Ethical Hacking & Countermeasures Basic Theory

David Bain
Mind Map by David Bain, updated more than 1 year ago
David Bain
Created by David Bain about 6 years ago
60
4

Description

Mind Map on Ethical Hacking & Countermeasures Basic Theory, created by David Bain on 05/20/2014.
Tags

Resource summary

Ethical Hacking & Countermeasures Basic Theory
1 Security Principles
1.1 Security is a supporting process
1.2 Security requirements come fron
1.2.1 Valuable data
1.2.2 Personal / private data
1.2.3 Valuable resources
1.2.4 E-Payments
1.2.5 Gov. Secrects
1.2.6 Criminal conspiracy
1.3 Info Security preserves
1.3.1 Confidentiality
1.3.1.1 Information is not made available or disclosed to unauthorised individuals
1.3.2 Integrity
1.3.2.1 Safeguarding the accuracy and completeness of assets
1.3.3 Availability
1.3.3.1 Being accessible and usable upon demand by an authorised entity
1.3.4 Reliability
1.3.4.1 Trustworthiness of the data and system
1.3.5 Authenticity
1.3.5.1 Like integrity, confirms accuracy of who / what is accessing assets
1.3.6 Accountability
1.3.6.1 Know who did what and be sure of it
1.4 Systems
1.4.1 Application or software
1.4.2 Libraries
1.4.3 Hardware
1.4.4 Supply chain
1.4.5 Users and customers
1.5 Assets have tangible or intangible value
1.6 More definitions
1.6.1 Vulnerabilities: exploitable system weakness
1.6.2 Threat: Event with potential to cause harm or damage
1.6.3 Risk: The potential for a threat to exploit a vulnerability and open up assets
1.7 Elements of security
1.8 Social context
1.8.1 Social norms impact on people's behaviour
1.8.2 If policies are against social norms, people won't comply
2 Risk
2.1 "A threat or possibility that an action of even will affect an organisations ability to achieve goals"
2.2 Security Measures

Annotations:

