diff --git a/.github/workflows/release-pdf-action.yaml b/.github/workflows/release-pdf-action.yaml new file mode 100644 index 0000000..f925227 --- /dev/null +++ b/.github/workflows/release-pdf-action.yaml @@ -0,0 +1,38 @@ +name: Generate PDF Release + +on: + push: + tags: + - 'v*' + workflow_dispatch: # Allow manual triggering + +jobs: + generate-pdf-release: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.12' + + - name: Generate PDF + run: python security-plus-all.py + + - name: Create release + id: create_release + uses: actions/create-release@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + tag_name: ${{ github.event.ref }} + release_name: Release ${{ github.event.ref }} + body: | + Automated release generated from markdown files. + draft: false + prerelease: false + files: | + security-plus-sy0-601-all.pdf diff --git a/.gitignore b/.gitignore index 6e052d3..aa63e93 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ ## Text Editor / IDE # IntelliJ IDEA .idea + +# The All file should not be upload to the repo. It's a working file +security-plus-sy0-601-all.md \ No newline at end of file diff --git a/1.0-threats-attacks-and-vulnerabilities/1.1-compare-and-contrast-different-types-of-social-engineering-techniques.md b/1.0-threats-attacks-and-vulnerabilities/1.1-compare-and-contrast-different-types-of-social-engineering-techniques.md index 38d75ea..9f4dac3 100644 --- a/1.0-threats-attacks-and-vulnerabilities/1.1-compare-and-contrast-different-types-of-social-engineering-techniques.md +++ b/1.0-threats-attacks-and-vulnerabilities/1.1-compare-and-contrast-different-types-of-social-engineering-techniques.md @@ -1,175 +1,207 @@ -# __1.1 Compare and contrast different types of social engineering techniques__ +# 1.1 Compare and contrast different types of social engineering techniques -# Phishing +## Phishing -_Phishing_ is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a user into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack or the revealing of sensitive information. +A phishing attack **is a type of social engineering attack in which an attacker sends a fraudulent email or message**, typically with a malicious link or attachment, to trick the recipient into revealing sensitive information, such as login credentials, financial information, or personal data. -Most of this attacks use _Spoofing_ techniques. Spoofing is the act of disguising a communication from an unknown source as being from a known, trusted source. Spoofing can apply to emails, phone calls, and websites, or can be more technical, such as a computer spoofing an IP address, Address Resolution Protocol (ARP), or Domain Name System (DNS) server. +The email or message may appear to come from a trusted source, such as a bank, social media site, or a familiar brand. The attacker's goal is to deceive the recipient into clicking on the link or opening the attachment, which may download malware onto their computer or direct them to a fake website designed to steal their login credentials or other sensitive information. -Some of the techniques used do disguise users are: +Phishing attacks are a common tactic used by cybercriminals to steal sensitive information and gain unauthorized access to networks, systems, and data. To avoid falling victim to phishing attacks, it is important to be cautious when opening emails or messages, to verify the sender's identity before clicking on links or opening attachments, and to use two-factor authentication whenever possible. -* __Typosquatting__: Typosquatting, also known as URL hijacking, is a form of cybersquatting (sitting on sites under someone else's brand or copyright) that misspell a website address (e.g., "gooogle.com" instead of "google.com") and, usually hosts an alternative website owned by a hacker imitating the look and feel of the original one. +## Smishing -* __Prepending__: It is a type or typosquatting where an attacker attaches something as a prefix to a URL (e.g., "ggoogle.com" instead of "google.com"). +Smishing **is a type of phishing attack that uses SMS** (Short Message Service) or text messages to deceive victims into divulging sensitive information, installing malware on their device, or visiting a malicious website. The term "*smishing*" is a combination of "*SMS*" and "*phishing*." -* __Pretexting__: Pretexting is a form of social engineering in which an attacker tries to convince a user to give up valuable information or access to a service or system. The distinguishing feature of this kind of attack is that the scam artists comes up with a story - or pretext - in order to fool the user. +Smishing attacks can be difficult to detect because text messages are often considered more trustworthy than emails, and victims may be more likely to take action immediately without questioning the validity of the message. To protect against smishing attacks, users should be cautious when clicking on links or responding to text messages from unknown or suspicious sources, and avoid sharing personal or financial information over text messages. It is also advisable to keep software and mobile apps up-to-date, and to use security software on your device. -## Types of phishing attacks +## Vishing -* __Smishing__: A form of phishing when someone tries to trick users into giving them their private information via a text or SMS message. +Vishing **is a type of phishing attack that uses voice or telephone communications** to deceive victims into divulging sensitive information, such as passwords, account numbers, or credit card information. The term "*vishing*" is a combination of "*voice*" and "*phishing*." -* __Vishing__: Vishing is the phone's version of email phishing and uses automated voice messages to steal confidential information. Vishing attacks use a spoofed caller ID to disguise as a legitimate number. +During the call, the attacker will try to gain the victim's trust by using a friendly tone, creating a sense of urgency, or posing as a security or fraud prevention officer. The attacker may ask the victim to confirm their personal or financial information, such as their Social Security number, account number, or password, under the guise of a security check or investigation. -* __Pharming__: Pharming ("farming" + "phishing") is a kind of social engineering cyberattack in which criminals redirect internet users trying to reach a specific website to a different, fake site. Pharming typically works by installing malicious code on either a user's machine or a DNS server, which then misdirects users to fraudulent websites without their knowledge or consent. The first method works on an individual level. It alters the hosts file on a victim's computer, which causes internet traffic from that computer to go to a fake website instead of the desired one. The second works on a broader level by poisoning a DNS server to redirect multiple users to the fake site. +To protect against vishing attacks, it is important to be cautious when receiving unexpected phone calls or voice messages, especially from unknown or suspicious sources. Do not provide sensitive information over the phone unless you are absolutely sure of the caller's identity. If you are unsure, hang up and call the organization directly using a trusted phone number to verify the legitimacy of the request. It is also important to be aware that attackers may use a combination of vishing and other social engineering techniques, such as phishing or smishing, to increase their chances of success. -* __Spear phishing__: Spear phishing is an email or electronic communications scam targeted towards a specific individual, organization or business. To be effective, attackers perform some previous information gathering on the victim, known as __*Reconnaissance*__. The information can be gathered from open sources like lead generation websites, Linkedin, Twitter, Facebook or Instagram or, corporate websites. Based on this information, attackers can build a believable pretext using information such as where you work, where you bank, recent financial transactions and family or friends. If the spear phishing attempt targets executives (e.g., CEO or CFO) is called _whaling_. +## Spam -# Impersonation +Spam **refers to unsolicited or unwanted messages** that are sent in bulk via email, messaging apps, social media platforms, or other communication channels. These messages often contain advertisements, scams, phishing attacks, or malware, and are typically sent to a large number of recipients who have not expressed any interest in receiving them. In addition to email, spam can also come in the form of text messages, phone calls, and social media messages. -_Impersonation_ (pretending to be someone else) is one of the basic social -engineering techniques. The classic impersonation attack is for the social -engineer to phone into a department, claim they have to adjust something on -the user's system remotely, and get the user to reveal their password. For these types of attacks to succeed the approach must be convincing and persuasive. This is linked with the _pretexting_. +To prevent spam, users can take steps such as using spam filters, blocking messages from unknown or suspicious senders, and being cautious about sharing their email address or other contact information online. -The amount and accuracy of the information gathered during _Reconnaissance_ is key to run these types of attacks successfully. Once attackers gain the trust of the victim they proceed to extract information, __*eliciting information*__ without the victim realising this is happening. Things like email addressed or passwords. Attackers use well-documented psychological techniques to play the victim. +## Spam over instant messaging (SPIM) -This extraction of information can be used for *__Identity fraud__*. Identity fraud is the use by one person of another person's personal information, without authorization, to commit a crime or to deceive or defraud that other person or a third person. Some examples are: +Spam over Instant Messaging (SPIM) **is a type of unsolicited or unwanted messages that are sent in bulk via instant messaging (IM) platforms**, such as WhatsApp, Facebook Messenger, or Skype. Similar to email spam, SPIM messages are typically commercial advertisements, phishing attacks, scams, or malware, and are sent to a large number of users who have not requested them. In addition, SPIM messages can disrupt communication and productivity, especially in a work environment. - * Credit card fraud: Credit card fraud is the unauthorized use of a credit or debit card, or similar payment tool (ACH, EFT, recurring charge, etc.), to fraudulently obtain money or property. - - * Bank fraud: Bank fraud is the use of potentially illegal means to obtain money, assets, or other property owned or held by a financial institution, or to obtain money from depositors by fraudulently posing as a bank or other financial institution. - - * Loan fraud: Loan fraud is when your information is used to request a loan or a lease. - - * Government benefits fraud: Government benefits fraud is when attacker obtain benefits on your behalf. +To prevent SPIM, users can take steps such as configuring privacy settings on their IM accounts, blocking messages from unknown or suspicious senders, and being cautious about sharing their IM contact information online. Some IM platforms also offer built-in spam filters or reporting tools to help users identify and block SPIM messages. -## Protecting against impersonation +## Spear phishing -Some basic precautions can be taking to try to prevent impersonation: +Spear phishing **is a type of targeted phishing** attack that involves sending personalized and highly-customized emails, text messages, or social media messages to specific individuals or organizations. The aim of spear phishing is to trick the target into divulging sensitive information or performing an action that benefits the attacker, such as clicking on a link, downloading malware, or transferring money. -* Never volunteer information, e.g., passwords. -* Do not disclose personal details. -* Always verify before revealing information. Call back companies and verify through 3rd parties. -* Always encourage verification. +Unlike traditional phishing attacks that typically use generic messages sent to a large number of recipients, spear phishing attacks are highly customized and often appear to come from a trusted source, such as a colleague, manager, or business partner. The attackers may use publicly available information, such as social media profiles or corporate websites, to gather information about the target's job responsibilities, interests, and relationships, in order to craft a convincing message that appears legitimate. For these reasons, spear phishing attacks can be highly effective because they are tailored to the target's specific context and use social engineering techniques to create a sense of urgency or authority. -# Dumpster diving +To protect against spear phishing attacks, it is important to be cautious when receiving unexpected or suspicious messages, especially if they request sensitive information or prompt you to take immediate action. Users should also be aware of the potential risks of sharing personal or professional information online, and should use strong passwords and two-factor authentication to protect their accounts. Additionally, it is important to stay up-to-date with the latest security best practices and to regularly review and update security policies and procedures. -Dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network. Dumpster diving is not limited to searching through the trash for obvious treasures like access codes or passwords written down on sticky notes. The main purpose is to collect information that can ba used later for different attacks. +## Dumpster diving -There are some simple ways, specially , companies can use to secure their garbage: +Dumpster diving is a type of physical security attack that **involves searching through trash or discarded materials** to find sensitive or confidential information that can be used to compromise a person, organization, or system. This can include documents, files, or electronic devices that contain personal or financial information, login credentials, or other sensitive data. -* Secure it with a fence and a lock. -* Shred your documents or even burn them. -* Check your disposal policies making sure you are disposing properly confidential information. Use external companies if necessary. +Dumpster diving can be a low-tech but effective way for attackers to obtain information that would otherwise be difficult or impossible to access through digital means. For example, attackers may search through the trash of a business to find discarded customer records or financial statements, or they may search through the trash of an individual to find credit card statements or other personal information. -# Shoulder surfing +To prevent dumpster diving attacks, it is important to properly dispose of sensitive information and materials by shredding documents or destroying electronic devices before disposing of them. In addition, businesses should establish clear policies and procedures for the disposal of confidential information and provide training to employees on how to follow these procedures. It is also important to be aware of the potential risks of sharing personal or professional information online, and to use strong passwords and two-factor authentication to protect online accounts. -Shoulder surfing is a criminal practice where thieves steal your personal data by spying over your shoulder as you use a laptop, ATM, public kiosk or other electronic device in public. Despite the funny name, it is a security risk that can cause a financial wipeout. +## Shoulder surfing -Some ways to prevent it are: +Shoulder surfing is a type of physical security attack that **involves an attacker observing or eavesdropping on a person as they enter sensitive or confidential information**, such as passwords or PIN numbers, into a device or system. This can be done by looking over the person's shoulder or using binoculars or other tools to view the screen from a distance. -* Be aware of your surroundings when introducing sensitive information. -* User privacy filters. Used on a screen, they block the view of the screen unless you are sitting directly in front of it. -* Keep your monitors out of sight, away from windows or hallways. +Shoulder surfing can be a low-tech but effective way for attackers to obtain information that would otherwise be difficult or impossible to access through digital means. For example, an attacker may watch a person enter their PIN number at an ATM or observe their login credentials as they type them into a computer in a public space. -# Hoax +To prevent shoulder surfing attacks, it is important to be aware of your surroundings and to take steps to protect your sensitive information. This can include positioning yourself in a way that makes it difficult for others to see your screen, using privacy screens or filters on your devices, or using your body to shield your screen from view. It is also important to use strong passwords and two-factor authentication to protect your online accounts, and to avoid sharing sensitive information in public spaces. -A hoax is a falsehood deliberately fabricated to masquerade as the truth. It seems that it could be real, but it does not exit. In the ambit of security, hoaxes are false reports about non-existent threats or situations. It is design, if credible enough, to divert resources and trigger actions, sometimes drastic such as shutting down a network. +## Pharming -Typically, the warning arrives in an email note or is distributed through a note in a company's internal network but, it can arrive through other channels like Facebook or Linkedin walls or tweets. +Pharming **is a type of cyber attack that involves redirecting a user's web traffic to a fake website that is designed to look like a legitimate one**. The aim of pharming is to trick the user into divulging sensitive information, such as login credentials, credit card numbers, or other personal information, which can then be used for fraudulent purposes. -Other hoaxes are just design to simply take your money, even, not through electronic means. An example will be the request of gift cards. +Pharming attacks can be conducted using a variety of methods, including manipulating domain name system (DNS) settings, exploiting vulnerabilities in web browsers or network devices, or infecting a user's computer with malware that redirects web traffic to a fake site. In some cases, attackers may also use social engineering techniques to trick users into visiting a fake site, such as by sending phishing emails that contain links to a fake website. -Some advice to prevent fall for a hoax are: +To protect against pharming attacks, it is important to use trusted sources for web browsing and to be cautious when visiting unfamiliar or suspicious websites. Users should also keep their web browsers and other software up-to-date with the latest security patches and should use anti-virus software and firewalls to protect their devices. In addition, it is important to be cautious when clicking on links or downloading attachments from unknown or suspicious sources, and to be wary of any unexpected or unsolicited messages that request sensitive information. -* Do not believe anything on the Internet, contrast and check the information. -* Perform cross-references on specialised webs. -* Spam filters can help. -* In general, common sense. If it sounds too good to be true, double check. +## Tailgating -# Watering hole attack +Tailgating **is a physical security attack that involves an unauthorized person following closely behind an authorized person** to gain access to a restricted area or secure facility. This can occur when the authorized person uses a key card, access code, or other means to enter the restricted area, and the unauthorized person quickly follows behind them before the door or gate closes. -A watering hole attack works by identifying a website that's frequented by users within a targeted organisation, or even an entire sector, such as defence, government or healthcare. That website is then compromised to enable the distribution of malware. +Tailgating can be a low-tech but effective way for attackers to gain access to sensitive areas or systems that would otherwise be difficult or impossible to access through digital means. For example, an attacker may tailgate an employee into a secure data center or server room in order to steal or manipulate sensitive data. -The attacker identifies weaknesses in the main target's cyber-security, then manipulates the watering hole site to deliver malware that will exploit these weaknesses. +To prevent tailgating attacks, it is important to establish clear policies and procedures for access control and to provide training to employees on how to follow these procedures. This can include requiring employees to use their own key cards or access codes to enter secure areas, and to be aware of their surroundings and to report any suspicious behavior. In addition, physical security measures such as security cameras, turnstiles, or security guards can be used to monitor access to restricted areas and deter unauthorized access. -Some basic points to try to prevent this kind of attacks are: +## Eliciting information -* Defense-in-depth. A layered defense never based on just one thing. -* Firewalls and IPS. To stop traffic before things get bad. -* Anti-virus / Anti-malware signature updates/ +Eliciting information **is a type of social engineering attack that involves an attacker using various techniques to gather sensitive or confidential information from a victim**. The aim of this attack is to gain access to information that can be used for fraudulent purposes, such as stealing identities, committing financial fraud, or compromising computer systems. -# Spam +Eliciting information can take many forms, including posing as a trusted authority figure, such as a bank or government official, and requesting sensitive information over the phone or email, or using pretexting techniques to trick the victim into divulging information, such as by pretending to be a friend or family member. Other techniques may include using flattery or sympathy to gain the victim's trust, or providing false information to convince the victim to disclose information. -Spam is digital junk mail: unsolicited communications sent in bulk over the internet or through any electronic messaging system. The most common is by email but, it can be spam over instant messaging (SPIM), forums or other sources. Spam messages has a wide variety of contents such as commercial advertising, non-commercial proselytizing or phishing attempts. Spam is a significant issue for some different reasons like security concerns, resource utilisation, storage and management cost among others. +To prevent eliciting information attacks, it is important to be cautious when sharing sensitive information and to be aware of common tactics used by attackers. This can include verifying the identity of anyone requesting sensitive information, using secure communication channels such as encrypted email or secure messaging apps, and being skeptical of unsolicited requests for information. -There are multiple solutions for preventing spam getting into users' mailboxes: +## Whaling -* Mail gateways: A cloud-based or on-site mail gateway can prevent spam of reaching users mailboxes. -* Identifying spam: Various mechanisms can be use to classify the received emails: - * Allowed lists: Users can only receive emails from origins that are in a list of trusted senders. - * SMTP standards checks: Block anything that does not follow RFC standards. - * Reverse DNS (rDNS): block emails where the sender's domain does not match the API address. - * Tarpitting: Intentionally slow downs the server conversation. - * Recipient filtering: Block all email not addressed to a valid recipient email address. +Whaling **is a type of phishing attack that targets high-profile individuals**, such as executives or high-level employees, in order to steal sensitive information or gain access to valuable resources. The term "*whaling*" is used because these attacks typically focus on "*big fish*" targets, rather than casting a wide net like traditional phishing attacks. -# Influence campaigns +Whaling attacks can take many forms, but typically involve the use of social engineering techniques to trick the victim into divulging sensitive information, such as login credentials or financial information. For example, an attacker may send a convincing email that appears to be from a trusted authority, such as a bank or government agency, and request that the victim provide sensitive information or click on a link that installs malware on their computer. -Influence campaigns try to alter the public opinion in their favour. They can be done for politcal reasons, to support social issues or, they can cover multiple other cases where to manipulate the public opinion is necessary to achieve a determinate goal. This manipulation can have multiple goals such as divide, distract or persuade. And, unfortunately, multiple actors like nation-states not just attackers use these techiniques on their advantage. +To prevent whaling attacks, it is important for high-profile individuals to be aware of the risks and to take steps to protect their personal and professional information. This can include using strong passwords and two-factor authentication to protect online accounts, being cautious when clicking on links or downloading attachments from unknown sources, and verifying the identity of anyone requesting sensitive information. In addition, regular security awareness training can help employees recognize and respond to potential whaling attacks. -## Social media +## Prepending -Methods to amplify a message can vary from more traditional ones like advertisements to the use of social media to propagate information. On social media, a common procedure is the creation of multiple fake profiles that start creating, posting and sharing content on social media, amplifiying the message and flooding different platforms with content related to the information actors want to disseminate. Once the information has disseminated enough, real users start sharing the messages, giving legitimacy to that content and even mass media will pick up the story because of the amount of people talking about it. +Prepending **is a technique used by attackers to manipulate file names or website addresses in order to deceive users or bypass security measures**. In prepending, an attacker adds a string of characters to the beginning of a file name or URL in order to disguise its true nature or to evade detection by security software. -## Hybrid warfare +Some examples are, an attacker may prepend a file name with a string of characters that causes it to appear innocuous or as a different type of file, or an attacker can create fake websites that appear to be legitimate and add a string of characters to the beginning of a URL that makes it appear to be a trusted site. -One of the motivations to execute this attack is knows as _cyberwarfare_, which is to attack an entity using technology. In cyberwarfare, a nation-state actor tries to convince the people of another country of the unfairness of their goverment or some of its rules and perhaps influence elections using _fake news_. It is not a new concept; countries have been doing it for a long time but the Internet has brought new ways of doing it. +To prevent prepending attacks, it is important to be cautious when opening files or visiting websites, particularly if they appear suspicious or have unusual file names or URLs. Users should also keep their software and security measures up-to-date and use trusted sources for downloading files and accessing websites. In addition, regular security awareness training can help users recognize and respond to potential attacks. -# Other social engineering attacks +## Identity fraud -## Tailgating +Identity fraud, also known as identity theft, **is a type of fraud in which an attacker steals the personal information of a victim in order to impersonate them** and gain access to their financial or other sensitive information. The attacker may use the stolen identity to open new accounts, make purchases, or commit other fraudulent activities in the victim's name. -Tailgating (also known as piggybacking) is one of the most widespread security breaches affecting businesses today and often goes undetected. Tailgating can be simply described as the passage of unauthorised personnel, either forced or accidental, behind that of an authorised user. Tailgating not only puts the property, data and occupants of an organisation at risk, it can also cost businesses huge losses in revenue from long term damage to their brand and reputation. For service industries such as the leisure industry, where controlled access is required, this can also result in a loss of revenue. +Identity fraud can occur through various means, including stealing physical documents such as passports or credit cards, accessing computer systems or databases that contain sensitive information, or using social engineering techniques such as phishing or pretexting to obtain sensitive information. -Some methods used are: +To protect against identity fraud, individuals should take steps to safeguard their personal information, such as using strong and unique passwords for online accounts, monitoring financial statements and credit reports regularly, and being cautious when providing personal information online or over the phone. In addition, organizations should have robust security measures in place to protect customer and employee data, such as encryption, access controls, and regular security assessments. -* Blend in using same uniforms or type of clothes. -* Simulate being a legitimate 3rd-party. -* Temporarily take up smoking to follow smokers on their way back. -* Bring donuts or food and have their hands full to take advantage of some helpful employee. +## Invoice scams -Some mitigations can be: +Invoice scams **are a type of fraud in which an attacker attempts to trick a business or individual into paying a fake or fraudulent invoice**. These scams often involve the attacker posing as a legitimate vendor or supplier and sending a fraudulent invoice for goods or services that were never provided or authorized. -* To have a visitors policy where everyone is properly identified. -* One scan, one person can be achieved by policies or be mechanically required. -* Encourage your employees to to ask unknown people who are they and why are they there. +To protect against invoice scams, businesses and individuals should be cautious when receiving invoices, particularly if they appear suspicious or unexpected. It is important to verify the identity of the sender and the authenticity of the invoice, for example, by cross-checking it with purchase orders or other documentation. Employees should also be trained to recognize and respond to potential invoice scams, and organizations should have robust policies and procedures in place for verifying and approving invoices before payment is made. -## Invoice scams +## Credential harvesting -Invoice scams typically work in one of two ways: through fake invoices with a goal of receiving money or by prompting a victim to put their credentials into a fake login screen. The latter of the two is a bit more simple and follows the typical phishing lure approach. +Credential harvesting **is a technique used by attackers to obtain login credentials**, such as usernames and passwords, from unsuspecting users. This is typically done through phishing emails or fake login pages designed to mimic legitimate websites or services. Its goal is to gain access to sensitive information or systems, which can then be used for fraudulent purposes such as unauthorized purchases, identity theft, or further attacks on other systems or users. -Invoice fraud involves a fraudster notifying your company that supplier payment details have changed and providing alternative details in order to defraud you. The fraudster could be claiming to be from your company’s genuine supplier, or even be posing as a member of your own firm. Funds are often quickly transferred so recovering money from fraudulent accounts can be extremely difficult. +To protect against credential harvesting, users should be wary of entering their login credentials on websites that look different than what they normally use or require additional information that is not normally requested. Organizations can also implement security measures such as two-factor authentication, intrusion detection systems, and security awareness training for employees to mitigate the risk of credential harvesting attacks. -## Credential harvesting +## Reconnaissance + +Reconnaissance, often referred to as recon, **is the process of gathering information about a target or target environment**. In the context of information security, reconnaissance is often used by attackers to gather information about a target system or network in order to identify vulnerabilities or potential attack vectors. + +**Reconnaissance can take various forms, including passive and active techniques**. Passive reconnaissance involves gathering information without directly interacting with the target, such as through public information sources like social media, online forums, or search engines. Active reconnaissance, on the other hand, involves directly interacting with the target, such as by scanning the target network for open ports or running vulnerability scans. + +The information gathered through reconnaissance can be used to identify potential weaknesses or vulnerabilities that could be exploited in an attack. For example, an attacker may use reconnaissance to identify outdated software or systems with known vulnerabilities that can be exploited. + +To protect against reconnaissance attacks, organizations can implement security measures such as firewalls, intrusion detection systems, and network monitoring tools to detect and block malicious activity. Organizations can also reduce their attack surface by minimizing the amount of sensitive information that is publicly available and implementing security awareness training for employees to help identify and report suspicious activity. + +## Hoax + +A hoax **is a type of deception or prank that is intended to trick or mislead people**. In the context of information security, a hoax can take various forms, such as fake warnings or alerts, false rumors, or fake news stories. + +Hoaxes can be spread through various channels, such as social media, email, or messaging apps, and can be used to cause panic or confusion among the targeted audience. They can also be used as a social engineering tactic to gain access to sensitive information or systems. + +To protect against hoaxes, individuals and organizations should be cautious when receiving and sharing information, particularly if it appears suspicious or unexpected. It is important to verify the source and authenticity of any information before taking action, and to be skeptical of claims that seem too good to be true or that generate an emotional response. In addition, organizations should implement security awareness training for employees to help them recognize and respond to hoaxes and other social engineering tactics. + +## Impersonation + +Impersonation **is the act of pretending to be someone else** in order to deceive others or gain access to sensitive information or systems. In the context of information security, impersonation is often used as a social engineering tactic to trick users into divulging sensitive information or granting access to restricted systems. + +Impersonation can take various forms, such as pretending to be a trusted authority figure, such as a bank representative or IT administrator, or impersonating a coworker or other employee. Impersonation can also be carried out through various channels, such as email, phone, or in-person interactions. + +To protect against impersonation attacks, individuals and organizations should be cautious when receiving and responding to requests for sensitive information or access to restricted systems. It is important to verify the identity and legitimacy of the requester through known, trusted channels, such as by contacting the person directly or checking with a supervisor or IT administrator. + +## Watering hole attack + +A watering hole attack **is a type of cyber attack in which an attacker targets a specific group of users by infecting websites that the targeted group is known to visit**, in the hopes of infecting the users with malware or obtaining sensitive information. + +The term "*watering hole*" refers to the tactic of lying in wait for prey at a location where the prey is known to congregate, such as a watering hole in the wild. In the context of cybersecurity, a watering hole attack involves an attacker identifying a group of users with a common interest, such as employees of a particular company or members of a particular industry group, and infecting websites that the group is known to frequent. + +The attacker may compromise the website by injecting malicious code, redirecting users to a malicious site, or infecting ads or plugins on the site. When users visit the infected site, their devices may be infected with malware, which can then be used to steal sensitive information or carry out other types of attacks. + +Watering hole attacks can be difficult to detect and defend against, as they rely on infecting legitimate websites that the targeted users are likely to visit. To protect against watering hole attacks, organizations should implement security measures such as intrusion detection systems, web filters, and endpoint protection software to detect and block malicious activity. It is also important for users to keep their devices and software up-to-date, and to be cautious when visiting unfamiliar websites or downloading unknown files. + +## Typosquatting + +Typosquatting, also known as URL hijacking or domain mimicry, **is a type of cybersquatting where an attacker registers a domain name that is similar to a legitimate website's domain name, but with typographical errors or slight variations**. The attacker may use the domain to deceive users who mistype the legitimate website's URL or to redirect them to a malicious site. + +Typosquatting can be difficult to detect, as the typosquatted domain may appear legitimate at first glance. However, users can protect themselves by being cautious when entering website addresses and double-checking the URL before entering sensitive information. Organizations can also protect their users by registering similar domain names and redirecting them to the legitimate site, as well as monitoring for typosquatted domains and taking legal action against attackers who engage in typosquatting. + +## Pretexting + +Pretexting **is a form of social engineering in which an attacker creates a false scenario or pretext to trick someone into divulging sensitive information or performing an action that they normally would not do**. The attacker may impersonate someone else, such as a coworker or a customer service representative, and use the false identity to gain the victim's trust. + +Pretexting relies on manipulating the victim's trust and exploiting their desire to be helpful. To protect against pretexting, it is important to be cautious when receiving unexpected requests for information or action, and to verify the identity of the person making the request through a separate channel, such as a known phone number or email address. It is also important to avoid divulging sensitive information or performing actions based solely on a request, without proper verification and validation. + +## Influence campaigns + +Influence campaigns **refer to coordinated efforts by individuals or organizations to shape public opinion or influence political outcomes**. Influence campaigns can take many forms, including disinformation, propaganda, and manipulation of social media or online forums. + +Influence campaigns can be difficult to detect and combat, as they often involve sophisticated techniques and use multiple channels to reach their targets. To protect against influence campaigns, individuals should be critical of the information they receive, fact-check sources before sharing or acting on information, and be aware of the potential biases and motivations of those who are promoting a particular message. Organizations can also take steps to educate employees and stakeholders about the risks of influence campaigns and implement policies and procedures to mitigate the impact of these campaigns. + +### Hybrid warfare + +Hybrid warfare **is a type of warfare that involves the use of a combination of conventional and unconventional tactics**, including influence campaigns, **to achieve military or strategic objectives**. In the context of influence campaigns, hybrid warfare refers to the use of influence operations to shape public opinion and undermine the legitimacy of opponents in a military or geopolitical conflict. -Credential harvesting, account harvesting or password harvesting is the use of MITM attacks, DNS poisoning, phishing, and other vectors to amass large numbers of credentials (username / password combinations) for reuse. +For example, in a hybrid warfare scenario, an adversary may use influence campaigns to sow confusion and discord among the population of an adversary country, weaken support for the government, and promote a particular agenda or ideology. This can be done through a variety of tactics, such as spreading false information, creating fake news stories or websites, and manipulating social media or other online forums. -# Principles of social engineering +Hybrid warfare is often used by state actors, but can also be employed by non-state actors or even individuals. It can be difficult to combat, as it involves a combination of conventional and unconventional tactics, and can be carried out across multiple domains, including cyberspace, social media, and traditional media. -Social engineering is a contantly evolving discipline innovating every day. Methodologies and communication channels are always changing and evolving and, they can vary on size, from just one attacker involved to multiple atackers. In addtion, with the growing number of open-source intelligence sources they can be highly elaborate and focus on the target. +To protect against hybrid warfare, governments and organizations should be vigilant for signs of influence campaigns and take steps to detect and counter these operations. This may involve monitoring social media and other online platforms for signs of disinformation and propaganda, conducting media literacy campaigns to educate the public on how to identify false information, and building resilience and resistance to influence campaigns through strong democratic institutions and civil society. -Despite all of these, they usually follow the same principles: +### Social Media -* Authority: Attacker simulates being in charge or acting on behalf of someone in charge such as a CEO or law enforcement. +Social media **is a powerful tool for influence campaigns**, as it allows individuals and organizations to reach a large audience quickly and easily. In the context of influence campaigns, social media can be used to spread propaganda, disinformation, and other forms of manipulative content with the aim of shaping public opinion and influencing political outcomes. -* Intimidation: Threats including physical violence are directly applied to the users themselves or their environment with serious consequences for the business. +Social media platforms can be targeted for influence campaigns for a variety of reasons, such as to promote a particular ideology or agenda, to discredit opponents, or to sow confusion and chaos. Influence campaigns on social media can take many forms, such as the creation of fake accounts and bot networks to amplify certain messages, the use of paid advertising to target specific audiences, and the spread of false or misleading information through posts and articles. -* Consensus: Taking advantage of the expected normality, unwritten social rules or previous scenarios e.g. _John did it last time_. +The impact of social media on influence campaigns is significant, as it allows for the rapid dissemination of information and the amplification of certain messages. However, social media can also be used to combat influence campaigns, through the use of fact-checking, user education, and the promotion of critical thinking skills. Social media platforms themselves can also take steps to combat influence campaigns, such as by implementing policies to detect and remove fake accounts and bot networks, and by partnering with fact-checking organizations to identify and label false information. -* Scarcity: Given a concrete, short period of time to act. +### Principles (reasons for effectiveness) -* Urgency: Closely related to the previous one, trying to prevent users from thinking properly about the actions and requests. +Social engineering refers to the use of psychological manipulation techniques to influence individuals or groups to divulge sensitive information or perform actions that may not be in their best interest. There are several principles that underlie social engineering tactics: -* Familiarity: Trying to achieve a certain level of relationship by talking about common friends or acquaintances. +1. **Authority**: Social engineers often present themselves as figures of authority, such as a law enforcement officer, IT technician, or supervisor, in order to gain trust and convince the target to comply with their requests. +2. **Intimidation**: Social engineers may use intimidation tactics by making threats of physical harm, legal consequences, or damage to the target's reputation or financial status. The goal of intimidation is to create a sense of fear or vulnerability in the target, in order to coerce them into complying with the social engineer's requests or divulging sensitive information. +3. **Consencus**: Social engineers may use consensus tactics by presenting themselves as part of a larger group or authority, and implying that others have already complied with their requests. This can create a sense of pressure or social expectation for the target to comply as well, as they may feel that others are expecting them to do so. +4. **Scarcity**: Social engineers may create a sense of urgency or scarcity in order to pressure the target into taking action, such as by claiming that there are limited resources or time to act. +5. **Familiarity**: Social engineers may use information about the target's personal or professional life in order to establish a rapport and build trust, such as by using the target's name or referencing shared interests. +6. **Trust**: Social engineers may use trust tactics by building a rapport with the target and appearing to be trustworthy or authoritative, in order to gain access to sensitive information or to influence the target's behavior. This can be done through impersonating trusted individuals or organizations, using official-looking documents or uniforms, or using convincing language and social cues. +7. **Urgency**: Social engineers may use urgency tactics by creating a sense of urgency or time pressure in order to influence the target's behavior. This can be done through creating a false sense of urgency, such as by claiming that there is an imminent threat or emergency that requires immediate action, or by setting strict deadlines or time limits for the target to comply. +8. **Reciprocity**: Social engineers may offer something of value to the target in order to gain compliance, such as by offering a reward or making a concession. +9. **Likability**: Social engineers may use charm or flattery to build rapport and trust with the target, in order to increase the likelihood of compliance. -* Trust: Simulating to be a figure of someone that has implicit, trust such as someone from the IT or security deparments trying to help. +These principles can be used in a variety of ways, depending on the specific social engineering tactic being employed. By understanding these principles, individuals and organizations can better protect themselves against social engineering attacks. \ No newline at end of file diff --git a/1.0-threats-attacks-and-vulnerabilities/1.2-given-a-scenario-analyze-potential-indicators-to-determine-the-type-of-attack.md b/1.0-threats-attacks-and-vulnerabilities/1.2-given-a-scenario-analyze-potential-indicators-to-determine-the-type-of-attack.md index 672571b..f53c99e 100644 --- a/1.0-threats-attacks-and-vulnerabilities/1.2-given-a-scenario-analyze-potential-indicators-to-determine-the-type-of-attack.md +++ b/1.0-threats-attacks-and-vulnerabilities/1.2-given-a-scenario-analyze-potential-indicators-to-determine-the-type-of-attack.md @@ -1,279 +1,254 @@ -# __1.2 Given a scenario, analyze potential indicators to determine the type of attack__ +# 1.2 Given a scenario, analyze potential indicators to determine the type of attack -# An overview of malware +## Malware -Malware is the collective name for a number of malicious software variants, including viruses, ransomware and spyware. Shorthand for malicious software, malware typically consists of code developed by cyberattackers, designed to cause extensive damage to data and systems or to gain unauthorized access to a network. +Malware **is a type of software that is designed to harm or exploit computers, networks, or other digital devices**. The term "*malware*" is short for "*malicious software*". -Since its birth more than 30 years ago, malware has found several methods of attack. Malware is typically delivered in the form of a link or file over email and requires the user to click on the link or open the file to execute the malware taking advantage of an exiting vulnerability. In addition, they include email attachments, malicious advertisements on popular sites (malvertising), fake software installations, infected USB drives, infected apps, phishing emails and even text messages. +Malware can take many different forms, including viruses, worms, Trojans, ransomware, spyware, adware, and more. Malware is often spread through email attachments, malicious websites, or other types of online downloads. -## Types of malware +Once installed on a device, malware can cause a range of harmful effects, including stealing sensitive data, taking control of the device, damaging or destroying files or programs, monitoring the user's online activity, displaying unwanted ads, and more. -### Virus +To protect against malware, individuals and organizations can use a variety of cybersecurity measures, including antivirus software, firewalls, intrusion detection systems, and good online security practices such as avoiding suspicious emails and downloads, keeping software up to date, and using strong passwords. -Computer viruses are a type of malware that earned their name because of how they spread by "infecting" other files on a disk or computer. Viruses then spread to other disk drives and machines when the infected files are received in downloads from websites, email attachments, shared drives or when carried in files on physical media, such as USB drives or - in the early days - floppy disks. Viruses need the user to execute, this is why they attach to legitime programs. - -#### Virus types - -* __Program virus__: Malicious code or program written to alter the way a computer operates and is designed to spread from one computer to another. A virus operates by inserting or attaching itself to a legitimate program or document that supports macros in order to execute its code. - -* __Boot sector virus__: A boot sector virus is a type of virus that infects the boot sector of floppy disks or the Master Boot Record (MBR) of hard disks (some infect the boot sector of the hard disk instead of the MBR). - -* __Script virus__: A script virus is any type of malicious code that is executed after a user visits a page that has advertisements, files or code running in the background that contains the malicious code. - -* __Macro virus__: A macro virus is a computer virus written in the same macro language used for software applications, such as word processors. Microsoft Word and Excel are two examples of applications that feature powerful macro languages, which are embedded in documents so they run automatically when the documents are open. A macro virus subsequently releases a chain of events in conjunction with the application. +### Ransomware -* __Fileless virus__: Fileless malware is a type of malicious software that does not rely on virus-laden files to infect a host. Instead, it exploits applications that are commonly used for legitimate and justified activity to execute malicious code in resident memory. +Ransomware **is a type of malware that is designed to encrypt a victim's data and demand payment**, typically in the form of cryptocurrency, in exchange for the decryption key needed to restore access to the data. -Appropriately updated with the last signatures can help stop virus from infect the systems. +Once a system is infected with ransomware, the malware will typically display a ransom note, which explains that the victim's files have been encrypted and provides instructions for how to pay the ransom. The ransom note often includes a deadline for payment, and threatens to permanently delete or destroy the encrypted files if the payment is not made in time. -### Worms +Ransomware can be spread through a variety of methods, including email attachments, software vulnerabilities, and social engineering tactics. Some variants of ransomware are also capable of spreading laterally across a network, infecting multiple systems within an organization. -A computer worm is a type of malware that spreads copies of itself from computer to computer. A worm can replicate itself without any human interaction, and it does not need to attach itself to a software program in order to cause damage. +To protect against ransomware, individuals and organizations should take steps to prevent infection, such as by using up-to-date antivirus software, regularly backing up important data, and training employees to recognize and avoid phishing attacks. In the event that a ransomware infection does occur, it is generally recommended to avoid paying the ransom, as there is no guarantee that the attackers will provide the decryption key, and payment may encourage further attacks. -Firewalls, IDS or IPS can mitigate many work infection avoiding the spread of them. +### Trojans -### Ransomware +A Trojan, or Trojan horse, **is a type of malware that is designed to look like a legitimate program or file but actually has malicious functionality hidden inside**. Trojans typically operate by tricking users into downloading and installing them, often through social engineering tactics such as email attachments or fake software updates. -Ransomware is a type of malware that prevents you from accessing your computer (or the data that is stored on it). The computer itself may become locked, or the data on it might be stolen, deleted or encrypted. +Once installed on a system, a Trojan can perform a variety of malicious actions, such as stealing sensitive data, taking control of the system, installing additional malware, or creating backdoors for remote access by attackers. Trojans can be designed to target specific types of systems or data, and can be customized to suit the goals of the attacker. -Usually users are asked to contact the attacker via an anonymous email address or follow instructions on an anonymous web page, to make payment. The payment is invariably demanded in a cryptocurrency such as Bitcoin, in order to unlock your computer, or access your data. However, even if you pay the ransom, there is no guarantee that you will get access to your computer, or your files. +Unlike viruses and worms, which are self-replicating and can spread from system to system, Trojans typically require some degree of user interaction to spread. However, once installed on a system, Trojans can be difficult to detect and remove, as they often use advanced techniques such as rootkits to hide their presence. -One recent version of rasomware is *__crypto malware__* or *__crypto ransomware__* is one of the recent forms of malware that attacks a computer by restricting the user's access to files stored in the computer. The malware displays an on-screen alert advising the user to pay a given amount of money through anonymous methods such as Bitcoin, to regain access to his or her files. +To protect against Trojans, individuals and organizations should use up-to-date antivirus software, avoid downloading software or files from untrusted sources, and be wary of suspicious emails or messages. It is also important to keep software and operating systems up to date with the latest security patches to prevent exploitation of known vulnerabilities. -One way to protect against ransomware is to keep a backuk of your data, keep your system and applications up to date and, keep you anti-virus or anti-malware up to date with the latest signatures. +### Worms -### Trojan +A worm **is a type of malware that is designed to replicate itself and spread from system to system**, often through network connections or email attachments. Unlike viruses, worms do not require a host program to spread and can replicate and spread independently. -A trojan horse, or trojan, is a type of malicious code or software that looks legitimate but can take control of your computer. A trojan is designed to damage, disrupt, steal, or in general inflict some other harmful action on your data or network. +Once a worm infects a system, it can carry out a variety of malicious actions, such as stealing sensitive data, installing additional malware, or using the infected system to launch attacks on other systems. Worms can be designed to target specific types of systems or data, and can be customized to suit the goals of the attacker. -A trojan acts like a bona fide application or file to trick you. It seeks to deceive you into loading and executing the malware on your device. Once installed, a trojan can perform the action it was designed for. +Worms can spread rapidly and cause widespread damage to computer networks and systems. In some cases, worms can cause denial-of-service attacks by overwhelming network resources with traffic or by exploiting vulnerabilities in network protocols. -Multiple times this action is to download other software to your e.g., potentially unwanted programs (PUPs). Potentially unwanted programs are programs that does not need to be malicious but it is not desirable an it may cause problems in your computer e.g., a browser tool bar. +To protect against worms, individuals and organizations should use up-to-date antivirus software, keep software and operating systems up to date with the latest security patches, and be cautious when opening email attachments or clicking on links from untrusted sources. It is also important to practice good security hygiene, such as using strong passwords and avoiding the use of default or easily guessable passwords. -On a trojan has access to a system a very common action is to install a *__backdoor__* into the systems. A backdoor is a malware that provides a non-convencional method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access (aka root access) on a computer system, network or software application. +### Potentially unwanted programs (PUPs) -A specific type of backdoor are *__remote access trojans__*. A remote access trojan (RAT) is a malware program that includes a back door for administrative control over the target computer. RATs are usually downloaded invisibly with a user-requested program - such as a game - or sent as an email attachment. +Potentially unwanted programs (PUPs) **are software applications that are not inherently malicious, but are generally considered undesirable or problematic for computer users**. Examples of PUPs include adware, browser hijackers, toolbars, and other types of software that may display unwanted ads, change browser settings, or collect and transmit user data without consent. -Once a remote access trojan has infiltrated a computer, the cybercriminal can gain remote access, monitoring or even controlling the device or the network. And once they have this access, there is no limit to what the cybercriminal can do; they have complete, anonymous control. +PUPs are often bundled with other software downloads, and may be installed without the user's knowledge or consent. Once installed, PUPs may be difficult to remove and can cause a variety of problems, such as slowing down system performance, displaying unwanted pop-up ads, or redirecting web searches to unwanted sites. -Prevention of trojan infectation follow similar guidelines than any other malware. +While not always harmful, PUPs can be a security risk and may compromise the user's privacy and security. To protect against PUPs, it is important to be cautious when downloading software from the internet, and to use reputable antivirus software that can detect and remove potentially unwanted programs. -### Rootkit +### Fileless virus -Rootkits are a type of malware that are designed so that they can remain hidden on your computer. But while you might not notice them, they are active. Rootkits give cybercriminals the ability to remotely control your computer. +A fileless virus **is a type of malware that operates using advanced techniques to avoid detection and infect systems without leaving any traces on the hard drive**. Unlike traditional viruses, which infect executable files or other types of files on the system, fileless viruses operate entirely in memory, using legitimate system processes to carry out their malicious actions. -Rootkits can contain a number of tools, ranging from programs that allow hackers to steal your passwords to modules that make it easy for them to steal your credit card or online banking information. Rootkits can also give hackers the ability to subvert or disable security software and track the keys you tap on your keyword, making it easy for criminals to steal your personal information. +Fileless viruses are often spread through spear-phishing attacks, where attackers send targeted emails containing malicious links or attachments. Once the user clicks on the link or opens the attachment, the fileless virus is downloaded and executed in memory, allowing it to carry out a variety of malicious actions, such as stealing sensitive data or downloading additional malware. -Because rootkits can hijack or subvert security software, they are especially hard to detect, making it likely that this type of malware could live on your computer for a long time causing significant damage. Sometimes the only way to completely eliminate a well-hidden rootkit is to erase your computer’s operating system and rebuild from scratch. +Because fileless viruses operate entirely in memory and do not leave any files or other traces on the hard drive, they can be difficult to detect and remove using traditional antivirus software. To protect against fileless viruses, it is important to use a combination of security measures, such as antivirus software, firewalls, and intrusion detection systems, as well as best practices for cybersecurity, such as avoiding suspicious links and attachments, and keeping software and operating systems up to date with the