Chapter 2: Cybersecurity Concepts

Knowledge Statements

• Domain 1: Cybersecurity Concepts
• 1.1 Knowledge of cybersecurity principles used to manage risk related to the use, processing, storage and transmission of information or data
• 1.2 Knowledge of security management
• 1.3 Knowledge of risk management processes, including steps and methods of assessing risk
• 1.4 Knowledge of threat actors e.g. script kiddies, non nation state and state sponsored
• 1.5 Knowledge of cybersecurity roles
• 1.6 Knowledge of common adversary tactics, techniques and procedures
• 1.7 Knowledge of relevant laws, policies, procedures and governance requirements

Chapter 2: Cybersecurity Concepts

• Effective policies, security implementation, resource allocation and incident response are all dependent on an understanding of risk and threats facing an organisation.
• Compliance Approach
• Regulation and standards, implemented regardless of need and a checklist approach
• Risk Approach
• Unique to the organisation, address risk using controls and aligned to organisations appetite
• Ad-Hoc Approach
• No rationale, often indicates a lack of SME knowledge

Key Terms & Common Attack Vectors

• TERMS
• RISK: probability of an event and its consequences
• RESIDUAL RISK: remaining risk after safeguards
• INHERENT RISK: risk level without mitigating actions
• THREATS: cause of an unwanted incident
• ASSETS: item of value
• VULNERABILITY: weakness that can be exploited
• THREAT SOURCE: process attempting to exploit
• THREAT EVENT: result of a threat
• COMMON ATTACK VECTORS
• CYBERATTACK: well defined, advanced & targeted
• THREAT AGENT: Friendly or Hostile
• CORPORATIONS: breach boundaries to gain competitive advantage
• NATION STATES: targets government & private entities
• HACTIVISTS: often independent & politically motivated
• CYBER TERRORIST: may use violence, aimed at govt
• CYBER CRIMINALS: motivated by profit
• CYBER WARRIORS: on behalf or aimed at political groups
• SCRIPT KIDDIES: young, learning to code
• SOCIAL HACKERS: social engineering, cyber bullies
• EMPLOYEES: low tech, disgruntled employees

Attack Attributes

• Attack is the actual occurrence of a threat. Threat Agent views the asset as a target and the path used to gain access is known as the attack vector.
• Attacker must defeat any controls and use an exploit to take advantage of a vulnerability.
• Attack mechanism is the method used to deliver the exploit and may involve a payload to deliver the exploit to the target.
• Each attack attributes provide a unique point where controls can be implemented to prevent or detect an attack
• Analysis of each point can provide details of the attack, vulnerabilities and how to prevent recurrence
• ATTACK VECTORS THREAT EVENT
• INGRESS: intrusion - ADVERSARIAL: malicious
• EGRESS: exfiltration - NON ADVERSARIAL: accidental

Generalised Attack Process (Adversarial)

• 1. Perform Reconnaissance
• 2. Create Attack Tool
• 3. Deliver Malicious Content
• 4. Exploit and Compromise
• 5. Conduct an Attack
• 6. Achieve Results
• 7. Maintain a Presence or Capabilities
• 8. Co-ordinate a Campaign

Generalised Attack Process

• 1. Perform Reconnaissance
• Adversary gathers information using a number of techniques
• Sniffing or scanning network perimeter
• Use of open source discovery tools on organisation info
• Running malware to identify potential targets
• 2. Create Attack Tool
• Adversary crafts the tools needed to carry out the attack
• Phishing or spear phishing
• Counterfeit websites or certificates
• False fronts and injections of malicious components
• 3. Deliver Malicious Content
• Adversary inserts or installs what is needed to carry out an attack
• Introduces malware into a system
• Placing subverted individuals into privileged positions
• Installs sniffers or scanning devices on targeted networks and systems
• Insert tampered hardware into organisation system or supply chain
• 4. Exploit & Compromise
• Adversary takes advantage of information and systems to compromise
• Split tunnelling, physical access
• Exfiltration of data/sensitive information
• Exploits multi-tenany in a cloud environment

