If improperly secured against external use -
- Malware imported via laptop – Laptop has been taken home etc. - 50Types of Firewalls- Packet Filtering
- Stateful packet filters
- Application gateway firewalls
- Circuit relay firewalls
- Combination - 51Stateful Packet FiltersStateful inspection, also known as dynamic packet filtering, is a firewall technology that monitors the state of active connections and uses this information to determine which network packets to allow through the firewall.
- 52Web Traffic Security- Incorporate SSL and TLS
- Embed SSL in specific packages
- Implement application specific security services embedded with a particular application - 53SSL Services- Server authentication
- Valid certificate or public key
- Confidentiality – Via encryption to sto eaves dropping
- Integrity with MAC
- Client authentication – Passwords - 54SSL Components- SSL Record Protocol
- SSL Handshake Protocol:
SSL Alert Protocol - 55Types of Intruders- Masquerader – Pretending to be someone
- Misfeasor – Accessing programs beyond there access
- Clandestine – Getting access
- Two levels of intruders:
o Hackers
o People interested in security - 56Intrusion Detection System (IDS)- Supervise computer systems and communication infrastructure
- Detect intrusions
- Components:
o Audit Records
o Detection
o Response - 57Virus Types- Encrypted virus
- Encryption key
- When an infected program is invoked
- Changes encryption key
- Replicates
- Stealth virus
- Polymorphic virus
- Metamorphic virus - 58Copyright Rights- Reproduction
- Modification
- Distribution
- Public-performance right
- Public display right - 59Logic Bomb:- Malicious code embedded into some legitimate program that activates when certain conditions are met.
- Can delete or alter files
- Halt a machine - 60Heartbleed- Encrypts Internet connection
- Allows an attacker to read server memory (Including Passwords)
-No method of detection before 2014 - 61Cybersecurity plan- Policy, Procedures, standards and guidelines
- Roles and respnsibiltieis
- Management and planning
- Assurance
- Accreditation - 62Organizational Constraints- Governance
- Managemnet
- Integration
- Legal - 63State-Sponsored attack example- AXIOM
- 4 Layers of Malware - 64Integrity Functions- Hash Functions
- Tripwire - 65Firewall ConfigurationsScreened host firewall system
Screened host firewall system
Screened subnet firewall system - 66Bastion Host- Runs circuit/application level gateways
- 2 or more net connections
- Externally accessible services - 67Defensive Strategies- Prevention
- Detection
- Responce - 68IDS Components- Audit Records
- Detection
- Response - 69OSI Security Architecture focuses onSecurity attacks
Security Mechanisms
Security services - 70Things that would increase SCP risk- Extending Guardianship
- Assisting natural surveillance
- Reducing Anonymity
- Utilizing place managers
- Strengthing formal surveillance - 71Encryption Techniques- Application level encryption
- Logical drive encryption
- Full Disk encryption - 72Fiestel Cipher- Subkey Generation algorithm
- Block and key Size
- Number of rounds and Roun Function - 73Permutation- Reorders bits of a binary word
- 74SubstitutionS-Box
- Impractical to build 64 bit blocks - 75RC5- Variable number of rounds
- High security
- Data-dependent rotations - 76Certify Public KeyTrusted body is needed
- 77NATNetwork Address Translator
Placed on in the firewall - 78Measures used for web security- HASH
- Authentication
- Dos - 79Popular INtrusion Detection Techniques- Realsecure
- BlackICe
- IPS - 80—
Información
- Descripción
- Fichas sobre Info Sec Notes, creado por Ash Z el 11/06/2019.
- Creado por
- Ash Z · jun 2019
- Actualizado
- 16 jun 2019
- Visitas
- 0
- Valoración