latest security patches. -#### Types of rootkits +### Command and control -* __Hardware or firmware rootkit__: The name of this type of rootkit comes from where it is installed on your computer. This type of malware could infect your computer’s hard drive or its system BIOS, the software that is installed on a small memory chip in your computer’s motherboard. It can even infect your router. Hackers can use these rootkits to intercept data written on the disk. +Command and control (C&C) **refers to a mechanism used by attackers to remotely control malware-infected devices or systems**. It allows the attacker to send commands to the malware on the infected devices, instructing it to carry out various malicious actions, such as stealing sensitive information, launching DDoS attacks, or installing additional malware. -* __Bootloader rootkit__: Your computer’s bootloader is an important tool. It loads your computer’s operating system when you turn the machine on. A bootloader toolkit, then, attacks this system, replacing your computer’s legitimate bootloader with a hacked one. This means that this rootkit is activated even before your computer’s operating system turns on. +Typically, a C&C server is used to issue commands to the malware, and the infected devices or systems communicate with the C&C server to receive instructions and report back on their activities. C&C communication can take many forms, such as HTTP requests, IRC channels, or custom protocols designed specifically for the malware. -* __Memory rootkit__: This type of rootkit hides in your computer’s RAM, or Random Access Memory. These rootkits will carry out harmful activities in the background. The good news? These rootkits have a short lifespan. They only live in your computer’s RAM and will disappear once you reboot your system — though sometimes further work is required to get rid of them. +The use of C&C is a key feature of many advanced persistent threats (APTs) and other sophisticated cyber attacks. Because the attacker can control the infected devices remotely, C&C allows for stealthy and persistent access to compromised systems, as well as the ability to update or modify the malware to evade detection by security software. Defending against C&C attacks typically involves identifying and blocking communication between infected devices and the C&C server, and implementing other security measures to prevent malware infections in the first place. -* __Application rootkit__: Application rootkits replace standard files in your computer with rootkit files. They might also change the way standard applications work. These rootkits might infect programs such as Word, Paint, or Notepad. Every time you run these programs, you will give hackers access to your computer. The challenge here is that the infected programs will still run normally, making it difficult for users to detect the rootkit. +### Bots -* __Kernel mode rootkits__: These rootkits target the core of your computer’s operating system. Cybercriminals can use these to change how your operating system functions. They just need to add their own code to it. This can give them easy access to your computer and make it easy for them to steal your personal information. +Bots, short for "*robots*," **are software programs that are designed to perform automated tasks on the internet**. Bots can be used for a variety of purposes, including web crawling, data scraping, and chatbots for customer support. However, some bots are created and used by cybercriminals for malicious purposes, such as launching DDoS attacks, stealing personal information, or spreading malware. -Rootkits due to its nature are very difficult to find and remove. Some general advice is: +Botnets are networks of computers or devices that have been infected with malware and are under the control of a botmaster. The infected devices are often referred to as "*bots*" or "*zombies*," and the botmaster can use them to carry out coordinated attacks on other targets, such as websites or servers. The botmaster can remotely control the botnet using a command and control (C&C) server, which issues commands to the bots and receives reports on their activities. -* Look for unusual processes running. -* Use a remover specific to the rootkit. -* Secure boot with UEFI, that it is security implemented in the BIOS. +Botnets can be difficult to detect and dismantle, as the individual bots are often spread across multiple networks and geographic locations. Defending against botnets typically involves implementing security measures to prevent infections, such as using antivirus software and keeping software and systems up to date with security patches. Additionally, identifying and blocking communication with the C&C server can help prevent the botnet from carrying out further attacks. -### Adware +### Cryptomalware -Adware, or advertising supported software, is software that displays unwanted advertisements on your computer. Adware programs will tend to serve you pop-up ads, can change your browser’s homepage, add spyware and just bombard your device with advertisements. Adware is a more succinct name for potentially unwanted programs. It is not quite a virus and it may not be as obviously malicious as a lot of other problematic code floating around on the Internet. +Cryptomalware, also known as ransomware, is a type of malware that encrypts files on a victim's computer or device, making them inaccessible to the user. The attacker then demands a ransom payment from the victim in exchange for the decryption key that will unlock the files. -### Spyware +Cryptomalware typically spreads through email attachments, malicious downloads, or vulnerabilities in software or operating systems. Once it infects a device, it will often attempt to spread to other connected devices on the network. -Spyware is unwanted software that infiltrates your computing device, stealing your internet usage data and sensitive information. Spyware is classified as a type of malware - malicious software designed to gain access to or damage your computer, often without your knowledge. +There are several different types of cryptomalware, including screen lockers, which lock the user out of their device entirely, and file-encrypting ransomware, which encrypts the user's files. Some variants of cryptomalware threaten to publish sensitive information stolen from the victim's device if the ransom is not paid. -### Bots and Botnets +Defending against cryptomalware involves implementing strong cybersecurity measures, such as using antivirus software, keeping software and systems up to date with security patches, and regularly backing up important files to an external device or cloud storage. It is also important to avoid clicking on suspicious links or downloading attachments from unknown sources, as these are common methods used to spread cryptomalware. -A botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform distributed denial-of-service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its connection. +### Logic bombs -Botnet owners can have access to several thousand computers at a time and can command them to carry out malicious activities. Cybercriminals initially gain access to these devices by using special Trojan viruses to attack the computers’ security systems, before implementing *__command and control__* software to enable them to carry out malicious activities on a large scale. These activities can be automated to encourage as many simultaneous attacks as possible. +A logic bomb **is a type of malicious software or code that is designed to execute a specific action when certain conditions are met**. The action is usually destructive or disruptive, such as deleting files, stealing data, or causing a system to crash. -Some recommendations to protect against botnet attacks are: +Unlike other types of malware, such as viruses or worms, logic bombs are typically triggered by a specific event or condition, rather than spreading autonomously. They can be installed on a system by a malicious insider or by an attacker who has gained unauthorized access. -* Use a Firewall -* Update your software and systems to the latest version -* Get protection that works at DNS-level -* Manage admin rights in your organization +Logic bombs can be difficult to detect because they are often dormant until triggered, and may not exhibit any unusual behavior until the trigger condition is met. They are typically designed to be difficult to remove or disarm, making them a potent weapon in the hands of a skilled attacker. -### Logic bombs +Some common trigger conditions for logic bombs include a specific date or time, the execution of a certain program or process, or the failure of a particular system component. Defending against logic bombs involves implementing strong access controls to prevent unauthorized installation, as well as regularly monitoring system behavior for signs of unusual activity or unexpected behavior. -A logic bomb is a sinister piece of code that is secretly inserted into a computer network, operating system, or a software application. Like any other malicious code, its primary goal is to wreak havoc on your system – steal or corrupt your data, crash or overtake your device, or completely wipe your hard drive. +### Spyware -However, the main difference between a logic bomb and other malicious software is that the former can lie dormant for years. It is designed to execute its code only when certain conditions are met. For example, after a specified date and time, when a specific file is opened, or when it is deleted. +Spyware **is a type of software that is designed to gather information from a computer or other electronic device without the user's knowledge or consent**. Spyware can be installed on a device through various means, including email attachments, software downloads, or exploiting security vulnerabilities. -### Keylogger +Once installed, spyware can monitor a user's activity, such as their browsing history, keystrokes, and online transactions. It can also collect personal information, such as usernames, passwords, and credit card numbers, which can then be used for malicious purposes such as identity theft or financial fraud. -Keyloggers are a type of monitoring software designed to record keystrokes made by a user. One of the oldest forms of cyber threat, these keystroke loggers record the information you type into a website or application and send to back to a third party. +Some forms of spyware are designed to be difficult to detect and remove, and may continue to operate even after the infected device has been rebooted. To protect against spyware, it is important to use antivirus and antimalware software, avoid downloading software from untrusted sources, and keep operating systems and software up to date with the latest security patches. -# Password attacks +### Keyloggers -Password attacks are one of the most common forms of corporate and personal data breach. A password attack is simply when a hacker trys to steal your password. +Keyloggers, also known as keystroke loggers, **are a type of software or hardware device that is designed to capture and record every keystroke made on a computer or other electronic device**. This can include sensitive information such as usernames, passwords, credit card numbers, and other personal data. -Because passwords can only contain so many letters and numbers, passwords are becoming less safe. Hackers know that many passwords are poorly designed, so password attacks will remain a method of attack as long as passwords are being used. In addition, there are still application with a poor password management pocily where passwords get stored in *__plaintext__* or *__unencrypted__*. Fortunately, nowadays this situation is less common. +Keyloggers can be installed on a device through various means, including email attachments, software downloads, or exploiting security vulnerabilities. They can also be physically installed on a device through the use of hardware devices such as USB keyloggers. -Password should be stored in it hashed form. A hash function is a mathematical algorithm that maps data of arbitrary size, sually called '_message_', to a bit array of a fixed size, usually called '_message digest_' or '_fingerprint_'. It is a one-way practically infeasible to invert function and they are a basic tool of modern cryptography. +Keyloggers can be used for both legitimate and malicious purposes. Legitimate uses of keyloggers include monitoring employee activity, tracking children's online activity, or detecting unauthorized access to a device. However, they can also be used for malicious purposes, such as stealing sensitive information or monitoring a victim's online activity without their knowledge. -The simple idea behind is that every message gets encrypted using the hash function on a fingerprint and, every different message generates a different fingerprint if the hashing function has not collisions (_ideal case_). +To protect against keyloggers, it is important to use antivirus and antimalware software, avoid downloading software from untrusted sources, and keep operating systems and software up to date with the latest security patches. It is also important to use strong and unique passwords and to avoid entering sensitive information on public or unsecured networks. -## Types of password attacks +### Remote access Trojan (RAT) -### Spraying attack +A Remote Access Trojan (RAT) **is a type of malware that allows an attacker to gain remote access and control over a victim's computer**. Once installed on a victim's device, a RAT can give an attacker complete access to the device, including the ability to view, modify, and delete files, capture keystrokes, record audio and video, and control the device's webcam and microphone. -Password spraying is an attack that attempts to access a large number of accounts (usernames) with a few commonly used passwords. Traditional brute-force attacks attempt to gain unauthorized access to a single account by guessing the password. This can quickly result in the targeted account getting locked-out, as commonly used account-lockout policies allow for a limited number of failed attempts during a set period of time. During a password-spray attack, also known as the "low-and-slow" method, the malicious actor attempts a single commonly used password against many accounts before moving on to attempt a second password, and so on. This technique allows the actor to remain undetected by avoiding rapid or frequent account lockouts. +RATs are typically spread through social engineering tactics, such as phishing emails, or by exploiting vulnerabilities in software or hardware. Once a victim's device is infected with a RAT, the attacker can control it remotely, often without the victim's knowledge. -### Brute-force attack +RATs can be used for both legitimate and malicious purposes. Legitimate uses of RATs include remote administration and technical support, while malicious uses include stealing sensitive data, spying on users, and conducting distributed denial of service (DDoS) attacks. -A brute-force attack uses trial-and-error to guess login info, encryption keys, or find a hidden web page. Hackers work through all possible combinations hoping to guess correctly. +To protect against RATs, it is important to use antivirus and antimalware software, keep operating systems and software up to date with the latest security patches, and avoid downloading software from untrusted sources. It is also important to use strong and unique passwords and to avoid entering sensitive information on public or unsecured networks. -These attacks are done by 'brute force' meaning they use excessive forceful attempts to try and 'force' their way into private accounts. +### Rootkit -This is an old attack method, but it is still effective and popular with hackers. Because depending on the length and complexity of the password, cracking it can take anywhere from a few seconds to many years. +A rootkit **is a type of malicious software designed to gain unauthorized access to a computer or system and to remain hidden from detection**. Once installed on a computer or system, a rootkit can allow an attacker to remotely control the system, steal sensitive information, and perform a wide range of other malicious activities. -Brute-force attacks can take place offline or online. In case of *__offline attacks__*, the attacker has access to the encrypted material or a password hash and tries different keys without the risk of discovery or interference. +Rootkits are typically installed through a variety of methods, including phishing attacks, software exploits, and social engineering tactics. Once installed, a rootkit can hide its presence by modifying the operating system's behavior or by redirecting system calls to hide its activities. -In *__online attacks__*, the attacker needs to interact with a target system. In such cases, the system can counteract the attack by, for example, limiting the number of attempts that a password can be tried, introducing time delays between successive attempts, increasing the answer’s complexity, e.g. by requiring a CAPTCHA answer or verification code sent to a cell phone, or locking accounts out after reaching a threshold of unsuccessful logon attempts. Introducing the second factor of authentication is another countermeasure. +Some common techniques used by rootkits to hide their presence include modifying system files, altering the system's boot sequence, and intercepting system calls. By doing so, a rootkit can remain hidden from detection by antivirus and other security software. -### Dictionary attack +Rootkits can be extremely difficult to detect and remove, and often require specialized tools and techniques to do so. To protect against rootkits, it is important to keep operating systems and software up to date with the latest security patches, avoid downloading software from untrusted sources, and use antivirus and antimalware software. It is also important to be vigilant for signs of suspicious activity on your computer or system, such as changes to system settings or the appearance of new or unknown files or programs. -A dictionary attack attempts to guess/crack user passwords by taking a dictionary of commonly used passwords instead of blindly trying out all permutations. Unlike a brute-force attack that systematically tries every possible combination for the secret, a dictionary attack uses only commonly used permutations. As a result, the number of attempted options is dramatically reduced. +### Backdoor -The premise behind a dictionary attack is that most users will not choose random strings as their passwords - they will choose words or combinations of words with meaning, to make the password easier to remember. +A backdoor **is a method of bypassing normal authentication and security mechanisms to gain unauthorized access to a computer system or network**. It is often installed by an attacker after gaining initial access to a system through other means, such as exploiting a vulnerability or tricking a user into installing malware. Once installed, a backdoor can allow an attacker to remotely control the compromised system, steal sensitive information, or launch additional attacks. Backdoors can be very difficult to detect and remove, and can remain active on a system for long periods of time if not discovered and addressed. -### Rainbow table +## Password Attacks -A rainbow table attack is a type of hacking wherein the perpetrator tries to use a rainbow hash table to crack the passwords stored in a database system. A rainbow table is a hash function used in cryptography for storing important data such as passwords in a database. In other words, it is a pre-built optimised set of hashes. +Password attacks are methods used by attackers to obtain passwords or gain unauthorized access to computer systems or networks. Password attacks can be very effective if proper security measures are not in place, and can lead to unauthorized access to sensitive data or systems. It is important to use strong, unique passwords, enable two-factor authentication where possible, and be aware of phishing scams and other forms of social engineering. -One of the advantages of the use of rainbow tables is the remarkable speed increase especially with longer password lengths. +### Spraying -One of the challenges is that different applciations use different hashing methods what creates the need of having different rainbow tables. +Password spraying **is a type of brute-force attack in which an attacker uses a list of commonly used usernames and a single password or a small set of passwords to try to gain unauthorized access to a large number of user accounts**. -## Making your password more secure +The goal of password spraying is to find weak or reused passwords, rather than guessing a specific user's password. This attack is often used against web-based applications or remote access services that allow access to a large number of users. -On common method to increse the robustness of hashed password is to add a salt to the hashing. +### Dictionary -In cryptography, a salt is random data that is used as an additional input to a one-way function that hashes data, a password or passphrase. Salts are used to safeguard passwords in storage. +A dictionary attack **is a type of password attack in which an attacker uses a pre-computed list of words, phrases, or other strings of characters** (known as a "*dictionary*") **to try to guess a user's password**. -A new salt is randomly generated for each password. In a typical setting, the salt and the password are concatenated and processed with a cryptographic hash function, and the output hash value is stored with the salt in a database. +The idea behind a dictionary attack is that many people use common words or phrases as their passwords, rather than random combinations of letters, numbers, and symbols. By using a dictionary of these common words and phrases, an attacker can quickly and efficiently guess many passwords. -Salts defend against a pre-computed hash attack, e.g., rainbow tables. Since salts do not have to be memorized by humans they can make the size of the hash table required for a successful attack prohibitively large without placing a burden on the users. Since salts are different in each case, they also protect commonly used passwords, or those users who use the same password on several sites, by making all salted hash instances for the same password different from each other. +A dictionary attack can be carried out manually or using automated tools, and it can be effective against weak passwords or passwords that use only lowercase letters or other predictable patterns. To defend against dictionary attacks, it's important to use strong, complex passwords that are not easily guessed by an attacker. -# Physical attacks +### Brute force -A physical attack disrupts, damages, or destroys computer equipment and/or the availability of data. A physical attack is implemented either through use of conventional weapons, creating heat, blast, and fragmentation, or through direct manipulation of wiring or equipment, usually after gaining unauthorized physical access. +Brute force **password attacks are a type of password attack that involves trying every possible combination of characters until the correct password is found**. This method relies on sheer computing power to try all possible password combinations, typically starting with the most common passwords and moving on to less common ones. Brute force attacks can be time-consuming and resource-intensive, but they can be effective if the password is weak and relatively short. However, longer and more complex passwords can make brute force attacks much more difficult or even impractical. -A physical attack can constitute a threat to an organization, certain areas of the organization or individuals. The technical possibilities to perpetrate an attack are numerous: throwing bricks, blasts by explosives, use of firearms or arson. +Two types of brute force password attacks can be found: -## Types of physical attacks +- **Online** brute force password attacks are carried out in real-time and involve trying to guess a password by sending login attempts to a server or website. These attacks are limited by rate limits and other security measures put in place by the website or server, which can slow down the attack or even prevent it altogether. +- **Offline** brute force password attacks, on the other hand, are carried out on a stolen or leaked password database file that is not connected to the internet. Attackers can use specialized software to try all possible password combinations against the file, without being limited by rate limits or other security measures. This type of attack can be very effective, especially if the attackers have a powerful computer or a botnet at their disposal. However, obtaining a password database file is not easy, and it often requires a separate attack, such as a phishing or malware attack. -### Serial Bus (USB) attacks +### Rainbow table -With increasing pressure to limit network access to organisations, computers or systems, the dependence upon USB removable media to transfer information, files, patches and updates has been increased. In additon, they are a very common way for users to exchange information or files. +A rainbow table **is a precomputed table used for password cracking**. It contains a large number of potential password hashes and their corresponding plaintext passwords. Rainbow tables are used by attackers to quickly recover plaintext passwords from hashed passwords by looking them up in the table. This technique is particularly effective against weak passwords or passwords that are commonly used, as these can be easily cracked using precomputed tables. To counteract rainbow table attacks, stronger hashing algorithms and the use of salting have been recommended. -This has transform a USB device in a powerful attack vector that can be used to attack systems directly using the USB interface. +### Plaintext/unencrypted -There are three main types of attack: +Plaintext/unencrypted password **attacks refer to an attack in which an attacker gains access to a password that is stored in plain text or an unencrypted format**. This type of attack can occur when passwords are stored in a database, a configuration file, or any other location in which they can be accessed by someone with the right privileges or through a vulnerability in the system. Once an attacker has obtained a plaintext password, they can use it to gain access to the associated user account or system. This type of attack can be prevented by using encryption and secure password storage practices. -* __Malicious code__: In the most basic of USB drop attacks, the user clicks on one of the files on the drive. This unleashes a malicious code that automatically activates upon viewing and can download further malware from the Internet. +## Physical attacks -* __Social engineering__: The file takes the thumb drive user to a phishing site, which tricks them into handing over their login credentials. +Physical attacks **refer to any type of attack that involves physical access to computer systems or other electronic devices**. These attacks can include theft of equipment, destruction or damage of hardware, or manipulation of hardware or software to gain unauthorized access. -* __Human Interface Device (HID) spoofing__: In a more sophisticated attack, the device looks like a USB stick but in fact will trick the computer into thinking a keyboard is attached. When plugged into a computer, it injects keystrokes to command the computer to give a hacker remote access to the victim’s computer. +### Malicious Universal Serial Bus (USB) cable -As a countermeassure, do not plug USBs do not come from a trusted source. +The Malicious Universal Serial Bus (USB) cable **physical attack involves the use of a specially designed USB cable to gain unauthorized access to a device or network**. The cable contains additional hardware, such as a microcontroller or wireless transmitter, that allows an attacker to remotely execute commands or extract data from the device. This type of attack is particularly dangerous because it can be difficult to detect and is often disguised as a legitimate cable. -### Skimming +### Malicious flash drive -Skimming is a method used by identity thieves to capture payment and personal information from a credit card holder. Several approaches can be used by fraudsters to procure card information, with the most advanced approach involving a small device called a skimmer that reads the information stored in a card's magnetic strip or microchip. +A malicious flash drive **physical attack refers to the act of using a specially crafted USB flash drive to infiltrate a computer system or network**. The attacker may create a flash drive that contains malware or other malicious software designed to exploit vulnerabilities in the targeted system or network. Once the flash drive is inserted into a USB port, the malware can automatically execute, giving the attacker access to sensitive information, control of the system, or the ability to spread the malware to other connected devices. This type of physical attack is often used in combination with social engineering tactics, such as leaving the flash drive in a public location with the hope that someone will pick it up and insert it into their computer out of curiosity. ### Card cloning -Card cloning refers to the practice of making an unauthorized copy of a credit card. This practice is also sometimes called skimming. It requires copying information at a credit card terminal using an electronic device or software, then transferring the information from the stolen card to a new card or rewriting an existing card with the information. +Card cloning **is a physical attack in which an attacker uses a skimming device to steal data from the magnetic stripe of a credit or debit card**. The skimming device is usually placed over a legitimate card reader, such as an ATM or a gas pump, and captures the card information as it is swiped. The attacker can then use this information to create a cloned card or to make unauthorized purchases. Card cloning is a type of credit card fraud and can result in financial losses for the victim. -# Adversarial artificial intelligence (AI) - -Artificial intelligence and machine learning (ML) are blooming nowadays and colonising almost every organisation or business. The cybersecurity ambit is not different. Cybercriminals are utilising artificial intelligence to launch more effective attacks or, attacking the source of data machine learning algorithms are using to alter or influence the training of the algorithms. +### Skimming -In general, cybersecurity is an adversarial and adaptive activity. It follows that ML used for cybersecurity purposes is itself vulnerable to adversarial manipulation—that is, attackers may learn enough about the ML model to design ways of tricking or altering it to render it ineffective for defense. +Skimming **is a physical attack that involves stealing credit or debit card information by using a device called a skimmer**. The skimmer is typically installed on a legitimate card reader, such as an ATM or gas pump, and it reads the information from the magnetic strip on the card when it is swiped. The information is then stored on the skimmer, and can later be used to create a counterfeit copy of the card or to make unauthorized purchases. Skimming is a form of credit card fraud, and can result in significant financial losses for victims. -One of this adversarial attacks is *__Data poisoning__*. Data poisoning is an adversarial attack that tries to manipulate the training dataset in order to control the prediction behavior of a trained model such that the model will label malicious examples into a desired classes, e.g., labeling spam e-mails as safe. +## Adversarial artificial intelligence (AI) -It is important when training algorithms to check and verify the data used, constantly re-train with new and verified data and, try to train the algorithm with possible poisoning data to try to predict what attacks could do. +Adversarial artificial intelligence (AI) **refers to the use of machine learning techniques to deceive or manipulate a model by intentionally inputting malicious data into the system**. Adversarial AI can be used to generate fake data or to modify legitimate data in such a way that it is misinterpreted by the machine learning model. This can result in incorrect decisions or actions being taken by the system, leading to security breaches, privacy violations, or other negative consequences. Adversarial AI is a growing concern in cybersecurity as machine learning models become more prevalent in various applications, including network intrusion detection, malware detection, and fraud detection. -# Supply-chain attacks +### Tainted training data for machine learning (ML) -Supply chain attacks are an emerging kind of threat that target software developers and suppliers. The goal is to access source codes, build processes, or update mechanisms by infecting legitimate apps to distribute malware. +Tainted training data for machine learning (ML) **refers to data used to train a machine learning model that has been intentionally or unintentionally modified or manipulated to generate incorrect or biased results**. This can happen when the training data is incomplete, inaccurate, or biased towards a certain group, leading the machine learning model to make inaccurate predictions or decisions. Tainted training data can be intentionally created by attackers to manipulate machine learning models and cause harm, such as in adversarial attacks, or it can occur accidentally due to poor data quality or biased selection of training data. It is a significant concern in machine learning and artificial intelligence applications that rely on accurate and unbiased data to make decisions. -Attackers hunt for unsecure network protocols, unprotected server infrastructures, and unsafe coding practices. They break in, change source codes, and hide malware in build and update processes. +### Security of machine learning algorithms -Because software is built and released by trusted vendors, these apps and updates are signed and certified. In software supply chain attacks, vendors are likely unaware that their apps or updates are infected with malicious code when they are released to the public. The malicious code then runs with the same trust and permissions as the app. +Security of machine learning (ML) algorithms is an emerging area of concern in the field of cybersecurity. ML algorithms are being increasingly used in a wide range of applications, such as image recognition, natural language processing, and fraud detection. However, these algorithms are vulnerable to a range of security threats, including adversarial attacks, data poisoning, and model stealing. -The number of potential victims is significant, given the popularity of some apps. +Adversarial attacks are a type of attack in which an attacker intentionally manipulates the input data to cause the ML algorithm to produce incorrect results. These attacks can be carried out through a range of techniques, such as adding noise to the input data or modifying the input data in subtle ways. -# Cloud-based vs. on-premises attacks +Data poisoning is another type of attack in which an attacker manipulates the training data used to train the ML algorithm. By inserting malicious data into the training dataset, an attacker can influence the output of the ML algorithm in a way that benefits them. -Today’s businesses can decide between on-premises vs. cloud solutions for just about every element of their IT services, including software, servers, storage, backups, security, and enterprise resource planning (ERP). The cloud is becoming increasingly popular, but on-premises implementations retain a vital role. Each solution has its own advantages and disadvantages. +Model stealing is a type of attack in which an attacker attempts to steal the ML model itself. This can be done by analyzing the input-output behavior of the model, or by using a technique known as model inversion to reverse-engineer the model from its output. -On-premises servers are the traditional enterprise computing model. In this implementation, all hardware and software resides in house. A business purchases and maintains its own servers, located in a secure, climate-controlled room onsite. +To address these security threats, researchers are developing a range of techniques for securing ML algorithms, such as detecting and mitigating adversarial attacks, detecting data poisoning attacks, and protecting the ML model from theft. These techniques involve a range of approaches, such as developing more robust ML algorithms, designing better training datasets, and using techniques such as encryption to protect the ML model from theft. -Cloud solutions mean that businesses rely on servers that exist offsite away from their offices. The cloud providers take care of maintenance, backups, software updates, power, and HVAC. +## Supply-chain attacks -The security of the cloud vs. on-premises is a key consideration in this debate. Cloud security controls have historically been considered less robust than on-premises ones, but cloud computing is no longer a new technology. Nowadays, more and more businesses are trusting the cloud for their security needs. Both approaches have different advantages and disadvantages. +Supply-chain attacks, also known as third-party attacks, **are a type of cyberattack that target vulnerabilities in the software and hardware supply chain**. The attackers compromise one or more elements of the supply chain, such as a software vendor or a hardware manufacturer, and inject malicious code or components into the final product or service. This allows the attackers to gain unauthorized access, steal data, or cause damage to the targeted organization or individuals using the compromised product or service. -## On-premises security +Supply-chain attacks are a growing concern for cybersecurity professionals because they are difficult to detect and mitigate. They can also have widespread and long-lasting consequences, as the compromised product or service may be used by multiple organizations or individuals. Examples of supply-chain attacks include the NotPetya ransomware attack, the SolarWinds attack, and the recent Kaseya ransomware attack. -### Advantages +## Cloud-based vs. on-premises attacks -* Customise your security posture. Full control when everything is in house. -* On-site IT team can manage secutiry better. The local team can ensure everything is secure. -* Local team maintains uptime and availability. System checks can occur at any time. No phone call for support. +Cloud-based and on-premises attacks **refer to different ways in which cyber attacks can be carried out, depending on the location of the target systems and data.** -### Disadvantages +On-premises attacks refer to attacks that are carried out against systems and data that are located within an organization's own physical premises, such as a data center or a server room. These types of attacks typically involve attempts to breach an organization's internal network security, such as by exploiting vulnerabilities in software or by using social engineering techniques to trick employees into divulging sensitive information. -* A local team can be expensive and difficult to stuff. -* Security changes can take time. New equipement, configurations, and additional costs. -* Difficult to have specialised members. +Cloud-based attacks, on the other hand, target systems and data that are located in cloud environments, such as those provided by Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform. These types of attacks can take many forms, including attempts to exploit vulnerabilities in cloud services, phishing attacks targeting cloud-based accounts and credentials, and attacks aimed at hijacking cloud-based virtual machines. -## Cloud-basd +Both on-premises and cloud-based attacks can have serious consequences for organizations, including theft of sensitive data, disruption of critical business processes, and damage to the organization's reputation. As such, it is important for organizations to implement robust security measures to protect against both types of attacks, such as strong access controls, regular security assessments, and employee training programs to prevent social engineering attacks. -### Advantages +## Cryptographic attacks -* Data is in a secure environment. No physical access to the data centre. -* Cloud providers are managing large-scale security. Automated signature and security updates. -* Limited downtime. Extensive fault tolerance and 24/7/365 monitoring. -* Scalable security options. One-click security deployments. +Cryptographic attacks are methods used by attackers to exploit weaknesses or vulnerabilities in cryptographic systems or algorithms to gain unauthorized access to sensitive data or information. These attacks may involve analyzing the cryptographic keys, algorithms, or protocols used to secure data transmission, storage, or communication to find weaknesses that can be exploited to decrypt, modify, or otherwise compromise the integrity or confidentiality of the data. -### Disadvantages +These attacks can be used to crack passwords, intercept encrypted communications, steal confidential information, or compromise the security of authentication mechanisms used to control access to critical systems or networks. To prevent such attacks, it is important to use strong encryption algorithms, secure key management, and implement best practices for secure data transmission, storage, and communication. -* Third-party may have access to the data. -* Users forced to follow security best-practices (_Is this bad?_) -* It may not be as customisable as necessary. +### Birthday -# Cryptographic attacks +In cryptography, a birthday is a phenomenon where the probability of two people sharing the same birthday is higher than expected in a group of people. Similarly, a birthday attack **is a cryptographic attack that takes advantage of this phenomenon to find two inputs that generate the same hash value**. -Cryptographic attacks are methods for circumventing the security of a cryptographic system by finding a weakness in a code, cipher, cryptographic protocol or key management scheme. This process is also called "cryptanalysis". +In a cryptographic hash function, the output (hash) has a fixed size, regardless of the size of the input. This means that different inputs can produce the same hash value. In a birthday attack, the attacker tries to find two inputs that produce the same hash value by generating a large number of random inputs (often using a brute-force approach) and checking if any two of them have the same hash value. -## Types of cryptographic attacks +A birthday attack can be used to attack cryptographic protocols that use hash functions, such as digital signatures or message authentication codes (MACs). If an attacker can find two messages that produce the same hash value, they can create a fraudulent digital signature or MAC, which can be used to impersonate the legitimate sender or receiver of a message. -### Birthday attack +### Collision -A birthday attack is a type of cryptographic attack, which exploits the mathematics behind the birthday problem in probability theory. Birthday attack can be used in communication abusage between two or more parties. The attack depends on a fixed degree of permutations (pigeonholes) and the higher likelihood of collisions found between random attack attempts, as described in the birthday paradox/problem. +In cryptografy, a collision **refers to the situation where two different input values** (such as two different plaintext messages) **produce the same output value** (such as the same hash value). In other words, a collision occurs when a cryptographic hash function generates the same output for two different inputs. -As an example, consider the scenario in which a teacher with a class of 30 students asks for everybody's birthday (ignore leap years) to determine whether any two students have the same birthday, corresponding to a *__hash collision__*. Intuitively, this chance may seem small. Counter-intuitively, the probability that at least one student has the same birthday as any other student on any day is around 70%. +Collisions are considered a weakness in cryptographic hash functions because they can be used by attackers to generate fraudulent data or to deceive a system that relies on the integrity of hash values for data verification. In practice, collisions can be exploited to bypass authentication mechanisms, create counterfeit digital signatures, or break digital certificates. -A hash collision is when two different paintexts have the same hash value. Collisions are bad because hash digests are supposed to be unique and, different input data should never create the same hash. +Cryptographic hash functions are designed to be resistant to collisions through the use of complex mathematical algorithms that generate unique hash values for each input. However, some hash functions are more vulnerable to collision attacks than others, and researchers are constantly working to develop stronger hash functions that are less susceptible to such attacks. -This is why some hash algorithms such as MD5 are consired not secure any more. +### Downgrade -### Downgrade attack +In cryptograpy, a downgrade attack **is a type of attack that exploits vulnerabilities in communication protocols to force a system to use weaker cryptographic algorithms or protocols than it would normally use**. This makes it easier for attackers to intercept and decode sensitive information that is being transmitted over the network. -A downgrade attack or version rollback attack is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation, e.g., an encrypted connection, in favor of an older, lower-quality mode of operation, e.g., cleartext, that is typically provided for backward compatibility with older systems. An example of such a flaw was found in OpenSSL that allowed the attacker to negotiate the use of a lower version of TLS between the client and server. This is one of the most common types of downgrade attacks. Another example is intercepting web traffic and redirecting the user from the secure, HTTPS version of a website to an unencrypted HTTP version. +Downgrade attacks can be particularly effective when used against systems that are not configured to detect or prevent such attacks, and they can be used in a variety of contexts, including web applications, email systems, and virtual private networks (VPNs). diff --git a/1.0-threats-attacks-and-vulnerabilities/1.3-given-a-scenario-analyze-potential-indicators-associated-with-application-attacks.md b/1.0-threats-attacks-and-vulnerabilities/1.3-given-a-scenario-analyze-potential-indicators-associated-with-application-attacks.md index 2b31f57..d13fac2 100644 --- a/1.0-threats-attacks-and-vulnerabilities/1.3-given-a-scenario-analyze-potential-indicators-associated-with-application-attacks.md +++ b/1.0-threats-attacks-and-vulnerabilities/1.3-given-a-scenario-analyze-potential-indicators-associated-with-application-attacks.md @@ -1,228 +1,146 @@ -# __1.3 Given a scenario, analyze potential indicators associated with application attacks__ +# 1.3 Given a scenario, analyze potential indicators associated with application attacks. -# Privilege escalation +## Privilege escalation -Privilege escalation is a common way for attackers to gain unauthorized access to systems within a security perimeter. +Privilege escalation **refers to the act of exploiting a vulnerability or a weakness in a system or application to gain higher levels of access or permissions than originally intended or authorized**. This could allow an attacker to gain administrative or root-level access to a system, giving them complete control over it and the ability to carry out malicious actions such as stealing sensitive data, modifying or deleting files, or installing malware. Privilege escalation attacks can occur due to misconfigurations, software vulnerabilities, or weaknesses in access controls. It is a common technique used by attackers to gain more extensive control over a compromised system or network. -Attackers start by finding weak points in an organization’s defenses and gaining access to a system. In many cases that first point of penetration will not grant attackers with the level of access or data they need. They will then attempt privilege escalation to gain more permissions or obtain access to additional, more sensitive systems. +## Cross-site scripting -In some cases, attackers attempting privilege escalation find the "doors are wide open" - inadequate security controls, or failure to follow the principle of least privilege, with users having more privileges than they actually need. In other cases, attackers exploit software vulnerabilities, or use specific techniques to overcome an operating system’s permissions mechanism. +Cross-site scripting (XSS) **is a type of security vulnerability found in web applications that enables an attacker to inject client-side scripts into web pages viewed by other users**. XSS attacks occur when an attacker injects malicious code, typically in the form of a script written in JavaScript or HTML, into a vulnerable web page. When a user visits the compromised web page, the script executes within the user's web browser, allowing the attacker to steal data, modify or delete web page content, or take control of the user's session on the vulnerable website. -There are two types of privilege escalation: +XSS attacks can take different forms, including **reflected XSS**, **stored XSS**, and **DOM-based XSS**, and can be classified as either **persistent or non-persistent**. Persistent XSS involves injecting malicious code that is permanently stored on the target web server and executed every time a user visits a vulnerable page. Non-persistent XSS involves injecting malicious code that is only temporarily stored on the target server and executed when a user visits a specific, compromised URL. -* __Horizontal privilege escalation__: An attacker expands their privileges by taking over another account and misusing the legitimate privileges granted to the other user. +Preventing XSS attacks typically involves input validation and output encoding to ensure that user-supplied data is not executed as code in the user's web browser. Other strategies include the use of content security policies and the implementation of measures to prevent unauthorized access to cookies or session tokens. -* __Vertical privilege escalation__: An attacker attempts to gain more permissions or access with an existing account they have compromised. For example, an attacker takes over a regular user account on a network and attempts to gain administrative permissions. This requires more sophistication and may take the shape of an Advanced Persistent Threat. +## Injections -## Mitigation +In the context of cybersecurity, an injection **is a type of attack where an attacker injects malicious code or data into a vulnerable software application or system**. The term "*injection*" refers to the attacker injecting (i.e., inserting) the malicious code or data into the application or system. -* Path quickly: When it comes to OS-level privilege escalation vulnerabilities, it is vital to install security patches as soon as possible, not only for the OS, but for all third-party applications used on the system. +There are several types of injection attacks, including SQL injection, command injection, and LDAP injection. In SQL injection, the attacker injects malicious SQL code into a vulnerable web application's input field. The injected SQL code can then access or manipulate the application's database. In command injection, the attacker injects malicious code into a command that is executed by the application or system. In LDAP injection, the attacker injects malicious data into an LDAP search query to extract sensitive information. -* Update anti-virus/anti-malware software to block known vulnerabilities. +### Structured query language (SQL) -* Data execution prevention: Application whitelisting technologies can be used to restrict which programs may run on a system or limited the areas where data can be executable, enabling organizations to reduce a machine's attack surface. Making sure that unneeded services are turned off and that unused hardware components and drivers are disabled is also very important. +SQL injection **is a type of injection attack that targets database-driven web applications.** It occurs when an attacker inserts malicious SQL code into a web form or query string, tricking the application into executing unintended actions such as reading, modifying, or deleting data stored in the database. The attack can result in data theft, data loss, or unauthorized access to sensitive information. SQL injection attacks can be prevented by using parameterized queries or prepared statements to sanitize user input and validate data before passing it to the database. -* Address space layout randomisation: Some operative system allow the data to be allocated randomly preventing a buffer overrun at a known memory address. +### Dynamic-link library (DLL) -# Cross-site scripting +Dynamic-link library (DLL) injection **is a type of cyber attack where an attacker injects malicious code into a running process by inserting a malicious DLL into the process's address space**. DLL injection can be used to perform various malicious activities, such as stealing sensitive information, modifying system settings, or executing arbitrary code. This attack can be executed through several means, including exploiting software vulnerabilities, social engineering, or through the use of malicious email attachments or downloads. Once the malicious code has been injected into the process, the attacker gains control over the system and can execute any command or access any data that the compromised process has access to. -Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. +### Lightweight Directory Access Protocol (LDAP) -An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page. +Lightweight Directory Access Protocol (LDAP) injection **is a type of injection attack that targets LDAP databases or directories**, which are used to store information about users, groups, and other objects within an organization. In an LDAP injection attack, an attacker exploits vulnerabilities in the input validation of an application that uses LDAP to query or update an LDAP directory. The attacker injects malicious LDAP statements into the application's input fields to gain unauthorized access to the LDAP directory, extract sensitive data, or modify the directory's content. LDAP injection attacks can result in serious consequences, such as data theft, data tampering, or unauthorized access to critical systems or applications. -## Types of cross-site scripting +### Extensible Markup Language (XML) -### Stored XSS (persistent) +XML injection **is a type of security vulnerability that can occur when user input is not properly sanitized in applications that process XML data**. Attackers can exploit this vulnerability by injecting malicious XML code into an XML document or data stream, which can then be executed by the application or passed on to other systems. The injected code can be used to steal sensitive information, manipulate or delete data, or take control of the application or system. To prevent XML injection, it is important to properly validate and sanitize user input and use secure coding practices when working with XML data. -Stored XSS generally occurs when user input is stored on the target server, such as in a database, in a message forum, visitor log, comment field, etc. And then a victim is able to retrieve the stored data from the web application without that data being made safe to render in the browser. With the advent of HTML5, and other browser technologies, we can envision the attack payload being permanently stored in the victim’s browser, such as an HTML5 database, and never being sent to the server at all. +## Pointer/object dereference -### Reflected XSS (non-persistent) +Pointer/Object dereference, also known as a pointer/reference vulnerability, **is a type of software vulnerability that occurs when an application does not properly validate or sanitize user-supplied input before using it as a memory address or object reference**. This can allow an attacker to manipulate the input in such a way that the program ends up accessing or modifying memory locations or objects it shouldn't have access to, potentially leading to a range of security issues, such as information disclosure, denial of service, or remote code execution. Pointer/Object dereference vulnerabilities are commonly found in low-level programming languages like C and C++, but can also occur in other languages. -Reflected XSS occurs when user input is immediately returned by a web application in an error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data. In some cases, the user provided data may never even leave the browser. - -### DOM based XSS - - DOM Based XSS is a form of XSS where the entire tainted data flow from source to sink takes place in the browser, i.e., the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser. For example, the source (where malicious data is read) could be the URL of the page (e.g., document.location.href), or it could be an element of the HTML, and the sink is a sensitive method call that causes the execution of the malicious data (e.g., document.write). - -## Protecting against - -From a users perspective some actions or precautions can be taken: - -* Be careful when clicking untrusted links. -* Consider disabling Javascript or limit its use. -* Keep your browser and applications updated. - -From a developer point of view: - -* Train and maintain awareness. -* Do not trust any user input. -* Use escaping/encoding. -* Sanitize HTML. -* Set the HttpOnly flag. -* Use a Content Security Policy. -* Scan regularly. - -# Injection attacks - -Injection attacks refer to a broad class of attack vectors. In an injection attack, an attacker supplies untrusted input to a program. This input gets processed by an interpreter as part of a command or query. In turn, this alters the execution of that program. - -Injections are amongst the oldest and most dangerous attacks aimed at web applications. They can lead to data theft, data loss, loss of data integrity, denial of service, as well as full system compromise. The primary reason for injection vulnerabilities is usually insufficient user input validation. - -This attack type is considered a major problem in web security. Injection attacks, particularly SQL Injections (SQLi attacks) and Cross-site Scripting (XSS), are not only very dangerous but also widespread, especially in legacy applications. - -What makes injection vulnerabilities particularly scary is that the attack surface is enormous. Furthermore, injection attacks are a very well understood vulnerability class. This means that there are many freely available and reliable tools that allow even inexperienced attackers to abuse these vulnerabilities automatically. - -## Types of injection attacks - -* Code injection: The attacker injects application code written in the application language. This code may be used to execute operating system commands with the privileges of the user who is running the web application. In advanced cases, the attacker may exploit additional privilege escalation vulnerabilities, which may lead to full web server compromise. Some of the injections named below belong to this category but they deserve to be named independently. - -* __CRLF injection__: The attacker injects an unexpected CRLF (Carriage Return and Line Feed) character sequence. This sequence is used to split an HTTP response header and write arbitrary contents to the response body. This attack may be combined with Cross-site Scripting (XSS). - -* __Cross-site Scripting (XSS)__: The attacker injects an arbitrary script (usually in JavaScript) into a legitimate website or web application. This script is then executed inside the victim’s browser. - -* __Email Header Injection__: This attack is very similar to CRLF injections. The attacker sends IMAP/SMTP commands to a mail server that is not directly available via a web application. - -* __Host Header Injection__: The attacker abuses the implicit trust of the HTTP Host header to poison password-reset functionality and web caches. - -* __LDAP Injection__: The attacker injects LDAP (Lightweight Directory Access Protocol) statements to execute arbitrary LDAP commands. They can gain permissions and modify the contents of the LDAP tree. - -* __OS Command Injection__: The attacker injects operating system commands with the privileges of the user who is running the web application. In advanced cases, the attacker may exploit additional privilege escalation vulnerabilities, which may lead to full system compromise. - -* __SQL Injection (SQLi)__: The attacker injects SQL statements that can read or modify database data. In the case of advanced SQL Injection attacks, the attacker can use SQL commands to write arbitrary files to the server and even execute OS commands. This may lead to full system compromise. - -* __XPath injection__: The attacker injects data into an application to execute crafted XPath queries. They can use them to access unauthorized data and bypass authentication. - -* __DLL injection__: It is a technique used for running code within the address space of another process by forcing it to load a dynamic-link library DLL injection is often used by external programs to influence the behavior of another program in a way its authors did not anticipate or intend. - -* __XML Injection__: It is an attack technique used to manipulate or compromise the logic of an XML application or service. The injection of unintended XML content and/or structures into an XML message can alter the intend logic of the application. - -# Buffer overflows - -Buffers are memory storage regions that temporarily hold data while it is being transferred from one location to another. A buffer overflow (or buffer overrun) occurs when the volume of data exceeds the storage capacity of the memory buffer. As a result, the program attempting to write the data to the buffer overwrites adjacent memory locations. - -Buffer overflows can affect all types of software. They typically result from malformed inputs or failure to allocate enough space for the buffer. If the transaction overwrites executable code, it can cause the program to behave unpredictably and generate incorrect results, memory access errors, or crashes. - -## Types of buffer overflow attacks - -* __Stack-based buffer overflows__: Stack-based buffer overflows are more common, and leverage stack memory that only exists during the execution time of a function. - -* __Heap-based attacks__: Heap-based attacks are harder to carry out and involve flooding the memory space allocated for a program beyond memory used for current runtime operations. - -# Replay attacks - -A replay attack occurs when a cybercriminal eavesdrops on a secure network communication, intercepts it, and then fraudulently delays or resends it to misdirect the receiver into doing what the hacker wants. The added danger of replay attacks is that a hacker does not even need advanced skills to decrypt a message after capturing it from the network. The attack could