  • Risk analysis and management flow
2.2.1 Risks
2.2.1.1 Vulnerabilities
2.2.1.2 Threats
2.2.1.3 Assets
2.3 Identify and assess levels of risk
2.3.1 Values of assets
2.3.2 Threats to those assets
2.3.3 Any vulnerabilities and their severity
2.4 Outcomes of analysis
2.4.1 All assets identified and rated by importance
2.4.2 Threats identified and rated
2.4.3 Vulnerabilities identified and rated
2.4.4 Documented in risk register
2.5 Problems
2.5.1 Biz measures in money not actual security risk
2.5.2 Accuracy on the likliehood of threats
2.6 Risk levels
2.6.1 DON'T use financial scale for risk
2.6.2 High
2.6.2.1 Major impact on organisation
2.6.3 Medium
2.6.3.1 Noticeable impact
2.6.4 Low
2.6.4.1 Can be absorbed
2.7 Risk analysis steps
2.7.1 Decide on scope
2.7.1.1 Draw context diagram
2.7.1.2 Decide on boundary
2.7.1.3 Make assumptions
2.7.2 Identify assets
2.7.2.1 Types of asset include: Hardware, software, data, people, docs, supplies, money
2.7.3 Identify threats
2.7.3.1 I.e. loss of confidentiality, integrity, completeness or avilability
2.7.3.1.1 Rank either High, med or low / 1 out of 10.
2.7.4 Identify vulnerabilities to threats
2.7.4.1 Current system: Look at known issues and weaknesses
2.7.4.1.1 New System: Look at what software is to be used and what security it offers.
2.7.4.1.1.1 Further reading: ISO 27001
2.7.4.2 Chart them with an attempt Vs success rate
2.7.5 Risk assesment
2.7.5.1 Impact valuation Vs vulnerability
2.8 Risk management & response
2.8.1 Adoption of security measures related to risks to the assets
2.8.2 Bad: Withdraw from activity, accept it and do nothing
2.8.3 Good: reduce it with prevention, detection, reaction and insurance
3 Ethics and Professionalism
3.1 Common fallacies
3.1.1 All info should be free
3.1.2 System resources are wasted
3.1.3 Hackers keep authorities at bay
3.2 Ethics provide rules and morals
3.2.1 Ethical theories
3.2.1.1 Authoritarianism: held by most people, no single auth.
3.2.1.2 Consequentialism: Greatest happiness of greatest number, got to protect minorities
3.2.1.3 Deontologism: Should everyone act in a certain way, can rule breaks be justified?
3.2.1.4 Relativism: Knowledge of cultural variation, some absolutes.
3.3 Professionals have specific problems, work affects others, new situations.
3.4 Computing ethics include the privacy of data and people, safety of systems (i.e. transport) and accountability (decision making)
3.5 Codes of conduct act as a reminder, guidance to newbies, based on a wealth of experience, allow for professional perspective.
3.5.1 BCS codes of conduct to protect public interest, have a duty to authorities and to the profession.
3.5.2 People may react negitivly as it doesn't wholly relate to them, they don't like it or it isn't addressing their particular issue
3.6 Approaching ethical issues
3.6.1 Identify controversial practice
3.6.2 Analyse ethical issue
3.6.3 Deliberate on ethical issue (apply theories to analyse)
3.7 Ethical hacking works in unchartered territory
3.8 Must be able to debate controversial moral issues
4 Basic Hacking Techniques
4.1 Insider and outsider attacks
4.1.1 Security is equal to the countermeasures in place
4.2 Types of hacker
4.2.1 White hat: authorised to test the security via agreed means
4.2.2 Grey hat: Claim to test security for the good of everyone
4.2.3 Black hat: Attempt to break security and profit from it in some form
4.3 The hacking stack
4.3.1 Social
4.3.1.1 Application
4.3.1.1.1 Application software
4.3.1.1.1.1 Systems software
4.3.1.1.1.1.1 Transport
4.3.1.1.1.1.1.1 Physical
4.3.1.1.1.1.1.1.1 Key loggers, bin rummage, listening equipment
4.3.1.1.1.1.1.2 Denial of service, intrusion.
4.3.1.1.1.1.2 OS, routers, hardware devices via viruses
4.3.1.1.1.2 Injected PDF's & content, incorrect security function
4.3.1.2 Social engineering, blackmail
4.3.2 Layer selection based on nature (of target), skills and time.
4.4 The process
4.4.1 Plan, identify targets, contacts and scope
4.4.2 Footprint
4.4.2.1 Occurs at more than one layer
4.4.3 Execute attack
4.4.4 Analyse and Evaluate
4.5 Hackers aim to disrupt: Privacy, Availability, Non-repudiation, Integrity, Confidentiality.
4.5.1 Non-Repudiation: e-commerce, sender cannot deny sending message, recipient cannot deny having the message
4.5.2 Privacy: not to be confused with security.
4.6 Planning pen test
4.6.1 Methodologies
4.6.1.1 OSSTMM
4.6.1.2 ISSAF
4.6.1.3 NIST SP 800-115
4.6.2 Rules of engagement
4.6.3 Handling reports
4.7 Diagnostics
4.7.1 What worked / didn't work and why
4.7.2 Is it accurate, complete?
4.7.3 How long will it take?
Show full summary Hide full summary

Similar

Computing Hardware - CPU and Memory
ollietablet123
SFDC App Builder 2
Parker Webb-Mitchell
Intake7 BIM L1
Stanley Chia
Data Types
Jacob Sedore
CCNA Security Final Exam
Maikel Degrande
CCNA Answers – CCNA Exam
Abdul Demir
Software Processes
Nurul Aiman Abdu
Design Patterns
Erica Solum
Abstraction
Shannon Anderson-Rush
ISACA CISM Exam Glossary
Fred Jones
Security Guard Training
Summit College