Generalised Attack Process

• 5. Conduct an Attack
• Adversary co-ordinates attack tools or performs activities that interfere with organisational functions
• Communication interception or wireless jamming
• DoS/DDoS
• Remote interference/physical attacks
• Session hi-jacking
• Man-in-the-middle
• 6. Achieve Results
• Adversary causes an adverse impact
• Obtaining unauthorised access to systems and info
• Degrading org services or capabilities
• Creating, corrupting or deleting critical date
• 7. Maintain a Presence or Capabilities
• Adversary continues to exploit and compromise system
• obfuscating adversary to exploit and compromise system IDS
• adapt cyber attacks in response to org security measures
• 8. Co-ordinate a Campaign
• Adversary co-ordinates campaign using
• Multi-staged attacks
• Internal and external attacks
• Widespread and adaptive attacks

Threat Events (Non Adversarial)

• Mishandling of critical or sensitive information by authorised users
• Incorrect privilege settings
• Fire, flood, hurricane, windstorm or earthquake
• Introduce vulnerabilities into software
• Pervasive disk errors or other problems caused by ageing equipment

Malware

• Malware or malicious code is software designed to gain access to targeted computer systems, steal information or disrupt operations
• Key Components:
• A worm that carries out payload routines
• A link file that propagates copies of the worm
• A rootkit hides malicious processes to prevent detection
• Common vectors:
• Viruses
• Worms
• Trojan Horse
• Botnets
• Spyware
• Adware
• Ransomware
• Key Logger
• Rootkit
• Viruses: code that can replicate and spread across computers
• Worms: self replicating code spreads across networks
• Trojan Horse: malware accesses by hiding within a genuine application
• Botnets: large, automated and distributed network (DOS)
• Spyware: gathers information without the knowledge of the person
• Adware: designed to present adverts (unwanted)
• Ransomware: extortion malware lock data or functions
• Key Logger: malware secretly records keystrokes and screen content
• Rootkit: hides existence of other malware by modifying OS

CAPEC

• Common Attack Pattern Enumeration Classification
• An abstraction mechanism for helping describe how an attack against vulnerable system of networks is executed
• Advanced Persistent Threat (APT)
• Complex, co-ordinated, directed at specific entity and resource intensive
• Backdoor
• Regain access to a compromised system and access remotely
• Brute Force
• Try all combinations until success
• Buffer Overflow
• Programme store more data in buffer than intended
• DOS Attack
• Overwhelm a system to bring down/reduce services
• Man-in-the-Middle
• Attacker intercepts communications and replaces with malicious code
• Social Engineering
• Exploit social media to trick users
• Phishing
• Email attack to trick users into giving information
• Spear Phishing
• Targets specific individuals e.g. CEO
• SQL Attacks
• Injection of malicious code where inputs are not validated
• Zero Day Exploit
• Vulnerability exploited before creator is aware of its existence

Policies and Procedures

• Policies
• Communicates requirements and sets out expected behaviours
• Standards
• Interprets policies in specific situations
• Procedures
• How to comply with policies and standards
• Guidelines
• General guidances and recommendations (non mandatory)
• COBIT Framework
• Business Continuity
• Disaster Recovery
• Asset Management
• Rules of Behaviour
• Acquisition Development
• Vendor Management
• Communication & Operations
• Compliance
• Risk Management
• Scope of Framework
• Roles and Responsibilities
• Vision, Goals & Culture
• Data Management
• Risk Assessment
• Compliance
• Legal & Regulatory
• Contract Management

Types of IS Policy

• Access Control
• Physical & Logical
• Least privilege
• Segregation of Duties
• Emergency Access
• Personnel
• Background checks
• Succession planning
• Termination procedures
• Incident Response
• Definition of an incident
• How incidents will be handled
• Escalation points
• Incident Response Plan
• Criticality of incidents
• Reporting and escalations
• Recovery Time Objective
• Testing
• Post Incident Review
• Incident Documentation

Cybersecurity Controls

• Identity Management
• Essential control
• Authentication, authorisation and access controls
• Must be consistent across the organisation
• Authorisation
• Ability to differentiate users
• Least privilege
• Set system access levels e.g. read, write
• Provisioning
• Control through user ID and password
• Remove when no longer needed
• JML policies and procedures
• Access Control List (ACL)
• Used to provide access
• Set to specific levels and defined groups
• Filters traffic at interface
• Without ACL routers pass all packets
• Change Management
• Verify potential impact
• Access proposals
• Inspect lines of defence
• Version Controls
• Patch Management
• Solution to software programme errors
• Failure to apply is the most common cause of events