be successful simply by resending the whole thing. - -## Types of replay attacks - -* __Pass-the-hash__: A Pass-the-hash (PtH) attack is a technique whereby an attacker captures a password hash (as opposed to the password characters) and then simply passes it through for authentication and potentially lateral access to other networked systems. The threat actor doesn’t need to decrypt the hash to obtain a plain text password. PtH attacks exploit the authentication protocol, as the passwords hash remains static for every session until the password is rotated. Attackers commonly obtain hashes by scraping a system’s active memory and other techniques. - -* __Session replays__: Session replay attacks are network attacks that maliciously that focus on the user's session IDs stored as either a cookie, URL, or form field. This makes possible the *__session hijacking__*. Session hijacking happens when an intruder takes advantage of a compromised active session by hijacking or stealing the HTTP cookies used to maintain a session on most websites. Another way is by predicting an active session to gain unauthorized access to information in a remote webserver without detection as the intruder uses the credentials of the particular user. - -# Request forgeries - -Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. +## Directory traversal -Two types of request forgeries: Cross-Site Request Forgery and Server-Side Request Forgery attacks. Both take advantage of how servers process URLs. However, these attacks have very different purposes and impacts. +Directory traversal, also known as path traversal, **is a type of web application vulnerability that allows an attacker to access files and directories outside the intended directory tree**. This can occur when a web application does not properly sanitize user input, which allows an attacker to use special characters and sequences to navigate up and down the directory structure. This can lead to sensitive information disclosure, unauthorized access to files, and in some cases, execution of malicious code. Directory traversal attacks can be prevented by implementing proper input validation and sanitization techniques. -* __Cross-site request forgery__: The purpose of Cross-Site Request Forgery (CSRF) is to force a user to take undesired actions on their online account. Accomplishing this involves taking advantage of state-changing requests, where a web server will take some action based upon an authenticated user browsing to a particular page. +## Buffer overflows -* __Server-Side Request Forgery__: Server-Side Request Forgery (SSRF) attacks are designed to exploit how a server processes external information. Some web applications may be designed to read information from or write information to a particular URL like a REST API. If an attacker can modify the target URL, they can potentially exfiltrate sensitive information from the application or inject untrusted input into it. +A buffer overflow **is a type of software vulnerability that can occur when a program tries to write more data to a buffer** (temporary storage area in memory) **than it can actually hold**. When this happens, the extra data can overwrite adjacent memory areas, potentially causing the program to behave unexpectedly or crash. - The vulnerabilities associated with SSRF are not limited to data exfiltration. In some cases, applications may be designed to read data from a particular URL. If this URL is trusted, the application may not be performing data validation. This could allow an attacker to provide malicious input that could exploit a buffer overflow, integer overflow, SQL injection or other vulnerability in the application. +Buffer overflow attacks can be used by malicious actors to take control of a program or a system, and they can be particularly dangerous when they allow attackers to execute arbitrary code. Because buffer overflows can be difficult to detect and can occur in a wide range of software, they have been a common technique used by hackers to exploit vulnerabilities in software applications. As a result, software developers and security professionals work to identify and patch buffer overflow vulnerabilities as part of their efforts to secure software and systems. -# Driver manipulation +## Race conditions -Our device drivers have direct access to hardware and the operating system, this is why, they are a great place to put a piece of malicious software that it is installed in our operating systems. These drivers sit between the hardware and the operating system itself. They are effectively privileged code that is running, very much trusted by the operating system. So this would be a great place to embed some malicious software. +Race condition **is a type of vulnerability that occurs in computer systems when two or more processes or threads attempt to access and manipulate shared resources or data simultaneously, leading to unexpected or unpredictable behavior**. A race condition can arise when the outcome of a computation depends on the sequence or timing of events, and this sequence or timing can be altered by interference from other processes or threads. In the context of cybersecurity, race conditions can be exploited by attackers to gain unauthorized access to systems or data, execute malicious code, or cause denial of service (DoS) conditions. -## Shimming +### Time of check/time of use -Application shimming is a Windows Application Compatibility framework that Windows created to allow programs to run on versions of the OS that they were not initially created to run on. Malware authors have discovered they can write their own shims to get around security like the User Access Control (AUC). +The Time of Check/Time of Use (TOCTOU) **race condition is a type of security vulnerability that can occur when a program checks the state of a resource** (such as a file or network connection) **before using it, but the resource's state can change between the time it is checked and the time it is used**. Attackers can exploit this vulnerability by manipulating the resource's state to cause the program to perform unintended actions or grant unauthorized access. -## Refactoring +The TOCTOU vulnerability can be especially problematic in situations where multiple processes or threads are accessing the same resource simultaneously. If one process or thread modifies the resource's state while another process or thread is checking its state, this can result in unexpected behavior and can potentially be exploited by attackers to execute malicious code. -Refactoring or metamorphic virus is one that can transform based on the ability to translate, edit and rewrite its own code. It is considered the most infectious computer virus, and it can do serious damage to a system if it is not detected quickly. Antivirus scanners have a difficult time detecting this type of virus because it can change its internal structure, rewriting and reprogramming itself each time it infects a computing system. This is different from a polymorphic virus, which encrypts its original code to keep from being detected. Because of their complexity, creating metamorphic viruses requires extensive programming knowledge. +To prevent TOCTOU vulnerabilities, programmers can use techniques such as file locking, atomic operations, and transactional memory to ensure that resources are accessed in a consistent and secure manner. Additionally, developers should be careful to validate user input and use appropriate error handling to prevent unexpected behavior. -# SSL Stripping +## Error handling -SSL Stripping or an SSL Downgrade Attack is to strip away the encryption offered by HTTPS and, it is a serious cyber threat to many corporations since their employees are constantly on the move and require access to Internet on-the-go even through open non-secure Wi-Fi hotspots. Once attackers gain access to a network, they can act as a Man-in-the-Middle (MitM) to intercept connections over the network. These interception tactics can also be deployed against wired networks, provided that someone gains access to an Ethernet port. +Error handling **refers to the process of managing and responding to unexpected or erroneous events that occur during software execution**. In other words, it involves identifying and anticipating potential errors or exceptions, and implementing mechanisms to prevent or handle them when they occur. Proper error handling is essential for ensuring the stability, reliability, and security of software applications. Effective error handling includes a combination of techniques, such as exception handling, logging, testing, and debugging. -# Race conditions +## Improper input handling -A race condition or race hazard is the condition of an electronics, software, or other system where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events. It becomes a bug when one or more of the possible behaviors is undesirable. +Improper input handling **is a vulnerability that occurs when an application does not properly validate or sanitize input data from users or other sources**. This can leave the application open to various types of attacks, including injection attacks, buffer overflows, and other forms of malicious code execution. Examples of improper input handling include not checking the length or format of user input, allowing input that includes special characters or code that can be executed by the application, and not validating input against expected values or ranges. Proper input handling is essential to ensure the security and reliability of software applications. -*__Time-of-Check-Time-of-Use__* (TOCTOU) attacks fall under the category of a race condition which, as said, occurs when two or more operations that should be done in sequence are attempted simultaneously. Attackers are able to access a file and make harmful changes between the time of check (first time the program accesses the file) and the time of use (when the software uses the file). The opportunity window is very short due to that near simultaneous overlap. +## Replay attack -# Other application attacks +A replay attack **is a type of cyber attack in which an attacker intercepts and records a legitimate data transmission and then resends it to its intended destination in order to impersonate the original sender**. This type of attack takes advantage of the fact that the recipient system will not be able to distinguish between the original transmission and the replayed transmission, and will therefore accept it as authentic. Replay attacks can be used to gain unauthorized access to systems or information, perform fraudulent transactions, or disrupt communication between systems. To prevent replay attacks, cryptographic techniques such as message authentication codes (MACs) or timestamps can be used to ensure the integrity and freshness of data transmissions. -## Memory Vulnerabilities +### Session replays -Manipulating a systems memory can be very advantageous for an attacker but, quite complicated. +Session replay attacks **are a type of replay attack in which an attacker records a user's session, including user inputs and server responses, and then replays the session to the server, impersonating the user**. The attacker can use various methods to record the session, such as capturing network traffic, using malware or keyloggers on the user's system, or even physically observing the user's activities. -### Memory leak +The goal of session replay attacks is to gain unauthorized access to the user's account or to perform fraudulent activities on their behalf. For example, an attacker could use a session replay attack to bypass authentication mechanisms or to make unauthorized transactions on a user's behalf. -A memory leak is a way of manipulating memory and it is an unintentional form of memory consumption whereby the developer fails to free an allocated block of memory when no longer needed. The consequences of such an issue depend on the application itself. Consider the following general three cases: +To prevent session replay attacks, applications should use strong authentication mechanisms, such as multi-factor authentication, and should encrypt sensitive data in transit and at rest. Applications should also implement mechanisms to detect and prevent replay attacks, such as using session tokens that expire after a certain period of time or implementing mechanisms to detect and block replayed requests. -* __Short Lived User-land Application__: Little if any noticable effect. Modern operating system recollects lost memory after program termination. -* __Long Lived User-land Application__: Potentially dangerous. These applications continue to waste memory over time, eventually consuming all RAM resources. Leads to abnormal system behavior. -* __Kernel-land Process__: Very dangerous. Memory leaks in the kernel level lead to serious system stability issues. Kernel memory is very limited compared to user land memory and should be handled cautiously. +## Integer overflow -### Pointer/object dereference +Integer overflow **is a type of computer programming error that can occur when an arithmetic operation attempts to create a numeric value that is outside the range that can be represented with a given number of bits**. This can lead to unexpected behavior, such as incorrect calculations or program crashes, and can also be exploited by attackers to execute malicious code or gain unauthorized access to a system. Integer overflow can occur in many types of programming languages, including C, C++, Java, and Python, and can be a difficult type of vulnerability to detect and mitigate. -The program can potentially dereference a null pointer, thereby raising a NullPointerException. Null pointer errors are usually the result of one or more programmer assumptions being violated. Most null pointer issues result in general software reliability problems, but if an attacker can intentionally trigger a null pointer dereference, the attacker might be able to use the resulting exception to bypass security logic or to cause the application to reveal debugging information that will be valuable in planning subsequent attacks. +## Request forgeries -A null-pointer dereference takes place when a pointer with a value of NULL is used as though it pointed to a valid memory area. +### Server-side request forgery (SSRF) -Null-pointer dereferences, while common, can generally be found and corrected in a simple way. They will always result in the crash of the process, unless exception handling (on some platforms) is invoked, and even then, little can be done to salvage the process. +Server-side request forgery (SSRF) **is a type of security vulnerability in which an attacker can manipulate the server into making an unintended request on behalf of the server or exploiting the trust of the server**. The attacker can send requests to other systems or services that are available to the server, such as internal resources or third-party systems, using the server's credentials and privileges. This can result in sensitive information disclosure, unauthorized access to resources, or a complete compromise of the system. SSRF attacks are often carried out through manipulated URLs, headers, or other input parameters that are sent to the server. -## Integer Overflow +### Cross-Site Request Forgery (CSRF) -An integer overflow is a type of an arithmetic overflow error when the result of an integer operation does not fit within the allocated memory space. Instead of an error in the program, it usually causes the result to be unexpected. Integer overflows have been listed as the number 8 most dangerous software error in the most recent CWE 2019 list, mostly because they often lead to buffer overflows, which are currently the number 1 most dangerous software error according to that list. +Cross-Site Request Forgery (CSRF) **is an attack technique that tricks a web application into performing an action that the user didn't intend or authorize**. The attacker sends a malicious request to the website, usually via a link or a form, that contains a hidden exploit code, which performs a specific action on the user's behalf without their knowledge or consent. The attack takes advantage of the fact that many web applications use session cookies to authenticate users and don't properly validate requests. -## Directory traversal +## Application programming interface (API) attacks -Directory traversal or Path Traversal is an HTTP attack which allows attackers to access restricted directories and execute commands outside of the web server’s root directory. +API attacks **refer to various types of attacks on the APIs used by web applications**. APIs are interfaces used by web applications to interact with external services, such as databases, other applications, and third-party services. API attacks aim to exploit vulnerabilities in these interfaces to gain unauthorized access to sensitive information or take control of the application. -Web servers provide two main levels of security mechanisms: +There are several types of API attacks, including: -* Access Control Lists (ACLs) -* Root directory +1. **Injection attacks**: these involve injecting malicious code or data into the API requests to exploit vulnerabilities in the application. +2. **Parameter manipulation**: this involves manipulating the API parameters to bypass security controls and gain unauthorized access to resources. +3. **Authentication attacks**: these involve exploiting vulnerabilities in the authentication process used by the API to gain unauthorized access to the application. +4. **Denial-of-service attacks**: these involve overwhelming the API with a high volume of requests to disrupt its availability or performance. +5. **Man-in-the-middle attacks**: these involve intercepting and manipulating API requests and responses to gain unauthorized access to sensitive data. +6. **API key attacks**: these involve stealing or guessing API keys to gain unauthorized access to the application. -The root directory is a specific directory on the server file system in which the users are confined. Users should not able to access anything above this root but, if not properly configured or vulnerable, attackers can explore the rest of the disc. +It is important for developers to implement proper security controls and testing procedures to prevent API attacks and protect sensitive data. -## Improper Error Handling +## Resource exhaustion -Improper handling of errors can introduce a variety of security problems for a web site. The most common problem is when detailed internal error messages such as stack traces, database dumps, and error codes are displayed to the user (attacker). These messages reveal implementation details that should never be revealed. Such details can provide attackers important clues on potential flaws in the site and such messages are also disturbing to normal users. - -## Improper input handling +Resource exhaustion **is a type of cyber attack in which an attacker attempts to overwhelm or deplete the resources of a targeted system or application**. The goal of this attack is to consume all available resources such as CPU, memory, disk space, or network bandwidth, so that the system becomes unresponsive or unusable. This type of attack is also known as a Denial of Service (DoS) attack, which can impact the availability of a service or application to legitimate users. Resource exhaustion attacks can be launched using various methods, such as sending a large volume of requests, exploiting vulnerabilities, or generating high traffic to a targeted system or network. -Improper input handling is the term used to describe functions such as validation, sanitization, filtering, or encoding and/or decoding of input data. Improper Input handling is a leading cause of critical vulnerabilities that exist in today's systems and applications. No input should never be trusted. +## Memory leak -## API attacks +A memory leak **is a type of software bug that occurs when a computer program fails to deallocate memory it has previously reserved, leading to a gradual loss of available memory**. This can cause the program to slow down or crash, and can ultimately affect the performance of the entire system. Memory leaks are a common problem in software development, particularly in languages like C and C++, which require manual memory management. In such languages, it is the programmer's responsibility to allocate and deallocate memory appropriately, which can be a complex task. If memory is not deallocated correctly, the program can run out of available memory, causing it to become unstable or crash. -An API attack is hostile usage, or attempted hostile usage, of an API. Some of the many ways that attackers can abuse an API endpoint: +## Secure Sockets Layer (SSL) stripping -### Resource exhaustion +SSL stripping **is a type of cyber attack where an attacker intercepts a secure connection between a client and a server and downgrades it to an insecure HTTP connection**. The attacker can then monitor and manipulate the data being sent between the client and server. This type of attack is particularly effective when a user is trying to connect to a secure website, such as a banking or e-commerce site, and is unaware that their connection has been compromised. SSL stripping can be prevented by using HTTPS connections, which encrypt all data sent between the client and server, and by ensuring that the user is always on an encrypted connection. -Resource exhaustion attacks are computer security exploits that crash, hang, or otherwise interfere with the targeted program or system. +## Driver manipulation -#### DoS/DDoS Attacks +Driver manipulation **is a technique used by attackers to compromise a system's security by manipulating a device driver, which is a software component that controls a particular hardware device**. An attacker can modify the driver's behavior by injecting malicious code or modifying the driver's code, allowing them to take control of the device or gain elevated privileges on the system. This technique can be used to bypass security measures or gain access to sensitive information on a system. Attackers can also use driver manipulation to hide their presence on a system, making it more difficult to detect and remove them. -In a Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack, the attacker attempts to make the targeted system unavailable to its intended users. They have a wide variation of possible scale. At one extreme, "slow" DoS attacks can exhaust the victim’s resources with very little bandwidth. At the opposite extreme, volumetric DDoS assaults can consist of several terabits per second of incoming traffic. When these occur against prominent websites, they can gain a lot of publicity. However, DoS and DDoS attacks are growing in frequency against API endpoints as well. +Shimming and refactoring are two techniques that can be used to modify a driver's behavior. -#### DHCP starvation +### Shimming -A DHCP starvation attack is a malicious digital attack that targets DHCP servers. During a DHCP attack, a hostile actor floods a DHCP server with bogus DISCOVER packets until the DHCP server exhausts its supply of IP addresses. Once that happens, the attacker can deny legitimate network users service, or even supply an alternate DHCP connection that leads to a Man-in-the-Middle (MitM) attack. +Shimming **is a technique that involves adding an additional layer of code between the operating system and the driver**. This additional layer can be used to intercept calls to the driver and modify their behavior. Shimming can be used to fix bugs in a driver or to add new functionality. -#### Zip bomb +### Refactoring -It is a relatively small file that when extracted consumes a huge amount of memory. +Refactoring, on the other hand, **involves modifying the source code of the driver itself**. This can be a more invasive technique than shimming, as it requires a deeper understanding of the driver's code. Refactoring can be used to optimize the performance of a driver or to add new features. -### Data Exposure +Both shimming and refactoring can be used for legitimate purposes, such as fixing bugs or adding new functionality. However, they can also be used for malicious purposes, such as bypassing security checks or stealing data. Therefore, it is important to ensure that drivers are only modified by authorized parties and that modifications are thoroughly tested before being deployed. -Web applications frequently process and transfer sensitive data: credit card information, passwords, session tokens, private health information, and more. If an application does not handle the data correctly—for example, by not encrypting in transit, or at rest—then it could be compromised. +## Pass the hash -This is especially a concern for RESTful APIs that use HTTP as the underlying protocol. HTTP includes a number of operations that are potentially vulnerable. An attacker can craft malicious requests, control message mapping, and even manipulate the responses generated by the backend system. +Pass the hash (PtH) **is a type of cyber attack that involves stealing hashed credentials from a computer or server and then using these hashes to authenticate as the user or administrator, without the need for their actual password**. -### Parameter Tampering +The attacker first gains access to the target system and extracts the hashed password from the system's memory or from a file on disk. Then, the attacker can use this hash to authenticate as the user or administrator to other systems or services that trust the same hash, essentially bypassing the need for the actual password. This technique is especially effective against systems that use the NTLM authentication protocol. -An attacker attempts to manipulate the parameters exchanged between client and server. The goal is to modify application data, such as user credentials and permissions, price and quantity of products, etc. +PtH attacks are difficult to detect, as they do not involve stealing the actual password and may not trigger authentication failure notifications. The best defense against PtH attacks is to implement strong password policies, limit the number of systems that trust the same hash, and use multi-factor authentication whenever possible. \ No newline at end of file diff --git a/1.0-threats-attacks-and-vulnerabilities/1.4-given-a-scenario-analyze-potential-indicators-associated-with-network-attacks.md b/1.0-threats-attacks-and-vulnerabilities/1.4-given-a-scenario-analyze-potential-indicators-associated-with-network-attacks.md index 4dfb99a..969c032 100644 --- a/1.0-threats-attacks-and-vulnerabilities/1.4-given-a-scenario-analyze-potential-indicators-associated-with-network-attacks.md +++ b/1.0-threats-attacks-and-vulnerabilities/1.4-given-a-scenario-analyze-potential-indicators-associated-with-network-attacks.md @@ -1 +1,105 @@ -# __1.4 Given a scenario, analyze potential indicators associated with network attacks__ +# 1.4 Given a scenario, analyze potential indicators associated with network attacks. + +## Wireless + +Wireless attacks **refer to various methods of exploiting vulnerabilities in wireless networks, including Wi-Fi networks, Bluetooth, and cellular networks, to gain unauthorized access or disrupt network operations**. Wireless attacks can be carried out by attackers in close proximity to the target network or from a remote location using specialized tools and techniques. + +### Evil twin + +The evil twin wireless attack **is a type of wireless attack where an attacker sets up a fake wireless access point (AP) that appears to be a legitimate one**. The fake AP has the same name and appears to be broadcasting from the same location as the legitimate one, tricking users into connecting to it instead. Once a user connects to the fake AP, the attacker can intercept and capture the user's network traffic, steal sensitive information, or launch other attacks such as malware injection or phishing. This attack can be carried out by creating a rogue wireless network with a similar name and tricking users into connecting to it or by setting up a wireless AP that broadcasts the same SSID as a legitimate one. It is an example of a man-in-the-middle attack. + +### Rogue access point + +A rogue access point attack **is a wireless attack where an attacker sets up a wireless access point (AP) that appears to be legitimate but is actually controlled by the attacker**. The rogue access point is typically set up in a public area, such as a coffee shop or hotel lobby, where unsuspecting users connect to the internet through the rogue AP. Once a user connects to the rogue AP, the attacker can intercept and manipulate their network traffic, steal sensitive information such as login credentials, or spread malware to the user's device. This type of attack can be especially effective in environments where users are accustomed to connecting to public Wi-Fi networks without taking proper security precautions. + +### Bluesnarfing + +Bluesnarfing **is a type of wireless attack that involves gaining unauthorized access to a Bluetooth-enabled device, such as a smartphone or laptop, to steal information or access sensitive data**. This attack can occur when the device's Bluetooth connection is left on and set to "*discoverable*" mode, allowing an attacker to connect to the device without the user's knowledge. Once connected, the attacker can access the device's data and even take control of the device, potentially allowing them to install malware or spyware. Bluesnarfing can be prevented by disabling Bluetooth when it is not in use and setting it to "*non-discoverable*" mode. + +### Bluejacking + +Bluejacking **is a type of wireless attack that involves sending unsolicited messages or data over Bluetooth to a Bluetooth-enabled device such as a smartphone, laptop, or tablet**. The attacker can use the device's Bluetooth connection to send unwanted messages, typically for spamming or harassment purposes. The messages are usually harmless and can be easily ignored, but in some cases, the attacker can use Bluejacking as a means to deliver malware or phishing attempts. Bluejacking does not involve hacking into the device or accessing any sensitive information; it is simply a nuisance for the victim. + +### Disassociation + +A disassociation attack **is a type of wireless attack in which an attacker sends forged disassociation packets to a wireless access point or a client device on a wireless network**. The disassociation packet causes the access point or client to disconnect from the wireless network, which can result in a denial-of-service (DoS) attack or allow the attacker to capture sensitive information. + +The disassociation attack exploits a weakness in the IEEE 802.11 wireless protocol, which defines how wireless devices communicate with each other. Specifically, the attack abuses the fact that an attacker can send a forged disassociation packet to a wireless device without being authenticated to the wireless network. + +By disconnecting a device from the network, an attacker can prevent legitimate users from accessing network resources or cause disruptions in network traffic. In some cases, a disassociation attack can also be used to capture sensitive information by tricking a client device to connect to a rogue access point set up by the attacker. + +### Jamming + +Jamming **is a type of wireless attack that involves the deliberate interference with wireless signals in order to disrupt communications**. This can be done using a variety of techniques, such as flooding the airwaves with noise, sending signals on the same frequency as the intended communication, or transmitting a high-powered signal that overwhelms the receiver. Jamming can be used to disrupt wireless networks, prevent users from accessing network resources, and even cause physical damage to wireless devices in some cases. It is considered a form of denial-of-service (DoS) attack, as it aims to deny legitimate users access to a wireless network or resource. Jamming is illegal in most jurisdictions and is often used by attackers to carry out malicious activities such as theft, espionage, or terrorism. + +### Radio frequency identification (RFID) + +Radio frequency identification (RFID) **is a wireless technology that uses radio waves to automatically identify and track objects**. It involves small electronic devices, called RFID tags, that contain a unique identifier and are attached to or embedded within items. These tags communicate with RFID readers or antennas to transmit and receive information. RFID technology has many applications in various industries, including inventory management, supply chain management, and asset tracking. However, it also poses security risks, as RFID tags can be used for tracking and surveillance purposes, and the communication between the tags and readers can be intercepted and manipulated by attackers. + +### Near-field communication (NFC) + +Near-field communication (NFC) **is a wireless communication technology that allows two electronic devices, typically a mobile device and a NFC-enabled tag or reader, to establish communication when they are brought in close proximity**, usually within a few centimeters of each other. It is a short-range communication technology that operates at a frequency of 13.56 MHz and uses electromagnetic induction to transmit information between devices. NFC is commonly used for contactless payment, access control, and data transfer between devices. It is often considered to be more secure than other wireless communication technologies such as Bluetooth because of its short range and the need for physical proximity. + +### Initialization vector (IV) + +An initialization vector (IV) **is a fixed-size input used in conjunction with a cryptographic algorithm to enhance the security of encrypted messages**. The IV is typically a random or pseudo-random value that is used to initialize the state of the encryption algorithm before encryption begins. The IV is used to introduce additional randomness into the encryption process, making it more difficult for an attacker to decrypt the encrypted message by brute force or other methods. The IV must be kept secret and shared between the sender and receiver of the encrypted message. However, weaknesses in the generation or management of IVs can lead to vulnerabilities in the security of wireless networks. For example, in the case of WEP, weak IVs were one of the factors that made the protocol vulnerable to attack. + +## On-path attack + +On-path attack, also known as man-in-the-middle attack (MITM)/man-in-the-browser attack (MITB), **is a type of cyber attack where an attacker intercepts and alters the communication between two parties without either party's knowledge**. The attacker is able to monitor the communication and can even modify it for their own purposes, such as stealing sensitive information like login credentials or credit card numbers. On-path attacks are often conducted through the use of various techniques, such as session hijacking, ARP spoofing, DNS spoofing, and SSL stripping. + +## Layer 2 attacks + +Layer 2 attacks, also known as data link layer attacks, **are a type of network attack that targets the data link layer of the OSI model**, which is responsible for the transmission of data packets between two adjacent network nodes over a physical connection. These attacks involve manipulating or exploiting weaknesses in the data link layer protocols to intercept, modify, or block data packets, redirect traffic to unauthorized destinations, or conduct other malicious activities. + +### Address Resolution Protocol (ARP) poisoning + +Address Resolution Protocol (ARP) poisoning, also known as ARP spoofing, **is a type of attack in which an attacker sends falsified ARP messages over a local area network (LAN) to link the attacker's MAC address with the IP address of another network device on the LAN**. This can allow the attacker to intercept, modify, or even stop network traffic between the two devices. ARP poisoning can be used to launch other types of attacks, such as man-in-the-middle attacks, denial-of-service attacks, or session hijacking attacks. ARP poisoning can be prevented by using secure ARP protocols or by implementing measures such as static ARP tables, ARP spoofing detection software, or cryptographic network protocols. + +### Media access control (MAC) flooding + +Media Access Control (MAC) flooding **is a network attack in which an attacker sends a large number of frames with different MAC addresses to a switch**. The purpose of this attack is to overload the switch's content-addressable memory (CAM) table, which is used to map MAC addresses to switch ports. Once the CAM table is full, the switch will start to broadcast frames to all ports, rather than forwarding them only to the intended destination port. This can lead to a denial-of-service (DoS) condition, as well as allow the attacker to intercept or manipulate network traffic. + +### MAC cloning + +MAC cloning **is the process of copying the Media Access Control (MAC) address of one device and assigning it to another device**. It is often used to bypass network security measures that filter traffic based on the MAC address of a device. By cloning the MAC address of an authorized device, an attacker can gain access to a network or system that would otherwise be blocked. + +## Domain name system (DNS) + +Domain Name System (DNS) **is a hierarchical decentralized naming system that translates human-readable domain names into numerical IP addresses that machines can use to identify and communicate with each other on the internet**. It functions like a phone book for the internet, enabling users to access websites and other online services by typing in a domain name (such as [www.example.com](http://www.example.com/)) instead of the numerical IP address (such as 93.184.216.34) associated with that website. The DNS system is critical to the functioning of the internet, and it relies on a distributed network of servers to handle the translation of domain names to IP addresses. + +### Domain hijacking + +Domain hijacking, also known as domain theft, **is the unauthorized takeover of a domain name without the consent of the domain owner**. It is a type of cyber attack in which an attacker gains access to the domain name account of the legitimate owner and takes control of the domain name by changing its registration information. The attacker can then redirect traffic meant for the legitimate domain to a fake website, steal sensitive information, or use the domain for malicious purposes. This can have severe consequences for the legitimate owner, including loss of business, reputation damage, and financial losses. + +### DNS poisoning + +DNS poisoning, also known as cache poisoning, **is a type of cyber attack where a hacker corrupts the Domain Name System (DNS) server's cache by altering the IP address mapping for a domain name**. This allows the attacker to redirect users to a malicious website without their knowledge or consent. + +For example, a hacker could modify the DNS server's cache for a legitimate banking website, directing users who attempt to visit the site to a fake site that looks similar to the real one. The fake site could then steal the user's login credentials and other sensitive information. + +DNS poisoning can occur in a variety of ways, including exploiting vulnerabilities in the DNS server software, intercepting DNS requests, or redirecting traffic through a compromised router or switch. The attack can be especially effective if the attacker can poison the DNS cache of a popular website or a widely used DNS server. + +### Uniform Resource Locator (URL) redirection + +URL redirection **is a technique used in web development to make a web page available under more than one URL address**. This technique can also be used maliciously as a type of attack known as URL redirection or URL forwarding. In this attack, an attacker crafts a malicious URL that redirects the user to a fake website or a website that the attacker controls. The user is often lured to click on the URL through phishing emails, social engineering, or other means. Once the user clicks on the URL, they are redirected to the attacker's website, where their personal information may be harvested, or they may be tricked into downloading malware. + +### Domain reputation + +Domain reputation **refers to the assessment of a domain's trustworthiness or legitimacy based on various factors** such as domain age, history of malicious activity associated with the domain, and the reputation of the IP addresses associated with the domain. A domain with a poor reputation may be associated with spamming, phishing, malware, or other forms of malicious activity, and can result in blocking by spam filters or blacklists. Domain reputation is an important consideration in evaluating the safety and trustworthiness of websites and online services. + +## Distributed denial-of-service (DDoS) + +A Distributed Denial-of-Service (DDoS) attack **is a type of cyber attack that attempts to disrupt the normal functioning of a targeted server, website, or network by overwhelming it with a flood of traffic from multiple sources**. This is accomplished by using a network of infected computers or "*botnet*" to flood the target with a high volume of traffic, rendering it unable to handle legitimate requests from users. DDoS attacks can be launched for various reasons, including extortion, revenge, or as a form of activism, and can cause significant damage to the targeted organization by disrupting business operations, causing financial losses, and damaging its reputation. + +The three main types of DDoS attacks are: + +1. **Network-layer DDoS attacks**: In this type of DDoS attack, the attacker targets the network infrastructure of the victim, flooding the network with a high volume of traffic that causes the network to slow down or become unavailable. These attacks can be conducted using a variety of techniques, including UDP flooding, ICMP flooding, SYN flooding, and DNS amplification. +2. **Application-layer DDoS attacks**: In this type of DDoS attack, the attacker targets the web applications or servers of the victim, exploiting vulnerabilities in the application layer to cause a denial-of-service. These attacks are more difficult to detect and mitigate, as they mimic legitimate traffic and require deep packet inspection to detect. +3. **Operational technology (OT) DDoS attacks**: This type of DDoS attack targets the control systems and devices used in operational technology (OT) environments such as industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems. The attack can lead to a disruption of the normal operation of critical infrastructure or other processes that rely on OT devices. + +### Malicious code or script execution + +Malicious code or script execution **is a type of cyber attack where an attacker injects harmful code into a computer system to gain unauthorized access or to cause damage to the system**. Malicious code can take many forms, including viruses, worms, Trojans, spyware, adware, ransomware, and more. Once the code is executed, it can perform a variety of harmful actions, such as stealing sensitive information, damaging files, or controlling the computer remotely. Malicious code can be spread through various means, including email attachments, software downloads, and infected websites. The consequences of a successful malicious code attack can be severe, including financial loss, reputational damage, and legal liability. + +Security professionals should be familiar with scripting and compiled languages, and how they can be used to execute malicious code. In addition, they should also be familiar with techniques used to prevent or mitigate the execution of malicious code. This includes techniques such as code signing, whitelisting, and sandboxing, as well as good coding practices such as input validation and error checking. diff --git a/1.0-threats-attacks-and-vulnerabilities/1.5-explain-different-threat-actors-vectors-and-intelligence-sources.md b/1.0-threats-attacks-and-vulnerabilities/1.5-explain-different-threat-actors-vectors-and-intelligence-sources.md new file mode 100644 index 0000000..cffd4f5 --- /dev/null +++ b/1.0-threats-attacks-and-vulnerabilities/1.5-explain-different-threat-actors-vectors-and-intelligence-sources.md @@ -0,0 +1,136 @@ +# 1.5 Explain different threat actors, vectors, and intelligence sources. + +## Actors and threats + +Actors refer to individuals or entities that pose a threat to an organization's assets or systems. While, threats refer to actions or events that have the potential to cause harm to an organization's assets or systems. + +### Advanced persistent threat (APT) + +An Advanced Persistent Threat (APT) **is a stealthy, targeted attack by an adversary, typically a nation-state or other well-resourced attacker, who gains unauthorized access to a network or system and remains undetected for an extended period**. APT attacks involve a series of carefully planned and orchestrated steps that allow attackers to gain access to a target network or system, move laterally through the network, escalate privileges, and maintain persistence. APT attacks often involve sophisticated techniques, such as social engineering, zero-day exploits, and custom malware, and are designed to compromise high-value targets, such as government agencies, military organizations, critical infrastructure, and large corporations. APT attacks are typically motivated by espionage, theft of intellectual property, or sabotage, and can cause significant damage to an organization's reputation, finances, and operations. + +### Insider threats + +Insider threats **refer to the risks and vulnerabilities that arise from individuals who have authorized access to an organization's assets or information**, such as employees, contractors, or business partners. Insider threats may occur when these individuals misuse their access privileges or intentionally or unintentionally cause harm to the organization's information security. Examples of insider threats include stealing or selling confidential information, installing malware, sabotaging systems or data, or simply making errors that cause security breaches. Insiders can be both malicious and unintentional, making them a complex and difficult challenge for organizations to manage and mitigate. + +### State actors + +State actors **are individuals, groups, or organizations that operate on behalf of a nation-state or government**. They may carry out attacks or espionage to achieve political, economic, or military objectives on behalf of their government. State actors often have extensive resources, technical expertise, and support from their government, making them a significant threat to national security and critical infrastructure. Examples of state actors include intelligence agencies, military organizations, and diplomatic corps. + +### Hacktivists + +Hacktivists **refer to a type of threat actor who uses their hacking skills and tools to achieve political or social goals**. They are typically motivated by their ideology or belief system and use cyberattacks to promote their agenda or to bring attention to a particular cause or issue. Hacktivists may target government organizations, corporations, or other entities that they believe are engaging in unethical or illegal practices. They may also engage in cyber protests or defacements of websites to promote their message. Examples of hacktivist groups include Anonymous and LulzSec. + +### Script kiddies + +Script kiddies **are individuals who use automated tools and pre-written scripts to carry out cyber attacks, rather than creating their own tools or techniques**. They often have limited technical knowledge and rely on readily available hacking tools and exploits to launch attacks. Script kiddies may be motivated by a desire for notoriety or attention, or they may engage in hacking activities for personal gain or to advance political or social causes. While they may not pose as significant a threat as more sophisticated attackers, script kiddies can still cause damage and disruption, particularly to vulnerable or poorly secured systems. + +### Criminal syndicates + +Criminal syndicates **refer to organized groups of criminals or crime organizations that operate to engage in illegal activities** such as drug trafficking, human trafficking, money laundering, fraud, and cybercrime. These groups may be comprised of individuals from different backgrounds and may have a hierarchical structure with specific roles and responsibilities. Criminal syndicates often use violence and intimidation tactics to maintain control and expand their criminal activities. In the context of cybercrime, criminal syndicates may engage in activities such as ransomware attacks, phishing scams, and stealing personal and financial information for financial gain. + +### Hackers + +Hackers **are individuals or groups with advanced computer skills and knowledge of how to exploit vulnerabilities in computer systems and networks for various purposes**, including gaining unauthorized access to sensitive information or disrupting systems. + +As a simple classification can be: + +**- Black hat/Unauthorized hackers**, also known as "*crackers*," use their skills for malicious purposes, such as stealing sensitive data, distributing malware, or causing damage to systems or networks. +**- White hat/Authorized hackers**, also known as "*ethical hackers*," use their skills for legitimate purposes, such as identifying and reporting vulnerabilities to improve security. +**- Grey hat/Semi-authorized hackers** are somewhere in between black and white hats, using their skills for both ethical and unethical purposes, often without malicious intent but without proper authorization. + +It's important to note that these categories are not necessarily fixed, and an individual may move between them based on their actions and motivations. + +### Shadow IT + +Shadow IT **refers to the use of information technology (IT) systems, software, devices, or services within an organization that are not approved or managed by the IT department**. This can include the use of personal devices, applications, or cloud services to store or access company data without proper authorization or security measures. Shadow IT can pose significant security risks, as it often involves the use of unsupported or unsecured technologies that can be vulnerable to cyber attacks or data breaches. + +### Competitors + +Competitors **refer to other businesses or organizations that are competing with a particular company in the marketplace**. Competitors can potentially pose a threat to a company's cybersecurity through various means, such as attempting to steal intellectual property, customer data, or sensitive business information. In some cases, competitors may engage in corporate espionage or other illegal activities to gain an advantage in the marketplace. Therefore, it is important for companies to have appropriate security measures in place to protect their assets from competitors and other potential threats. + +## Attributes of actors + +Attributes of actors **refer to the characteristics or traits that describe threat actors who carry out cyberattacks**. Some common attributes of actors include their level of access, sophistication, resources, motivation, and objectives. Here is a brief overview of each attribute: + +- **Access**: This refers to the leve of authorized access to an organization's systems. Actors can be internal or external, this distinction is important in determining the potential damage that they can cause, as well as the potential motives for their actions. In addition, where they are geographically located can be relevant in determining the jurisdiction and legal framework that applies to their actions, as well as the potential motives and resources available to them. +- **Sophistication**: This refers to the technical skills and knowledge of an actor when it comes to carrying out cyberattacks. Highly sophisticated actors have advanced technical expertise and are capable of developing custom malware and other tools to evade detection. +- **Resources/funding**: This refers to the funding, infrastructure, and tools that an actor has at their disposal to carry out cyberattacks. Actors with greater resources can launch more complex and sustained attacks. +- **Intent/motivation**: This refers to the reason why an actor is carrying out cyberattacks. Motivations can range from financial gain to political or ideological reasons, and can influence the types of targets and methods used. +- **Objectives**: This refers to the specific goals that an actor is trying to achieve through their cyberattacks. Objectives can include stealing sensitive data, disrupting business operations, or gaining access to critical infrastructure. + +## Vectors + +Attack vectors **refer to the various ways in which an attacker can gain unauthorized access to a system or network**. These can include both technical and non-technical methods of attack, such as: + +1. **Malware**: Attackers can use malware to gain access to a system or network, steal data, or disrupt operations. Malware can be delivered through email attachments, infected software, or through malicious websites. +2. **Social Engineering**: Social engineering involves manipulating individuals into divulging sensitive information or performing actions that enable the attacker to gain access to a system or network. This can include techniques such as phishing, pretexting, or baiting. +3. **Password attacks**: Password attacks involve attempting to guess or steal a user's login credentials. Attackers can use various methods, including brute force attacks, dictionary attacks, or keylogging. +4. **Network attacks**: Network attacks involve exploiting vulnerabilities in network protocols or hardware to gain unauthorized access to a system or network. These can include methods such as packet sniffing, port scanning, or denial of service attacks. +5. **Physical attacks**: Physical attacks involve physically accessing a system or network, either through theft or by gaining unauthorized access to a physical location. +6. **Supply Chain Attacks**: Supply chain attacks involve attacking third-party vendors or suppliers that provide products or services to the targeted organization. This can include methods such as software supply chain attacks, hardware supply chain attacks, or service provider attacks. +7. **Wireless Attacks**: Wireless attacks involve exploiting vulnerabilities in wireless networks to gain unauthorized access to a system or network. These can include methods such as rogue access points, evil twin attacks, and wireless sniffing. +8. **Insider Attacks**: Insider attacks involve individuals who have authorized access to a system or network, but use that access for malicious purposes. This can include actions such as stealing data, introducing malware, or disrupting operations. + +## Threat intelligence sources + +Threat intelligence sources **refer to the information that can be gathered from various sources to identify and understand potential threats to an organization's security posture**. These sources may include open-source intelligence, commercial threat intelligence services, government intelligence agencies, and other relevant sources. + +Threat intelligence sources may also include internal sources such as security logs, incident reports, and vulnerability assessments conducted within the organization. Additionally, threat intelligence may be gathered through partnerships and collaborations with other organizations in the same industry or with similar security concerns. + +### Open-source intelligence (OSINT) + +Open-source intelligence (OSINT) **refers to information that is publicly available and can be collected from open sources, such as social media platforms, news articles, blogs, and other public websites**. OSINT can be used by organizations or individuals to gain insights into potential threats, risks, or vulnerabilities. It can also be used to gather intelligence about a particular target or subject. OSINT is typically collected through automated tools and manual research, and it can be used in combination with other sources of intelligence to form a comprehensive understanding of a situation. + +### Closed/proprietary intelligence + +Closed or proprietary intelligence **refers to information that is not publicly available and is typically owned and controlled by a specific organization**. This type of intelligence is often gathered through internal monitoring and analysis of an organization's own networks, systems, and applications, as well as by using various security technologies and tools. Closed/proprietary intelligence can also be obtained through partnerships with other organizations, sharing of threat intelligence among industry peers, and by purchasing commercial intelligence services. The main goal of closed/proprietary intelligence is to provide organizations with specific and relevant information about threats and vulnerabilities that could potentially impact their operations and assets. + +### Vulnerability databases + +Vulnerability databases are repositories that contain information about known vulnerabilities in software, operating systems, and other technology systems. These databases provide detailed information about the nature of the vulnerabilities, including the potential impact on the affected systems, the severity of the vulnerability, and the affected versions or products. They may also provide guidance on how to mitigate or remediate the vulnerabilities, such as recommended patches or workarounds. Examples of popular vulnerability databases include the National Vulnerability Database (NVD), Common Vulnerabilities and Exposures (CVE), and the Open Web Application Security Project (OWASP) Top 10. + +### Public/private information-sharing centers + +Public/private information-sharing centers **are organizations that facilitate the sharing of cybersecurity information among different entities such as private companies, government agencies, and non-profit organizations**. These centers act as a central point where information related to cyber threats, vulnerabilities, and incidents can be collected, analyzed, and shared with relevant parties. They serve as a means for improving situational awareness, enabling better incident response, and enhancing overall cybersecurity posture. Examples of public information-sharing centers include the Department of Homeland Security's (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the National Cyber-Forensics and Training Alliance (NCFTA), while examples of private information-sharing centers include the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Retail Cyber Intelligence Sharing Center (R-CISC). + +### Dark Web + +The dark web **refers to a part of the internet that is not indexed or searchable through conventional search engines**. It is also known as the "darknet" and requires special software, configurations, or authorization to access. The dark web is often associated with illegal activities, such as the sale of drugs, weapons, stolen data, and other illicit goods and services. It is also a popular platform for cybercriminals to communicate, exchange information and tools, and conduct various cyber attacks, including DDoS attacks, phishing, and malware distribution. + +### Indicators of compromise + +Indicators of Compromise (IoCs) **are pieces of forensic evidence that indicate a potential intrusion into a network or system**. They can be used to detect or investigate security incidents and can include various artifacts such as network traffic, system logs, file system activity, and suspicious behavior patterns. IoCs are typically collected and analyzed by security teams to identify patterns and indicators of malicious activity, and are often shared among organizations to improve collective defense against cyber threats. Common examples of IoCs include IP addresses, domain names, hashes of malicious files, and patterns of command and control traffic. + +### Automated Indicator Sharing (AIS) + +Automated Indicator Sharing (AIS) **is a system that enables the automated exchange of threat intelligence between different organizations**. It allows for the sharing of information on Indicators of Compromise (IOCs) and other relevant threat intelligence, such as the Tactics, Techniques, and Procedures (TTPs) used by threat actors. + +Structured Threat Information eXpression (**STIX**) and Trusted Automated eXchange of Intelligence Information (**TAXII**) are two standards used in the implementation of AIS. STIX provides a standardized language for describing cyber threat information, while TAXII provides a framework for the exchange of that information between different organizations. Together, STIX and TAXII allow for the automated sharing of threat intelligence in a structured and consistent format. + +### Predictive analysis + +Predictive analysis **is a technique used in cybersecurity to forecast potential future events and trends based on historical data, statistical algorithms, and machine learning models**. It involves analyzing large datasets to identify patterns and relationships, and then using this information to predict possible outcomes. In the context of cybersecurity, predictive analysis can help identify potential threats and vulnerabilities, and enable organizations to take proactive measures to prevent or mitigate the impact of these threats. This approach can be particularly useful in identifying emerging threats, such as new malware variants or attack methods, and in predicting potential attack targets. + +### Threat maps + +Threat maps **are visual representations that display cybersecurity threats and attacks on a map or other geographical display**. They allow users to see the location and frequency of cyber attacks in real-time or over a period of time. Threat maps can also show the severity of the attack, the type of attack, and the source of the attack. They are commonly used by security analysts and organizations to monitor and track potential threats and to identify patterns or trends in cyber attacks. Threat maps can also help organizations to understand the threat landscape and to develop strategies for mitigating cyber risks. + +### File/code repositories + +File/code repositories **are online platforms that allow developers to store and manage their source code and related files**. These repositories are often used for collaboration, allowing multiple developers to work on the same project simultaneously. They also provide version control features, allowing developers to track changes to their code over time and revert to previous versions if necessary. Some popular file/code repositories include GitHub, GitLab, and Bitbucket. These repositories can be a valuable source of information for threat intelligence, as they may contain indicators of compromise or other evidence of malicious activity. + +## Research sources + +Research sources **refer to various information sources that can be used to gather information and insights about a particular topic, issue, or subject**. In the context of cybersecurity, research sources can include academic papers, industry reports, technical documentation, security blogs, white papers, and other similar sources. These sources can provide valuable information about emerging threats, vulnerabilities, attack techniques, and other relevant cybersecurity issues. Research sources can be used by security professionals, researchers, and analysts to stay up-to-date with the latest trends and developments in the cybersecurity landscape and to inform their decision-making and strategy development. + +Some research resources are: + +1. **Vendor websites**: These are websites of technology vendors and manufacturers, which can provide information on their products and services, including security updates, patches, and advisories. +2. **Vulnerability feeds**: These are sources that provide information on newly discovered vulnerabilities and exploits, including Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD). +3. **Conferences**: Security conferences, such as Black Hat and DEF CON, bring together security professionals, researchers, and vendors to discuss the latest trends, threats, and solutions in the cybersecurity industry. +4. **Academic journals**: Peer-reviewed journals published by academic institutions and research organizations can provide in-depth analysis and research on various aspects of cybersecurity, including threat analysis, malware, and vulnerabilities. +5. **Request for Comments (RFC)**: RFCs are documents that define the protocols and standards used on the internet. They can provide insights into the design and implementation of various network protocols and technologies. +6. **Local industry groups**: These are industry associations and groups that bring together professionals in the cybersecurity field to discuss and share knowledge on various topics, including emerging threats and best practices. +7. **Social media**: Social media platforms, such as Twitter and LinkedIn, can be a valuable source of information on the latest security news and trends, as well as insights and analysis from industry experts and researchers. +8. **Threat feeds**: These are feeds that provide information on the latest threats and indicators of compromise (IOCs), including IP addresses, domain names, and hashes of malware. +9. **Adversary tactics, techniques, and procedures (TTP)**: Adversary TTPs are techniques used by threat actors to carry out cyber attacks. Studying these tactics can help security professionals identify and mitigate threats more effectively. diff --git a/1.0-threats-attacks-and-vulnerabilities/1.6-explain-the-security-concerns-associated-with-various-types-of-vulnerabilities.md b/1.0-threats-attacks-and-vulnerabilities/1.6-explain-the-security-concerns-associated-with-various-types-of-vulnerabilities.md new file mode 100644 index 0000000..d71904e --- /dev/null +++ b/1.0-threats-attacks-and-vulnerabilities/1.6-explain-the-security-concerns-associated-with-various-types-of-vulnerabilities.md @@ -0,0 +1,100 @@ +# 1.6 Explain the security concerns associated with various types of vulnerabilities + +## Cloud-based vs. on-premises vulnerabilities + +Cloud-based and on-premises vulnerabilities **refer to security risks associated with two different types of IT infrastructure deployment models. On-premises refers to the traditional model of hosting an organization's IT infrastructure within its own physical facilities, while cloud-based refers to the practice of outsourcing IT infrastructure to a third-party provider who delivers services over the internet**. + +Both cloud-based and on-premises environments have their own unique security concerns. + +Cloud-based vulnerabilities: + +1. Data breaches: Cloud-based environments store large amounts of data, making them attractive targets for cybercriminals seeking sensitive information. +2. Misconfiguration: Improperly configured cloud infrastructure can lead to exposure of sensitive data and systems. +3. Insider threats: Cloud providers employ many individuals who have access to customers' data, which can lead to insider threats. +4. Shared infrastructure vulnerabilities: Cloud providers often use shared resources to deliver services to multiple customers, creating the possibility of a security breach in one tenant's environment affecting others. + +On-premises vulnerabilities: +1. Physical access: On-premises infrastructure can be vulnerable to physical attacks if not properly secured. +2. Software vulnerabilities: The use of outdated or unpatched software can lead to vulnerabilities that can be exploited by attackers. +3. Social engineering attacks: Attackers can trick employees into divulging sensitive information or granting access to systems through social engineering tactics. +4. Insider threats: On-premises environments are vulnerable to insider threats, which can be difficult to detect and prevent. + +Both cloud-based and on-premises environments require robust security measures to protect against these vulnerabilities. It is important for organizations to carefully consider their specific security needs and the risks associated with each deployment model when selecting an IT infrastructure solution. + +## Zero-day + +Zero-day **refers to a vulnerability or weakness in a software system, application, or hardware that is unknown to the vendor or manufacturer and for which no patch or fix has been released yet**. As a result, zero-day vulnerabilities can be exploited by attackers to gain unauthorized access to a system, steal data, or carry out other malicious activities without being detected or prevented by traditional security measures. Zero-day vulnerabilities can pose significant risks to organizations and require prompt remediation measures to prevent attacks. + +## Weak configurations + +Weak configurations **refer to security vulnerabilities that arise due to improper or inadequate configuration of software, hardware, or network components**. The following are some examples of weak configurations: + +1. **Open permissions**: This vulnerability arises when users are granted excessive or unnecessary privileges or permissions, allowing them to access, modify or delete sensitive data. +2. **Unsecure root accounts**: This vulnerability arises when the root accounts, which have full administrative privileges, are not properly secured with strong passwords, two-factor authentication or other security measures. +3. **Errors**: Configuration errors such as typos, incorrect syntax, or improper settings can lead to security vulnerabilities. +4. **Weak encryption**: Weak encryption protocols, outdated algorithms, and improper key management can make data susceptible to unauthorized access or theft. +5. **Unsecure protocols**: Using unsecure protocols such as HTTP, FTP or Telnet can leave data vulnerable to interception or eavesdropping attacks. +6. **Default settings**: Default settings on software, hardware or network devices may not be secure and may need to be changed to protect against potential security risks. +7. **Open ports and services**: Unnecessary open ports and services can expose a system to attacks by providing attackers with entry points into the system. + +All of these weak configurations can be exploited by attackers to gain unauthorized access to sensitive data, install malware, or carry out other malicious activities. It is important to regularly assess and update configurations to prevent these vulnerabilities from being exploited. + +## Third-party risks + +Third-party risks **refer to the potential security threats that arise from the use of third-party products or services in an organization's IT environment**. These risks can come from various sources, such as vendors, suppliers, contractors, or other external parties. + +### Vendor management +Vendor management is an important aspect of third-party risk management. It **involves the selection and oversight of vendors and their products or services to ensure that they meet an organization's security requirements**. Failure to manage vendor relationships can lead to security breaches, service disruptions, or other types of cyber attacks. + +1. **System integration**: Integrating third-party systems with an organization's existing IT infrastructure can introduce vulnerabilities that attackers can exploit. +2. **Lack of vendor support**: If a vendor stops providing support or patches for their products, it can leave an organization vulnerable to attacks that exploit known vulnerabilities. + +### Supply chain + +Supply chain risks are also a concern when it comes to third-party security. This **includes risks associated with the use of third-party suppliers for hardware components or other critical components of an organization's IT infrastructure**. Attackers can target these suppliers to gain access to an organization's systems and data. + +### Outsourced code development + +Outsourced code development can also pose security risks. If an organization outsources software development, it is important to ensure that the development process is secure and that the resulting software is free from vulnerabilities that attackers can exploit. + +### Data storage + +Data storage is another area of concern when it comes to third-party risks. Organizations may store their data on third-party cloud services or other external storage solutions, which can introduce security vulnerabilities if not properly configured or managed. It is important to ensure that data stored with third-party providers is adequately secured and protected. + +## Improper or weak patch management + +Improper or weak patch management **refers to the inadequate or ineffective process of updating and maintaining software and systems to protect against known vulnerabilities**. This can lead to security risks, as attackers can exploit these vulnerabilities to gain unauthorized access or compromise systems. + +Firmware, operating systems (OS), and applications are all critical components of a computer system that require regular patching. + +1. **Firmware** is a type of software that is embedded in the hardware of devices, such as routers and printers. Vulnerabilities in firmware can allow attackers to bypass security controls, take control of devices, or intercept and manipulate data. Proper patch management is essential for mitigating these risks. +2. **Operating systems (OS)** are the core software that manages a computer's hardware and software resources. OS vulnerabilities can allow attackers to gain unauthorized access to systems, steal data, or launch attacks on other systems. The most common OS vulnerabilities are related to privilege escalation, remote code execution, and denial-of-service attacks. Regular patching of operating systems is critical to reducing the risk of exploitation. +3. **Applications** are software programs that perform specific functions, such as email, web browsing, and file sharing. Vulnerabilities in applications can allow attackers to execute malicious code, steal data, or take control of systems. Common vulnerabilities in applications include buffer overflows, SQL injection, and cross-site scripting (XSS). Patching applications is essential to preventing exploitation of these vulnerabilities. + +Proper patch management involves identifying vulnerabilities, prioritizing patching based on risk, testing patches before deployment, and deploying patches in a timely manner. Failure to properly manage patches can result in systems being left vulnerable to known attacks. + +## Legacy platforms + +Legacy platforms **refer to older hardware or software systems that are still in use, despite being outdated or no longer supported by the vendor**. The use of legacy platforms presents several security risks, including: + +**1. Unsupported software**: Legacy platforms are typically not supported by vendors, which means that they are no longer receiving security updates and patches. This leaves these systems vulnerable to known security flaws and exploits that can be easily leveraged by attackers. +**2. Outdated technology**: Legacy platforms may use outdated technology that does not meet modern security standards. For example, they may use outdated encryption protocols or lack modern security features that are now considered essential. +**3. Compatibility issues**: Legacy platforms may not be compatible with newer security technologies or products, making it difficult to integrate them into an organization's security architecture. +**4. Lack of documentation**: Older systems may lack proper documentation or have undocumented features, making it difficult to identify and mitigate security risks. +**5. Difficult to maintain**: Legacy platforms may be difficult to maintain and update, which can make it challenging to ensure that they are secure and up-to-date. + +Overall, legacy platforms pose a significant risk to organizations, as they are often targeted by attackers due to their known vulnerabilities and lack of support. It is important for organizations to carefully manage their legacy platforms and consider upgrading or replacing them with more modern and secure technology. + +## Impact + +Risk impact **refers to the degree of harm that a security incident could cause to an organization or system**. It is the consequence or outcome of a security risk occurring. The impact of a risk can vary depending on the type of incident, the nature of the organization, and the assets involved. The impact of a security risk is often evaluated in terms of the damage that could be done to the confidentiality, integrity, and availability of data or systems. Understanding the potential impact of security risks can help organizations prioritize their risk management efforts and develop effective strategies for preventing, detecting, and responding to security incidents. + +Some common impacts of security risks include: + +1. **Data loss**: The unintended or accidental loss of data can result in significant consequences for organizations, including loss of productivity, loss of reputation, and financial damages. +2. **Data breaches**: A data breach can result in the unauthorized access, theft, or disclosure of sensitive information, leading to legal and regulatory consequences, financial losses, and damage to an organization's reputation. +3. **Data exfiltration**: Data exfiltration occurs when sensitive data is intentionally stolen or leaked by threat actors, resulting in loss of intellectual property, financial damages, and legal and regulatory consequences. +4. **Identity theft**: Identity theft occurs when personal information, such as social security numbers or credit card numbers, are stolen and used for fraudulent purposes, resulting in financial damages and reputational harm for individuals and organizations. +5. **Financial**: Security risks can result in financial damages for organizations, including the cost of remediation, legal fees, and regulatory fines. +6. **Reputation**: Security incidents can damage an organization's reputation, leading to loss of business, negative publicity, and difficulty in attracting new customers. +7. **Availability loss**: Availability loss occurs when critical systems or services become unavailable due to security incidents, resulting in loss of productivity, financial damages, and damage to an organization's reputation. diff --git a/1.0-threats-attacks-and-vulnerabilities/1.7-Summarize-the-techniques-used-in-security-assessments.md b/1.0-threats-attacks-and-vulnerabilities/1.7-Summarize-the-techniques-used-in-security-assessments.md new file mode 100644 index 0000000..a5a7614 --- /dev/null +++ b/1.0-threats-attacks-and-vulnerabilities/1.7-Summarize-the-techniques-used-in-security-assessments.md @@ -0,0 +1,43 @@ +# 1.7 Summarize the techniques used in security assessments + +## Threat hunting + +Threat hunting **is a proactive approach to cybersecurity that involves searching for and identifying potential threats or malicious activities within an organization's networks, systems, and applications**. This involves analyzing data from various sources such as logs, network traffic, and system behavior to identify anomalies and potential indicators of compromise. The goal of threat hunting is to detect and stop threats before they can cause damage or steal sensitive information. It requires a combination of technical skills, knowledge of threat actors and attack methods, and the ability to think like an attacker to anticipate and identify potential attack vectors. + +1. **Intelligence fusion**: Intelligence fusion refers to the process of integrating and analyzing data from various sources, such as open-source intelligence, closed intelligence, and internal organizational data, to generate actionable intelligence. +2. **Threat feeds**: Threat feeds are a collection of information related to emerging or existing threats, such as IP addresses, domain names, malware signatures, and other indicators of compromise. Threat feeds are used to detect, prevent, and respond to cyber attacks. +3. **Advisories and bulletins**: Advisories and bulletins are notifications that provide information about vulnerabilities, exploits, malware, or other security-related issues. These advisories and bulletins are typically issued by software vendors, security researchers, and government agencies. +4. **Maneuver**: Maneuver refers to the process of pivoting from one indicator of compromise or piece of intelligence to another in order to uncover additional information about a potential threat. This can involve digging deeper into a particular host or network, searching for additional IOCs, or analyzing metadata and logs to identify patterns or anomalies. + +## Vulnerability scans + +Vulnerability scans **are a method of identifying security vulnerabilities in a system or network by using automated tools**. Vulnerability scans are typically performed using specialized software that systematically searches for known vulnerabilities in system components, such as operating systems, applications, and network devices. The software typically uses a database of known vulnerabilities and configuration issues to check if the system or network has any vulnerabilities that can be exploited by attackers. + +The purpose of vulnerability scanning is to identify and document potential security weaknesses before they can be exploited by attackers. By regularly scanning systems and networks, organizations can proactively identify and address vulnerabilities before they can be exploited by attackers. This can help to prevent data breaches, system downtime, and other security incidents. + +Some concepts associated are: + +- **False positives**: Refers to the identification of an issue or vulnerability by a scan tool that doesn't actually exist or isn't exploitable. False positives can waste time and resources by diverting attention away from legitimate vulnerabilities. +- **False negatives**: Refers to the failure of a scan tool to identify a vulnerability that actually exists. False negatives can lead to a false sense of security and leave an organization vulnerable to attack. +- **Log reviews**: Refers to the examination of system logs to identify patterns of suspicious activity or potential security incidents. Log reviews are an important part of detecting and responding to security incidents. +- **Credentialed vs. non-credentialed**: Refers to the method by which a vulnerability scan is conducted. Credentialed scans are performed with administrative credentials, allowing the scanner to access and analyze more detailed information about the system being scanned. Non-credentialed scans are performed without administrative credentials and can only analyze publicly available information. +- **Intrusive vs. non-intrusive**: Refers to the level of access granted to the scan tool during the scan. Intrusive scans attempt to exploit vulnerabilities to determine their exploitability and impact, while non-intrusive scans only look for vulnerabilities without attempting to exploit them. +- **Application**: Refers to the process of scanning applications for vulnerabilities. Application scans can identify issues such as SQL injection, cross-site scripting, and buffer overflow vulnerabilities. +- Web application: Refers specifically to the process of scanning web applications for vulnerabilities. Web application scans are similar to application scans but focus specifically on web-based vulnerabilities. +- **Network**: Refers to the process of scanning a network for vulnerabilities. Network scans can identify issues such as open ports, outdated software, and misconfigured devices. +- **Common Vulnerabilities and Exposures (CVE)/Common Vulnerability Scoring System (CVSS)**: CVEs are standardized identifiers for publicly known security vulnerabilities, while CVSS is a system for rating the severity of vulnerabilities based on a set of standardized metrics. +- **Configuration review**: Refers to the examination of system configurations to identify potential vulnerabilities. Configuration reviews can identify issues such as weak passwords, unnecessary services, and misconfigured firewalls. + +## Syslog/Security information and event management (SIEM) + +Syslog and Security Information and Event Management (SIEM) **are both technologies used for collecting, storing, and analyzing logs and events generated by various systems, devices, and applications within an organization's network infrastructure**. + +**Syslog is a standard protocol used for sending event messages across IP networks**. It enables different network devices, such as routers, switches, firewalls, and servers, to send their system logs to a central location for storage and analysis. Syslog messages contain important information such as source IP address, timestamp, event type, and severity level. + +**SIEM**, on the other hand, **is a comprehensive security solution that integrates and correlates logs and events from multiple sources across the network to provide a holistic view of the security posture of an organization**. It combines real-time monitoring, correlation, and analysis of security events to provide actionable insights to security analysts. SIEM tools use advanced analytics and machine learning techniques to detect and respond to security threats in real-time. They can provide a variety of capabilities, including reporting, packet capture, analysis of data inputs, user behaviour analysis, sentiment analysis, security monitoring, log aggregation and log collection. + +## Security orchestration, automation, and response (SOAR) + +Security orchestration, automation, and response (SOAR) **is a technology solution that helps organizations automate and coordinate their incident response processes**. SOAR solutions integrate with various security tools to aggregate alerts and event data, apply pre-defined or customized playbooks for response and automate actions based on these playbooks. + +SOAR platforms aim to increase the efficiency and effectiveness of security teams by reducing the amount of time spent on manual tasks and enabling quicker and more coordinated response to security incidents. They can also help improve consistency and accuracy in incident response processes, reduce response times, and provide better visibility into security operations. diff --git a/1.0-threats-attacks-and-vulnerabilities/1.8-explain-the-techniques-used-in-penetration-testing.md b/1.0-threats-attacks-and-vulnerabilities/1.8-explain-the-techniques-used-in-penetration-testing.md new file mode 100644 index 0000000..36f8da8 --- /dev/null +++ b/1.0-threats-attacks-and-vulnerabilities/1.8-explain-the-techniques-used-in-penetration-testing.md @@ -0,0 +1,57 @@ +# 1.8 Explain the techniques used in penetration testing + +## Penetration testing + +Penetration testing **is a security assessment technique in which a tester simulates an attack on a system or network to identify vulnerabilities that could be exploited by a malicious actor**. The goal of a penetration test is to identify weaknesses in security controls, applications, and infrastructure that could be exploited by an attacker to gain unauthorized access or cause damage. + +Penetration testing can be classified into two types: + +- **Black box**: In black box testing, the tester has no prior knowledge of the target system or network and attempts to identify vulnerabilities as an attacker would. +- **White box**: In white box testing, the tester has full knowledge of the target system or network and is able to simulate attacks more accurately. +- **Grey box**: In grey box testing, the tester has a limited view of the target system or network and is able to reduce the time collecting information. + +An important point of penetration testing is the **rules of engagement (ROE)**, they are the guidelines that define the scope, objectives, and limitations of a penetration testing engagement. These rules are typically agreed upon by the penetration testing team and the organization that is being tested before the engagement begins. + +Some techniques utilised during a penetration testing are: + +- **Lateral movement**: Lateral movement refers to the technique of moving through a network or system to gain access to additional resources or data. This is typically achieved by exploiting vulnerabilities in different areas of the network, such as weak passwords or unpatched systems. +- **Privilege escalation**: Privilege escalation refers to the process of gaining higher-level access or permissions on a system or network. This is typically achieved by exploiting vulnerabilities in the system or by using social engineering tactics to trick users into giving up their credentials. +- **Persistence**: Persistence refers to the ability of an attacker to maintain their access to a system or network over time. This may involve creating backdoors or other forms of access that can be used to re-enter the system even after the initial attack has been discovered and resolved. +- **Pivoting**: Pivoting refers to the technique of using a compromised system as a platform to launch attacks against other systems or networks. This is typically done to bypass security measures that are in place to prevent direct attacks against the targeted systems. + +An especial type of penetration testing is **Bug Bounty**. A bug bounty program is a crowdsourced initiative that rewards individuals for identifying and reporting vulnerabilities in a company's software or systems. This approach can help companies identify and fix vulnerabilities before they can be exploited by attackers. + +While the purpose of a penetration testing is to simulate an attack on an organisation, the are two extra steps a penetration tester needs to perform as part of a penetration testing: + +- **Cleanup**: Cleanup refers to the process of removing any traces of the penetration testing activity from the system or network. This is important to ensure that the testing does not cause any damage or disruption to normal operations, and to maintain the confidentiality of any sensitive information that may have been accessed during the testing. +- **Reporting**: Once the testing is complete, the penetration tester will prepare a report that summarizes the testing methodology, findings, and recommendations for remediation. The report should include: + - An executive summary that provides a high-level overview of the testing results and highlights any critical vulnerabilities or risks. + - A detailed analysis of each vulnerability that was identified, including the severity of the vulnerability, the impact that it could have on the organization, and any recommended remediation actions. + - Technical details on how the vulnerabilities were exploited, including any tools or techniques that were used. + - Recommendations for improving the organization's overall security posture. + +## Passive and active reconnaissance + +Reconnaissance **is the process of gathering information about a target system or network to identify potential vulnerabilities that an attacker could exploit**. Reconnaissance can be categorized into two types: passive and active. + +- **Passive reconnaissance**: Passive reconnaissance involves gathering information about the target without actually interacting with it directly. This can be done by searching public records, social media, or other publicly available information. Passive reconnaissance is less likely to be detected by the target and is a good first step in gathering information about the target. +- **Active reconnaissance**: Active reconnaissance involves actively probing the target system or network to gather information. This can be done through techniques such as port scanning, network mapping, or fingerprinting. Active reconnaissance is riskier because it can be detected by security measures and may trigger an alert. + +Some examples of reconnaisance are: + +1. Drones: Unmanned aerial vehicles (UAVs) or drones equipped with cameras and sensors can be used to conduct reconnaissance from the air. This technique is particularly useful for large areas and can provide a high level of detail. +2. War flying: This involves using a wireless-enabled device such as a laptop or smartphone to search for wireless access points while in flight. This technique is often used to identify vulnerable wireless networks. +3. War driving: This involves driving around with a wireless-enabled device to search for wireless access points. This technique is often used to identify vulnerable wireless networks. +4. Footprinting: Footprinting involves gathering information about a target organization or individual through various means such as online searches, social engineering, dumpster diving, and physical reconnaissance. +5. OSINT: Open-source intelligence (OSINT) involves gathering information from publicly available sources such as social media, news articles, forums, and blogs. This technique can provide valuable insights into a target's infrastructure, personnel, and operations. + +## Exercise types + +Exercise types **refer to the different types of security testing and evaluation methodologies used to assess the security posture of an organization or system**. These exercises can be used to identify security weaknesses and vulnerabilities, as well as to evaluate the effectiveness of security controls and policies. + +The main types of exercise are: + +1. **Red-team**: A red-team exercise is a simulated attack by an external or internal team of security professionals who try to exploit vulnerabilities in the organization's defenses. The goal of a red-team exercise is to identify and exploit weaknesses that could be used by real attackers. +2. **Blue-team**: A blue-team exercise is a defensive exercise that focuses on evaluating the organization's ability to detect, respond to, and recover from a simulated attack. The goal of a blue-team exercise is to assess the effectiveness of the organization's security controls and incident response capabilities. +3. **White-team**: A white-team exercise is a collaborative exercise in which members of the red and blue teams work together to identify vulnerabilities and improve security. The white team acts as a neutral party to help resolve any issues that arise during the exercise. +4. **Purple-team**: A purple-team exercise is a combination of red and blue team exercises, where the teams work collaboratively to identify vulnerabilities and improve security. The goal of a purple-team exercise is to identify and address weaknesses in a proactive manner, rather than waiting for an actual attack to occur. diff --git a/1.0-threats-attacks-and-vulnerabilities/README.md b/1.0-threats-attacks-and-vulnerabilities/README.md index 5e779c3..f383414 100644 --- a/1.0-threats-attacks-and-vulnerabilities/README.md +++ b/1.0-threats-attacks-and-vulnerabilities/README.md @@ -7,3 +7,11 @@ * [1.3 Given a scenario, analyze potential indicators associated with application attacks](./1.3-given-a-scenario-analyze-potential-indicators-associated-with-application-attacks.md) * [1.4 Given a scenario, analyze potential indicators associated with network attacks](./1.4-given-a-scenario-analyze-potential-indicators-associated-with-network-attacks.md) + +* [1.5 Explain different threat actors, vectors, and intelligence sources](./1.5-explain-different-threat-actors-vectors-and-intelligence-sources.md) + +* [1.6 Explain the security concerns associated with various types of vulnerabilities](./1.6-explain-the-security-concerns-associated-with-various-types-of-vulnerabilities.md) + +* [1.7 Summarize the techniques used in security assessments](./1.7-Summarize-the-techniques-used-in-security-assessments.md) + +* [1.8 Explain the techniques used in penetration testing](./1.8-explain-the-techniques-used-in-penetration-testing.md) diff --git a/2.0-archiecture-and-design/README.md b/2.0-archiecture-and-design/README.md deleted file mode 100644 index 7dfa2ef..0000000 --- a/2.0-archiecture-and-design/README.md +++ /dev/null @@ -1 +0,0 @@ -# 2.0 Architecture and Design \ No newline at end of file diff --git a/2.0-architecture-and-design/2.1-explain-the-importance-of-security-concepts-in-an-enterprise-environment.md b/2.0-architecture-and-design/2.1-explain-the-importance-of-security-concepts-in-an-enterprise-environment.md new file mode 100644 index 0000000..cd8fb87 --- /dev/null +++ b/2.0-architecture-and-design/2.1-explain-the-importance-of-security-concepts-in-an-enterprise-environment.md @@ -0,0 +1,98 @@ +# 2.1 Explain the importance of security concepts in an enterprise environment + +## Configuration management + +Configuration management **refers to the process of managing and maintaining the settings and features of an organization's IT infrastructure**. It involves establishing and maintaining a consistent and documented configuration baseline, managing configuration changes, and verifying compliance with security policies and standards. + +Some key components of configuration management include: + +- **Diagrams**: These are visual representations of the IT infrastructure that help IT professionals understand how different components of the infrastructure are connected. +- **Baseline configuration**: This refers to a known good configuration of an IT system or component. It provides a reference point for IT professionals to compare the current configuration to identify any deviations or changes that may indicate a security risk. +- **Standard naming conventions**: These are established naming conventions used for naming devices, servers, and other components of the IT infrastructure. Consistent naming conventions can help to identify components easily and reduce confusion when troubleshooting or configuring systems. +- **Internet Protocol (IP) schema**: This refers to the logical addressing scheme used on an organization's network. A consistent IP schema can help IT professionals manage and troubleshoot network issues more efficiently. + +Overall, configuration management helps to ensure that IT systems and infrastructure are configured correctly and remain compliant with security policies and standards. + +## Data sovereignty + +Data sovereignty **refers to the concept that data is subject to the laws and regulations of the country or region in which it is physically located**. It refers to the right of a country or organization to have control and ownership over its own data and the ability to determine how that data is stored, processed, and used. Data sovereignty is becoming an increasingly important issue in the age of cloud computing, where data is often stored and processed across multiple jurisdictions and countries. + +## Data protection + +Data protection **refers to the set of security measures and technologies that are implemented to safeguard sensitive and confidential information from unauthorized access, use, theft, or loss**. The following are some common techniques used for data protection: + +- Data loss prevention (DLP): DLP is a set of tools and processes that are designed to prevent the unauthorized disclosure of sensitive data. DLP solutions can monitor, detect, and block the transmission of confidential data through email, instant messaging, webmail, or other channels. +- Masking: Data masking involves replacing sensitive data with non-sensitive data to ensure that unauthorized users cannot view or access the original data. For example, credit card numbers can be masked by replacing the digits with asterisks. +- Encryption: Encryption is the process of converting data into a coded language to make it unreadable to unauthorized users. Encryption can be applied to data at rest (stored data), data in transit (data being transmitted across networks), or data in processing (data being processed by applications). +- Tokenization: Tokenization is a data protection technique that involves replacing sensitive data with non-sensitive tokens. Tokens are random values that cannot be used to derive the original data. +- Rights management: Rights management is a set of technologies and processes that are designed to manage the use of digital content. Rights management solutions can control access to content, restrict the use of content, and track the usage of content. + +Data can be classified depending on its state: + +- At rest: Data at rest refers to data that is stored on hard drives, databases, or other storage media. Data at rest can be protected through encryption, access controls, and backup and recovery processes. +- In transit/motion: Data in transit refers to data that is being transmitted across networks or other communication channels. Data in transit can be protected through encryption, secure protocols, and firewalls. +- In processing: Data in processing refers to data that is being processed by applications or other systems. Data in processing can be protected through access controls, encryption, and auditing. + +## Geographical considerations + +Geographical considerations **refer to the various factors related to location that can impact the security of an organization's data, systems, and networks**. These factors can include physical location, geopolitical issues, legal and regulatory requirements, and environmental factors. + +- **Physical location**: Physical location can impact security because it affects the risks and threats faced by an organization. For example, if a company is located in a high-crime area, it may face a greater risk of theft or vandalism. Similarly, if a company is located in an area prone to natural disasters, such as hurricanes or earthquakes, it may need to take additional measures to protect its data and systems. +- **Geopolitical issues**: Geopolitical issues can also impact security. For example, if an organization operates in a country that is experiencing political instability or conflict, it may face a higher risk of cyberattacks or other security threats. +- **Legal and regulatory requirements**: Legal and regulatory requirements can also vary by location, which can impact how an organization approaches security. For example, different countries may have different data protection laws, which can impact how an organization collects, stores, and processes data. +- **Environmental factors**: Environmental factors, such as temperature and humidity, can also impact the security of an organization's systems and data. For example, data centers and other facilities that house critical infrastructure may require specialized environmental controls to ensure the reliability and availability of systems. + +## Response and recovery controls + +Response and recovery controls **are the measures and procedures that an organization employs to respond to and recover from a security incident**. These controls aim to minimize the damage caused by the incident, restore normal operations, and prevent future incidents from occurring. Response and recovery controls typically involve incident response planning, backup and recovery procedures, disaster recovery planning, and business continuity planning. + +Some common response and recovery controls include: + +- Incident response planning: This involves creating a documented plan for responding to security incidents. The plan typically includes procedures for identifying, analyzing, containing, eradicating, and recovering from incidents. +- Backup and recovery procedures: This involves creating and testing procedures for backing up data and systems, and for restoring them in the event of an incident. +- Disaster recovery planning: This involves creating and testing procedures for recovering from disasters such as natural disasters, power outages, and other major disruptions. +- Business continuity planning: This involves creating and testing procedures for maintaining business operations in the event of an incident or disaster. + +Overall, response and recovery controls are an essential part of a comprehensive security program, helping organizations to mitigate the impact of security incidents and maintain business operations. + +## Secure Sockets Layer (SSL)/Transport Layer Security (TLS) inspection + +Secure Sockets Layer (SSL)/Transport Layer Security (TLS) inspection **is a process of intercepting and decrypting encrypted network traffic between two endpoints in order to inspect the traffic for potential security threats**. This is often done by security devices, such as firewalls or intrusion prevention systems, that are placed in the network path between the two endpoints. The process involves decrypting the traffic, inspecting it for threats or policy violations, and then re-encrypting the traffic before forwarding it to its intended destination. SSL/TLS inspection is important for ensuring the security of network traffic, but it can also raise privacy concerns as it involves breaking the encryption of communications. + +## Hashing + +Hashing **is the process of taking input data of any size and producing a fixed size output string of characters that represents the original input data in a unique and repeatable way**. The output of a hash function is often referred to as a "*hash value*", "*hash code*", "*checksum*", or "*digest*". Hashing is commonly used in cryptography to securely store and transmit sensitive information, such as passwords and digital signatures, as well as in data integrity checks to detect changes or corruption in files or messages. + +## API considerations + +API considerations **refer to the security aspects that need to be taken into account while designing and implementing application programming interfaces (APIs)**. APIs are a way for different software systems to interact with each other, and they are a critical component of modern web and mobile applications. The security considerations for APIs are similar to those for other software applications, but with some additional considerations, such as: + +1. Authentication and Authorization: APIs should use secure authentication and authorization mechanisms to ensure that only authorized users or systems can access the API. +2. Input validation: API inputs should be validated to prevent injection attacks such as SQL injection, cross-site scripting (XSS), and other similar attacks. +3. Encryption: Sensitive data that is transmitted over APIs should be encrypted to prevent unauthorized access. +4. Rate Limiting: APIs should include rate-limiting features to prevent denial-of-service (DoS) attacks and to prevent excessive usage of the API. +5. API keys: APIs should use secure API keys or access tokens to control access to the API and to identify authorized users or systems. +6. API documentation: APIs should have clear and detailed documentation to help developers understand how to use the API securely. +7. Monitoring and Logging: APIs should be monitored and logged to detect and respond to security incidents in a timely manner. + +## Site resiliency + +Site resiliency **refers to the ability of a system or application to continue functioning with minimal disruption in the event of a disaster or outage**. There are several approaches to site resiliency, including hot sites, cold sites, and warm sites. + +- **Hot site**: A hot site is a fully operational backup site that can take over immediately if the primary site goes down. It is a duplicate of the primary site, with all the necessary equipment and infrastructure in place and ready to go. Hot sites are the most expensive and complex option for site resiliency, but they offer the fastest recovery time objective (RTO) and the least amount of data loss. +- **Cold site**: A cold site, on the other hand, is an empty facility with basic infrastructure such as power and cooling. It does not have any equipment or systems installed, but it is designed to accommodate the necessary hardware and infrastructure in the event of a disaster. A cold site is the most cost-effective option, but it can take several days or weeks to get it fully operational and restore services. +- **Warm site**: A warm site is a compromise between a hot site and a cold site. It has some of the necessary equipment and infrastructure in place, but not everything is fully operational. A warm site can be brought online more quickly than a cold site, but it may take longer to recover services than a hot site. + +Site resiliency is an important aspect of disaster recovery planning and can help organizations maintain business continuity in the event of a disaster or outage. + +## Deception and disruption + +Deception and disruption **are techniques used in cybersecurity to deceive and mislead attackers or to disrupt their activities**. Some common examples include: + +1. **Honeypots**: A honeypot is a decoy system designed to lure attackers and distract them from actual production systems. The honeypot can be a software or hardware-based system that appears to be a legitimate system or a sensitive resource, but it is designed to gather intelligence about the attacker's methods and motives. +2. **Honeyfiles**: Similar to honeypots, honeyfiles are fake files that appear to be valuable data, but they are designed to alert security personnel when someone tries to access them. Honeyfiles can also be used to monitor activity and gain insights into the behavior of attackers. +3. **Honeynets**: A honeynet is a network of honeypots designed to simulate a real network environment. Honeynets are used to gather information about attackers and their methods, as well as to test new security tools and techniques. +4. **Fake telemetry**: Fake telemetry is a technique used to send false data to attackers, making them believe that they have successfully compromised a system. This technique can be used to monitor the attacker's activities and gain valuable intelligence about their methods. +5. **DNS sinkhole**: DNS sinkhole is a technique used to redirect traffic from a malicious domain to a harmless server. This technique can be used to prevent malware from communicating with its command-and-control server, thus disrupting the attacker's activities. + +Overall, deception and disruption techniques can be effective in deterring attackers and mitigating the risks associated with cyber attacks. However, they require careful planning and execution to ensure that they do not have unintended consequences and do not compromise the security of legitimate systems. diff --git a/2.0-architecture-and-design/2.2-summarize-virtualization-and-cloud-computing-concepts.md b/2.0-architecture-and-design/2.2-summarize-virtualization-and-cloud-computing-concepts.md new file mode 100644 index 0000000..6fc8758 --- /dev/null +++ b/2.0-architecture-and-design/2.2-summarize-virtualization-and-cloud-computing-concepts.md @@ -0,0 +1,111 @@ +# 2.2 Summarize virtualization and cloud computing concepts + +## Cloud models + +Cloud computing has become an increasingly popular method of delivering IT resources and services over the internet. There are several cloud service models that organizations can use, each with their own set of characteristics and considerations. + +1. **Infrastructure as a Service (IaaS**): This model provides organizations with virtualized computing resources, including servers, storage, networking, and other infrastructure components. With IaaS, organizations can deploy and manage their own operating systems, applications, and middleware. +2. **Platform as a Service (PaaS)**: In this model, cloud service providers offer a platform that enables customers to develop, run, and manage their own applications without the need to manage the underlying infrastructure. PaaS providers typically offer a pre-configured development environment, as well as tools for application deployment, testing, and management. +3. **Software as a Service (SaaS)**: In this model, cloud service providers deliver fully functional software applications over the internet. SaaS applications are typically accessible via a web browser or a mobile app, and are managed by the provider. +4. **Anything as a Service (XaaS)**: This model refers to the delivery of any kind of IT service over the internet. This includes services like security as a service, data as a service, and network as a service. + +Cloud services can also be categorized based on their deployment models: + +1. **Public cloud**: Public cloud services are hosted by third-party providers and can be accessed by anyone with an internet connection. Public cloud services are typically delivered over a pay-as-you-go model, where customers only pay for the resources they use. +2. **Community cloud**: Community clouds are shared by several organizations with common computing requirements. This deployment model enables organizations to benefit from the advantages of cloud computing while retaining control over their data and applications. +3. **Private cloud**: Private clouds are dedicated to a single organization and are typically hosted on-premises or in a data center. Private clouds offer greater control and security, but require significant upfront investment. +4. **Hybrid cloud**: Hybrid clouds are a combination of two or more cloud deployment models (public, private, or community) that remain separate entities but are integrated to provide a cohesive infrastructure. Hybrid clouds enable organizations to take advantage of the benefits of both public and private clouds. + +## Cloud service providers + +Cloud service providers (CSPs) **are companies that offer cloud computing services to businesses and individuals**. These services may include hosting applications and data, storing and managing data, providing infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS). CSPs may also offer security services, backup and recovery, and other services related to cloud computing. Examples of CSPs include Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform, and IBM Cloud. + +## Managed service provider (MSP)/ managed security service provider (MSSP) + +**A Managed Service Provider (MSP) is a company that provides a range of IT services and support to its clients**, typically on a subscription basis. These services can include network management, data backup and recovery, software installation and maintenance, security monitoring, and more. The goal of an MSP is to help its clients streamline their IT operations and reduce the burden of managing their own IT infrastructure. + +**A Managed Security Service Provider (MSSP) is a type of MSP that specializes in providing security-related services to its clients**. These services can include threat monitoring, incident response, vulnerability assessments, penetration testing, and more. The MSSP typically provides these services remotely, using a combination of automated tools and human expertise to identify and respond to security threats. The goal of an MSSP is to help its clients improve their overall security posture and reduce the risk of cyber attacks. + +## On-premises vs. off-premises + +**On-premises** refers to the infrastructure and applications that are located **within an organization's physical facility**, managed and maintained by the organization's own staff. In contrast, **off-premises** refers to infrastructure and applications that are **hosted and managed by a third-party** service provider and accessed remotely through the internet or private network connections. Off-premises solutions are typically based on cloud computing technology and may be offered as a public, private, or hybrid cloud service. The choice between on-premises and off-premises solutions depends on the organization's requirements for control, customization, cost, scalability, and security. + +## Fog computing vs Edge computing + +Fog computing **is a distributed computing infrastructure in which data, computing, and storage resources are located at the edge of the network, closer to the end-users and devices that generate and consume data**. Fog computing provides a way to process data locally, instead of sending all data to a centralized cloud, allowing for faster processing and reduced latency. + +Edge computing **is a distributed computing paradigm that involves processing and storing data near the edge of a network, rather than relying on a central location**. In edge computing, data is processed closer to the source, such as on devices themselves or in nearby servers, rather than being sent to a central data center or cloud for processing. + +Edge computing and fog computing are both emerging technologies that extend cloud computing capabilities to the edge of the network, but they differ in several ways: + +1. Architecture: Edge computing relies on local devices to perform data processing and analysis, while fog computing uses a distributed network of devices, including gateways, routers, and switches, to provide a platform for computation and data storage. +2. Proximity: Edge computing involves deploying computing resources as close as possible to the end-users or the devices that generate the data, while fog computing focuses on providing computational resources close to the data source, such as sensors or IoT devices. +3. Scalability: Edge computing can be challenging to scale due to the limited resources of local devices, while fog computing can be more scalable by using a distributed network of devices that can be managed and orchestrated centrally. +4. Latency: Edge computing provides low latency by processing data locally, while fog computing can offer low latency by distributing computation and storage closer to the data source. +5. Security: Both edge and fog computing face unique security challenges, but fog computing can provide a more secure environment by placing computational resources closer to the data source, reducing the exposure to cyber threats. + +In summary, edge computing and fog computing are similar in that they both aim to extend cloud computing capabilities to the edge of the network, but they differ in architecture, proximity, scalability, latency, and security. + +## Thin client + +A thin client **is a computer or client device that relies heavily on a server to perform most of its processing and data storage functions**. It is a type of computer that does not have a hard disk drive or other storage media, and it depends on a network for its resources, including applications, memory, storage, and processing power. The thin client is designed to be lightweight, energy-efficient, and low-cost, with a minimalistic hardware configuration. It is often used in enterprise environments where centralized management, security, and cost savings are critical. + +## Containers + +Containers **are a lightweight virtualization technology that allows for the creation and deployment of isolated software environments, called containers, on a single host machine**. Containers provide an abstraction layer between the application and the host operating system, making it easier to deploy and manage applications across different environments, such as development, testing, and production. + +Containers use the host operating system's kernel, libraries, and other resources, which makes them lightweight and fast to start up and shut down. Each container includes only the necessary dependencies and configuration files required to run the application, making them highly portable and efficient. Containers can be managed and orchestrated using tools like Docker and Kubernetes, which provide a high level of automation and scalability for containerized applications. + +## Microservices/API + +Microservices and Application Programming Interfaces (APIs) are two related concepts in software development that are increasingly used in modern computing environments. + +**Microservices refer to the architectural approach of building an application as a collection of small, independently deployable services that work together to provide the required functionality**. Each microservice is a self-contained component that can be developed, deployed, and scaled independently from the rest of the application. Microservices are typically designed to be lightweight, scalable, and resilient, and are often implemented using containerization technologies like Docker and Kubernetes. + +**APIs**, on the other hand, **are a way for applications to interact with each other or with external services**. APIs define a set of rules and protocols for communication between different software systems, and enable applications to exchange data and functionality with each other. APIs can be public or private, and can be used to expose a variety of functionality, from simple data access to more complex services like machine learning algorithms. + +In modern software development, microservices and APIs often go hand in hand, with microservices using APIs to communicate with each other and with external systems. This approach enables developers to build complex applications more quickly and efficiently, by breaking down the application into smaller, more manageable pieces and leveraging existing services through APIs. + +## Infrastructure as code + +Infrastructure as code (IaC) **is an approach to managing and provisioning IT infrastructure through machine-readable configuration files instead of manual intervention**. IaC enables administrators to automate the deployment of resources, configuration management, and other operational tasks, reducing the chance of human error and increasing efficiency. + +Software-defined networking (SDN) is a type of network architecture where the control and management planes are decoupled from the underlying network hardware, allowing network administrators to manage network services through a central location. SDN can be implemented through IaC, where the network infrastructure is defined in code and can be quickly provisioned, changed, or removed. + +Software-defined visibility (SDV) is another approach to managing network infrastructure through machine-readable configuration files. SDV enables network administrators to centrally configure and manage traffic visibility policies and access controls, making it easier to identify and mitigate security threats. + +Both SDN and SDV are examples of how IaC can be used to manage and automate network infrastructure. + +## Serverless architecture + +Serverless architecture, also known as Function as a Service (FaaS), **is a cloud computing model that allows developers to run their application code without having to manage the underlying infrastructure**. With serverless architecture, the cloud provider takes care of the infrastructure needed to run the code, such as servers, operating systems, and runtime environments, and developers simply write and deploy their code as functions. + +In serverless architecture, applications are built around a set of functions that are triggered by specific events, such as an incoming request or a change in a data store. These functions can be written in a variety of programming languages and are typically short-lived, running for only a few seconds to process a specific request. Because serverless architecture scales automatically to meet demand, it can be a cost-effective solution for applications that have unpredictable or variable workloads. + +Serverless architecture can also provide increased security, as the cloud provider is responsible for maintaining the infrastructure and implementing security measures such as encryption and access control. Additionally, serverless architecture can reduce the time and effort required for application deployment and management, as developers can focus on writing and deploying their functions rather than managing the underlying infrastructure. + +## Services integration + +Services integration **refers to the process of combining and connecting different software services, applications, or systems together to function as a cohesive whole**. The goal of services integration is to enable seamless data flow and communication between different components within an organization's IT infrastructure. + +This can be achieved through various methods such as application programming interfaces (APIs), middleware, message queues, service-oriented architectures (SOAs), and enterprise service buses (ESBs). Service integration is becoming increasingly important as organizations continue to adopt cloud-based and hybrid IT infrastructures, which often consist of multiple interconnected systems and applications. + +## Resource policies + +Resource policies **refer to the set of rules or configuration settings that determine how a particular resource or set of resources should be accessed or managed within a cloud environment**. These policies can be applied to a wide range of cloud resources, including virtual machines, storage volumes, databases, and network components. + +Resource policies allow administrators to control access to cloud resources and enforce specific security and compliance requirements. For example, policies may specify which users or groups are authorized to access a particular resource, what actions they are allowed to perform, and under what conditions. Additionally, policies may define specific requirements around data protection, network access, auditing, and logging. + +In general, resource policies are defined using a declarative language, such as JSON or YAML, which specifies the desired state of a resource. These policies can be managed and applied through a variety of tools and interfaces, including cloud provider consoles, command-line tools, and automation frameworks. + +## Transit gateway + +A transit gateway **is a horizontally scalable service that allows users to connect Virtual Private Clouds (VPCs) and remote networks together**. It acts as a hub to enable network traffic routing among the connected networks and serves as a central point to apply various network policies and controls. Transit gateway simplifies network management by reducing the need for complex peering connections between VPCs and provides more control over network traffic between VPCs and external networks. + +## Virtualization + +Virtualization **is the process of creating a virtual version of something, such as a virtual machine (VM) that behaves like a physical computer**. It involves the use of software to create a simulated environment that can run various operating systems or applications. + +Virtual machine (VM) sprawl avoidance is the practice of managing and controlling the growth of virtual machines in a virtualized environment. It involves creating policies and procedures to ensure that virtual machines are created, used, and decommissioned in a controlled and organized manner. + +VM escape protection is the practice of securing virtual machines from unauthorized access or exploitation by a host system or another virtual machine. It involves implementing security measures such as access controls, network segmentation, and vulnerability management to prevent attackers from exploiting vulnerabilities in the virtualization environment to gain access to sensitive data or systems. diff --git a/2.0-architecture-and-design/2.3-summarize-secure-application-development-deployment-and-automation-concepts.md b/2.0-architecture-and-design/2.3-summarize-secure-application-development-deployment-and-automation-concepts.md new file mode 100644 index 0000000..e16f129 --- /dev/null +++ b/2.0-architecture-and-design/2.3-summarize-secure-application-development-deployment-and-automation-concepts.md @@ -0,0 +1,76 @@ +# 2.3 Summarize secure application development, deployment, and automation concepts + +## Environment + +In software development, an environment **refers to the infrastructure or platform on which applications are developed, tested, deployed, and operated**. There are different types of environments that correspond to different stages of the software development lifecycle. These include: + +1. **Development environment**: This is where developers write and test code before it is ready for release to other environments. The development environment is typically isolated from other environments, and developers may have administrative privileges to install software and configure settings as needed. +2. **Test environment**: This is where code is tested to ensure that it works as expected and is free from bugs and errors. The test environment is usually a replica of the production environment, but with less data and traffic. Testers may have limited access to configure settings in the test environment. +3. **Staging environment**: This is where code is deployed to simulate the production environment as closely as possible. It is used to test the code in a real-world setting before releasing it to the production environment. The staging environment is typically isolated from the production environment and may have limited access to data. +4. **Production environment**: This is the live environment where the application is used by end-users. The production environment is critical to the success of the application and requires the highest level of security, stability, and performance. Developers typically have limited access to the production environment to ensure that it is not accidentally altered or compromised. +5. **Quality assurance (QA) environment**: This is a specialized environment that focuses on testing the quality of the application. It is typically used for manual and automated testing to ensure that the application meets the quality standards before being released to the production environment. The QA environment is usually a replica of the production environment with limited data and traffic. + +## Provisioning and deprovisioning + +**Provisioning refers to the process of setting up and configuring computing resources** such as servers, virtual machines, storage, and networking infrastructure to make them available for use. This includes activities such as creating user accounts, configuring access permissions, and installing necessary software. + +**Deprovisioning**, on the other hand, **refers to the process of removing access rights, user accounts, and computing resources** that are no longer needed or have been decommissioned. This process is crucial for security and compliance purposes to ensure that access to sensitive data or resources is revoked when no longer required. + +## Integrity measurement + +Integrity measurement **is a process of verifying the integrity of a system or application by measuring and comparing the current state with a known good state**. This is done to detect any unauthorized changes or modifications that may have been made to the system or application. Integrity measurement can be performed using various techniques, including cryptographic hashing, digital signatures, and trusted platform modules (TPMs). + +In essence, integrity measurement involves creating a baseline of the system or application's "*normal*" state, and then periodically checking to see if there have been any changes that deviate from this baseline. This can help detect and prevent security breaches and other unauthorized activities. + +## Secure coding techniques + +Secure coding techniques **refer to the practices and methods used to develop and maintain secure software applications**. Here are some common techniques used: + +- **Normalization**: This technique involves ensuring that data stored in a database is consistent and conforms to certain rules, reducing the chances of SQL injection attacks. +- **Stored procedures**: This involves using pre-written procedures to execute database operations, reducing the chances of injection attacks. +- **Obfuscation/camouflage**: This technique involves disguising code to make it harder for attackers to understand and reverse-engineer. +- **Code reuse/dead code**: Unused code or code that is no longer required should be removed, as it can introduce security vulnerabilities. +- **Server-side vs. client-side execution and validation**: Server-side execution and validation is more secure than client-side, as it reduces the chances of tampering and injection attacks. +- **Memory management**: Proper memory management techniques should be used to prevent buffer overflow and other memory-related vulnerabilities. +- **Use of third-party libraries and software development kits (SDKs**): Third-party code should be vetted and kept up-to-date to reduce the chances of vulnerabilities. +- **Data exposure**: Sensitive data should be encrypted both in transit and at rest to reduce the chances of data exposure. + +## Open Web Application Security Project (OWASP) + +The Open Web Application Security Project (OWASP) **is a nonprofit foundation focused on improving software security through open-source projects, resources, and tools**. OWASP provides guidance, checklists, and best practices to help organizations build secure web applications and APIs. They also publish a list of the top 10 most critical web application security risks, which is updated periodically to reflect new threats and trends in the industry. Additionally, OWASP hosts community events, training sessions, and conferences to promote awareness and education on software security issues. + +## Software diversity + +Software diversity **refers to the use of different software implementations for a particular task or function**. The idea behind software diversity is that using different implementations can make it harder for attackers to find and exploit vulnerabilities that exist in a specific implementation. + +**A compiler is a program that translates source code written in a programming language into machine-readable code** that can be executed by a computer. **A binary**, on the other hand, **is the output of the compilation process and contains executable code** that can be run on a specific hardware architecture. In the context of software diversity, having different compilers or different versions of the same compiler can help to create diverse binaries that are less likely to share vulnerabilities with each other. + +## Automation/scripting + +Automation and scripting are essential components of secure application development and deployment processes. **Automation refers to the use of tools and processes that can be executed automatically**, without requiring human intervention, to perform tasks such as testing, deployment, and configuration management. **Scripting involves the creation of scripts or code that automate repetitive tasks and processes**. + +Some areas or practices in software development associated to automation are: + +- **Automated courses**: Automated courses of action are preconfigured responses to security incidents that can be triggered automatically. +- **Continuous monitoring**: Continuous monitoring involves the use of tools and techniques to monitor systems and applications for potential security issues in real-time. +- **Continuous validation**: Continuous validation involves the use of automated tools and techniques to test and validate the security of applications and systems on an ongoing basis. +- **Continuous integration**: Continuous integration is a software development practice where developers frequently merge their code changes into a central repository. +- **Continuous delivery**: Continuous delivery is the process of automatically deploying changes to a staging or production environment, and continuous deployment is the process of automatically deploying changes directly to production. + +Overall, automation and scripting can help improve the speed, efficiency, and accuracy of secure application development and deployment processes, while also helping to reduce the risk of human error and security vulnerabilities. + +## Elasticity + +Elasticity **refers to the ability of a system to automatically scale its resources up or down based on demand**. This means that when the demand for a system increases, more resources are allocated to it, and when the demand decreases, resources are automatically released. Elasticity is an important characteristic of cloud computing environments, where resources are typically provisioned dynamically and charged on a usage-based model. Elasticity enables organizations to achieve optimal resource utilization, reduce costs, and ensure that systems can handle peak loads without degradation in performance. + +## Scalability + +Scalability **refers to the ability of an application or system to handle an increasing amount of work or traffic without experiencing performance degradation or downtime**. This can be achieved through various techniques, such as adding more resources, optimizing the code, or redesigning the architecture. + +Scalability is essential in modern software development as it allows applications and systems to grow and adapt to changing demands and user needs. A scalable system should be able to handle an increasing number of users, requests, and data without any significant impact on performance, reliability, or security. It is typically measured in terms of vertical scalability, which involves adding more resources to a single machine, or horizontal scalability, which involves adding more machines to distribute the workload. + +## Version control + +Version control **is a system that helps developers keep track of changes made to their code over time**. It allows multiple developers to collaborate on the same codebase, track changes, and roll back to previous versions if necessary. + +There are two types of version control systems: centralized and distributed. In a centralized system, there is a single repository that stores all code changes, and developers check out and check in code to the repository. In a distributed system, each developer has a copy of the repository on their local machine, and changes are synced between repositories. diff --git a/2.0-architecture-and-design/2.4-summarize-authentication-and-authorization-design-concepts.md b/2.0-architecture-and-design/2.4-summarize-authentication-and-authorization-design-concepts.md new file mode 100644 index 0000000..149c6f3 --- /dev/null +++ b/2.0-architecture-and-design/2.4-summarize-authentication-and-authorization-design-concepts.md @@ -0,0 +1,82 @@ +# 2.4 Summarize authentication and authorization design concepts + +## Authentication methods + +Authentication methods **are used to verify the identity of a user or entity**. There are various authentication methods, and some of them are: + +1. **Directory services**: It is a centralized database that stores user credentials, such as usernames and passwords. It provides a way to authenticate users across multiple applications and services. +2. **Federation**: It is a method of authentication that allows a user to authenticate with a third-party identity provider. The identity provider is responsible for verifying the user's identity and providing authentication tokens that can be used to access the requested resource. +3. **Attestation**: It is a method of authentication that uses a trusted third-party to verify the identity of a user or device. It involves providing proof of identity, such as a certificate or digital signature. +4. **Smart card authentication**: It is a method of authentication that uses a smart card to store user credentials. The smart card is inserted into a card reader, and the user provides a PIN to authenticate themselves. + +These are some additional technologies related to authentication methods: + +- **Time-based one-time password (TOTP)**: TOTP is a type of two-factor authentication that generates a temporary password based on the current time and a shared secret key. The password is typically valid for a short period of time (e.g., 30 seconds) and is used in combination with a user's regular password to provide an additional layer of security. +- **HMAC-based one-time password (HOTP)**: HOTP is similar to TOTP, but instead of using the current time, it uses a counter value to generate the temporary password. This can be useful in situations where the clock on a user's device is not synchronized with the server. +- **Short message service (SMS)**: SMS authentication involves sending a temporary code to a user's mobile phone via text message. The user must enter the code to complete the authentication process. While SMS authentication is convenient, it is also vulnerable to attacks such as SIM swapping. +- **Token key**: A token key is a physical device that generates a one-time password or other type of authentication code. Token keys can be either hardware-based (e.g., a USB token) or software-based (e.g., an app on a user's phone). +- **Static codes**: Static codes are pre-generated codes that can be used for authentication. They are typically printed on a card or other physical medium and given to the user. +- **Authentication applications**: Authentication applications are software applications that generate one-time passwords or other types of authentication codes. They can be installed on a user's computer or mobile device. +- **Push notifications**: Push notifications involve sending a notification to a user's device asking them to approve or deny an authentication request. This can be a more user-friendly alternative to entering a password or authentication code. +- **Phone call**: Phone call authentication involves calling a user's phone and asking them to enter a PIN or other authentication code. This method can be useful in situations where a user does not have access to their mobile device or computer. + +Other common authentication methods include username and password, biometric authentication (such as fingerprint or facial recognition), and multi-factor authentication (MFA). + +## Biometrics + +Biometrics **is the measurement and analysis of unique physical and behavioral characteristics of an individual to confirm their identity**. It involves the use of advanced technology to collect and analyze data on physical features such as fingerprints, facial recognition, voice recognition, iris scans, and even DNA. Biometric authentication is often used as a secure method of identity verification for access to sensitive information or physical locations, replacing traditional passwords or PINs. It provides a higher level of security and convenience for users, as they do not need to remember complex passwords or carry identification cards. + +Some common types of biometric authentication include fingerprint, retina, iris, facial, voice, vein, and gait analysis. + +- **Fingerprint**: This type of biometric authentication is based on the unique patterns of ridges and furrows on an individual's fingers. It is one of the oldest and most commonly used forms of biometric authentication. +- **Retina**: Retinal biometrics is based on the unique patterns of blood vessels at the back of the eye. It requires a specialized scanner that emits a low-intensity light into the eye and captures the reflection from the retina. +- **Iris**: Iris biometrics is similar to retinal biometrics but instead focuses on the unique patterns in the colored part of the eye. It also requires a specialized scanner to capture the image of the iris. +- **Facial**: Facial biometrics uses an individual's unique facial features to verify their identity. It involves capturing an image or video of the face and using algorithms to analyze and compare it with stored templates. +- **Voice**: Voice biometrics involves capturing an individual's unique vocal patterns and using them to verify their identity. It can be used to authenticate individuals over the phone or in person. +- **Vein**: Vein biometrics is based on the unique patterns of blood vessels beneath an individual's skin. It requires a specialized scanner that uses near-infrared light to capture the vein patterns. +- **Gait analysis**: Gait analysis biometrics uses an individual's unique walking pattern to verify their identity. It involves capturing video footage of the individual's gait and using algorithms to analyze and compare it with stored templates. + +The efficacy rates of biometric authentication vary depending on the type of biometric and the quality of the data captured. **False acceptance refers to when an unauthorized user is mistakenly granted access**, while **false rejection refers to when an authorized user is mistakenly denied access**. The crossover error rate is the point at which the false acceptance and false rejection rates are equal, and it is used to measure the overall accuracy of a biometric system. + +## Multifactor authentication (MFA) factors and attributes + +Multifactor authentication (MFA) **is a security system that requires users to provide two or more forms of identification in order to access a system, application, or device**. The goal of MFA is to provide an additional layer of security beyond a simple username and password combination. By requiring multiple forms of identification, MFA can greatly reduce the risk of unauthorized access to sensitive data or systems. + +### Factors + +There are three authentication factors used in computing: + +- **Something you know**: The knowledge factor relates to something you know, typically used when you identify yourself to a system with a user name and password combination. +- **Something you have**: The possession factor relates to something you have. You physically possess an object to use as an authenticator. +- **Something you are**: The inherence factor relates to something you are, relying on a person’s unique physical characteristics that can be used as a form of identification, such as fingerprints, retinal eye patterns, iris patterns, handprints, and voiceprints. + +### Attributes + +There are four common attributes: + +- **Something you do**: Something you do, meaning that when you present your credentials to the system, you must perform an action, is a common attribute that accompanies authentication factors, such as a hand gesture on a smartphone. +- **Somewhere you are**: The location attribute relates to your location when you authenticate. This attribute could use either physical or logical locations and requires you to be in a certain location when you authenticate to the system, such as, in a highly secure facility, you may need to use a specific workstation. +- **Something you exhibit**: Something you exhibit can refer to something neurological that can be measured or scanned; it could be a personality trait or a mannerism , such as speech analysis systems. +- **Someone you know**: The someone you know attribute reflects a trust relationship, such as someone vouching for a third person. + +## Authentication, authorization, and accounting (AAA) + +Authentication, authorization, and accounting (AAA) **are three security-related components commonly used to provide secure access to network resources**. These components are used in various network security applications, including remote access VPNs, wireless networks, and Network Access Control (NAC) solutions. + +**Authentication refers to the process of verifying the identity of a user, device, or system**. The goal of authentication is to ensure that the person or system attempting to access a resource is who they claim to be. Authentication is typically accomplished using one or more factors, such as a username and password, a security token, or biometric data. + +**Authorization refers to the process of granting or denying access to a particular resource based on the authenticated user's privileges**. Authorization is often referred to as access control, and it is used to enforce security policies and ensure that users can only access the resources they are authorized to use. + +**Accounting refers to the process of tracking and recording user activity and resource usage. This information is used for security auditing**, billing, and analysis purposes. Accounting data may include information such as who accessed a resource, when it was accessed, and how long it was accessed. + +Together, authentication, authorization, and accounting provide a comprehensive security framework for controlling access to network resources and ensuring that users are held accountable for their actions. + +## Cloud vs. on-premises requirements + +Authentication requirements can vary between cloud and on-premises environments due to differences in the way they are accessed and managed. + +In an on-premises environment, authentication can be managed through local user accounts and directories, such as Microsoft Active Directory, and user authentication is typically performed on the organization's own servers. This can provide greater control and customization of authentication policies and user access to resources, but it also requires the organization to manage and maintain their own authentication infrastructure. + +In a cloud environment, authentication is typically managed by the cloud service provider, with users accessing resources through the provider's authentication systems. This can provide convenience and scalability, but also requires a certain level of trust in the provider's security practices and authentication mechanisms. + +Regardless of the environment, authentication should include strong password policies, multi-factor authentication, and secure communication protocols to protect against unauthorized access. Additionally, authorization and accounting mechanisms should be in place to ensure that only authorized users are accessing resources and to track access and usage for auditing and compliance purposes. diff --git a/2.0-architecture-and-design/2.5-given-a-scenario-implement-cybersecurity-resilience.md b/2.0-architecture-and-design/2.5-given-a-scenario-implement-cybersecurity-resilience.md new file mode 100644 index 0000000..54166e4 --- /dev/null +++ b/2.0-architecture-and-design/2.5-given-a-scenario-implement-cybersecurity-resilience.md @@ -0,0 +1,124 @@ +# 2.5 Given a scenario, implement cybersecurity resilience + +## Redundancy + +Redundancy **is a strategy for ensuring system resilience by duplicating critical components, resources, or systems**. The aim of redundancy is to increase availability, reliability, and fault tolerance by reducing the risk of a single point of failure. Redundancy can be implemented at different levels, including hardware, software, data, and network infrastructure. In cybersecurity, redundancy can be used to ensure continuity of operations and mitigate the impact of cyber attacks or natural disasters. For example, redundant systems can be used to automatically switch over to a backup system in case of a failure, ensuring uninterrupted service. + +### Geographic dispersal + +Geographic dispersa **refers to the practice of distributing critical data, systems, and infrastructure across multiple geographic locations to minimize the risk of a single point of failure**. This approach can help organizations to maintain operations and continuity in the event of natural disasters, cyberattacks, or other disruptive events. + +By having redundant systems and infrastructure in multiple geographic locations, organizations can ensure that if one location is impacted by a disaster or cyberattack, they can continue to operate from another location. Geographic dispersal can be often achieved through the use of cloud-based services, and can also be achieved through the use of physical redundancy, where critical systems and infrastructure are replicated in multiple geographic locations. + +### Disk + +Disk redundancy **refers to the practice of creating redundant copies of data across multiple physical storage devices or systems to ensure that data remains available even in the event of disk failure**. Two commonly used techniques for disk redundancy are RAID and Multipath. + +**RAID (Redundant Array of Inexpensive Disks) is a technology that allows multiple physical disks to be combined into a single logical volume**. There are several RAID levels, each with its own method of storing data across multiple disks. The most commonly used RAID levels are: + +1. **RAID 0**: Striping. Data is split evenly across two or more disks, providing increased read and write speeds, but no redundancy. +2. **RAID 1**: Mirroring. Data is duplicated on two or more disks, providing redundancy but no performance improvement. +3. **RAID 5**: Striping with parity. Data is split across three or more disks, with one disk dedicated to storing parity information. This provides both increased read and write speeds and redundancy, but requires at least three disks. +4. **RAID 6**: Striping with double parity. Similar to RAID 5, but with two disks dedicated to storing parity information. This provides redundancy even if two disks fail simultaneously, but requires at least four disks. + +**Multipath is a technique that provides redundancy for storage area network (SAN) devices**. Multipath software allows multiple paths between a server and a SAN device to be used simultaneously, ensuring that data remains available even if one of the paths fails. This can improve the performance and reliability of storage systems, particularly in large-scale enterprise environments. + +### Network + +Network redundancy **is the process of having backup components or systems that can take over if the primary components or systems fail**. This helps to ensure that network services remain available even in the event of a failure. Two common methods of achieving network redundancy are through the use of load balancers and network interface card (NIC) teaming. + +**Load balancers are devices that distribute incoming network traffic across multiple servers or network resources**. This helps to evenly distribute the workload across the network and ensures that no one resource is overloaded. If one server or resource fails, the load balancer can automatically redirect traffic to the remaining resources, ensuring that network services remain available. + +**Network interface card (NIC) teaming is the process of combining two or more network interface cards into a single virtual NIC**. This helps to ensure that network traffic can continue to flow even if one NIC fails. In addition, NIC teaming can provide increased bandwidth and load balancing capabilities, helping to improve network performance and resilience. + +Another example of network redundancy is the use of redundant routers or switches. This involves having multiple routers or switches configured in such a way that if one fails, the other can take over seamlessly, ensuring that network traffic continues to flow uninterrupted. + +### Power + +Power **redundancy refers to the practice of having backup systems in place to ensure continuous power supply in case of power failures or outages**. Here are some common power redundancy techniques: + +1. **Uninterruptible Power Supply (UPS)**: A UPS is a backup power supply that provides power to devices in case of power loss. It typically has a battery that can provide power for a limited time, allowing for a safe shutdown of systems or time for backup power sources to activate. +2. **Generator**: A generator is a device that produces electrical energy from mechanical energy. It can be used as a backup power source in case of power outages or as a primary power source in remote areas where access to the power grid is limited. +3. **Dual supply**: Dual supply refers to having two separate power sources that can provide power to a system simultaneously. This ensures that if one power source fails, the other can take over seamlessly without any downtime. +4. **Managed Power Distribution Units (PDUs)**: A PDU is a device that distributes power to multiple devices from a single power source. A managed PDU provides advanced features like remote power management, outlet-level monitoring, and power usage reporting. + +By using these power redundancy techniques, organizations can ensure that critical systems remain operational in case of power disruptions, minimizing downtime and maximizing business continuity. + +## Replication + +Replication **is a process of creating and maintaining multiple copies of data or applications to ensure availability and resilience in case of failures or disasters**. In the context of cybersecurity, replication plays a crucial role in maintaining business continuity and disaster recovery. Here are some topics related to replication: + +1. **Storage area network (SAN) replication**: A SAN is a high-speed network that connects servers and storage devices in a data center. SAN replication involves replicating data between two or more SANs to ensure data availability and disaster recovery. SAN replication can be synchronous or asynchronous, depending on the distance between the SANs and the network bandwidth. +2. **VM replication**: Virtual machine replication involves creating and maintaining multiple copies of virtual machines across different hosts or clusters. VM replication can be used to ensure availability and resilience of critical applications running on virtual machines. VM replication can be synchronous or asynchronous, depending on the replication technology used. + +Replication is a critical component of disaster recovery and business continuity planning. It helps organizations to maintain continuous access to critical data and applications in the event of a disaster or failure. However, replication can also increase the complexity and cost of IT infrastructure, so it is important to carefully evaluate the replication needs and choose the right technology and configuration to meet the organization's requirements. + +## On-premises vs. cloud + +**On-premises resilience refers to the ability of an organization's IT infrastructure to withstand and recover from disruptions or failures**, such as hardware failures, power outages, or natural disasters. This is typically achieved through redundancy and disaster recovery planning, such as having multiple power sources, backups, and failover mechanisms in place. + +**Cloud resilience**, on the other hand, **refers to the ability of a cloud-based system to remain available and recover from disruptions or failures**. Cloud providers typically offer built-in resilience features, such as replication across multiple data centers, automatic failover, and backup and recovery services. + +In comparison to on-premises resilience, cloud resilience can offer several advantages, including: + +1. Scalability: Cloud-based systems can easily scale up or down to meet changing demand, which can be particularly useful during times of high traffic or increased workload. +2. Flexibility: Cloud providers often offer a wide range of services and configurations, which can be customized to meet the specific needs of an organization. +3. Reduced management overhead: Cloud providers are responsible for maintaining and updating the underlying infrastructure, which can reduce the management burden on an organization. + +However, there are also potential disadvantages to relying solely on cloud resilience, including: + +1. Dependence on the cloud provider: Organizations may have limited control over the underlying infrastructure and may be at the mercy of the cloud provider in the event of a disruption or outage. +2. Security concerns: Cloud-based systems can be vulnerable to security threats, such as data breaches or hacking attempts, which can impact both the organization and its customers. +3. Cost: While cloud-based systems can be cost-effective in some cases, they can also be expensive, particularly if an organization requires high levels of availability and redundancy. + +## Backup types + +Backup **is the process of creating and maintaining copies of important data in case the original data is lost or corrupted**. Here are the different types of backups: + +- **Full backup**: A full backup copies all the data in a system, including files, folders, and applications. +- **Incremental backup**: An incremental backup only copies data that has changed since the last backup, saving time and storage space. +- **Snapshot backup**: A snapshot backup captures the state of a system at a particular point in time, enabling quick restoration to that exact state. +- **Differential backup**: A differential backup copies all data that has changed since the last full backup. +- **Tape backup**: Tape backup involves copying data onto magnetic tapes that can be stored offline or offsite for safekeeping. +- **Disk backup**: Disk backup involves copying data onto external hard drives or other storage devices for quick and easy restoration. +- **Copy backup**: A copy backup makes an exact copy of the data without compression or encryption, ensuring that the backup is an exact replica of the original. +- **Network-attached storage (NAS) backup**: NAS backup involves storing backup data on a separate NAS device, providing easy access and management of backup data. +- **Storage area network (SAN) backup**: SAN backup involves copying data onto a separate storage area network for easy access and management. +- **Cloud backup**: Cloud backup involves copying data onto a cloud-based storage service, providing secure offsite storage and easy restoration. +- **Image backup**: An image backup involves creating a complete image of a system, including the operating system, settings, and applications. +- **Online vs. offline backup**: Online backup involves copying data while the system is running, while offline backup involves copying data while the system is turned off. +- **Offsite storage**: Offsite storage involves storing backups in a different physical location than the original data, protecting against disasters that could affect the primary location. Distance considerations should be taken into account, such as ensuring that the offsite storage is far enough away to be safe from the same disaster that could affect the primary location. + +## Non-persistence + +Non-persistence resilience **refers to the ability of a system to maintain its critical functions and services despite disruptions or attacks that attempt to compromise or destroy the system**. One approach to achieving non-persistence resilience is to use techniques that allow the system to revert to a known-good state or configuration in the event of an incident. + +Here are some techniques that can be used for non-persistence resilience: + +1. **Revert to known state**: This technique involves periodically restoring the system to a known-good state. This can be done by taking regular system backups or by creating restore points that capture a snapshot of the system's state at a particular time. In the event of a security incident or system failure, the system can be rolled back to the last known-good state to restore its functionality. +2. **Last known-good configuration**: This technique involves saving a copy of the system's last known-good configuration, which can be used to restore the system's functionality in the event of a security incident or system failure. This technique is often used in conjunction with backup and recovery processes. +3. **Live boot media**: This technique involves booting the system from a read-only medium, such as a CD or USB drive, that contains a pre-configured operating system and applications. This technique provides an isolated environment that is immune to malware and other attacks, and can be used to recover critical data or to restore the system's functionality in the event of a security incident or system failure. + +These techniques are useful for systems that are highly critical and cannot tolerate any downtime or disruption. They are commonly used in industries such as healthcare, finance, and government, where system availability is essential. Distance considerations are also important when it comes to offsite storage, as the distance between the primary and secondary locations should be enough to prevent both from being affected by a single event, such as a natural disaster or power outage. + +## High availability + +High availability and scalability are two important concepts related to system resilience and performance. + +**High availability refers to the ability of a system to remain operational and accessible even in the event of failures or outages**. The goal of high availability is to minimize downtime and maintain service levels for end-users. This is often achieved through the use of redundant systems, such as backup servers, load balancers, and clustering. In the case of a failure, these redundant systems can seamlessly take over and continue to provide services to users without any disruption. + +**Scalability**, on the other hand, **refers to the ability of a system to handle increasing amounts of workload or traffic without degrading in performance**. A scalable system is designed to be flexible and adaptable, allowing it to accommodate growth and changes in demand. This is often achieved through the use of distributed architectures and load balancing techniques that enable the system to distribute workload across multiple servers or nodes. + +A highly available system is typically also scalable, as it is designed to be resilient and capable of handling fluctuations in traffic or demand. Similarly, a scalable system must also be highly available to ensure that it can continue to function under heavy load or in the event of failures. + +## Restoration order + +Restoration order **is the sequence in which an organization restores its systems, applications, and data after a disaster or disruptive event**. It is essential to have a well-defined restoration order to minimize downtime and resume operations as quickly as possible. + +The restoration order should be based on criticality and recovery time objectives (RTOs) for each system, application, and data set. Critical systems and applications that are required for the organization's core business operations should be given the highest priority for restoration. The RTOs for each system should also be considered, with the most time-sensitive systems restored first. It should also take into account dependencies between systems and applications. + +## Diversity + +Diversity is an essential aspect of resilience planning. Diverse technologies, vendors, and cryptographic controls provide options and flexibility to mitigate risks, prevent system failure, and improve recovery time. The use of different technologies, such as hardware and software, can reduce the risk of a single point of failure. Employing multiple vendors and suppliers can reduce the risk of supply chain attacks and the dependence on a single source of technology. Cryptographic diversity can also be used to provide multiple levels of security and reduce the risk of a single cryptographic algorithm being compromised. Additionally, incorporating different security controls, such as access controls, network segmentation, and monitoring, can improve overall resilience by creating multiple layers of defense. + +Overall, the use of diverse technologies, vendors, cryptographic controls, and security controls can enhance resilience planning and increase the ability of an organization to recover from disruptions or incidents. diff --git a/2.0-architecture-and-design/2.6-explain-the-security-implications-of-embedded-and-specialized-systems.md b/2.0-architecture-and-design/2.6-explain-the-security-implications-of-embedded-and-specialized-systems.md new file mode 100644 index 0000000..05bbcfc --- /dev/null +++ b/2.0-architecture-and-design/2.6-explain-the-security-implications-of-embedded-and-specialized-systems.md @@ -0,0 +1,79 @@ +# 2.6 Explain the security implications of embedded and specialized systems + +## Embedded systems + +Embedded and specialized systems **are computer systems that are designed for specific functions or tasks and are integrated into other devices or systems**. These systems can be found in a variety of applications, including medical devices, industrial control systems, and automotive systems. While these systems offer many benefits, such as increased efficiency and reliability, they also present unique security challenges. + +One of the primary security implications of embedded and specialized systems is that they are often designed with limited resources and may lack the processing power or memory to support advanced security features. This can make them vulnerable to various types of attacks, including denial-of-service attacks, buffer overflows, and code injection attacks. + +Another challenge with embedded systems is that they often have a long lifespan and may not be updated or patched regularly. This means that vulnerabilities may go unnoticed or unaddressed for extended periods, leaving the system open to attack. Additionally, many embedded systems lack proper security controls, such as access controls or encryption, which can leave sensitive data or system functions vulnerable. + +Furthermore, embedded systems are frequently connected to other devices or networks, which can introduce additional vulnerabilities. For example, a medical device that is connected to a hospital network could be used as a point of entry for attackers looking to gain access to sensitive patient information. + +To address these challenges, it is essential to incorporate security considerations into the design and development of embedded and specialized systems. This can include implementing access controls, encryption, and other security features, as well as performing regular vulnerability assessments and applying updates and patches as necessary. Additionally, it is important to monitor and secure any connections to other devices or networks to prevent unauthorized access or data breaches. + +Some examples of devices used as embedded systems are: + +- Raspberry Pi: a small, low-cost, single-board computer that can run various operating systems and is popular for use in DIY projects and prototyping. +- Field-programmable gate array (FPGA): an integrated circuit that can be programmed after manufacturing, allowing for flexible and customizable hardware configurations. +- Arduino: an open-source platform for building electronics projects, consisting of hardware and software components, often used for prototyping and education. + +## Supervisory control and data acquisition (SCADA)/industrial control system (ICS) + +**Supervisory control and data acquisition (SCADA) is a type of industrial control system (ICS) used to monitor and control industrial processes and infrastructure**, such as power plants, water treatment facilities, and transportation systems. SCADA systems collect data from sensors and other devices in real-time, and send commands to control actuators and other output devices. They provide a centralized interface for operators to monitor and control industrial processes, and can also include data analysis and reporting features. + +The can be found in manufacturing facilities, industrial areas, energy management facilities, and all kind of logistic operations. + +## Internet of Things (IoT) + +The Internet of Things (IoT) **refers to a network of physical devices, vehicles, sensors, and other items that are embedded with software, sensors, and connectivity to enable the collection, exchange, and analysis of data**. + +Some elements involved are: + +- Sensors: IoT devices equipped with sensors to collect and transmit data +- Smart devices: IoT-enabled devices that can communicate with other devices and perform automated actions +- Wearables: IoT devices that can be worn on the body, such as fitness trackers and smartwatches +- Facility automation: IoT devices used for building automation and control systems + +Security vulnerabilities in IoT devices that can be exploited by attackers, often due to weak default settings and passwords. + +## Specialized + +Specialized embedded devices **refer to devices that are designed for specific purposes**, such as medical systems, vehicles, aircraft, or smart meters. Medical systems, such as insulin pumps or pacemakers, are implanted in the human body and need to meet high standards of security and reliability. Vehicles and aircraft contain various embedded systems that control different functions, from engine control to entertainment systems. Smart meters are used to measure and manage electricity usage in homes and businesses. All of these specialized embedded devices have unique security challenges due to their specific use cases and potential impact on human safety and privacy. For example, a vulnerability in a medical device could lead to serious harm to a patient, while a vulnerability in a smart meter could result in unauthorized access to personal energy usage data. Therefore, it is important to ensure that these devices are designed, implemented, and maintained with robust security measures to prevent attacks and maintain the safety of users. + +## Voice over IP (VoIP) + +Voice over Internet Protocol (VoIP) **is a technology that allows voice communication and multimedia sessions over the internet or any other IP-based network**. It converts analog voice signals into digital packets, which are transmitted over the network using IP protocol. VoIP can be used for voice calls, video calls, and other forms of communication, and it offers advantages such as cost savings, scalability, and flexibility. + +## Some embedded technologies + +Some examples of embedded technologies are: + +- Heating, ventilation, air conditioning (HVAC): Systems used for indoor temperature and air quality control in buildings and other enclosed spaces. +- Drones: Unmanned aerial vehicles used for various purposes, including surveillance, delivery, and data collection. +- Multifunction printer (MFP): Devices that can print, scan, copy, and sometimes fax documents. +- Real-time operating system (RTOS): Operating system designed for applications that require precise and predictable timing and execution. +- Surveillance systems: Systems used for monitoring and recording activities and events in a particular area. +- System on chip (SoC): Integrated circuit that contains all the components required for a complete electronic system. + +## Communication considerations + +As embedded devices become more connected and reliant on network communication, several communication methods can to be taken into account to ensure their security and resilience. + +- **5G**: 5G, which is a newer and faster version of cellular network technology, provides high-speed connectivity and low latency. +- **Narrow-band**: Narrow-band communication allows devices to communicate using less bandwidth, minimizing the risk of interference and reducing the power consumption. +- **Baseband**: Baseband radio is a low-level radio signal that operates on a narrow frequency range. +- **Subscriber identity module (SIM) cards**: SIM cards are often used in embedded devices, which enable cellular network communication and device authentication. +- **Zigbee**: Zigbee is a popular wireless communication standard used in IoT devices that operates on low power and allows devices to communicate over short distances. + +## Constraints + +- **Power**: Embedded devices must be designed to operate within specific power requirements to prevent issues like overheating, battery drain, and electrical fires. +- **Compute**: Embedded devices have limited computational capabilities and must be designed with these limitations in mind. +- **Network**: Embedded devices must be designed to operate on specific networks, including wired, wireless, and cellular, with limited bandwidth and connectivity. +- **Crypto**: Embedded devices must have strong cryptographic capabilities to secure sensitive data and communications. +- **Inability to patch**: Embedded devices often cannot be patched or updated, making them vulnerable to newly discovered vulnerabilities and exploits. +- **Authentication**: Embedded devices must have robust authentication mechanisms to prevent unauthorized access and ensure the integrity of the device and its data. +- **Range**: The range of an embedded device refers to the maximum distance over which it can communicate with other devices or networks. +- **Cost**: Embedded devices must be designed with cost in mind to ensure they are affordable for their intended use cases. +- **Implied trust**: Users often assume embedded devices are secure and trustworthy, even when this may not be the case, leading to potential security risks. diff --git a/2.0-architecture-and-design/2.7-explain-the-importance-of-physical-security-controls.md b/2.0-architecture-and-design/2.7-explain-the-importance-of-physical-security-controls.md new file mode 100644 index 0000000..8d41501 --- /dev/null +++ b/2.0-architecture-and-design/2.7-explain-the-importance-of-physical-security-controls.md @@ -0,0 +1,120 @@ +# 2.7 Explain the importance of physical security controls + +Physical security controls refer to the measures and protocols that are put in place to protect physical assets, resources, and facilities from unauthorized access, damage, theft, or other physical threats. + +## Bollards/barricades + +Bollards/barricades **are physical security controls used to restrict or control vehicle or pedestrian traffic in certain areas, such as around buildings, infrastructure, or sensitive sites**. They are designed to prevent or deter unauthorized access, ramming attacks, or vehicular-borne improvised explosive devices (VBIEDs) by providing a physical barrier that can withstand a certain level of impact or force. Bollards/barricades can be fixed or removable, and made of different materials such as steel, concrete, or bollard sleeves that can be filled with concrete or sand. + +## Access control vestibules + +Access control vestibules **are small rooms located at the entry point of a building, designed to enhance security by creating a buffer zone between the outside environment and the inside of the building**. Vestibules usually consist of two sets of doors, one that opens to the outside and another that leads to the interior of the building. The doors are electronically controlled, and one set cannot be opened until the other set is closed. This ensures that only authorized individuals gain access to the building. + +## Badges + +Badges **are physical tokens or cards that are used to identify individuals and grant them access to secure areas within a building or facility**. They often contain personal information such as the person's name, photograph, job title, and department. They can also be encoded with access privileges or permissions, allowing individuals to enter specific areas or rooms based on their role or clearance level. Badges may also be used to track employee movement and activity within the facility. + +## Alarms + +Alarms **are security devices that alert individuals or security personnel when an unauthorized access attempt or breach occurs**. They can be triggered by different factors such as motion detection, door and window contacts, glass breakage, and heat or smoke detection. Alarms can also be designed to sound silently, alerting security personnel without alarming the intruder, or with loud sirens to scare off the intruder. + +## Signage + +Signage **refers to the use of visual communication in the form of signs, symbols, and graphics to convey information and instructions to people in a physical space**. Signage can be used to indicate restricted areas, warn of potential hazards, provide directions, or display emergency information. Signage can be highly effective in improving security by clearly communicating rules and expectations to employees, visitors, and other individuals in a facility. It can also act as a deterrent by alerting potential intruders that security measures are in place. Effective signage should be clear, concise, and easy to understand, and should be strategically placed in high-traffic areas where it is easily visible. + +## Cameras + +Cameras **are electronic devices that capture and record visual information, and they are an essential physical security control in many settings**. Cameras can be used for a variety of purposes, including monitoring activity, deterring crime, and providing evidence in the event of an incident. Two important features of modern cameras are motion recognition and object detection. **Motion recognition allows cameras to detect movement** and trigger an alarm or recording when activity is detected in a specified area. **Object detection allows cameras to recognize and track specific objects or individuals** based on pre-defined criteria, such as facial recognition or license plate recognition. These features can enhance the effectiveness of camera surveillance systems and improve the security of a facility. However, it is important to consider the privacy implications of using cameras, and to ensure that they are deployed in compliance with applicable laws and regulations. + +## Closed-circuit television (CCTV) + +Closed-circuit television (CCTV) **is a surveillance system that uses cameras to transmit video signals to a specific set of monitors**. The signals are not publicly distributed, unlike broadcast television, hence the term "closed-circuit". CCTV cameras are commonly used for surveillance and security purposes in various settings such as public areas, businesses, and homes. The footage captured by CCTV cameras can be stored and reviewed later to identify security breaches or incidents. + +## Industrial camouflage + +Industrial camouflage **is a physical security control that involves the use of materials, colors, and patterns to blend in a facility or equipment with its surroundings to make it harder to detect or recognize**. The goal of industrial camouflage is to provide protection against unauthorized access or reconnaissance by making it difficult for potential attackers to identify the target. Industrial camouflage can be applied to buildings, vehicles, and other equipment, and it is often used in military and high-security applications. + +## Personnel + +Personnel **are physical security controls that involve human beings in various roles**. These controls are designed to ensure the safety and security of a facility or organization. + +- Guards: Security guards are hired to protect the premises and keep watch over the property. They may be armed or unarmed, and may be stationed at entry points, roam the premises, or monitor security systems. +- Robot sentries: Robot sentries are machines designed to patrol the premises, detect intruders, and sound alarms if necessary. They may also have the ability to take defensive measures against intruders. +- Reception: Reception is a security control that involves a person stationed at the entrance of a facility, who is responsible for verifying the identity of visitors, checking them in, and issuing visitor badges. +- Two-person integrity/control: Two-person integrity/control is a security control that requires two individuals to work together to perform a task. This is often used in scenarios where high-value assets are being handled, and it reduces the risk of fraud, theft, or error. + +## Locks + +A lock **is a physical device that is designed to prevent unauthorized access to a space or object**. There are several types of locks available in the market, each designed to provide different levels of security. Some examples are: + +- **Biometric locks**: These locks use a person's unique physical characteristics, such as fingerprints or iris scans, for authentication. They provide a high level of security but can be expensive to install and maintain. +- **Electronic locks**: These locks use electronic systems, such as a keypad or smart card, for authentication. They are more convenient to use than traditional physical locks and can be easily integrated with other security systems. +- **Physical locks**: These locks are the traditional locks that use keys or combination locks for authentication. They are widely used due to their simplicity and low cost. +- **Cable locks**: These locks use a cable to secure an object to a stationary object. They are commonly used to secure bicycles or laptops and are easy to use and transport. + +Each type of lock has its own advantages and disadvantages, and the choice of lock will depend on the level of security required and the specific needs of the user. + +## USB data blocker + +A USB data blocker, also known as a USB condom or USB privacy device, **is a small electronic device that is designed to prevent unauthorized data transfer or hacking when using USB charging ports or public charging stations**. The device blocks data transfer pins on a USB cable, allowing only power transfer pins to work. This prevents any malicious data transfer and keeps personal or sensitive data safe. USB data blockers are commonly used for charging mobile devices, laptops, and other USB-powered devices in public places such as airports, cafes, and hotels. + +## Lighting + +Lighting **refers to the use of artificial or natural light sources to illuminate an area, whether indoor or outdoor, to increase visibility, provide security, and enhance aesthetic appeal**. Proper lighting is an essential component of physical security controls as it can deter criminal activities, facilitate surveillance, and provide a safe and secure environment for occupants. In addition to traditional lighting fixtures, modern lighting systems can include advanced features such as motion sensors, timers, and remote controls, allowing for more effective and efficient use of lighting resources. + +## Fencing + +Fencing **is a physical security control used to restrict access to a specific area or property by creating a physical barrier**. Fences can be made of various materials such as wood, metal, or wire mesh and can come in different heights and styles to meet specific security needs. Fencing can provide a visual deterrent, prevent unauthorized access, and help to keep people and animals out of restricted areas. Fences can be used in a variety of settings, including industrial sites, government buildings, and residential properties. + +## Fire suppression + +Fire suppression systems **are designed to control and extinguish fires, typically through the use of chemicals, water, or gases**. They are installed in buildings and other facilities to prevent fires from spreading and causing damage or injury. Common types of fire suppression systems include sprinkler systems, which use water to extinguish fires, and gas suppression systems, which use gases such as carbon dioxide or halon to smother flames. Some fire suppression systems are automatic and triggered by heat or smoke sensors, while others are manually activated. + +## Sensors + +Sensors **are electronic devices that detect and respond to physical or environmental stimuli**, such as motion, temperature, or noise. They are commonly used in security systems to monitor and alert for potential threats. **Motion sensors detect movement** and can trigger an alarm or surveillance camera. **Noise sensors detect unusual sounds or disruptions** and can alert security personnel. **Proximity readers use radio frequency identification (RFID) or other technology to identify authorized personnel or objects**. **Moisture sensors detect water or moisture**, which can indicate the presence of leaks or other water-related issues. **Temperature sensors measure the ambient temperature** and can alert to changes in temperature that may indicate a fire or other environmental hazard. + +## Drones + +Drones, also known as unmanned aerial vehicles (UAVs), **are aircraft that are remotely controlled or operate autonomously through software-controlled flight plans**. They can be used for various purposes, including military operations, surveillance, and commercial applications such as photography, package delivery, and inspection of infrastructure. Drones typically have sensors such as cameras, GPS, and accelerometers to help with navigation and data collection. They come in various sizes and designs, from small quadcopters to large fixed-wing aircraft. + +## Visitor logs + +Visitor logs **are records maintained by an organization or facility to keep track of visitors who enter the premises**. The log typically includes information such as the visitor's name, the purpose of their visit, the date and time of their arrival and departure, and the name of the person they are meeting. The purpose of maintaining a visitor log is to ensure accountability and security, as it can be used to track who has entered the facility and when. In case of any security breach or incident, the visitor log can be used as evidence for investigations. + +## Faraday cage + +A Faraday cage **is a conductive enclosure that blocks electromagnetic fields (EMF) and waves, including radio waves, microwaves, and electromagnetic radiation**. It is made of a conductive material such as copper or aluminum and is designed to protect electronic equipment and devices from external electromagnetic interference (EMI). The Faraday cage works by creating an electromagnetic shield around the enclosed equipment, preventing any EMF from entering or leaving the cage. It is commonly used in various applications, including scientific experiments, military and defense systems, and even in everyday devices like microwaves and cell phones to prevent interference with other electronic equipment. + +## Air gap + +An air gap **is a security measure used to isolate a computer or network from external networks or the internet to prevent unauthorized access, data leakage, or cyber attacks**. It involves physically separating a system or network from other systems or networks by disconnecting it from external networks, such as the internet or local networks, using an air gap. The air gap is meant to create a physical barrier that prevents data from being transferred in or out of the system, which can be useful for protecting highly sensitive information such as government secrets or financial data. However, air gaps are not foolproof and can still be breached by physical access or social engineering attacks. + +## Screened subnet (previously known as demilitarized zone) + +A screened subnet, also known as a demilitarized zone (DMZ), **is a network architecture commonly used in computer networks to add an additional layer of security by segregating an internal network from an external network**. The screened subnet sits between the internal network and the external network and contains devices such as firewalls and intrusion detection systems that filter traffic to and from the internal network. The screened subnet is designed to provide a buffer zone where traffic from the outside world can be monitored and filtered before it is allowed to reach the internal network, thus providing an extra layer of protection against external threats. + +## Protected cable distribution + +Protected cable distribution **is a physical security measure used to protect network cabling from being tampered with or physically compromised**. The protected cables are often housed within secure conduits or routed through secure pathways, and are protected against physical access or attacks by measures such as armored sheathing or shielding. This is particularly important for critical infrastructure and sensitive environments where the physical security of network cabling is as important as cybersecurity measures. + +## Secure areas + +Secure areas **refer to physical locations, rooms, or facilities that are specifically designed and implemented with security measures** to safeguard sensitive information, assets, and critical infrastructure against unauthorized access, theft, vandalism, or physical damage. Secure areas may include multiple layers of security controls, such as access control systems, biometric authentication, surveillance cameras, motion sensors, alarms, and other measures to ensure the confidentiality, integrity, and availability of the information and assets within them. Some examples are: + +- **Air gap**: Physical isolation of a computer or network from unsecured networks or systems. +- **Vault**: A secure room or structure designed to protect valuables, such as money, documents, or data, from theft, fire, or other hazards. +- **Safe**: A secure container designed to store and protect valuables, such as money, documents, or data, from theft, fire, or other hazards. +- **Hot aisle**: A containment system used in data centers to manage the flow of hot air generated by equipment. +- **Cold aisle**: A containment system used in data centers to manage the flow of cool air to equipment. + +## Secure data destruction + +Secure data destruction **refers to the process of permanently and securely erasing data from a storage device to prevent unauthorized access or recovery of sensitive information**. It involves various methods such as burning, shredding, pulping, pulverizing, degaussing, and using third-party solutions to ensure that data is completely destroyed and cannot be recovered. + +- Burning involves incinerating the device or media. +- Shredding involves physically shredding the media into small pieces. +- Pulping involves reducing the media to a pulp. +- Pulverizing involves grinding it into small particles. +- Degaussing involves erasing the data by exposing the media to a strong magnetic field. +- Third-party solutions involve hiring a professional service to perform the secure data destruction process. diff --git a/2.0-architecture-and-design/2.8-summarize-the-basics-of-cryptographic-concepts.md b/2.0-architecture-and-design/2.8-summarize-the-basics-of-cryptographic-concepts.md new file mode 100644 index 0000000..6eeee9d --- /dev/null +++ b/2.0-architecture-and-design/2.8-summarize-the-basics-of-cryptographic-concepts.md @@ -0,0 +1,127 @@ +# 2.8 Summarize the basics of cryptographic concepts + +## Digital signatures + +A digital signature **is a cryptographic technique that provides authentication, integrity, and non-repudiation of electronic documents or messages**. It involves the use of a mathematical algorithm to create a unique digital fingerprint of the document or message, which can then be verified by the recipient to ensure that the document or message has not been altered and was indeed sent by the claimed sender. + +## Key length + +Key length **refers to the size of the key used in cryptographic algorithms**. In symmetric-key cryptography, it is the length of the secret key used for encryption and decryption, while in public-key cryptography, it is the length of the public and private keys used for digital signatures and encryption. The longer the key length, the more secure the encryption, as longer keys are more difficult to crack using brute-force attacks or other cryptographic attacks. + +## Key stretching + +Key stretching **is a technique used to make a cryptographic key stronger and more secure by adding complexity to the key derivation process, typically by using a slow hash function or a series of hash functions**. The goal is to increase the difficulty of brute-force attacks against the key. + +## Salting + +Salting **is the process of adding a random sequence of data to the input data before the data is hashed in order to make it more difficult for attackers to crack the hash**. This technique is commonly used in password storage to enhance security by making it harder to use precomputed hash tables or dictionary attacks. + +## Hashing + +Hashing **is the process of converting any arbitrary size data into a fixed-size string of characters or bytes, which is unique to that data**. The hash function takes the input (message or data) and produces the hash value, which can be used to verify the integrity of the data or to uniquely identify it. + +## Key exchange + +Key exchange **is a process of securely sharing cryptographic keys between two parties over an insecure channel**, such as the internet, to establish a secure communication channel between them. This process enables the parties to communicate securely without revealing the keys to an eavesdropper or attacker. Key exchange protocols are used in various applications, including secure web browsing, email encryption, and virtual private networks (VPNs). + +## Elliptic-curve cryptography + +Elliptic-curve cryptography (ECC) **is a type of public-key cryptography that uses elliptic curves to create and exchange keys, encrypt and decrypt data, and digitally sign messages**. ECC is known for providing the same level of security with smaller key sizes compared to traditional public-key cryptography algorithms such as RSA, making it suitable for resource-constrained devices such as embedded systems and mobile devices. + +## Perfect forward secrecy + +Perfect forward secrecy (PFS) **is a property of cryptographic protocols where the compromise of long-term secret keys does not compromise past session keys**. In other words, PFS ensures that even if an attacker obtains the private key, they cannot use it to decrypt previously intercepted encrypted communication. This is achieved by using a different key for each session, which is generated on the fly and not stored. PFS provides an additional layer of security for communication and is often used in secure messaging protocols and web browsing. + +## Quantum + +Quantum **cryptography is a subfield of cryptography that uses principles of quantum mechanics to provide secure communication**. In quantum cryptography, a secure key exchange is performed using quantum key distribution (QKD) protocols, which allow the transmission of cryptographic keys between two parties with unconditional security. The keys are generated based on the quantum properties of photons or other quantum particles, which are inherently random and impossible to copy or measure without disturbing the state of the particles. This ensures that any attempts to eavesdrop on the communication will be detected, as the act of measuring the key will alter its state, alerting the legitimate users. + +In the context of computing, quantum cryptography has the potential to revolutionize encryption by using quantum computing to break traditional cryptographic algorithms. Quantum computers can perform certain calculations exponentially faster than classical computers, making it possible to crack current encryption standards in seconds. However, quantum cryptography provides a solution to this problem by using quantum-resistant algorithms that are immune to attacks from quantum computers. + +## Post-quantum + +Post-quantum, also known as quantum-resistant or quantum-safe, **refers to cryptographic algorithms and systems that are designed to resist attacks by quantum computers**. As quantum computers become more powerful, they may be able to break many of the commonly used cryptographic algorithms that are currently considered secure. Post-quantum cryptography aims to provide security even in the presence of quantum computers by using mathematical problems that are believed to be hard for both classical and quantum computers to solve. + +## Ephemeral + +Ephemeral **data refers to data that is designed to be used only once and then discarded, such as a one-time password or a temporary encryption key**. Ephemeral keys are frequently used in cryptographic protocols to provide forward secrecy and protect against attacks that rely on the compromise of long-term keys. + +## Modes of operation + +Modes of operation **are techniques used to process large amounts of data through a block cipher, providing additional security features such as confidentiality and integrity**. Some common modes of operation include ECB, CBC, CFB, OFB, and CTR. + +- **Authenticated modes of operation include additional authentication steps**, such as adding an HMAC or a message authentication code (MAC), **to ensure that the message has not been tampered with**. Examples of authenticated modes of operation include GCM and OCB. +- **Unauthenticated modes of operation do not provide any additional authentication steps**, and therefore only provide confidentiality. An example of an unauthenticated mode of operation is ECB. +- **Counter (CTR) mode is a type of stream cipher that allows the encryption and decryption of individual blocks without affecting other blocks**. It generates a keystream by encrypting a counter value and then XORs the keystream with the plaintext. CTR mode is widely used in applications that require parallel processing and is considered to be one of the most efficient modes of operation. + +## Blockchain + +A blockchain **is a decentralized, distributed digital ledger used to record transactions across many computers in a tamper-resistant way**. Each block in the chain contains a number of transactions and once recorded, the data in any given block cannot be altered retroactively without altering all subsequent blocks. Public ledgers, which are often implemented using blockchain technology, are open and accessible to anyone who wants to use or contribute to the network. Public ledgers provide transparency, immutability, and decentralization, and are often used for applications such as cryptocurrencies and smart contracts. + +Bitcoin and blockchain rely on public key infrastructure (PKI) cryptosystems to ensure safe storage of the currency and the transactions as well. PKI is a system that uses digital certificates and public key cryptography to verify the identity of users and encrypt data transmissions. + +## Cipher suites + +Cipher suites **refer to a set of cryptographic algorithms and protocols that are used to secure network communications**. + +- **Stream ciphers**: operate on plaintext continuously, generating ciphertext one bit at a time, and are often used in applications where the data is transmitted in a continuous stream. +- **Block ciphers**: operate on fixed-length groups of bits, or blocks, and are often used in applications where the data is transmitted in discrete chunks or messages. Block ciphers can be used in various modes of operation such as Cipher Block Chaining (CBC), Electronic Codebook (ECB), and Counter (CTR). + +Both stream and block ciphers are used in various cryptographic applications, including secure communications, data encryption, and digital signatures. The choice of the cipher suite depends on the specific requirements of the application and the level of security needed. + +## Symmetric vs. asymmetric + +Symmetric and asymmetric are two types of encryption techniques used in cryptography. + +**Symmetric encryption uses a single key for both encryption and decryption**. This means that the same key is used by both the sender and receiver to encrypt and decrypt the data. Examples of symmetric encryption algorithms include AES (Advanced Encryption Standard) and DES (Data Encryption Standard). + +**Asymmetric encryption, also known as public-key encryption, uses two different keys for encryption and decryption**. One key is kept private and known only to the owner, while the other key is made public and can be distributed to anyone who needs to send encrypted data to the owner. Examples of asymmetric encryption algorithms include RSA and Elliptic Curve Cryptography (ECC). + +**The primary advantage of asymmetric encryption over symmetric encryption is that it enables secure communication without the need for a pre-shared key. However, asymmetric encryption is generally slower and more computationally intensive than symmetric encryption.** + +## Lightweight cryptography + +Lightweight cryptography **refers to cryptographic algorithms and protocols that are designed to be implemented on devices with limited resources** such as low-power microcontrollers, RFID tags, and sensor networks. These algorithms typically have low memory requirements, low computational complexity, and low power consumption, while still providing strong security. + +## Steganography + +Steganography **is the practice of hiding a secret message within a medium** such as audio, video, or image without any apparent suspicion. In audio steganography, data can be hidden in the audio signal by modifying the audio data. In video steganography, data can be hidden by modifying the video frames or by modifying the audio signal of the video. In image steganography, data can be hidden in the pixel values of an image or in the metadata of an image file. + +## Homomorphic encryption + +Homomorphic encryption **is a type of encryption that allows computations to be performed on encrypted data without the need to decrypt it first**. This means that sensitive data can be kept encrypted and still be processed, providing a high level of security and privacy. It has potential applications in various fields, such as finance, healthcare, and cloud computing. + +## Common use cases + +Cryptography has numerous use cases across various fields. Here are some common use cases and how cryptography can support them: + +- Low power devices: In resource-constrained environments such as IoT devices, lightweight cryptography algorithms like AES-CCM or Chacha20-Poly1305 can be used to encrypt and authenticate data with minimal overhead. +- Low latency: In high-speed communication networks, symmetric key cryptography can be used for encryption and decryption to reduce latency, as it requires less computation compared to asymmetric key cryptography. +- High resiliency: Cryptography can be used to ensure data resiliency against attacks like data breaches, ransomware attacks, etc. Cryptographic techniques like encryption, hashing, and digital signatures can help in ensuring data confidentiality, integrity, and non-repudiation. +- Supporting confidentiality: Cryptography is often used to ensure confidentiality by encrypting sensitive data, rendering it unreadable to unauthorized parties. Encryption techniques like symmetric key cryptography and asymmetric key cryptography can be used for this purpose. +- Supporting integrity: Cryptography can be used to ensure that data has not been tampered with, and its integrity has been maintained. Techniques like hashing and digital signatures can help in ensuring data integrity. +- Supporting obfuscation: Cryptography can be used to obfuscate data, making it difficult for attackers to read and understand the information. Techniques like encryption and steganography can be used for this purpose. +- Supporting authentication: Cryptography can be used for user authentication, ensuring that only authorized users can access the system. Techniques like password hashing and digital certificates can be used for authentication. +- Supporting non-repudiation: Cryptography can be used to establish non-repudiation, ensuring that parties cannot deny their actions. Techniques like digital signatures can be used to establish non-repudiation. + +## Limitations + +Cryptography is a fundamental tool for information security, but it has some limitations that need to be considered in various use cases. + +**Speed** is a common limitation in cryptography, especially in applications that require real-time processing, such as network communication or streaming media. In such cases, lightweight cryptography algorithms may be used, sacrificing some level of security for improved performance. + +**Size** is another limitation in some applications, such as small embedded devices or mobile phones, which have limited storage capacity. Cryptographic algorithms and keys need to fit within these constraints, which may require the use of smaller key sizes or less complex algorithms. + +**Weak keys** can also be a limitation in cryptography, as certain keys or configurations may be vulnerable to attacks that can compromise the confidentiality or integrity of the system. + +**Time** is a limitation in some cryptographic applications, such as those that require long-term data storage or archiving. In such cases, the longevity of the cryptographic algorithms and keys needs to be considered, as well as the ability to migrate to new algorithms and keys over time. + +**Predictability** is a limitation in some cryptographic applications, as some algorithms or modes of operation may be vulnerable to attacks based on predictable patterns or repetitions. + +**Reuse of keys** or other cryptographic components can also be a limitation, as it may increase the risk of attacks or compromise the confidentiality or integrity of the system. + +**Entropy** is a fundamental limitation in cryptography, as it is necessary to have sufficient randomness or unpredictability in the generation of keys and other cryptographic parameters. + +**Computational overheads** can be a limitation in some applications, such as those that require high levels of security or complexity, as the processing power or resources required to perform the cryptographic operations may be prohibitive. + +Finally, **resource vs. security constraints** can be a limitation in some applications, as there may be a trade-off between the level of security provided by cryptographic mechanisms and the available resources, such as computing power or bandwidth. diff --git a/2.0-architecture-and-design/README.md b/2.0-architecture-and-design/README.md new file mode 100644 index 0000000..ac31f28 --- /dev/null +++ b/2.0-architecture-and-design/README.md @@ -0,0 +1,15 @@ +# 2.0 Architecture and Design + +* [2.1 Explain the importance of security concepts in an enterprise environment](./2.1-explain-the-importance-of-security-concepts-in-an-enterprise-environment.md) + +* [2.2 Summarize virtualization and cloud computing concepts](./2.2-summarize-virtualization-and-cloud-computing-concepts.md) + +* [2.3 Summarize secure application development, deployment, and automation concepts](./2.3-summarize-secure-application-development-deployment-and-automation-concepts.md) + +* [2.4 Summarize authentication and authorization design concepts](./2.4-summarize-authentication-and-authorization-design-concepts.md) + +* [2.5 Given a scenario, implement cybersecurity resilience](./2.5-given-a-scenario-implement-cybersecurity-resilience.md) + +* [2.6 Explain the security implications of embedded and specialized systems](./2.6-explain-the-security-implications-of-embedded-and-specialized-systems.md) + +* [2.7 Explain the importance of physical security controls](./2.7-explain-the-importance-of-physical-security-controls.md) diff --git a/3.0-implementation/3.1-given-a-scenario-implement-secure-protocols.md b/3.0-implementation/3.1-given-a-scenario-implement-secure-protocols.md new file mode 100644 index 0000000..7c01947 --- /dev/null +++ b/3.0-implementation/3.1-given-a-scenario-implement-secure-protocols.md @@ -0,0 +1,28 @@ +# 3.1 Given a scenario, implement secure protocols + +## Protocols + +- **Domain Name System Security Extensions (DNSSEC**): DNSSEC is a set of extensions to the Domain Name System (DNS) that provide authentication of DNS data, enabling DNS clients to verify the authenticity of the DNS responses they receive. +- **SSH**: Secure Shell (SSH) is a cryptographic network protocol that enables secure communication between two networked devices, typically a client and a server. SSH is commonly used for remote access to servers and other networked devices, allowing users to securely log in and execute commands. +- **Secure/Multipurpose Internet Mail Extensions (S/MIME)**: S/MIME is a protocol used to secure email communication by providing authentication, integrity, confidentiality, and non-repudiation. It is commonly used in business environments where secure email communication is critical. +- **Secure Real-time Transport Protocol (SRTP)**: SRTP is a security extension of the Real-time Transport Protocol (RTP), which is used to transmit audio and video over the internet. SRTP provides confidentiality, integrity, and replay protection to RTP packets. +- **Lightweight Directory Access Protocol Over SSL (LDAPS)**: LDAPS is a secure version of the Lightweight Directory Access Protocol (LDAP), which is used to access and manage directory services. LDAPS uses SSL/TLS to provide encryption and authentication for LDAP traffic. +- **File Transfer Protocol, Secure (FTPS**): FTPS is a secure version of the File Transfer Protocol (FTP), which is used to transfer files over the internet. FTPS uses SSL/TLS to provide encryption and authentication for FTP traffic. +- **SSH File Transfer Protocol (SFTP)**: SFTP is a secure version of the File Transfer Protocol (FTP), which is used to transfer files over the internet. SFTP uses SSH to provide encryption and authentication for file transfer traffic. +- **Simple Network Management Protocol, version 3 (SNMPv3)**: SNMPv3 is a secure version of the Simple Network Management Protocol (SNMP), which is used to manage and monitor network devices. SNMPv3 uses encryption and authentication to provide security for SNMP traffic. +- **Hypertext transfer protocol over SSL/TLS (HTTPS)**: HTTPS is a secure version of the Hypertext Transfer Protocol (HTTP), which is used to transmit data over the internet. HTTPS uses SSL/TLS to provide encryption and authentication for HTTP traffic. +- **IPSec**: IPSec is a protocol suite used to provide security for IP traffic. It includes two main protocols, Authentication Header (AH) and Encapsulating Security Payloads (ESP), which provide authentication and confidentiality for IP packets, respectively. IPSec can be used in tunnel or transport mode to protect traffic at the network or transport layer. +- **Post Office Protocol (POP)/Internet Message Access Protocol (IMAP)**: POP and IMAP are two protocols used for retrieving email from a server. Both can be secured using SSL/TLS to provide encryption and authentication for email traffic. + +## Use cases + +- Voice and video: Secure Real-time Transport Protocol (SRTP) is commonly used to provide confidentiality, integrity, and authentication to real-time multimedia traffic over IP networks. +- Time synchronization: Network Time Protocol (NTP) can be secured using NTP authentication and Symmetric Key Cryptography. +- Email and web: Secure/Multipurpose Internet Mail Extensions (S/MIME) is used to provide end-to-end encryption and digital signatures for email messages. HTTPS, which uses SSL/TLS, is commonly used to secure web traffic, including online transactions and sensitive data transfers. +- File transfer: File Transfer Protocol, Secure (FTPS) and SSH File Transfer Protocol (SFTP) are commonly used to secure file transfers. +- Directory services: Lightweight Directory Access Protocol Over SSL (LDAPS) is used to provide secure access to directory services such as Active Directory. +- Remote access: Secure Shell (SSH) is used for remote login and execution of commands on remote machines. It provides confidentiality, integrity, and authentication for remote access. +- Domain name resolution: Domain Name System Security Extensions (DNSSEC) is used to secure domain name resolution by providing data integrity and authentication to DNS queries. +- Routing and switching: IP Security (IPSec) is commonly used to provide confidentiality, integrity, and authentication to IP traffic, including routing and switching. +- Network address allocation: Dynamic Host Configuration Protocol (DHCP) can be secured using Secure DHCP, which provides authentication and encryption of DHCP messages. +- Subscription services: Secure Sockets Layer (SSL)/Transport Layer Security (TLS) is used to secure subscription services, including online content delivery and streaming services. diff --git a/3.0-implementation/3.2-given-a-scenario-implement-host-or-application-security-solutions.md b/3.0-implementation/3.2-given-a-scenario-implement-host-or-application-security-solutions.md new file mode 100644 index 0000000..f3fd1c2 --- /dev/null +++ b/3.0-implementation/3.2-given-a-scenario-implement-host-or-application-security-solutions.md @@ -0,0 +1,99 @@ +# 3.2 Given a scenario, implement host or application security solutions + +## Endpoint protection + +Endpoint protection **refers to the set of security solutions and policies designed to secure endpoints such as desktops, laptops, mobile devices, servers, and other devices that connect to a network**. These solutions protect the endpoints from various types of cyber threats such as malware, viruses, Trojans, spyware, ransomware, and other attacks. + +- **Antivirus**: A type of software that detects, prevents, and removes malware, viruses, and other malicious programs from the endpoint devices. +- **Anti-malware**: A software that prevents and detects malicious software, including viruses, spyware, adware, and other types of malware. +- **Endpoint detection and response (EDR)**: An advanced security solution that uses behavioral analysis and machine learning techniques to detect and respond to advanced cyber threats in real-time. +- **DLP**: Data Loss Prevention is a security solution that prevents unauthorized access, theft, and data leakage of sensitive data from endpoint devices. +- **Next-generation firewall (NGFW)**: A firewall that is designed to provide advanced security features such as application-aware filtering, intrusion prevention, and malware detection. +- **Host-based intrusion prevention system (HIPS)**: A security solution that detects and prevents attacks at the host level by monitoring system events and processes for suspicious activity. +- **Host-based intrusion detection system (HIDS)**: A security solution that detects and alerts on suspicious activity at the host level by monitoring system logs and events. +- **Host-based firewall**: A firewall that is installed on the endpoint devices to monitor and control network traffic to and from the device. + +## Boot integrity + +Boot integrity **refers to the security measures implemented to protect the boot process of a computer system from unauthorized access or modification**. The boot process is a critical part of the system that initializes the hardware, loads the operating system, and launches the applications. Any compromise of the boot process can lead to serious security vulnerabilities, including malware infections, data breaches, and system crashes. + +Some of the common boot integrity solutions include: + +- **Boot security/Unified Extensible Firmware Interface (UEFI)**: UEFI is a replacement for the traditional BIOS (basic input/output system) firmware that provides enhanced security features, such as secure boot, which verifies the integrity of the firmware and operating system boot loaders before allowing them to execute. +- **Measured boot**: Measured boot is a feature of the UEFI firmware that measures the boot components and stores the measurements in a hardware-protected log called the Trusted Platform Module (TPM). The measurements can be used to verify the integrity of the boot components and detect any changes or tampering attempts. +- **Boot attestation**: Boot attestation is a process of verifying the integrity of the boot components by a trusted third party, such as a remote server or a security service. The attestation process involves collecting the boot measurements and verifying them against a set of trusted policies or standards. + +## Database + +Tokenization, salting, and hashing are all techniques used in database security to protect sensitive data. + +**Tokenization involves replacing sensitive data such as credit card numbers with a unique identifier called a token**. The token can be used to retrieve the original data if needed, but the original data is not stored in the database. This reduces the risk of data exposure in the event of a security breach. + +**Salting is a technique used to protect passwords. A random string of characters, called a salt, is added to the password before it is hashed**. This makes it much harder for attackers to crack passwords using techniques like dictionary attacks, as they must also determine the salt used in the hashing process. + +**Hashing involves converting sensitive data into a fixed-length string of characters that cannot be reversed to reveal the original data**. Hashing is often used to store passwords in a database, as it allows the system to verify a user's password without actually storing the password in plain text. However, it is important to use a strong hashing algorithm and a unique salt for each password to prevent attackers from cracking passwords through brute force attacks or rainbow table attacks. + +In addition to these techniques, database security solutions may also include access controls, encryption, auditing, and monitoring to protect against unauthorized access and data breaches. + +## Application security + +Application security **is a set of measures and best practices aimed at ensuring the security of software applications**. Here are some elaborations on specific application security concepts: + +- **Input validations**: Input validation is a security technique used to ensure that user input is clean, correct, and useful. By validating user input, applications can prevent various types of attacks, such as SQL injection, cross-site scripting, and command injection. +- **Secure cookies**: Cookies are small files that store data about a user's session on a website. Secure cookies are encrypted, preventing unauthorized access and modification by attackers. +- **HTTP headers**: HTTP headers are packets of data sent by a web server to a web client. They contain information about the server, the client, and the data being transferred. HTTP headers can be used to improve application security, for example, by preventing cross-site scripting attacks and clickjacking attacks. +- **Code signing**: Code signing is a technique used to verify the authenticity and integrity of software. Code signing involves attaching a digital signature to the code to ensure that it has not been tampered with and comes from a trusted source. +- **Allow list**: An allow list is a list of approved items, such as IP addresses, URLs, or file types, that are allowed to pass through a security filter. This can help prevent unauthorized access or data leakage. +- **Block list/deny list**: A block list, also known as a deny list, is a list of items that are blocked by a security filter. This can include IP addresses, URLs, or file types that are known to be malicious or unsafe. +- **Secure coding practices**: Secure coding practices are a set of best practices and guidelines that developers follow to ensure that their code is secure. This includes techniques such as input validation, proper error handling, and secure session management. +- **Static code analysis**: Static code analysis involves analyzing source code without executing it, looking for potential vulnerabilities and security flaws. Manual code review is a type of static code analysis where developers manually review code for security issues. +- **Dynamic code analysis**: Dynamic code analysis involves analyzing code while it is being executed to identify security vulnerabilities and weaknesses. +- **Fuzzing**: Fuzzing is a technique used to test software for security vulnerabilities by inputting random, unexpected, or malformed data into the application to see how it responds. This can help identify potential buffer overflows, SQL injection attacks, and other vulnerabilities. + +## Hardening + +Hardening **refers to the process of securing a system by reducing its vulnerabilities and increasing its overall security**. Here are some common hardening practices for different areas: + +- **Open ports and services**: The first step in hardening a system is to close any unnecessary open ports and services. This can be done by disabling any unused services, closing any unused ports, and implementing firewalls to restrict inbound and outbound traffic. +- **Registry**: The system registry is a critical component of a Windows system and can be vulnerable to attacks if not properly secured. Hardening the registry involves limiting access to it, using permissions and security policies to restrict who can modify registry keys and values, and disabling any unused or unnecessary features. +- **Disk encryption**: Disk encryption is the process of encoding data on a hard drive or other storage device so that it can only be accessed by authorized parties. Hardening a system with disk encryption involves using strong encryption algorithms, implementing proper key management and access controls, and regularly monitoring and auditing the system to detect any attempts at unauthorized access. +- **OS**: Hardening the operating system involves disabling any unused features, configuring security settings to the highest level possible, and keeping the OS up to date with the latest patches and updates. +- **Patch management**: Patch management involves keeping a system up to date with the latest security patches and updates. This includes regular installation of operating system and software updates, as well as monitoring for and applying any patches released by third-party vendors. Auto-update can be configured to automatically install the latest patches and updates as they become available. + +Overall, hardening involves implementing a range of security measures to make it more difficult for attackers to exploit vulnerabilities and gain unauthorized access to a system. + +## Self-encrypting drive (SED)/ full-disk encryption (FDE) + +Self-encrypting drives (SEDs) and full-disk encryption (FDE) **are both methods for encrypting all the data on a storage device, such as a hard drive or solid-state drive (SSD)**. SEDs are storage devices that have built-in encryption capabilities, while FDE involves using software to encrypt the entire disk. + +SEDs use a hardware-based encryption engine to encrypt and decrypt data on-the-fly, providing an extra layer of security compared to software-based encryption. SEDs typically use the Advanced Encryption Standard (AES) to encrypt data, and they can be configured to use different key lengths and modes of operation. Some SEDs also support the Opal Security Subsystem Class (Opal SSC) specification, which is an industry standard for self-encrypting drives. + +Opal is a security standard that defines a set of specifications for self-encrypting drives. It was developed by the Trusted Computing Group (TCG) and is supported by a wide range of hardware and software vendors. Opal-compliant SEDs use hardware-based encryption to protect data, and they support a range of features such as secure erasure and authentication. + +FDE, on the other hand, uses software to encrypt the entire disk, including the operating system, applications, and data. FDE is typically implemented using a disk encryption utility such as BitLocker (for Windows) or FileVault (for macOS). FDE can be used to protect data on laptops, desktops, and servers, and it can be configured to use different encryption algorithms and key lengths. + +Both SEDs and FDE provide a high level of security for data at rest, and they can be used to comply with various security regulations and standards. However, they have different trade-offs in terms of performance, cost, and manageability. SEDs are generally faster and more secure than FDE, but they are also more expensive and may require specialized hardware and software. FDE, on the other hand, is more affordable and easier to deploy, but it may have a slight impact on performance and may be vulnerable to attacks such as cold boot attacks. + +## Hardware root of trust + +Hardware root of trust **is a concept in computer security that involves the use of a secure hardware component to establish a trusted foundation for a system**. This hardware component, often called a Trusted Platform Module (TPM), is designed to securely store cryptographic keys and other sensitive data, and to perform secure boot and measurement of the system's software components. + +Hardware root of trust provides a strong defense against various types of attacks, including firmware attacks, bootkits, and rootkits. By establishing a trusted foundation for the system, hardware root of trust helps ensure that the system software has not been tampered with or modified in any way. + +## Trusted Platform Module (TPM) + +Trusted Platform Module (TPM) **is a hardware-based security module designed to provide a secure foundation for system security**. It is a microcontroller that is used to store and manage cryptographic keys, as well as to perform cryptographic operations such as encryption, decryption, and digital signatures. The TPM can be used to secure sensitive information and to authenticate the system to other devices or services. + +The TPM provides a root of trust for the system by ensuring that the system is in a known, secure state during the boot process. It can also be used to store and verify platform configuration data, such as boot code and firmware, and to provide secure storage for sensitive data, such as encryption keys and passwords. + +One of the main features of the TPM is the ability to create and manage cryptographic keys in a secure environment. The TPM uses a unique key hierarchy, with a root key that is stored in the TPM and protected by hardware security mechanisms. This root key can be used to generate and manage other keys, which can be used for a variety of security functions, such as encryption, decryption, and digital signatures. + +The TPM is typically implemented as a separate chip on the motherboard of a computer or other device. It communicates with the system through a set of standardized interfaces, such as the Trusted Computing Group's TPM interface specification. The TPM can be used in conjunction with other security technologies, such as secure boot, secure firmware updates, and secure storage, to provide a complete system security solution. + +## Sandboxing + +Sandboxing **is a technique used in computer security to isolate and control the execution of applications and processes**. It involves creating a restricted environment, known as a sandbox, where an application or process can execute without affecting other parts of the system. Sandboxing provides an additional layer of security by limiting the damage that can be caused by malicious software, vulnerabilities or human error. + +The sandbox typically includes restrictions such as limitations on network access, file system access, and communication with other processes. The goal is to prevent an application or process from accessing sensitive information or resources on the system, which could potentially compromise the security of the entire system. + +Sandboxing can be implemented using hardware, software, or a combination of both. Some examples of sandboxing techniques include virtualization, containerization, and application sandboxing. Sandboxing is commonly used in web browsers, mobile operating systems, and other software applications to prevent malware from accessing sensitive information or causing damage to the system. diff --git a/3.0-implementation/3.3-given-a-scenario-implement-secure-network-designs.md b/3.0-implementation/3.3-given-a-scenario-implement-secure-network-designs.md new file mode 100644 index 0000000..eda9cd8 --- /dev/null +++ b/3.0-implementation/3.3-given-a-scenario-implement-secure-network-designs.md @@ -0,0 +1,160 @@ +# 3.3 Given a scenario, implement secure network designs + +## Load balancing + +Load balancing **is the process of distributing incoming network traffic across multiple servers to ensure that no single server is overloaded, and to improve performance, reliability, and availability**. Load balancing can be implemented using hardware or software-based solutions. + +Some of the key concepts associated with load balancing include: + +- **Active/active**: This is a load balancing configuration in which all servers in the pool are actively handling requests at the same time. This type of configuration is typically used in environments where high availability is critical. +- **Active/passive**: This is a load balancing configuration in which one server in the pool is active and the others are passive, standing by as backups in case the active server fails. This type of configuration is typically used in environments where cost is a concern and high availability is not as critical. +- **Scheduling**: This refers to the algorithm used by the load balancer to determine which server in the pool should handle each incoming request. Some common scheduling algorithms include round robin, least connections, and IP hash. +- **Virtual IP**: This is an IP address that is used by the load balancer to represent a pool of servers. When a client connects to the virtual IP, the load balancer routes the request to one of the servers in the pool. +- **Persistence**: This refers to the ability of the load balancer to maintain state between the client and the server. Persistence can be implemented using source IP address, cookies, or other techniques to ensure that subsequent requests from the same client are directed to the same server. + +## Network segmentation + +Network segmentation **is a security strategy that involves dividing a computer network into smaller subnetworks to reduce the impact of a security breach**. The main idea behind network segmentation is to limit the exposure of sensitive information by controlling access to it. Here are some common types of network segmentation: + +1. **Virtual local area network (VLAN)**: VLAN is a type of network segmentation that enables you to group devices together based on their functions or logical groupings. This helps to prevent unauthorized access to sensitive data by separating them from other devices. +2. **Screened subnet (previously known as demilitarized zone)**: A screened subnet is a network that is located between an organization's internal network and the public Internet. The screened subnet provides an additional layer of security by filtering traffic between the internal network and the Internet. +3. **East-west traffic**: East-west traffic refers to the traffic that flows between servers or workloads within a data center. East-west traffic is usually less protected than north-south traffic (traffic that flows between the Internet and the internal network), making it an attractive target for attackers. +4. **Extranet**: An extranet is a private network that connects two or more organizations over the Internet. Extranets are often used to share data and resources securely between organizations. +5 **Intranet**: An intranet is a private network that is used within an organization. Intranets are often used to share information and resources between departments or teams within an organization. +5. **Zero Trust**: Zero Trust is a security concept that assumes that every device or user that tries to access a network is potentially compromised. Zero Trust networks verify every device or user that tries to access the network, and they limit access to only the resources that are needed to perform specific tasks. + +## Virtual private network (VPN) + +A Virtual Private Network (VPN) **is a secure, encrypted connection that allows users to access a private network over a public network such as the Internet**. VPNs are commonly used to provide remote access for users, secure communication between geographically separated offices, and to protect sensitive data while in transit. + +Here are some on VPN-related terms: + +- **Always-on**: Refers to a VPN connection that is automatically established and maintained whenever a device connects to the Internet. This ensures that all traffic from the device is encrypted and routed through the VPN tunnel. +- **Split tunnel vs. full tunnel**: In a split tunnel VPN, only traffic intended for the remote network is routed through the VPN tunnel, while other traffic is sent directly to the Internet. In a full tunnel VPN, all traffic is routed through the VPN tunnel, regardless of its destination. +- **Remote access vs. site-to-site**: Remote access VPNs are used by individual users to securely connect to a private network from a remote location, while site-to-site VPNs are used to securely connect multiple networks together over the Internet. +- **IPSec**: Internet Protocol Security (IPSec) is a suite of protocols used to encrypt and authenticate IP packets. It is commonly used in VPNs to establish a secure tunnel between devices. +- **SSL/TLS**: Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), are cryptographic protocols used to secure web traffic. They are commonly used in SSL/TLS VPNs to establish a secure connection between a user's device and a web server. +- **HTML5**: HTML5 VPNs use web technologies such as JavaScript and HTML5 to establish a secure connection between a user's device and a web server, eliminating the need for client-side software. +- **Layer 2 Tunneling Protocol (L2TP)**: L2TP is a protocol used to tunnel data over an IP network. It is commonly used in combination with IPSec to provide a secure VPN connection. + +## DNS + +DNS **stands for Domain Name System, which is a hierarchical and decentralized naming system for computers, services, or other resources connected to the internet or a private network**. It translates domain names, which are easy-to-remember words and phrases, into IP addresses, which are numerical addresses that computers use to identify each other on the network. This allows users to access websites, send emails, and perform other network activities using human-readable domain names instead of having to remember and enter lengthy IP addresses. The DNS system is composed of several components, including DNS servers, DNS resolvers, and DNS zones, which work together to manage the domain name resolution process. + +## Network access control (NAC) + +Network Access Control (NAC) **is a security solution that is designed to control access to network resources based on the user's identity, device type, and compliance with security policies**. NAC solutions can be implemented through agents or agentless methods. + +**Agent-based NAC solutions require the installation of software agents on the endpoints**, which are responsible for providing information about the device's security status and compliance with security policies. The agents can also enforce security policies on the endpoint, such as disabling access to the network if the endpoint is found to be non-compliant. + +**On the other hand, agentless NAC solutions use network-based techniques to assess the security status of endpoints and enforce security policies**. These techniques may include network scanning, vulnerability assessments, and identity-based authentication. Unlike agent-based solutions, agentless NAC does not require software installation on the endpoints, which can simplify deployment and management. However, agentless solutions may not provide the same level of granular control over endpoints as agent-based solutions. + +## Out-of-band management + +Out-of-band management **refers to the management of networking devices or systems through a separate, dedicated management channel that is physically separated from the primary data path or "*in-band*" network**. This is done to provide secure and reliable access to manage the devices or systems without being affected by any issues that may arise on the primary network. + +In an out-of-band management setup, a separate management network is created that is only accessible through dedicated management interfaces on the devices being managed. This allows network administrators to remotely manage the devices, even if the primary network is down or experiencing issues. Out-of-band management can include tasks such as configuration, troubleshooting, monitoring, and firmware upgrades. + +## Port security + +Port security **is a feature of network switches that enables administrators to specify which devices are allowed to connect to a specific switch port**. This is typically done to prevent unauthorized access to the network by restricting the devices that can be connected to a specific port. + +The following are some common techniques used in port security: + +- **Broadcast storm prevention**: This technique prevents a broadcast storm from occurring by limiting the number of broadcasts that can be sent on a port. +- **Bridge Protocol Data Unit (BPDU) guard**: This technique prevents loops from occurring in the network by preventing BPDU packets from being received on a port. +- **Loop prevention**: This technique prevents loops from occurring in the network by disabling a port when a loop is detected. +- **Dynamic Host Configuration Protocol (DHCP) snooping**: This technique prevents rogue DHCP servers from being connected to the network by monitoring DHCP messages and dropping any messages that do not originate from a trusted DHCP server. +- **Media access control (MAC) filtering**: This technique restricts the devices that can connect to a port by specifying a list of allowed MAC addresses. + +These techniques can be implemented using agent-based or agentless methods, depending on the network environment and the specific requirements of the organization. + +## Network appliances + +A network appliance **is a device or software application designed to perform a specific network function, such as routing, switching, security, or network monitoring**. It is a hardware or software tool that is placed on a network and provides a specific service or set of services. Some examples of network appliances are routers, switches, firewalls, intrusion detection systems, and load balancers. + +Here are some common network appliances: + +- **Jump servers**: A jump server is a specialized server that is used to access other servers and devices within a network. It is usually placed in a demilitarized zone (DMZ) or a separate network segment, and administrators use it to securely access other servers and devices without having to expose those devices to the public internet. +- **Proxy servers**: A proxy server is an intermediary server that sits between clients and servers and acts as a gateway for client requests. There are two types of proxy servers: forward proxy servers and reverse proxy servers. Forward proxy servers are used to access the internet on behalf of clients, while reverse proxy servers are used to distribute incoming requests among a group of servers. +- **Network-based intrusion detection system (NIDS)/network-based intrusion prevention system (NIPS)**: NIDS/NIPS are security appliances that monitor network traffic for signs of malicious activity. NIDS/NIPS can use different methods to detect attacks, including signature-based detection, heuristic/behavioral detection, and anomaly detection. NIDS/NIPS can be deployed in inline or passive mode, depending on the level of protection required. +- **HSM**: A hardware security module (HSM) is a specialized cryptographic device that is used to secure sensitive data and cryptographic keys. HSMs can be used to perform cryptographic operations, such as encryption and decryption, and to manage cryptographic keys. +- **Sensors**: Sensors are network devices that are used to collect data on network activity, such as traffic flows, packet payloads, and network events. Sensors can be deployed at different points in the network, such as at the perimeter or in the core, to provide visibility into network activity. +- **Collectors**: Collectors are network devices that are used to aggregate data from multiple sensors or other sources. Collectors can be used to store and analyze network data, and to provide a central point of control for network security. +- **Aggregators**: Aggregators are network devices that are used to combine multiple network connections into a single connection. Aggregators can be used to increase network bandwidth and to provide redundancy and failover protection. + +### Firewalls + +A firewall **is a network security system that monitors and controls incoming and outgoing network traffic based on predefined security rules**. It acts as a barrier between the internal network and the internet or other external networks to prevent unauthorized access and malicious attacks. + +Here are some types of firewalls and their elaboration: + +- **Web Application Firewall (WAF)**: It is a type of firewall that specifically targets web application traffic. It inspects HTTP traffic and applies security policies to protect against attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). +- **Next-Generation Firewall (NGFW)**: It is an advanced type of firewall that combines traditional firewall functionalities with additional features such as intrusion prevention, deep packet inspection, and application-level control. It provides more granular control over network traffic and can identify and block sophisticated threats that traditional firewalls may miss. +- **Stateful Firewall**: It is a type of firewall that keeps track of the state of network connections and only allows traffic that matches an existing connection to pass through. This provides additional security by preventing malicious traffic that is not part of an established connection. +- **Stateless Firewall**: It is a type of firewall that only inspects each individual packet and does not maintain any information about previous packets or network connections. It is less secure than stateful firewalls as it cannot prevent certain types of attacks such as TCP SYN floods and IP address spoofing. +- **Unified Threat Management (UTM)**: It is a type of firewall that integrates multiple security features into a single appliance, such as antivirus, intrusion prevention, VPN, and content filtering. It provides a comprehensive approach to network security. +- **Network Address Translation (NAT) Gateway**: It is a type of firewall that translates private IP addresses to public IP addresses, allowing devices on the internal network to access the internet without revealing their private IP addresses. It also provides an additional layer of security by hiding the internal network topology from the internet. +- **Content/URL Filter**: It is a type of firewall that filters web traffic based on the content or URL of the requested resource. It can block access to websites or web pages that contain inappropriate or malicious content. +- **Open-Source vs. Proprietary**: Firewalls can be either open-source or proprietary. Open-source firewalls are free and can be customized by the user, but may not have the same level of support as proprietary firewalls. Proprietary firewalls are commercial products that provide technical support and often have additional features and capabilities. +- **Hardware vs. Software**: Firewalls can be implemented as hardware devices or software programs. Hardware firewalls are standalone appliances that are installed at the network perimeter and provide dedicated security services. Software firewalls are installed on a server or workstation and protect that device. +- **Appliance vs. Host-based vs. Virtual**: Firewalls can be deployed as physical appliances, installed on a host, or run as a virtual machine. Appliance-based firewalls are standalone devices that are specifically designed for network security. Host-based firewalls are installed on individual computers or servers and protect the host device. Virtual firewalls are software-based and run on a virtual machine. + +## Access control list (ACL) + +An Access Control List (ACL) **is a security mechanism used in computer networks and operating systems to restrict access to specific resources**. It is a list of rules that controls which network traffic or system resources are allowed or denied to a specific user or group of users. + +ACLs can be implemented on various levels, such as at the router or switch level, at the file system level, or at the application level. They are composed of entries that identify a specific user, group, or network, along with a set of permissions or actions that are allowed or denied. + +ACLs can be used for a variety of purposes, including restricting access to sensitive data, controlling network traffic flow, and enforcing security policies. They are often used in conjunction with other security measures, such as firewalls and intrusion detection systems, to provide comprehensive network security. + +## Route security + +Route security **refers to measures taken to protect the routing infrastructure of a network from various types of attacks, including route hijacking, route leaks, and denial-of-service (DoS) attacks**. The routing infrastructure is critical to the proper functioning of a network, as it determines the paths that packets take as they traverse the network. A compromise of the routing infrastructure can result in traffic being redirected or lost, leading to significant disruptions or outages. + +To enhance route security, several measures can be taken, including: + +1. BGP (Border Gateway Protocol) security: BGP is the protocol used to exchange routing information between different networks on the internet. Enhancing BGP security involves measures such as filtering incoming and outgoing BGP announcements, using BGP origin validation, and implementing BGP route validation. +2. RPKI (Resource Public Key Infrastructure): RPKI is a system that provides a way to cryptographically sign routing information and validate the authenticity of this information. It helps prevent route hijacks and leaks by allowing routers to verify that the origin of a BGP announcement is authorized to advertise a particular prefix. +3. Route filtering: Route filtering involves implementing access control lists (ACLs) and route maps to control the flow of traffic through the network. It helps prevent the spread of malicious traffic and enables the prioritization of legitimate traffic. +4. Route reflectors: Route reflectors are used to simplify the management of BGP in large networks. They are responsible for propagating routing information to other routers in the network. By using route reflectors, a network can reduce the number of BGP sessions required, which can improve scalability and reduce the risk of errors. +5. Route analytics: Route analytics involves using tools to monitor and analyze the routing information flowing through the network. It can help detect anomalies and potential security issues, such as route leaks or hijacks, and enable proactive measures to prevent or mitigate them. + +Overall, implementing route security measures can help improve the reliability and security of a network's routing infrastructure, and ensure the proper functioning of critical services and applications. + +## Quality of service (QoS) + +Quality of Service (QoS) **refers to a set of techniques used to manage network traffic and prioritize certain types of traffic over others**. QoS is used to ensure that critical network traffic is given priority over non-critical traffic. + +QoS can be implemented by setting network policies that define the minimum or maximum bandwidth, delay, jitter, and packet loss rates for different types of traffic. QoS can also be implemented by using various queuing mechanisms, such as First-In-First-Out (FIFO), Weighted Fair Queuing (WFQ), and Priority Queuing (PQ), to prioritize traffic flows based on their importance. + +## Implications of IPv6 + +IPv6 is the latest version of the Internet Protocol (IP), designed to replace the current version, IPv4. IPv6 provides several benefits, including an increased address space, better security, and improved performance. However, its implementation can also have several implications: + +1. IPv6 addresses are longer than IPv4 addresses, making them more difficult to remember and potentially more vulnerable to typographical errors. +2. IPv6 requires the use of new hardware and software that support the protocol, which can lead to significant costs for organizations that need to upgrade their networks. +3. IPv6 introduces new security risks, such as the potential for attackers to use IPv6 tunnels to bypass security measures and the need for new security mechanisms to protect IPv6 traffic. +4. IPv6 introduces new routing protocols and new features such as automatic address configuration, which can make it more difficult to manage and secure networks. +5. Dual-stack networks, which support both IPv4 and IPv6, can create additional complexity and increase the attack surface of a network. +6. IPv6 may not be backward compatible with older IPv4-based systems and applications, which can cause compatibility issues for organizations that rely on legacy systems. + +Overall, the adoption of IPv6 requires careful planning and consideration of the potential implications and risks involved. + +## Port spanning/port mirroring + +Port spanning or port mirroring **is a feature available on many network switches that allows a network administrator to monitor network traffic by sending a copy of network packets from one port on the switch to another port that has been configured to receive the mirrored traffic**. + +Port spanning/mirroring can be useful for network troubleshooting, performance monitoring, and security analysis. For example, a network administrator could configure port spanning/mirroring to send a copy of all traffic from a critical server to a network monitoring tool to detect any suspicious activity or performance issues. + +Port taps are a type of network tap that can be used for more advanced network monitoring and analysis. Unlike port spanning/mirroring, which is a software-based feature on a network switch, port taps are hardware devices that physically tap into the network cabling to capture a copy of all traffic flowing through the network. This allows for more accurate and detailed network analysis, as port taps can capture all traffic on the network, including traffic that may not be visible to a network switch due to VLAN segmentation or other network configurations. + +## Monitoring services + +Network monitoring services **are tools and technologies used to monitor network traffic and activity to identify potential security threats, troubleshoot network issues, and ensure network performance and availability**. These services can include software and hardware solutions that collect and analyze network data, including network traffic, system performance, and security events. Network monitoring services can be used to detect network outages, bandwidth constraints, and security breaches, as well as identify usage patterns and trends to improve network performance and capacity planning. Network monitoring services can also provide real-time alerts and notifications to network administrators, allowing them to quickly respond to security threats and network issues. + +## File integrity monitors + +File Integrity Monitoring (FIM) **is a security solution designed to detect and alert on any unauthorized or unexpected changes to critical files and directories on a system or network**. FIM compares the current state of files and directories to their baseline or previous state, detecting any changes such as modifications, deletions, or additions. FIM can help organizations detect and prevent unauthorized access, data exfiltration, and data breaches. + +FIM typically operates by creating a snapshot of the baseline of the files and directories to be monitored. This baseline is used as a reference point for future changes, with any deviations from the baseline flagged as potentially suspicious. FIM can also generate alerts and notifications to administrators when a change is detected, and in some cases, can even block unauthorized changes or roll back unauthorized changes to the previous state. diff --git a/3.0-implementation/3.4-given-a-scenario-install-and-configure-wireless-security-settings.md b/3.0-implementation/3.4-given-a-scenario-install-and-configure-wireless-security-settings.md new file mode 100644 index 0000000..323c4ef --- /dev/null +++ b/3.0-implementation/3.4-given-a-scenario-install-and-configure-wireless-security-settings.md @@ -0,0 +1,54 @@ +# 3.4 Given a scenario, install and configure wireless security settings + +## Cryptographic protocols + +Cryptographic protocols **are sets of rules that are designed to secure communication between two parties over a network**. In the context of wireless security, cryptographic protocols are used to protect the data transmitted between wireless devices and access points. + +Some common cryptographic protocols used in wireless security include: + +- **WiFi Protected Access 2 (WPA2)**: This is the most widely used protocol for securing wireless networks. It uses the Advanced Encryption Standard (AES) algorithm to encrypt data transmitted over the wireless network. +- **WiFi Protected Access 3 (WPA3)**: This is the latest version of the WPA protocol and provides stronger security than WPA2. It uses a new key exchange protocol called Simultaneous Authentication of Equals (SAE) to protect against attacks that target the authentication process. +- **Counter-mode/CBC-MAC Protocol (CCMP)**: This is the encryption protocol used in WPA2 and WPA3. It uses AES in counter mode for encryption and CBC-MAC for message authentication. +- **Simultaneous Authentication of Equals (SAE)**: This is a key exchange protocol used in WPA3. It provides stronger protection against attacks that try to steal the password used for authentication. + +These cryptographic protocols are designed to provide strong protection against attacks that try to intercept or modify data transmitted over wireless networks. However, it is important to note that the security of wireless networks also depends on other factors such as the strength of passwords, the configuration of network devices, and the physical security of access points. + +## Authentication protocols + +Authentication protocols **are used to verify the identity of users or devices attempting to connect to a network or access a resource**. Here are some commonly used authentication protocols: + +- **Extensible Authentication Protocol (EAP**): EAP is an authentication framework used in wireless networks and point-to-point connections. It supports a variety of authentication methods, including password-based, token-based, and certificate-based authentication. +- **Protected Extensible Authentication Protocol (PEAP)**: PEAP is a more secure version of EAP that encrypts the EAP conversation using Transport Layer Security (TLS) or Secure Sockets Layer (SSL) encryption. It provides protection against eavesdropping attacks. +- **EAP-FAST**: EAP-FAST is a faster version of EAP that eliminates the need for digital certificates. It uses a shared secret instead of digital certificates to authenticate users. +- **EAP-TLS**: EAP-TLS is a certificate-based authentication protocol that uses digital certificates to authenticate users. It provides strong security against man-in-the-middle attacks and other types of attacks. +- **EAP-TTLS**: EAP-TTLS is a combination of EAP and Tunneling Protocol (TTLS). It provides authentication and confidentiality for data exchange between clients and servers. +- **IEEE 802.1X**: IEEE 802.1X is a standard for port-based network access control. It provides a mechanism for authenticating devices before allowing them to connect to a network. +- Remote Authentication Dial-in User Service (RADIUS) Federation: RADIUS Federation is a standard for exchanging authentication and authorization data between different RADIUS servers. It allows users to authenticate across different domains and networks. + +All these authentication protocols help in securing the network by verifying the identity of users or devices before granting access to network resources. + +## Methods + +Wireless configuration methods **refer to the different ways of configuring a wireless network to allow access to authorized users while preventing unauthorized access**. Some common wireless configuration methods include: + +1. **Pre-shared key (PSK)**: This is a common method of securing wireless networks for home and small office use. With PSK, all devices on the network share a common passphrase, and users enter this passphrase to gain access to the network. However, this method is vulnerable to attacks, such as dictionary attacks or brute force attacks, where hackers try to guess the passphrase. +2. **Enterprise**: This method is used in larger organizations and requires a RADIUS server for authentication. Enterprise networks use a digital certificate or username and password to authenticate users. +3. **Open**: With this method, anyone can connect to the wireless network without authentication. Open networks are not secure and should only be used in public places such as cafes or libraries. + +Other wireless configuration methods include: + +1. **WiFi Protected Setup (WPS)**: This method is used to simplify the process of connecting devices to a wireless network. WPS allows users to connect to the network without entering the SSID or passphrase. +2. **Captive portals**: A captive portal is a web page that users are redirected to when they first connect to a wireless network. Users must enter their credentials, accept terms of use, or pay a fee before they can access the internet. Captive portals are commonly used in public places such as airports or hotels. + +It is important to note that the choice of wireless configuration method should be based on the security needs of the organization or individual, as well as the ease of use for the end-users. + +## Installation considerations + +When planning and installing a wireless network, there are several considerations to take into account to ensure optimal performance and security. Some of these considerations include: + +- **Site surveys**: Before installing a wireless network, it is important to conduct a site survey to determine the best locations for access points (APs) and identify any potential sources of interference. +- **Heat maps**: A heat map is a visual representation of the wireless coverage and signal strength in a given area. Heat maps can help identify areas with poor coverage or signal strength and inform the placement of APs. +- **WiFi analyzers**: WiFi analyzers are software tools that can be used to troubleshoot wireless networks, analyze signal strength, and identify potential sources of interference. +- **Channel overlaps**: WiFi networks operate on different channels, and it is important to avoid channel overlaps to minimize interference and maximize performance. +- **Wireless access point (WAP) placement**: Access point placement is critical to ensuring optimal performance and coverage. Access points should be placed in locations where they can provide coverage to the desired areas while avoiding interference from other sources. +- **Controller and access point security**: It is important to secure both the wireless access points and the wireless controller. Access points should be configured with strong passwords, and the controller should be protected from unauthorized access. Additionally, it is important to regularly update the firmware on both the access points and controller to address any known vulnerabilities. diff --git a/3.0-implementation/3.5-given-a-scenario-implement-secure-mobile-solutions.md b/3.0-implementation/3.5-given-a-scenario-implement-secure-mobile-solutions.md new file mode 100644 index 0000000..58b2361 --- /dev/null +++ b/3.0-implementation/3.5-given-a-scenario-implement-secure-mobile-solutions.md @@ -0,0 +1,78 @@ +# 3.5 Given a scenario, implement secure mobile solutions + +## Connection methods and receivers + +Connection methods and receivers **refer to the different ways mobile devices can connect and receive data from other devices or networks**. These methods include cellular networks, Wi-Fi, Bluetooth, Near Field Communication (NFC), Infrared (IR), USB, point-to-point, point-to-multipoint, Global Positioning System (GPS), and Radio Frequency Identification (RFID). Depending on the device and its capabilities, it can use one or more of these methods to establish a connection and exchange data with other devices or networks. + +- **Cellular**: This is a wireless communication technology that allows mobile devices to connect to the internet or other networks through cellular networks provided by mobile network operators. Cellular networks use radio waves to transmit and receive data, voice, and multimedia content. +- **WiFi**: WiFi is a wireless networking technology that allows devices to connect to a network using radio signals in the 2.4 GHz and 5 GHz frequency bands. WiFi is commonly used for local area networking and provides high-speed wireless connectivity to devices within a specific range of the wireless access point. +- **Bluetooth**: Bluetooth is a wireless communication technology that enables devices to connect and communicate with each other over short distances using radio waves. Bluetooth is commonly used for wireless audio streaming, file sharing, and connecting peripherals like keyboards and mice to computers. +- **NFC**: NFC (Near Field Communication) is a wireless communication technology that allows devices to establish a short-range wireless connection with each other for data transfer, access control, and other applications. NFC is commonly used for mobile payments, access control systems, and file sharing between two devices. +- **Infrared**: Infrared is a wireless communication technology that uses light waves to transmit data between devices. Infrared communication requires a clear line of sight between the sender and receiver, and it is commonly used for remote controls and data transfer between mobile devices. +- **USB**: USB (Universal Serial Bus) is a wired connection method that allows devices to connect to a host computer or other device for data transfer, charging, and other purposes. USB cables are commonly used to connect smartphones, tablets, and other mobile devices to computers. +- **Point-to-point**: Point-to-point connections are wireless or wired connections between two devices. These connections can be used for data transfer, audio/video streaming, or other purposes. +- Point-to-multipoint: Point-to-multipoint connections are wireless or wired connections between one device and multiple devices. These connections can be used for broadcasting data, video, or audio to multiple devices at once. +- **GPS**: GPS (Global Positioning System) is a satellite-based navigation system that allows mobile devices to determine their location and velocity accurately. GPS is commonly used in mobile mapping applications, geolocation services, and navigation systems. +- **RFID**: RFID (Radio Frequency Identification) is a wireless communication technology that uses radio waves to identify and track objects or people. RFID tags can be attached to objects, and RFID readers can detect and track the tags to monitor inventory, access control, and other applications. + +## Mobile device management (MDM) + +Mobile device management (MDM) **refers to the administration of mobile devices** such as smartphones, tablets, laptops, and wearables. MDM solutions enable IT administrators to remotely manage and control devices, applications, and data on those devices. MDM typically includes features such as device inventory, device configuration management, application management, data management, and security management. It can help organizations to secure their mobile devices, protect sensitive data, and ensure compliance with regulations and policies. MDM solutions may be implemented using on-premises software, cloud-based services, or a combination of both. + +Some examples of managed features are: + +- **Application management**: It involves managing and distributing mobile applications to devices, controlling application updates, and removing applications remotely. MDM solutions allow IT administrators to distribute, manage, and update applications to ensure that employees have access to the latest versions of applications that they need to perform their job functions. +- **Content management**: This refers to the ability to manage and control access to corporate content on mobile devices. MDM solutions enable organizations to remotely configure devices and enforce security policies to ensure that corporate content remains secure and that sensitive information is not exposed. +- **Remote wipe**: This is a security feature that enables IT administrators to remotely erase all data and settings from a lost or stolen device. This ensures that sensitive information does not fall into the wrong hands. +- **Geofencing**: It is a feature that allows IT administrators to create virtual boundaries around specific locations. With geofencing, administrators can configure devices to automatically perform certain actions when the device enters or exits a specified location. +- **Geolocation**: It refers to the ability to determine the location of a mobile device using GPS or other location-based technologies. Geolocation can be used to track the location of lost or stolen devices and to enforce geofencing policies. +- **Screen locks**: It involves setting up security policies to lock the device screen after a period of inactivity or after a specified number of failed login attempts. This helps prevent unauthorized access to the device. +- **Push notifications**: It refers to the ability to push notifications to mobile devices to notify users of new messages, updates, or other important information. +- **Passwords and PINs**: It is a security feature that requires users to enter a password or PIN to unlock their mobile device. This helps prevent unauthorized access to the device. +- Biometrics: This involves using fingerprint, facial recognition, or other biometric data to authenticate users and grant access to mobile devices. +- **Context-aware authentication**: It is a security feature that uses contextual data, such as the user's location or the time of day, to determine whether to grant access to a device or application. +- **Containerization**: It involves separating personal and business data on a mobile device into separate containers. This allows organizations to protect their corporate data without infringing on the privacy of the employee's personal data. +- **Storage segmentation**: It refers to the ability to partition the device storage into different areas with varying levels of security. This allows organizations to protect sensitive data from unauthorized access. +- **Full device encryption**: It involves encrypting all data on a mobile device to protect it from unauthorized access. This ensures that sensitive information remains secure even if the device is lost or stolen. + +## Mobile devices + +- **MicroSD hardware security module (HSM)**: A hardware security module (HSM) is a physical computing device that provides secure cryptographic services to protect sensitive data and transactions. A microSD HSM is a small HSM in the form factor of a microSD card that can be inserted into a mobile device's microSD slot, adding an additional layer of hardware security to the device. +- **MDM/Unified Endpoint Management (UEM)**: Mobile Device Management (MDM) and Unified Endpoint Management (UEM) are solutions that allow organizations to manage and secure their mobile devices, including smartphones and tablets. These solutions provide features such as remote device wipe, application management, content management, and policy enforcement to ensure that mobile devices are used in a secure and compliant manner. +- **Mobile application management (MAM)**: Mobile Application Management (MAM) is a subset of mobile device management (MDM) that focuses on the management of mobile applications rather than the entire device. MAM solutions allow organizations to manage and secure the mobile applications that their employees use, ensuring that sensitive data is protected and compliance requirements are met. +- **SEAndroid**: Security-Enhanced Android (SEAndroid) is a set of security enhancements for the Android operating system developed by the United States National Security Agency (NSA) and made available as open source software. SEAndroid adds mandatory access control (MAC) policies to Android, which allow fine-grained control over the security of Android apps and the system as a whole. This helps to mitigate the risk of vulnerabilities and attacks on Android devices. + +## Enforcement and monitoring of + +Enforcement and monitoring of mobile device usage is an essential aspect of mobile device management (MDM) and unified endpoint management (UEM) solutions. This involves implementing policies and controls to ensure that mobile devices are used in a secure and compliant manner. + +Here are some examples of enforcement and monitoring of various mobile device usage scenarios: + +- **Third-party application stores**: Enterprises may choose to block access to third-party application stores to prevent employees from downloading potentially malicious apps. +- **Rooting/jailbreaking**: Rooting or jailbreaking a device can circumvent security controls and allow malicious apps to run. Enterprises may prohibit rooting/jailbreaking of devices or detect if a device has been rooted/jailbroken. +- **Sideloading**: Sideloading refers to installing apps from sources other than the official app store. Enterprises may prohibit sideloading or implement controls to monitor and allow only approved sideloaded apps. +- **Custom firmware**: Enterprises may prohibit or detect the use of custom firmware, which can introduce security vulnerabilities or cause compatibility issues. +- **Carrier unlocking**: Carrier unlocking allows a device to be used on other carriers' networks. Enterprises may prohibit carrier unlocking or detect if a device has been carrier unlocked. +- **Firmware over-the-air (OTA) updates**: OTA updates can introduce security patches and bug fixes, but they can also introduce vulnerabilities. Enterprises may enforce the use of approved OTA updates or test updates before deploying them. +- **Camera use**: Enterprises may prohibit or control the use of cameras on mobile devices to protect sensitive information. +- **SMS/Multimedia Messaging Service (MMS)/Rich Communication Services (RCS)**: Enterprises may monitor or block the use of messaging services to prevent data leakage or inappropriate use. +- **External media**: Enterprises may prohibit or control the use of external media such as SD cards, USB drives, or external hard drives to prevent data leakage. +- **USB On-The-Go (USB OTG)**: USB OTG allows a mobile device to act as a USB host and connect to other USB devices. Enterprises may monitor or control the use of USB OTG to prevent data theft or malware infection. +- **Recording microphone**: Enterprises may monitor or block the use of a device's microphone to prevent unauthorized audio recording. +- **GPS tagging**: GPS tagging can reveal the location of a device or the user. Enterprises may monitor or control the use of GPS tagging to protect privacy. +- **WiFi direct/ad hoc**: WiFi direct and ad hoc networks allow devices to connect directly to each other without an intermediary access point. Enterprises may monitor or control the use of WiFi direct and ad hoc networks to prevent unauthorized data sharing. +- **Tethering**: Tethering allows a device to share its internet connection with other devices. Enterprises may monitor or control the use of tethering to prevent unauthorized data usage. +- **Hotspot**: A hotspot allows other devices to connect to a mobile device's internet connection. Enterprises may monitor or control the use of hotspots to prevent unauthorized access. +- **Payment methods**: Enterprises may enforce the use of approved payment methods and monitor for unauthorized payment transactions. + +## Deployment models + +Deployment models **refer to the different ways in which mobile devices are deployed and managed in an organization**. The following are some commonly used deployment models: + +- **Bring your own device (BYOD)**: This deployment model allows employees to use their personal mobile devices for work-related purposes. BYOD is often implemented to reduce costs and increase employee productivity by allowing them to work from their preferred devices. However, BYOD brings security challenges, as employees may use devices that are not properly secured or managed, which could expose sensitive corporate data to unauthorized access. +- **Corporate-owned personally enabled (COPE)**: In this model, the company owns and provides mobile devices to employees, but employees are allowed to use them for personal purposes as well. COPE devices are usually managed and secured by the company's IT department, which can install and configure apps, set up policies and restrictions, and monitor and enforce compliance. +- **Choose your own device (CYOD)**: In CYOD deployment model, employees are given a selection of company-approved devices to choose from. This approach provides employees with some level of choice and flexibility, while still enabling IT to manage and secure the devices. +- **Corporate-owned**: This deployment model involves providing employees with company-owned mobile devices that are managed and controlled entirely by the IT department. This model is often used in highly regulated industries or where strict security policies are required. +- **Virtual desktop infrastructure (VDI)**: In this deployment model, mobile devices are used to access virtual desktops or applications hosted on remote servers. The actual computing and data processing take place on the server side, while the mobile device acts as a terminal to display the results. VDI can provide a high level of security, as data is not stored on the mobile device, but rather in the secure data center. + +Overall, the deployment model chosen depends on various factors such as the organization's security policies, budget, and user requirements. diff --git a/3.0-implementation/3.6-given-a-scenario-apply-cybersecurity-solutions-to-the-cloud.md b/3.0-implementation/3.6-given-a-scenario-apply-cybersecurity-solutions-to-the-cloud.md new file mode 100644 index 0000000..57ee18d --- /dev/null +++ b/3.0-implementation/3.6-given-a-scenario-apply-cybersecurity-solutions-to-the-cloud.md @@ -0,0 +1,73 @@ +# 3.6 Given a scenario, apply cybersecurity solutions to the cloud + +## Cloud security controls + +Cloud security controls **are a set of measures and technologies that are implemented to protect cloud-based resources and data from unauthorized access, data breaches, and other security threats**. These controls are designed to ensure the confidentiality, integrity, and availability of cloud-based resources and data. + +Some cloud security controls are: + +- **High availability across zones**: Refers to the ability of a cloud infrastructure to provide redundancy and failover across multiple geographical zones to ensure that applications and services remain available in the event of an outage or failure in one zone. +- **Resource policies**: Refers to a set of rules and permissions that govern access to cloud resources. These policies are used to define who can access resources, what they can do with them, and under what conditions. +- **Secrets management**: Refers to the management and protection of sensitive information such as passwords, API keys, and other cryptographic keys that are used to secure cloud resources. Secrets management tools help ensure that this information is securely stored and accessed only by authorized users and applications. +- **Integration and auditing**: Refers to the integration of cloud security controls with other security systems and tools, such as SIEMs and log management tools. Auditing is the process of monitoring and reviewing security events to ensure that security controls are effective and that security policies are being followed. Cloud providers typically offer tools and services that enable integration and auditing to be performed easily and effectively. + +### Storage + +Storage **cloud security controls are measures put in place to ensure the security and integrity of data stored in a cloud storage environment**. These controls help to protect the data from unauthorized access, data loss, and data breaches. Some of the important security controls for storage cloud are: + +1. **Permissions**: Permissions are the access controls used to manage access to cloud storage resources. It ensures that only authorized users have access to the data, preventing unauthorized access, modification, or deletion of data. Permission controls can be managed using various authentication and authorization mechanisms, such as access keys, policies, and roles. +2. **Encryption**: Encryption is used to protect data stored in the cloud storage from unauthorized access. Data encryption protects data at rest and in transit, ensuring the confidentiality, integrity, and availability of the data. Encryption can be implemented using different encryption algorithms and key management systems. +3. **Replication**: Replication ensures that data stored in the cloud storage is not lost in case of any hardware failure or disaster. It provides redundancy and availability of data by replicating data across multiple locations or data centers. Replication helps to prevent data loss due to hardware failure or natural disasters. +4. **High availability**: High availability ensures that data stored in the cloud storage is always available to authorized users. High availability is achieved by using redundant systems, failover mechanisms, and load balancing techniques to ensure that data is always available even in case of system failure or network outage. + +Overall, these security controls provide robust protection for data stored in cloud storage, ensuring that it is secure, available, and accessible only to authorized users. + +### Network + +Network **cloud security controls are measures taken to secure the network infrastructure of cloud computing services**. Some of these controls include: + +1. **Virtual networks**: Cloud providers offer the ability to create virtual networks that operate independently of the physical network, enabling customers to segment their network traffic and create network topologies that meet their specific requirements. +2. **Public and private subnets**: Subnets are used to segment the network into smaller, more manageable parts. Public subnets are accessible to the internet, while private subnets are not. This provides an additional layer of security for sensitive data. +3. **Segmentation**: Network segmentation is the practice of dividing a network into smaller, more secure zones. By separating different types of traffic, such as production and development environments, security can be improved. +4. **API inspection and integration**: Cloud providers offer APIs that allow customers to automate the management of their cloud services. However, these APIs also create potential vulnerabilities. By inspecting API traffic and integrating security controls, such as rate limiting and access controls, cloud providers can help protect customers from API-based attacks. + +### Compute + +Compute **cloud security controls refer to security measures and mechanisms put in place to secure cloud computing resources such as virtual machines, servers, and containers**. Here are some examples of compute cloud security controls: + +- **Security groups**: These are virtual firewalls that control inbound and outbound traffic to virtual machines. They allow administrators to specify which ports and protocols are allowed or denied for specific virtual machines. +- **Dynamic resource allocation**: This refers to the ability of cloud computing resources to scale up or down automatically based on demand. This helps to ensure that resources are always available to meet workload requirements. +- **Instance awareness**: This refers to the ability to monitor and manage cloud computing resources such as virtual machines, servers, and containers. Instance awareness allows administrators to monitor resource usage, detect potential threats, and take corrective actions. +- **Virtual private cloud (VPC) endpoint**: This is a secure way to access cloud services over a private network. VPC endpoints allow administrators to access cloud services without exposing them to the public internet. +- **Container security**: Containers are a lightweight alternative to virtual machines that provide isolated environments for running applications. Container security controls include access controls, image scanning, and vulnerability management. + +Overall, compute cloud security controls help to protect cloud computing resources from unauthorized access, data breaches, and other security threats. + +## Solutions + +- **Cloud Access Security Broker (CASB)**: Cloud Access Security Broker (CASB) is a solution that helps organizations monitor and secure their cloud environments by providing visibility into cloud services and the ability to enforce security policies. CASB solutions can provide a range of security controls, including data loss prevention (DLP), access control, encryption, and threat detection. +- **Application security**: Application security in a cloud environment involves securing the software applications that run on cloud infrastructure. This can include security testing, vulnerability management, and secure software development practices. Cloud providers often offer security features for their application services, such as identity and access management (IAM), encryption, and secure network communication. +- **Next-generation secure web gateway (SWG)**: Next-generation secure web gateway (SWG) is a solution that provides security for web traffic, including the ability to inspect and block malicious traffic. SWG solutions can also provide URL filtering and content filtering to enforce acceptable use policies and prevent data leakage. +- **Firewall considerations in a cloud environment**: In a cloud environment, firewalls can be implemented using cloud-native solutions or by using virtual appliances that run on cloud infrastructure. It is important to understand how traffic flows within the cloud environment and to implement segmentation to limit the blast radius in case of a breach. Additionally, organizations should consider the cost of implementing firewalls in a cloud environment and determine the most cost-effective solution for their needs. + +## Cloud native controls vs. third-party solutions + +Cloud native controls are security solutions that are provided by the cloud service provider themselves. These controls are typically designed to work specifically with the provider's cloud infrastructure, and are integrated into their platform. + +Some examples of cloud native controls include: + +- Identity and access management (IAM) tools provided by the cloud provider to manage user access and permissions. +- Encryption tools that allow you to encrypt data stored on the cloud provider's servers. +- Network security tools that allow you to create virtual private networks (VPNs) and set up firewall rules to restrict traffic. +- Monitoring and logging tools that allow you to monitor your cloud environment for suspicious activity. + +On the other hand, third-party solutions are security tools that are provided by a vendor that specializes in security solutions. These tools are designed to work across different cloud environments, and can be used to secure your cloud environment regardless of which cloud provider you use. + +Some examples of third-party cloud security solutions include: + +- Cloud access security brokers (CASBs), which provide a layer of security between your on-premises infrastructure and your cloud environment. +- Cloud workload protection platforms (CWPPs), which provide security for workloads running in the cloud. +- Cloud security posture management (CSPM) solutions, which help you manage your security posture across your cloud environment. +- Security information and event management (SIEM) solutions, which provide centralized monitoring and analysis of security events across your cloud environment. + +Both cloud native controls and third-party solutions have their own advantages and disadvantages. Cloud native controls are often more tightly integrated with the cloud provider's infrastructure, which can make them easier to manage and more cost-effective. However, third-party solutions may offer more advanced features and may be more customizable to your specific needs. Ultimately, the best approach to cloud security will depend on your organization's specific requirements and the cloud services you use. diff --git a/3.0-implementation/3.7-given-a-scenario-implement-identity-and-account-management-controls.md b/3.0-implementation/3.7-given-a-scenario-implement-identity-and-account-management-controls.md new file mode 100644 index 0000000..7932eb5 --- /dev/null +++ b/3.0-implementation/3.7-given-a-scenario-implement-identity-and-account-management-controls.md @@ -0,0 +1,46 @@ +# 3.7 Given a scenario, implement identity and account management controls + +## Identity + +Identity **refers to the unique characteristics and traits that identify an individual or entity within a system or environment**. In information security, identity and account management controls are used to ensure that only authorized individuals or entities are granted access to resources and data within a system. + +Some related concepts in this domain include: + +- **Identity provider (IdP)**: An entity that creates, maintains, and manages digital identities for users within a system. IdPs are responsible for issuing authentication credentials and managing user access rights. +- **Attributes**: Characteristics or properties of a user's digital identity, such as their name, email address, role, group membership, etc. Attributes are used to define access policies and control user access to resources. +- **Certificates**: Digital documents used to verify the identity of an entity, such as a user or a device. Certificates are issued by a trusted authority and are used to authenticate users and encrypt communications. +- **Tokens**: Small pieces of data that are used to authenticate a user's identity. Tokens can be physical (such as a smart card or a USB key) or digital (such as a software token or a mobile app). +- **SSH keys**: Secure Shell (SSH) keys are used for secure remote access to systems and resources. SSH keys provide a way to authenticate the identity of the user or device requesting access. +- **Smart cards**: Physical tokens that store digital certificates and are used for authentication and access control. Smart cards typically require a user to enter a PIN to unlock the card and access its contents. + +## Account types + +**Account types refer to the different types of accounts that exist within an organization's IT environment**. Here are some common types of accounts: + +- **User account**: A user account is assigned to an individual user and provides access to specific resources, applications, and services based on the user's job role and responsibilities. +- **Shared and generic accounts/credentials**: Shared accounts are used by multiple users, typically for accessing common resources such as a shared mailbox or a team collaboration tool. Generic accounts, on the other hand, are used for non-human entities such as applications or system services. +- **Guest accounts**: Guest accounts are temporary accounts created for individuals who do not have a permanent role in the organization, such as contractors or vendors. These accounts have limited access and are typically time-limited. +- **Service accounts**: Service accounts are used by applications or services to access other resources on the network. These accounts are often automated and have their own set of credentials. + +In addition to account types, identity and account management also involve managing various aspects of these accounts, such as authentication, authorization, and access control. It also involves managing the lifecycle of these accounts, such as creation, modification, and termination. + +## Account policies + +Account policies **are a set of rules and guidelines designed to manage user and account security within an organization**. The policies cover various aspects of account management, such as access controls, password complexity, and account audits, among others. + +Here are some of the topics covered by account policies: + +- **Password complexity**: This policy requires users to create complex and strong passwords that are difficult to guess or crack. A strong password typically contains a mix of upper and lowercase letters, numbers, and special characters. +- **Password history**: This policy prevents users from reusing their previous passwords when creating a new password. +- **Password reuse**: This policy prevents users from reusing the same password for multiple accounts or systems. +- **Network location**: This policy restricts user access to certain network resources based on their location. +- **Geofencing**: This policy defines geographical boundaries and restricts access to certain resources based on the user's location. +- **Geotagging**: This policy tags user's location information into digital media. +- **Geolocation**: This policy uses the location of the user's device to verify their identity and determine their access rights. +- **Time-based logins**: This policy restricts user access to certain resources based on the time of day or day of the week. +- **Access policies**: This policy defines user access rights to certain resources based on their role or job function. +- **Account permissions**: This policy specifies the level of access users have to certain resources or systems. +- **Account audits**: This policy requires periodic reviews of user accounts to ensure they are still necessary and have the appropriate level of access. +- **Impossible travel time/risky login**: This policy detects and flags login attempts from locations that are impossible for the user to reach within a certain time frame, or from devices that are not recognized as belonging to the user. +- **Lockout**: This policy automatically locks out user accounts after a certain number of failed login attempts to prevent unauthorized access. +- **Disablement**: This policy automatically disables or deletes user accounts that are no longer needed or pose a security risk. diff --git a/3.0-implementation/3.8-given-a-scenario-implement-authentication-and-authorization-solutions.md b/3.0-implementation/3.8-given-a-scenario-implement-authentication-and-authorization-solutions.md new file mode 100644 index 0000000..3e4c37b --- /dev/null +++ b/3.0-implementation/3.8-given-a-scenario-implement-authentication-and-authorization-solutions.md @@ -0,0 +1,46 @@ +# 3.8 Given a scenario implement authentication and authorization solutions + +## Authentication management + +Authentication management **involves the implementation of various techniques and tools to authenticate users' identity and ensure that they are authorized to access specific resources or perform certain actions**. Some of the topics related to authentication management are: + +- **Password keys**: A password key is a randomly generated code that is used to create a password. It is typically used to improve password strength and security. Password keys are often used in conjunction with a password manager to securely store and manage passwords. +- **Password vaults**: A password vault is a secure repository that is used to store passwords, credentials, and other sensitive information. Password vaults provide a centralized location for storing and managing passwords, which can help to reduce the risk of password theft or compromise. +- **TPM**: A Trusted Platform Module (TPM) is a hardware-based security device that is used to secure cryptographic keys and other sensitive information. TPMs are often used to provide secure boot functionality, which helps to prevent malware and other unauthorized software from running on a device. +- **HSM**: A Hardware Security Module (HSM) is a specialized device that is used to secure cryptographic keys and other sensitive information. HSMs are often used in high-security environments to protect sensitive data and prevent unauthorized access. +- **Knowledge-based authentication**: Knowledge-based authentication (KBA) is a form of authentication that relies on the user's knowledge of specific information, such as a password, PIN, or security question. KBA is often used as a secondary form of authentication, in addition to something the user has or is (such as a token or biometric). + +## Authentication/authorization + +Authentication and authorization are two crucial processes in information security. + +**Authentication is the process of verifying the identity of a user, device, or system**. It is used to ensure that the user or system attempting to access a resource is indeed who they claim to be. + +**Authorization**, on the other hand, **is the process of granting or denying access to a resource based on the authenticated identity of the user or system**. + +Here are some common authentication and authorization protocols and technologies: + +- **EAP (Extensible Authentication Protocol)**: A protocol used in wireless networks to support various authentication methods. +- **Challenge-Handshake Authentication Protocol (CHAP)**: A protocol used for authenticating remote users and devices, where the user or device must provide a secret password or key. +- **Password Authentication Protocol (PAP)**: A simple protocol used for authentication, where the user's password is transmitted in clear text. +- **802.1X**: A standard used for port-based network access control, which provides a framework for authentication and authorization. +- **RADIUS** (Remote Authentication Dial-In User Service): A protocol used for centralized authentication, authorization, and accounting for network access. +- **Single sign-on (SSO)**: A method of authentication that allows a user to log in once and access multiple applications or systems without the need to re-enter credentials. +- **Security Assertion Markup Language (SAML)**: An XML-based protocol used for exchanging authentication and authorization data between parties. +- **Terminal Access Controller Access Control System Plus (TACACS+)**: A protocol used for remote authentication and authorization in networked computing environments. +- **OAuth**: An authorization protocol that allows third-party applications to access a user's resources on a server without sharing the user's credentials. +- **OpenID**: A decentralized authentication protocol that allows users to authenticate with a single identity across multiple websites. +- **Kerberos**: A network authentication protocol that provides strong authentication for client/server applications using secret-key cryptography. + +## Access control schemes + +Access control schemes **are the methods used to regulate and manage access to information or resources in a system or organization**. These schemes involve the use of various techniques and mechanisms to ensure that only authorized entities are granted access to the system or information. Here are some commonly used access control schemes: + +- **Attribute-based access control (ABAC)**: ABAC is an access control scheme that uses attributes or characteristics to define access policies and permissions. This scheme uses various factors like user attributes, environmental attributes, and resource attributes to determine whether access should be granted or denied. +- **Role-based access control (RBAC)**: RBAC is an access control scheme that grants access based on a person's role within an organization. This scheme simplifies access management by defining permissions and roles for each user based on their job title or function within the organization. +- **Rule-based access control**: Rule-based access control is an access control scheme that allows access based on a set of rules. These rules define the conditions that must be met for access to be granted. +- **Mandatory access control (MAC)**: MAC is an access control scheme that grants access based on security labels. This scheme is typically used in highly secure environments where data and resources need to be highly protected. +- **Discretionary access control (DAC)**: DAC is an access control scheme where access is granted based on the discretion of the owner of the resource. This scheme allows the owner to determine who can access their resources and what level of access they are granted. +- **Conditional access**: Conditional access is an access control scheme that grants access based on certain conditions, such as the user's location, device, or time of day. +- **Privileged access management (PAM)**: PAM is an access control scheme that is used to manage and control access to critical systems and resources. This scheme ensures that only authorized individuals can access sensitive information and resources. +- **Filesystem permissions**: Filesystem permissions are access control settings that are applied to files and directories on a file system. These settings determine who can access the file or directory and what level of access they have. diff --git a/3.0-implementation/3.9-given-a-scenario-implement-public-key-infrastructure.md b/3.0-implementation/3.9-given-a-scenario-implement-public-key-infrastructure.md new file mode 100644 index 0000000..54a5f32 --- /dev/null +++ b/3.0-implementation/3.9-given-a-scenario-implement-public-key-infrastructure.md @@ -0,0 +1,64 @@ +# 3.9 Given a scenario, implement public key infrastructure + +## Public key infrastructure (PKI) + +Public key infrastructure (PKI) **is a system of hardware, software, policies, and procedures used to create, manage, distribute, and revoke digital certificates and their associated public and private keys**. A digital certificate is an electronic document that associates a public key with the identity of an individual, organization, or device. PKI provides a framework for secure electronic communication by enabling entities to establish and verify identities and establish secure communication channels. + +PKI is used for a variety of purposes, including: + +- Secure email communication +- Secure web communication, including website authentication and secure socket layer (SSL) encryption +- Virtual private network (VPN) access +- Wireless network access +- Secure file transfer +- Digital signatures and document encryption +- Secure access to cloud services and applications + +Some elementes involved in PKI are: + +- **Key management**: The process of creating, storing, distributing, and revoking cryptographic keys that are used for authentication, encryption, and digital signatures. +- **Certificate authority (CA)**: A trusted entity that issues digital certificates to verify the identity of an individual or organization. The CA also maintains a repository of issued certificates and their corresponding public keys. +- **Intermediate CA**: A subordinate CA that is authorized by the root CA to issue digital certificates on its behalf. +- **Registration authority (RA)**: An entity that verifies the identity of the certificate requester before submitting a certificate request to the CA for issuance. +- **Certificate revocation list (CRL)**: A list of digital certificates that have been revoked or are no longer valid before their expiration date. +- **Certificate attributes**: Additional information that is associated with a digital certificate, such as the name and email address of the certificate holder, the purpose of the certificate, and the name of the CA that issued the certificate. +- **Online Certificate Status Protocol (OCSP)**: A protocol that enables real-time verification of the validity of a digital certificate. +- **Certificate signing request (CSR)**: A request that is sent to a CA to obtain a digital certificate. The CSR includes the public key of the requester and the desired attributes of the certificate. +- **CN**: The common name attribute of a digital certificate that identifies the name of the entity associated with the certificate. +- **Subject alternative name**: An attribute of a digital certificate that allows for the specification of additional subject names to be associated with the certificate. +- **Expiration**: The date and time at which a digital certificate becomes invalid and can no longer be used for authentication, encryption, or digital signatures. + +## Types of certificates + +A PKI certificate is a digital certificate issued by a certificate authority (CA) to validate the identity of a person, organization, or device. It is used to establish secure communications over a network and to verify the authenticity of digital data. + +- **Wildcard**: A wildcard certificate is a type of PKI certificate that allows a single certificate to secure multiple subdomains of a domain. +- **Subject alternative name**: Subject alternative name (SAN) is an extension to a PKI certificate that allows additional identities (such as domain names, IP addresses, email addresses, etc.) to be bound to the same certificate. +- **Code signing**: Code signing certificates are PKI certificates used to sign executable code to ensure its authenticity and integrity. +- **Self-signed**: A self-signed certificate is a PKI certificate where the digital signature is created and validated by the same entity, without involving a trusted third-party CA. +- **Machine/computer**: A machine or computer certificate is a PKI certificate issued to a device such as a computer, server, or IoT device to authenticate its identity for secure communication with other devices or services. +- **Email**: An email certificate is a type of PKI certificate used for secure email communication, where the certificate is bound to an email address and is used to encrypt and digitally sign email messages. +- **User**: A user certificate is a type of PKI certificate issued to an individual user to authenticate their identity for secure access to network resources. +- **Root**: A root certificate is a type of PKI certificate that is self-signed and used to establish the trust relationship between a CA and the PKI certificates it issues. +- **Domain validation**: A domain validation certificate is a type of PKI certificate that verifies only the domain ownership of the certificate applicant, rather than their identity. +- **Extended validation**: An extended validation certificate is a type of PKI certificate that requires a more rigorous validation process to verify the identity of the certificate applicant. It is commonly used for e-commerce websites and is indicated by a green address bar in most web browsers. + +## Certificate formats + +The following are PKI certificate formats: + +1. **Distinguished Encoding Rules (DER)**: A binary format used to encode and decode PKI certificates and certificate requests. +2. **Privacy Enhanced Mail (PEM)**: A base64-encoded ASCII format used to represent a certificate, certificate chain, or private key. +3. **Personal Information Exchange (PFX)**: A binary format that is used to store a certificate, its private key, and any associated intermediate certificates in a single encrypted file. +4. **.cer**: A standard format for X.509 digital certificates that contain only the public key and do not include any private key information. +5. **P12**: A file extension for PKCS #12 files that contain both the certificate and the private key. +6. **P7B**: A file format that is used to store X.509 digital certificates in a binary format, often used for intermediate and root certificates. + +## Concepts + +- **Online vs. offline CA**: A Certificate Authority (CA) can operate in an online or offline mode. An online CA is always connected to the network and can issue, renew, and revoke certificates immediately, whereas an offline CA is not connected to the network, and the issuing of certificates is a manual process that involves physically transporting the certificate request to the CA. +- **Stapling**: Stapling is a method used by a web server to send a digitally signed certificate status message (OCSP response) during the SSL/TLS handshake. This enables the web server to prove the validity of its certificate without the need for the client to make an additional request to the CA. +- **Pinning**: Pinning is a technique used to ensure that a client only accepts a specific certificate or public key, and it can help prevent man-in-the-middle attacks. Pinning can be implemented in a web browser or application, and it involves storing the public key or certificate of a specific website or server. +- **Trust model**: A trust model is a set of rules or procedures used to establish and verify trust relationships between entities in a PKI environment. In a PKI, a trust model determines how certificates are issued, how they are validated, and how trust is established between the entities in the PKI. +- **Key escrow**: Key escrow is the process of storing a copy of an encryption key with a trusted third party. This is typically done for backup and recovery purposes, but it can also be used by law enforcement agencies to gain access to encrypted data in certain situations. +- **Certificate chaining**: Certificate chaining refers to the process of validating a certificate by verifying the entire chain of certificates that lead up to a trusted root CA. Each certificate in the chain is verified, and if any of the certificates are invalid or have been revoked, the entire chain is considered invalid. The goal of certificate chaining is to establish a trust relationship between the client and the server by verifying that the server's certificate is signed by a trusted root CA. diff --git a/3.0-implementation/README.md b/3.0-implementation/README.md index ccf0343..acd3d65 100644 --- a/3.0-implementation/README.md +++ b/3.0-implementation/README.md @@ -1 +1,19 @@ -# 3.0 Implementation \ No newline at end of file +# 3.0 Implementation + +* [3.1 Given a scenario, implement secure protocols](./3.1-given-a-scenario-implement-secure-protocols.md) + +* [3.2 Given a scenario, implement host or application security solutions](./3.2-given-a-scenario-implement-host-or-application-security-solutions.md) + +* [3.3 Given a scenario, implement secure network designs](./3.3-given-a-scenario-implement-secure-network-designs.md) + +* [3.4 Given a scenario, install and configure wireless security settings](./3.4-given-a-scenario-install-and-configure-wireless-security-settings.md) + +* [3.5 Given a scenario, implement secure mobile solutions](./3.5-given-a-scenario-implement-secure-mobile-solutions.md) + +* [3.6 Given a scenario, apply cybersecurity solutions to the cloud](./3.6-given-a-scenario-apply-cybersecurity-solutions-to-the-cloud.md) + +* [3.7 Given a scenario, implement identity and account management controls](./3.7-given-a-scenario-implement-identity-and-account-management-controls.md) + +* [3.8 Given a scenario, implement authentication and authorization solutions](./3.8-given-a-scenario-implement-authentication-and-authorization-solutions.md) + +* [3.9 Given a scenario, implement public key infrastructure](./3.9-given-a-scenario-implement-public-key-infrastructure.md) diff --git a/4.0-operations-and-incident-response/4.1-given-a-scenario-use-the-appropriate-tool-to-assess-organizational-security.md b/4.0-operations-and-incident-response/4.1-given-a-scenario-use-the-appropriate-tool-to-assess-organizational-security.md new file mode 100644 index 0000000..d67684d --- /dev/null +++ b/4.0-operations-and-incident-response/4.1-given-a-scenario-use-the-appropriate-tool-to-assess-organizational-security.md @@ -0,0 +1,103 @@ +# 4.1 Given a scenario, use the appropriate tool to assess organizational security + +## Network reconnaissance and discovery + +Network reconnaissance and discovery **refer to the process of gathering information about a target network, including its topology, network devices, services, and hosts**. The goal of network reconnaissance is to gain a better understanding of the target network and identify potential vulnerabilities that can be exploited. + +Here are the definitions of some of the commonly used tools in network reconnaissance and discovery: + +- **tracert/traceroute**: A tool used to trace the route of packets sent over a network and determine the network path to a destination host. +- **nslookup/dig**: A tool used to query DNS servers to obtain DNS records, such as IP addresses or mail exchange (MX) records. +- **ipconfig/ifconfig**: A command-line tool used to view the network configuration settings of a Windows or Unix-like operating system, respectively. +- **nmap**: A popular network mapping tool used to scan and discover hosts and services on a network, and identify open ports and vulnerabilities. +- **ping/pathping**: Tools used to test the connectivity to a host and measure the round-trip time of packets. +- **hping**: A command-line tool that sends custom packets to a target host and can be used for port scanning and fingerprinting. +- **netstat**: A command-line tool that displays active network connections, listening ports, and routing tables. +- **netcat**: A networking utility used to create TCP/UDP connections, port scanning, and file transfer. +- **IP scanners**: Tools used to scan IP addresses and network ranges to discover hosts, open ports, and running services. +- **arp**: A command-line tool used to display or modify the ARP cache, which is used to map IP addresses to physical addresses on a network. +- **route**: A command-line tool used to display or modify the routing table, which is used to determine the network path for packets. +- **curl**: A command-line tool used to transfer data to or from a server using various protocols, such as HTTP, FTP, and SMTP. +- **theHarvester**: A tool used to gather email addresses, subdomains, and other information about a target organization from public sources. +- **sn1per**: A reconnaissance and vulnerability scanning tool that uses multiple open-source tools to scan and identify vulnerabilities in a target network. +- **scanless**: A web-based tool that allows users to perform port scans and HTTP header checks on a target website. +- **dnsenum**: A tool used to enumerate DNS records, subdomains, and other information about a target domain. +- **Nessus**: A commercial vulnerability scanner used to identify security flaws, misconfigurations, and compliance issues in a target network. +- **Cuckoo**: A malware analysis tool used to analyze and detect malware in a safe and isolated environment. + +## File manipulation + +File manipulation **refers to the various operations that can be performed on files, such as creating, modifying, reading, or deleting them**. Here are the definitions of the following tools related to file manipulation: + +- **head**: A command-line utility that prints the first few lines of a text file. By default, it displays the first 10 lines, but you can specify a different number using the -n option. +- **tail**: A command-line utility that prints the last few lines of a text file. By default, it displays the last 10 lines, but you can specify a different number using the -n option. +- **cat**: A command-line utility that concatenates and displays the contents of one or more text files. +- **grep**: A command-line utility that searches for a specified pattern or regular expression in one or more text files and displays the matching lines. +- **chmod**: A command-line utility that changes the permissions of a file or directory. It can add or remove read, write, and execute permissions for the owner, group, or others. +- **logger**: A command-line utility that logs messages to the system log. It can be used to record events, errors, or other information for later analysis. + +## Shell and script environments + +**A shell is a command-line interface that provides a way to interact with an operating system's services and resources**. It allows users to run commands and execute scripts to perform various tasks such as managing files, running applications, and controlling system settings. A shell environment consists of a shell program and a set of environment variables that define the user's working environment. + +**Script environments**, on the other hand, **are programming environments that provide a platform for writing and executing scripts or code**. They typically include a text editor, a command-line interface, and a set of tools and libraries for development, testing, and deployment. Script environments are used to automate tasks and build applications and services. + +- **SSH**: Secure Shell (SSH) is a protocol that allows secure remote access to a server or other network device. It provides a secure, encrypted connection between two systems, and can be used for a variety of purposes including remote command execution, file transfers, and tunneling of network traffic. SSH clients and servers are available for most operating systems, and the protocol is widely used in the management of servers and network devices. +- **PowerShell**: PowerShell is a powerful command-line shell and scripting language developed by Microsoft. It is designed to automate tasks and provide an extensible platform for system administration, configuration management, and automation. PowerShell scripts can be used to manage local and remote systems, and can interact with a wide variety of systems and services using modules and APIs. +- **Python**: Python is a high-level programming language that is widely used for scripting and automation tasks. It is known for its simplicity and ease of use, and has a large ecosystem of libraries and modules that can be used to automate a wide variety of tasks. +- **OpenSSL**: OpenSSL is an open-source software library that provides support for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It can be used to implement secure communication between networked systems, and provides tools for generating and managing digital certificates and keys. + +Overall, these tools are commonly used for shell and scripting environments in various contexts, including system administration, network management, and automation. + +## Packet capture and replay + +Packet capture and replay **is the process of recording network traffic, including packets sent and received by devices, and then replaying that traffic for analysis or testing purposes**. This can be useful in various situations, such as troubleshooting network issues, analyzing network behavior, or testing network security. + +The following are tools commonly used for packet capture and replay: + +1. **Tcpreplay**: Tcpreplay is a tool for replaying previously captured network traffic. It allows you to reproduce network traffic patterns on a target network interface and can be used for testing network security devices or applications. +2. **Tcpdump**: Tcpdump is a command-line tool for capturing and analyzing network traffic. It can capture packets in real-time and display them on the terminal, or it can save them to a file for later analysis. +3. **Wireshark**: Wireshark is a network protocol analyzer that allows you to capture and view network traffic. It provides a graphical user interface and can capture traffic in real-time or read from previously saved capture files. It can also analyze and decode captured packets, making it a useful tool for troubleshooting network issues. + +## Forensics + +Computer forensics **is the process of collecting, analyzing, and preserving electronic data in a way that is admissible as evidence in a court of law**. It involves the use of various tools and techniques to uncover evidence from digital devices and networks. + +The following are some tools commonly used in computer forensics: + +- **dd**: a command-line tool used to create a bit-by-bit image of a device or file. It can be used to acquire data from a device for forensic analysis. +- **Memdump**: a tool used to create a memory dump of a running system. This can be used to extract volatile data from a system that would not be available from a disk image. +- **WinHex**: a forensic tool that can be used to analyze disk images and recover deleted files. +- **FTK imager**: a tool used to create forensic images of hard drives and other digital storage media. +- **Autopsy**: a graphical user interface (GUI) tool used for digital forensics analysis. It is capable of analyzing disk images and other digital media to extract evidence. + +These tools are used by forensic analysts to investigate and analyze data for the purposes of digital forensic analysis. Each tool has a specific function and can be used to extract specific types of data from digital devices and networks. + +## Exploitation frameworks + +Exploitation frameworks **are a set of tools and resources that are used to automate the process of identifying and exploiting vulnerabilities in computer systems**. These frameworks typically provide a comprehensive set of tools for vulnerability scanning, exploitation, and post-exploitation activities, including shellcode development and payload creation. + +Exploitation frameworks are used by security professionals to test the security of their own systems or to identify vulnerabilities in client systems. They can also be used by malicious actors for nefarious purposes, such as gaining unauthorized access to systems or stealing sensitive information. + +Some popular exploitation frameworks include: + +1. Metasploit Framework: a popular open-source framework that provides a comprehensive suite of tools for penetration testing and vulnerability assessment. +2. Cobalt Strike: a commercial exploitation framework that provides a range of features for conducting advanced penetration testing and red teaming activities. +3. Canvas: a commercial exploitation framework that offers a range of exploit modules and payload generators, as well as a comprehensive suite of post-exploitation tools. +4. Social Engineer Toolkit (SET): a framework designed specifically for social engineering attacks, such as phishing and spear phishing. +5. Empire: a post-exploitation framework that provides a range of tools for maintaining persistence on compromised systems and conducting lateral movement. +6. BeEF: a browser exploitation framework that allows attackers to compromise web browsers and execute JavaScript-based attacks. + +Exploitation frameworks can be powerful tools for identifying and exploiting vulnerabilities in computer systems. However, their use should be approached with caution and should only be used for legitimate purposes. Additionally, the use of exploitation frameworks may be subject to legal and ethical considerations, and users should be aware of the potential consequences of their actions. + +## Password crackers + +Password crackers **are tools or programs that are designed to crack or break passwords that protect a particular resource, such as a computer system, application, or network**. These tools work by attempting to guess the password through brute force methods, dictionary attacks, or other techniques, often using large sets of precomputed hashes. The goal of password cracking is to gain unauthorized access to the protected resource. However, password cracking can also be used by security professionals to assess the strength of passwords and to identify weaknesses in password policies. Popular password cracking tools include John the Ripper, Hashcat, and Hydra. + +## Data sanitization + +Data sanitization, also known as data wiping, data erasure, or data destruction, **is the process of permanently and securely deleting data from storage media so that it cannot be recovered or reconstructed by any means**. Data sanitization is typically performed on hard drives, solid-state drives, USB drives, tapes, and other types of storage media that contain sensitive or confidential information. + +The process of data sanitization typically involves overwriting the data on the storage media with a series of random patterns or characters, making it impossible to recover the original data. There are various methods of data sanitization, including software-based techniques that overwrite the data, hardware-based techniques that physically destroy the storage media, and cryptographic techniques that encrypt the data and then securely delete the encryption keys. + +Data sanitization is essential for protecting sensitive or confidential information from unauthorized access or disclosure. It is particularly important when disposing of old or damaged storage media, or when transferring storage media to another party. Many organizations have data sanitization policies and procedures in place to ensure that sensitive information is properly and securely deleted when it is no longer needed. diff --git a/4.0-operations-and-incident-response/4.2-summarize-the-importance-of-policies-processes-and-procedures-for-incident-response.md b/4.0-operations-and-incident-response/4.2-summarize-the-importance-of-policies-processes-and-procedures-for-incident-response.md new file mode 100644 index 0000000..6853a3b --- /dev/null +++ b/4.0-operations-and-incident-response/4.2-summarize-the-importance-of-policies-processes-and-procedures-for-incident-response.md @@ -0,0 +1,94 @@ +# 4.2 Summarize the importance of policies, processes, and procedures for incident response + +## Incident response plans + +Incident response plasn **are a set of policies, processes, and procedures that an organization follows in the event of a security incident**. The plan outlines the steps to be taken by the incident response team to contain the incident, minimize damage, and restore normal operations as quickly as possible. + +An effective incident response plan is critical for minimizing the impact of security incidents on an organization and for ensuring that the organization can respond quickly and effectively to any incident that does occur. + +## Incident response process + +The incident response process **is a structured approach that organizations follow to respond to and manage security incidents**. The following are the six elements of the incident response process: + +1. **Preparation**: This element involves developing an incident response plan, establishing an incident response team, and defining roles and responsibilities. It also includes identifying the critical assets, creating backups, and establishing communication channels to notify stakeholders in case of an incident. +2. **Identification**: This element involves identifying the security incident, collecting information, and classifying the incident based on its severity and impact. +3. **Containment**: This element involves isolating the affected systems to prevent the incident from spreading. The incident response team works on containing the incident and preventing further damage to the environment. +4. **Eradication**: This element involves removing the root cause of the incident and fixing the affected systems. The incident response team ensures that all the malicious software or other artifacts are removed from the systems. +5. **Recovery**: This element involves restoring the affected systems to their normal state and ensuring that they are functioning correctly. The incident response team performs system tests and verifies that the systems are secure. +6. **Lessons learned**: This element involves analyzing the incident response process, identifying any gaps, and updating the incident response plan. It also involves conducting training sessions to educate the incident response team and stakeholders on the lessons learned. + +## Exercises + +Incident response exercises **are a simulated scenario or drill that tests an organization's ability to respond to a security incident or breach**. These exercises can help organizations identify gaps in their incident response plans and procedures, improve communication and coordination among incident response teams, and provide hands-on experience for personnel to better prepare them for a real incident. There are various types of incident response exercises, such as tabletop exercises, walkthroughs, and simulations, each with their own level of complexity and objectives. Regular incident response exercises are an important part of a comprehensive incident response program. + +1. **Tabletop**: A tabletop exercise is a type of incident response exercise that simulates a cybersecurity incident in a discussion-based format. Participants discuss and analyze the incident response plan and procedures, identify potential gaps, and make recommendations for improvement. The exercise is typically conducted in a non-stressful, classroom-style setting. +2. **Walkthroughs**: A walkthrough is a type of incident response exercise that involves a detailed review of the incident response plan and procedures with key stakeholders. The exercise is focused on identifying potential issues and risks that could arise during a real incident and developing solutions for those issues. +3. **Simulations**: A simulation is a type of incident response exercise that involves a realistic, hands-on scenario in which participants respond to a simulated cybersecurity incident. The exercise is designed to test the incident response plan and procedures, as well as the capabilities and readiness of the incident response team. Simulations are typically more complex and stressful than tabletop exercises and walkthroughs, and may involve the use of realistic tools and equipment. + +## Attack frameworks + +Attack frameworks **are models or methodologies that describe the different stages of a cyberattack, including the techniques and tools used by attackers at each stage**. They provide a structured approach for understanding and analyzing cyberattacks and can be used to guide incident response activities and develop defensive strategies. + +The following are some of the commonly used attack frameworks: + +1. **MITRE ATT&CK**: This framework is widely used in the cybersecurity industry to describe the tactics and techniques used by attackers. It is organized into different stages of an attack, from initial access to exfiltration, and includes over 200 techniques and sub-techniques. +2. **The Diamond Model of Intrusion Analysis**: This model breaks down an intrusion into four main components: adversary, capability, infrastructure, and victim. It provides a framework for analyzing an intrusion in a structured way and can be used to identify patterns and relationships between different components. +3. **Cyber Kill Chain**: This framework was developed by Lockheed Martin and describes the stages of a cyberattack from the initial reconnaissance phase to the exfiltration of data. It includes seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and exfiltration. + +These frameworks are widely used in the cybersecurity industry and can provide a structured approach to understanding and analyzing cyberattacks, as well as developing effective defensive strategies. + +## Stakeholder management + +Stakeholder management **is the process of identifying, analyzing, and developing relationships with individuals or groups who have a vested interest in a project, program, or organization**. It involves identifying stakeholders, understanding their needs and expectations, and developing strategies to effectively engage and communicate with them. Stakeholder management helps mitigate risks and avoid conflicts by identifying potential issues early on and developing strategies to address them. + +## Communication plan + +A communication plan **is a detailed strategy that outlines how information will be shared with various stakeholders during a project, crisis, or other significant event**. The primary purpose of a communication plan is to ensure that relevant information is communicated to the right people at the right time and in the right way. A communication plan typically includes the following elements: + +1. Purpose and objectives: This section outlines the goals and objectives of the communication plan and defines the scope of the plan. +2. Target audience: Identifying the stakeholders and determining their communication needs, expectations, and preferences. +3. Key messages: The essential information that needs to be communicated to stakeholders, such as what happened, what the organization is doing about it, and what the impact will be. +4. Channels and tools: This section outlines the different communication channels that will be used to deliver the key messages to the target audience, such as email, social media, press releases, or town hall meetings. +5. Roles and responsibilities: Identifying the individuals or teams responsible for communicating the key messages, monitoring feedback, and responding to questions or concerns. +6. Timeline: A schedule of when and how often the communication will take place, outlining important milestones or deadlines for the delivery of information. +7. Feedback and evaluation: This section describes how the communication plan's effectiveness will be evaluated, and feedback will be collected from stakeholders to improve future communication plans. + +Overall, **a communication plan is a vital element of effective incident response and helps organizations to communicate with stakeholders in a coordinated, efficient, and effective manner, building trust and confidence among stakeholders**. + +## Disaster recovery plan + +A Disaster Recovery Plan (DRP) **is a document that outlines a structured approach to recover and restore critical IT infrastructure and systems that have been disrupted due to a natural or man-made disaster**. The primary objective of a DRP is to minimize the downtime and impact on business operations and to ensure the availability, integrity, and confidentiality of critical data and systems. A disaster recovery plan typically includes procedures for data backup, restoration, and continuity of operations, as well as roles and responsibilities of key personnel during the recovery process. The plan should also consider scenarios for different types of disasters, such as power outages, cyber attacks, and natural disasters, and should be tested regularly to ensure that it is effective in a real-world situation. + +## Business continuity plan + +A business continuity plan (BCP) is a document that outlines the procedures and processes an organization must follow to ensure that essential business functions continue to operate during and after a disaster or other disruptive event. The goal of a BCP is to minimize the impact of the disruption and to ensure that the organization can quickly resume operations to normal or near-normal levels. + +A BCP typically includes the following elements: + +1. Business impact analysis (BIA): This is a process that identifies and assesses the potential impact of a disruptive event on the organization's critical business functions and processes. +2. Risk assessment: This is a process that identifies potential risks and vulnerabilities that could impact the organization's ability to continue operations during a disruptive event. +3. Emergency response procedures: This includes procedures for responding to the immediate aftermath of a disruptive event, such as evacuating employees and securing the facility. +4. Recovery procedures: This includes procedures for restoring critical business functions and processes after a disruptive event, such as restoring IT systems and processes. +5. Testing and maintenance procedures: This includes procedures for testing and maintaining the BCP to ensure that it remains effective and up-to-date. + +**A BCP is important for all organizations, as it helps them to minimize the impact of a disruptive event on their operations, reputation, and finances**. It also helps to ensure that they can continue to serve their customers and clients, and fulfill their obligations and commitments to stakeholders. + +## Continuity of operations planning (COOP) + +Continuity of Operations Planning (COOP) **is the process of ensuring that essential functions continue to be performed during and after a catastrophic event or disruption to normal operations**. The goal of COOP is to ensure the timely resumption of critical business functions, maintain essential operations, and minimize the impact of a disruption to the organization's mission, functions, and services. COOP plans are designed to be scalable and flexible to accommodate various types of disruptions, including natural disasters, cyber-attacks, or pandemics. The plans typically include procedures for emergency response, alternate site operations, crisis communication, and recovery and reconstitution. + +## Incident response team + +An incident response team **is a group of individuals responsible for detecting, investigating, and responding to cybersecurity incidents within an organization**. The team typically consists of professionals with specialized skills in areas such as forensics, malware analysis, network security, and incident management. + +The incident response team is responsible for developing and implementing an incident response plan, which includes procedures and policies to identify, contain, eradicate, and recover from security incidents. They work closely with stakeholders within the organization to ensure that business operations are not impacted by security incidents and that the organization can return to normal operations as quickly as possible. + +The incident response team should have well-defined roles and responsibilities and be trained on the latest threat intelligence, attack techniques, and incident response best practices. Additionally, the team should conduct regular incident response exercises and review and update the incident response plan to ensure that it remains effective and up-to-date. + +## Retention policies + +Retention policies **refer to the policies and procedures that an organization has put in place to manage the retention and disposal of its data, documents, and records**. The policies dictate how long the organization must keep data and documents, and when they can be destroyed or disposed of. + +Retention policies are designed to ensure that the organization retains the necessary information to meet legal, regulatory, and operational requirements, while disposing of information that is no longer needed. Retention policies should consider factors such as the type of information, the value of the information to the organization, and the legal and regulatory requirements that apply to the information. + +Retention policies are an important part of an organization's information management program, as they help to reduce the risks associated with keeping information for too long or disposing of information too soon. By implementing retention policies, organizations can ensure that they are in compliance with legal and regulatory requirements, while reducing the costs and risks associated with storing and managing large volumes of data and documents. diff --git a/4.0-operations-and-incident-response/4.3-given-an-incident-utilize-appropriate-data-sources-to-support-an-investigation.md b/4.0-operations-and-incident-response/4.3-given-an-incident-utilize-appropriate-data-sources-to-support-an-investigation.md new file mode 100644 index 0000000..3aebbb8 --- /dev/null +++ b/4.0-operations-and-incident-response/4.3-given-an-incident-utilize-appropriate-data-sources-to-support-an-investigation.md @@ -0,0 +1,106 @@ +# 4.3 Given an incident, utilize appropriate data sources to support an investigation + +## Vulnerability scan output + +A vulnerability scan output **is the result of a vulnerability scan, which is a process of identifying security weaknesses in a system or network**. The output usually includes a list of vulnerabilities that were detected during the scan, along with details such as the severity of the vulnerability, the affected systems or devices, and recommendations for remediation. The vulnerability scan output may be presented in various formats, such as a report, a spreadsheet, or an online dashboard. The output may also include additional information, such as risk ratings, suggested fixes, and vulnerability descriptions. The vulnerability scan output is an important tool for cybersecurity professionals, as it helps them identify and prioritize vulnerabilities that need to be addressed to improve the overall security posture of a system or network. + +## SIEM dashboards + +SIEM (Security Information and Event Management) dashboards **are tools that provide a centralized view of security events across an organization's IT infrastructure**. They are designed to help security teams detect and respond to security threats and incidents by collecting and analyzing security event data from various sources. + +Some key terms related to SIEM dashboards: + +- **Sensor**: A device or software agent that collects security event data from various sources, such as firewalls, intrusion detection systems, and servers. +- **Sensitivity**: The degree to which an event is considered important or relevant to the organization's security posture. SIEM dashboards often use sensitivity levels to prioritize events and alert security teams accordingly. +- **Trends**: Patterns or changes in security event data over time. SIEM dashboards can help identify trends in security events, such as an increase in brute-force attacks or unusual traffic patterns. +- **Alerts**: Notifications that are triggered when a security event meets certain criteria or thresholds. SIEM dashboards can generate alerts based on predefined rules or machine learning algorithms. +- **Correlation**: The process of analyzing security event data from multiple sources to identify related events and detect potential threats. SIEM dashboards often use correlation rules to identify patterns and anomalies in security event data. + +Overall, SIEM dashboards are important tools for managing and responding to security events in a timely and effective manner. By providing a centralized view of security event data, they can help security teams detect threats and vulnerabilities, prioritize incident response efforts, and improve the organization's overall security posture. + +## Log files + +Log files **are records of events or actions that are generated by an application, operating system, or other system component**. These files can be used for auditing, troubleshooting, or security analysis purposes. Log files can contain a variety of information, such as system errors, security events, network traffic, or user activity. + +There are various types of log files, including: + +- **Network logs**: These logs capture traffic on a network, including the source and destination of packets, as well as their content. Network logs can be used to identify potential attacks or unusual traffic patterns. +- **System logs**: These logs record events related to the operating system, including system crashes, errors, and warnings. System logs can be used to identify problems with hardware or software, as well as potential security incidents. +- **Application logs**: These logs record events related to specific applications running on a system, including errors and warnings. Application logs can be used to identify potential problems with an application, as well as security incidents related to the application. +- **Security logs**: These logs record security-related events, including successful and unsuccessful login attempts, changes to system security settings, and other security-related events. Security logs can be used to identify potential security incidents, such as unauthorized access attempts. +- **Web logs**: These logs capture information about web server requests, including the source and destination of requests, as well as the content of the request. Web logs can be used to identify potential attacks against a web server, such as SQL injection or cross-site scripting attacks. +- **DNS logs**: These logs capture information about DNS requests and responses, including the source and destination of requests, as well as the content of the request. DNS logs can be used to identify potential DNS-based attacks, such as cache poisoning or DNS hijacking. +- **Authentication logs**: These logs record events related to user authentication, including successful and unsuccessful login attempts, as well as changes to user account settings. Authentication logs can be used to identify potential security incidents related to user accounts, such as brute-force attacks or account compromise. +- **Dump files**: These files contain information about system crashes, including the memory state at the time of the crash. Dump files can be used to identify the cause of a system crash, as well as potential security incidents related to system crashes. +- **VoIP and call manager logs**: These logs record events related to VoIP traffic, including call setup and teardown, as well as errors and warnings related to VoIP traffic. VoIP and call manager logs can be used to identify potential security incidents related to VoIP traffic, such as unauthorized call setup or eavesdropping. +- **Session Initiation Protocol (SIP) traffic**: These logs capture information about SIP traffic, including the source and destination of requests, as well as the content of the request. SIP logs can be used to identify potential SIP-based attacks, such as SIP flooding or SIP scanning. + +## syslog/rsyslog/syslog-ng + +Syslog **is a protocol used for sending event messages between devices in a computer network**. It allows different devices to share system logs and event messages. Syslog messages contain information about system events, such as security alerts, system errors, and user activity. + +**rsyslog and syslog-ng are both implementations of the Syslog protocol with additional features**. They are more advanced than the basic Syslog and can provide additional functionality, such as the ability to filter, sort, and process logs. These tools are commonly used for centralized logging and log analysis in large environments. + +**rsyslog** is a Syslog implementation that is widely used in Linux environments. It **offers more advanced features than the basic Syslog, including support for encryption and filtering. rsyslog can be used to store logs in a variety of formats, including binary files, plain text files, and databases**. + +**syslog-ng** is another implementation of the Syslog protocol that is commonly used in Unix and Linux environments. It also **provides more advanced features than the basic Syslog, including support for advanced filtering, pattern matching, and message modification. syslog-ng can also store logs in a variety of formats, including flat files, databases, and message queues**. + +## journalctl + +journalctl **is a command-line utility used to query and display messages from the systemd journal, which is a centralized logging system used in most Linux-based operating systems**. The journal contains logs of system events, service logs, kernel logs, and other types of logs. The journalctl command allows users to view these logs in a variety of ways, such as filtering by time range, priority level, unit, message content, or source. + +journalctl is a powerful tool for troubleshooting system issues, identifying security incidents, and monitoring system performance. It can also be integrated with other tools, such as SIEMs, to centralize log management and analysis. + +## NXLog + +NXLog **is a cross-platform log collection tool that enables organizations to collect, filter, and forward log data from various sources for security, compliance, and operational purposes**. It provides a modular architecture that supports a wide range of log sources, including files, Windows Event Logs, network devices, and more. + +NXLog allows users to collect, parse, and filter log data in real-time and supports various output formats, including Syslog, JSON, and XML. It also enables users to transform and enrich log data using built-in or custom modules, such as the Lua scripting module. Key features of NXLog are its ability to integrate with various SIEM solutionsand provides a secure, and scalable log collection solution that supports high availability and load balancing. + +## Bandwidth monitors + +Bandwidth monitors **are software tools used to measure and monitor the network bandwidth usage of a system or network**. They are designed to give an administrator an idea of the amount of data flowing through their network, and to help identify potential bottlenecks, unusual traffic patterns, and security threats. + +Bandwidth monitors work by collecting information on the data traffic flowing through the network, typically by analyzing packets or traffic flows. This data is then compiled into reports and displayed in real-time or near-real-time graphs and dashboards, giving network administrators the ability to quickly identify issues and troubleshoot them. + +Some common features of bandwidth monitors include the ability to measure bandwidth usage on a per-application or per-user basis, to track bandwidth usage over time, and to generate alerts when unusual traffic patterns or potential security threats are detected. Bandwidth monitors can be useful in a variety of settings, from small office networks to large enterprise environments. + +## Metadata + +Metadata **is information about data that provides additional context and details about the data itself**. This information can include details such as creation time, modification time, author, size, location, and other attributes depending on the type of data. + +Here are some examples of metadata for different types of data: + +- Email: In email messages, metadata can include information such as sender and recipient addresses, subject line, date and time sent, and message size. +- Mobile: Metadata on mobile devices can include information such as the device's make and model, operating system version, location data, and usage history. +- Web: Metadata on web pages can include information such as the page title, URL, author, creation date, and last modification date. +- File: Metadata on files can include information such as file name, file type, creation and modification dates, author, location, and file size. + +In general, metadata can be useful in a variety of ways, such as for organizing and searching data, tracking changes, and providing context for analysis. However, it is important to be aware of potential privacy concerns related to metadata, particularly in cases where sensitive information may be inadvertently included. + +## Netflow/sFlow + +NetFlow, sFlow, and IPFIX **are network protocols used for monitoring and collecting network traffic data**. They are used to analyze network traffic and provide valuable information for network administrators and security professionals. + +NetFlow is a network protocol developed by Cisco that collects and analyzes IP traffic data. NetFlow records information about network traffic flows, such as the source and destination of traffic, the protocols used, and the number of packets and bytes transferred. This information can be used to identify network traffic patterns and potential security threats. + +sFlow is another network protocol used for monitoring network traffic. It is designed to provide real-time visibility into network traffic by sampling packets and sending the data to a collector for analysis. sFlow can provide detailed information about network traffic, including the source and destination of traffic, the protocols used, and the amount of traffic generated. + +IPFIX (Internet Protocol Flow Information Export) is a standardized version of NetFlow that provides a common format for exporting flow data across different vendors' devices. IPFIX allows for more flexible and customizable flow data collection and analysis, making it a more powerful tool for network monitoring and analysis. + +All of these protocols can be used to monitor network traffic and analyze network behavior. By analyzing flow data, network administrators and security professionals can gain insights into network performance and identify potential security threats. + +## Protocol analyzer output + +Protocol analyzer output **is the result of capturing network traffic and analyzing it using a protocol analyzer tool**. The output can provide information about the types of packets on the network, the source and destination of the packets, the content of the packets, and any errors or issues that may be present. + +Some common elements that may be found in protocol analyzer output include: + +- Source and destination IP addresses +- Source and destination port numbers +- Protocol type (e.g., TCP, UDP) +- Packet length and size +- Time stamps for each packet +- Packet payload or data + +The output may also include additional information such as packet timing, packet sequence, and packet retransmission. The data can be used to troubleshoot network issues, monitor network performance, and detect security threats. It is often presented in a graphical or tabular format, making it easier to interpret and analyze. diff --git a/4.0-operations-and-incident-response/4.4-given-an-incident-apply-mitigation-techniques-or-controls-to-secure-an-environment.md b/4.0-operations-and-incident-response/4.4-given-an-incident-apply-mitigation-techniques-or-controls-to-secure-an-environment.md new file mode 100644 index 0000000..760307e --- /dev/null +++ b/4.0-operations-and-incident-response/4.4-given-an-incident-apply-mitigation-techniques-or-controls-to-secure-an-environment.md @@ -0,0 +1,51 @@ +# 4.4 Given an incident, apply mitigation techniques or controls to secure an environment + +## Reconfigure endpoint security solutions + +**Endpoint security solutions are software solutions that protect individual devices (endpoints) from security threats, such as malware, phishing attacks, or unauthorized access**. Reconfiguring endpoint security solutions is one of the key mitigation techniques for securing an environment. + +One approach to reconfiguring endpoint security solutions is to create an **application approved list**. This list **includes only the applications that are authorized to run on an endpoint device**. Any attempt to run an application that is not on the approved list will be blocked. This approach reduces the attack surface by restricting the number of applications that can be run on an endpoint device. + +Another approach is to create an application **blocklist or deny list**. This list **includes applications that are not allowed to run on an endpoint device**. Any attempt to run an application on the blocklist will be blocked. This approach is useful for preventing the use of known malicious applications or applications that have known vulnerabilities. + +**Quarantine** is another important feature of endpoint security solutions. **When an endpoint security solution detects a potentially malicious file or application, it can be automatically quarantined, preventing it from causing harm to the system**. Quarantine also allows security analysts to analyze the file or application and determine if it is a threat to the system. + +Overall, reconfiguring endpoint security solutions by implementing an approved list, blocklist, or quarantine feature can help prevent security threats and reduce the attack surface of an environment. + +## Configuration changes + +Configuration changes **refer to modifications made to the configuration settings of a system or application to enhance its security posture**. Here are some examples of configuration changes for various security solutions: + +- **Firewall rules**: Firewall rules can be configured to allow or block specific types of network traffic based on various criteria such as the source and destination IP addresses, ports, and protocols. By reconfiguring firewall rules, organizations can restrict the flow of network traffic and reduce the attack surface of their systems. +- **MDM**: Mobile device management (MDM) solutions can be used to manage and secure mobile devices such as smartphones and tablets. By reconfiguring MDM policies, organizations can enforce security controls such as device encryption, password requirements, and remote wipe capabilities to protect sensitive data on mobile devices. +- **DLP**: Data loss prevention (DLP) solutions can be used to prevent sensitive data from leaving an organization's network. By reconfiguring DLP policies, organizations can specify which types of data are considered sensitive and how they should be protected (e.g., encrypted in transit, blocked from being sent outside the network). +- **Content filter/URL filter**: Content filter and URL filter solutions can be used to block access to websites and other online content that could pose a security risk. By reconfiguring these filters, organizations can block access to known malicious websites and prevent employees from visiting non-work-related websites that could be a source of malware or phishing attacks. +- **Update or revoke certificates**: Digital certificates are used to verify the identity of websites, applications, and other digital assets. By updating or revoking certificates, organizations can ensure that only trusted entities are able to access their systems and data. For example, if a certificate is compromised or expires, it should be immediately revoked or replaced with a new one to prevent unauthorized access. + +## Isolation + +Isolation **is a security technique that involves separating critical systems or data from the rest of the network or other less secure systems to prevent unauthorized access or the spread of malware or other threats**. Isolation can be achieved through various methods, such as physical separation, network segmentation, or virtualization. By isolating systems or data, organizations can reduce the risk of attacks or breaches and limit the impact of any security incidents that occur. Isolation can be implemented in various areas, including network, application, and data. For example, a network can be segmented to isolate sensitive servers or data, or a virtual machine can be created to isolate an application from the rest of the system. + +## Containment + +Containment **refers to the process of limiting the impact of a security incident or data breach by isolating the affected systems or network segments**. The goal of containment is to prevent the incident from spreading further and to give incident response teams time to investigate and remediate the issue. + +Containment may involve various technical and procedural measures, such as disconnecting affected systems from the network, disabling user accounts, suspending certain services or applications, blocking certain IP addresses or ports, and so on. These measures help to minimize the damage caused by the incident and reduce the risk of further compromise. + +Containment is an important step in the incident response process and should be implemented as quickly as possible after an incident is detected. This helps to limit the damage and reduce the time and resources required to remediate the issue. + +## Segmentation + +Segmentation **is a security strategy that involves dividing a network or system into smaller segments, often referred to as subnetworks or subnets, in order to enhance security**. This technique is used to limit the ability of attackers to move laterally through a network, as well as to reduce the impact of security incidents. + +Segmentation can be implemented using various technologies such as VLANs, firewalls, and virtual private networks (VPNs). By segmenting a network, an organization can apply different security controls and policies to each segment based on the level of risk associated with the data and systems within that segment. For example, sensitive data can be placed in a highly secured segment while less sensitive data can be placed in a less secure segment. This approach can help reduce the risk of data breaches and other security incidents, as well as limit the scope of any incidents that do occur. + +## Security Orchestration, Automation, and Response (SOAR) + +SOAR stands for Security Orchestration, Automation, and Response. It **is a technology solution designed to help security teams automate their incident response workflows and integrate various security tools and technologies to streamline their operations**. + +Runbooks and playbooks are two common terms used in SOAR. **A runbook is a set of predefined procedures or steps that a security analyst follows when responding to an incident**. It provides a consistent, repeatable process for managing security incidents. Runbooks can be customized to suit an organization's specific needs and can include specific actions to be taken based on the type and severity of the incident. + +**Playbooks**, on the other hand, **are more complex than runbooks and provide a framework for orchestrating the response to a security incident**. Playbooks can include multiple runbooks, as well as automated actions and integrations with other security tools and technologies. They are designed to automate as much of the incident response process as possible and help organizations respond quickly and effectively to security incidents. + +In summary, runbooks and playbooks are two essential components of SOAR technology that help security teams to automate and streamline their incident response workflows. diff --git a/4.0-operations-and-incident-response/4.5-explain-the-key-aspects-of-digital-forensics.md b/4.0-operations-and-incident-response/4.5-explain-the-key-aspects-of-digital-forensics.md new file mode 100644 index 0000000..0e705c6 --- /dev/null +++ b/4.0-operations-and-incident-response/4.5-explain-the-key-aspects-of-digital-forensics.md @@ -0,0 +1,89 @@ +# 4.5 Explain the key aspects of digital forensics + +## Documentation/evidence + +Documentation/evidence **refers to the collection, preservation, and presentation of information to support an investigation or legal case**. It is important to maintain the integrity of evidence throughout the entire investigation process. + +Some elaborations on different aspects of documentation/evidence are: + +- **Legal hold**: A legal hold refers to the process of preserving evidence for a potential legal case. It involves identifying and securing all relevant data and documents that may be used in the case. +- **Video**: Video evidence may include CCTV footage, body-worn camera footage, or screen recordings. It can be used to provide visual evidence of an incident or to demonstrate a sequence of events. +- **Admissibility**: Admissibility refers to the ability of evidence to be accepted and used in court. Admissibility is based on factors such as relevance, reliability, and authenticity. +- **Chain of custody**: Chain of custody refers to the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. It is important to maintain a chain of custody to ensure the integrity of the evidence. +- **Timelines of sequence of events**: Timelines of sequence of events are a graphical representation of a sequence of activities and events. Time stamps and time offsets are important pieces of information that help establish the order of events and the timeline of the incident. +- **Tags**: Tags are metadata that are attached to evidence to describe it and help with organization and retrieval. They can include information such as file type, author, date, and location. +- **Reports**: Reports are a formal documentation of an investigation and include details such as the incident summary, findings, and conclusions. Reports should be detailed and objective. +- **Event logs**: Event logs are records of events that occur on a system, such as login attempts, file access, or network traffic. They can provide valuable information in an investigation. +- **Interviews**: Interviews are conversations with individuals involved in an incident, such as witnesses or suspects. Interviews can provide important context and information about the incident. It is important to document interviews carefully and accurately. + +## Acquisition + +Acquisition **refers to the process of collecting and preserving digital evidence for further analysis**. It involves gathering data from various sources, such as computer systems, mobile devices, or network infrastructure, in a forensically sound manner to ensure that the data is preserved and not altered during the collection process. + +One important principle related tothe acquisition of forensic evidences is the **Order of volatility**. This **is the principle that digital evidence is volatile and can be lost or altered if not collected in a timely manner**. The order of volatility is a guideline for prioritizing the collection of volatile data sources based on how quickly they may change or be lost. + +Some sources for acquisition are: + +- **Disk**: Disk acquisition involves making a forensic copy of the entire hard drive, including any deleted files and hidden data. +- **Random-access memory (RAM)**: RAM acquisition involves capturing the contents of a computer's memory, including any running programs and system processes. This is important for capturing volatile data that may be lost when the system is shut down. +- **Swap/pagefile**: Swap/pagefile acquisition involves capturing the data that has been swapped out of RAM and written to the hard drive. +- **OS**: Operating system acquisition involves capturing the data and configuration settings of the operating system, including user accounts, installed software, and system logs. +- **Device**: Device acquisition involves capturing data from mobile devices, such as smartphones and tablets. +- **Firmware**: Firmware acquisition involves capturing data from the firmware of devices such as routers, switches, and cameras. +- **Snapshot**: Snapshot acquisition involves capturing a point-in-time copy of a virtual machine or storage device. +- **Cache**: Cache acquisition involves capturing data that has been cached by applications or web browsers. +- **Network**: Network acquisition involves capturing data from network traffic, including packet captures and log files. +- **Artifacts**: Artifacts are pieces of data left behind by user activity or system processes. Examples of artifacts include browser history, cookies, and system logs. + +Documentation and evidence collection during acquisition is critical and must adhere to best practices to ensure admissibility in court. + +## On-premises vs. cloud + +Digital forensics can be conducted in both on-premises and cloud environments. However, there are some differences in the approach and challenges involved in each environment. + +- **On-Premises Forensics**: In on-premises forensics, the investigation is conducted on physical hardware and storage devices that are located within the organization's premises. The forensic investigator can take physical possession of the devices, which allows for a comprehensive analysis of the system. The data that is collected from these devices can be easily preserved and analyzed. +- **Cloud Forensics**: In cloud forensics, the investigation is conducted on virtual machines, cloud storage, and other cloud-based services. In this environment, forensic investigators may not have direct access to the physical hardware, and the data may be spread across multiple geographic locations. As a result, the forensic investigation may require additional steps to ensure that the data is collected and analyzed correctly. + +Some concepts to be famimliar when collecting forensic eveidences are: + +- **Right-to-Audit Clauses**: Right-to-audit clauses are contractual provisions that allow a party to conduct an audit of the other party's systems or data. In cloud environments, these clauses can be used to facilitate the forensic investigation by allowing forensic investigators to access the cloud service provider's systems and data. +- **Regulatory/Jurisdiction**: Regulatory and jurisdictional considerations are essential. The laws and regulations governing data collection, storage, and transmission can differ between countries and regions. Forensic investigators must be aware of these differences to ensure that the investigation is conducted legally and ethically. +- **Data Breach Notification Laws**: Data breach notification laws require organizations to notify individuals if their personal data has been compromised in a data breach. In cloud environments, these laws can be more complex due to the distributed nature of the data. Forensic investigators must be aware of the relevant laws and regulations to ensure that notifications are made correctly and in a timely manner. + +## Integrity + +Integrity **refers to the preservation of the authenticity, accuracy, and completeness of data during an investigation**. It is important to ensure that the data has not been altered, manipulated, or tampered with in any way that could affect its reliability as evidence. + +The following are some of the techniques used to maintain the integrity of digital evidence: + +- **Hashing**: This is the process of using a cryptographic algorithm to generate a fixed-size digest of data that represents the content of the original data. Any change to the original data will result in a different hash value, making it easy to detect any alteration to the data. Commonly used hashing algorithms include SHA-1, SHA-256, and MD5. +- **Checksums**: A checksum is a simple method of ensuring the integrity of data by adding up the values of all the bytes in the data and comparing the result to a predefined value. If the two values match, it means that the data has not been altered. +- **Provenance**: This refers to the documentation of the origin, custody, and ownership of digital evidence. It is important to track the chain of custody of evidence to ensure that it has not been tampered with or mishandled. + +In addition to these techniques, it is important to follow best practices for evidence collection and handling to ensure that the integrity of the evidence is maintained throughout the investigation process. This includes documenting the collection process, using write-protect tools to prevent accidental changes, and storing the evidence in a secure location to prevent unauthorized access. + +## Preservation + +Preservation **refers to the process of ensuring that the integrity and authenticity of digital evidence are maintained from the time it is collected until it is presented in court**. It involves taking appropriate measures to prevent any alteration, deletion, or modification of the evidence during its handling, storage, and analysis. The goal of preservation is to ensure that the evidence remains usable and admissible in a court of law. + +Preservation involves creating a bit-for-bit copy of the original evidence, also known as a forensic image. This forensic image is used for analysis, leaving the original evidence untouched to maintain its integrity. The forensic image is stored in a secure location, using write blockers to prevent any write access to the original evidence. + +Preservation also involves documenting the chain of custody to ensure that the evidence is not tampered with while in possession of investigators or other authorized personnel. This involves maintaining a detailed record of who has handled the evidence, where it has been, and what actions were taken with it at each step of the investigation. This documentation is important for demonstrating the integrity and authenticity of the evidence in court. + +## E-discovery + +E-discovery, or electronic discovery, **refers to the process of locating, preserving, collecting, reviewing, and producing electronically stored information (ESI) in response to a legal or regulatory request or investigation**. ESI can include a wide range of electronic data such as emails, text messages, social media posts, databases, videos, and other digital files. The process of e-discovery involves using specialized tools and techniques to search and analyze the ESI to identify relevant information and to ensure that the data is preserved in a forensically sound manner. E-discovery is an important aspect of modern legal and regulatory compliance, as the vast majority of information is now stored electronically. + +## Data recovery + +Data recovery **is the process of retrieving data from damaged, failed, or inaccessible storage media such as hard drives, solid-state drives, memory cards, USB drives, and other digital storage devices**. The data recovery process involves using specialized software tools and techniques to extract data from the damaged or corrupted storage media. Data recovery may be necessary due to hardware failure, software malfunction, accidental deletion, virus attacks, or other causes of data loss. The goal of data recovery is to retrieve as much data as possible from the damaged storage media while minimizing the risk of further damage or data loss. + +## Non-repudiation + +Non-repudiation **is a security concept that ensures that a party cannot deny that they performed a specific action or transaction**. This concept is often used in legal and contractual situations, where it is important to establish proof that a party took a specific action or made a specific statement. Non-repudiation is typically achieved through the use of digital signatures or other cryptographic mechanisms that ensure the integrity and authenticity of electronic documents or communications. By ensuring non-repudiation, parties can have greater confidence in the validity of digital transactions and can more easily resolve disputes that may arise. + +## Strategic intelligence/counterintelligence + +**Strategic intelligence refers to the collection, analysis, and dissemination of information that is relevant to a particular organization's decision-making processes**. This information is often used to identify and evaluate opportunities and threats in the organization's external environment, including its competitors, customers, and regulatory bodies. Strategic intelligence is used to gain a competitive advantage and make informed business decisions. + +**Counterintelligence**, on the other hand, **refers to the efforts made to prevent hostile entities from gathering and collecting intelligence that could harm the organization**. It involves detecting, identifying, and neutralizing foreign intelligence activities that pose a threat to the organization's personnel, facilities, operations, or sensitive information. The goal of counterintelligence is to protect the organization's interests and ensure the security and integrity of its operations. diff --git a/4.0-operations-and-incident-response/README.md b/4.0-operations-and-incident-response/README.md index 5401d56..65592c8 100644 --- a/4.0-operations-and-incident-response/README.md +++ b/4.0-operations-and-incident-response/README.md @@ -1 +1,11 @@ -# 4.0 Operations and Incident Response \ No newline at end of file +# 4.0 Operations and Incident Response + +* [4.1 Given a scenario, use the appropriate tool to assess organizational security](./4.1-given-a-scenario-use-the-appropriate-tool-to-assess-organizational-security.md) + +* [4.2 Summarize the importance of policies, processes, and procedures for incident response](./4.2-summarize-the-importance-of-policies-processes-and-procedures-for-incident-response.md) + +* [4.3 Given an incident, utilize appropriate data sources to support an investigation](./4.3-given-an-incident-utilize-appropriate-data-sources-to-support-an-investigation.md) + +* [4.4 Given an incident, apply mitigation techniques or controls to secure an environment](./4.4-given-an-incident-apply-mitigation-techniques-or-controls-to-secure-an-environment.md) + +* [4.5 Explain the key aspects of digital forensics](./4.5-explain-the-key-aspects-of-digital-forensics.md) diff --git a/5.0-governance-risk-and-compliance/5.1-compare-and-contrast-various-types-of-controls.md b/5.0-governance-risk-and-compliance/5.1-compare-and-contrast-various-types-of-controls.md new file mode 100644 index 0000000..2cdab39 --- /dev/null +++ b/5.0-governance-risk-and-compliance/5.1-compare-and-contrast-various-types-of-controls.md @@ -0,0 +1,22 @@ +# 5.1 Compare and contrast various types of controls + +Controls are measures or safeguards put in place to reduce risk and ensure compliance with policies, procedures, laws, and regulations + +## Category + +Controls can fall on the following categories: + +1. **Managerial controls**: These controls are administrative or policy-based controls that define the framework within which other controls operate. They are designed to ensure that the organization's policies, procedures, and guidelines are communicated, enforced, and monitored. Examples of managerial controls include policies, standards, procedures, guidelines, risk assessments, and compliance audits. +2. **Operational controls**: These controls are process-oriented controls that ensure that business operations are conducted efficiently and effectively. They are designed to ensure that tasks are performed in accordance with policies, procedures, and guidelines. Examples of operational controls include segregation of duties, background checks, training, quality assurance, and change management. +3. **Technical controls**: These controls are technology-based controls that use software, hardware, and other technology to protect information assets. They are designed to protect the confidentiality, integrity, and availability of information and systems. Examples of technical controls include access controls, firewalls, encryption, intrusion detection and prevention systems, antivirus software, and backup and recovery systems. + +## Control type + +When consireding their purpose, the following controls types can be found: + +- **Preventive** controls aim to stop an incident or a violation from occurring by preventing the unauthorized access or actions. Examples include access controls, authentication mechanisms, encryption, firewalls, and security awareness training. +- **Detective** controls aim to detect incidents that have occurred or violations of policies and regulations. Examples include intrusion detection systems, security cameras, audit trails, and log analysis. +- **Corrective** controls aim to mitigate the impact of an incident that has occurred or a violation that has been detected. Examples include incident response processes, disaster recovery plans, backup and recovery solutions, and vulnerability management. +- **Deterrent** controls aim to discourage individuals from engaging in activities that are against policies or regulations. Examples include security awareness training, policies and procedures, warning banners, and legal consequences. +- **Compensating** controls aim to provide an alternative control mechanism in situations where other controls are not feasible or practical. Examples include security guards, background checks, and job rotation. +- **Physical** controls aim to prevent unauthorized physical access to an organization's resources. Examples include locks, security cameras, fences, biometric authentication, and environmental controls like fire suppression systems and temperature control. diff --git a/5.0-governance-risk-and-compliance/5.2-explain-the-importance-of-applicable-regulations-standards-or-frameworks-that-impact-organizational-security-posture.md b/5.0-governance-risk-and-compliance/5.2-explain-the-importance-of-applicable-regulations-standards-or-frameworks-that-impact-organizational-security-posture.md new file mode 100644 index 0000000..400d2f7 --- /dev/null +++ b/5.0-governance-risk-and-compliance/5.2-explain-the-importance-of-applicable-regulations-standards-or-frameworks-that-impact-organizational-security-posture.md @@ -0,0 +1,36 @@ +# 5.2 Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture + +## Regulations, standards, and legislation + +Regulations, standards, legislation and frameworks **are important to an organization's security posture as they provide guidance and requirements for establishing effective security controls and managing risks**. Failure to comply with these regulations or standards can result in financial penalties, loss of reputation, or legal liability. + +Some of the important regulations, standards, and legislations that impact organizational security posture are: + +1. **General Data Protection Regulation (GDPR)**: The GDPR is a regulation in the European Union that addresses data protection and privacy for all individuals within the EU. It applies to all organizations that process the personal data of EU citizens, regardless of where the organization is based. +2. **Payment Card Industry Data Security Standard (PCI DSS)**: The PCI DSS is a set of security standards developed by major credit card companies to protect against credit card fraud. It applies to all organizations that accept credit card payments. +3. **Health Insurance Portability and Accountability Act (HIPAA)**: HIPAA is a regulation in the United States that sets standards for the privacy and security of protected health information (PHI). +4. **National, territory, or state laws**: National, territory, or state laws are legal regulations established by governments at different levels (national, regional, state, or local) to protect their citizens or constituents. These laws cover various aspects of security, including data privacy, cybersecurity, and physical security. + +Some of the important frameworks that impact organizational security posture are: + +1. **Center for Internet Security (CIS)**: The Center for Internet Security (CIS) is a nonprofit organization that is focused on providing cybersecurity solutions to public and private sector organizations. The CIS has developed a series of security benchmarks, guidelines, and best practices that are widely recognized and adopted in the industry. These benchmarks cover a wide range of technology domains, including operating systems, network devices, cloud infrastructure, and more. The CIS benchmarks are updated regularly to keep pace with emerging threats and technologies. +2. **National Institute of Standards and Technology (NIST) RISK Management Framework (RMF)/Cybersecurity Framework (CSF)**: The NIST CSF is a framework developed by the U.S. government to provide guidance for improving cybersecurity risk management and resilience. +3. **International Organization for Standardization (ISO) 27001/27002/27701/31000**: ISO are standards for information security management that provides a systematic approach to managing sensitive information and ensuring data security. + - ISO 27001: A globally recognized standard for Information Security Management Systems (ISMS) that provides a framework for managing and protecting sensitive information using a risk management approach. + - ISO 27002: A code of practice for information security management that provides guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization. + - ISO 27701: An extension to the ISO 27001 and ISO 27002 standards that provides guidance on implementing and maintaining a privacy information management system (PIMS) to support compliance with various privacy regulations and requirements. + - ISO 31000: A standard for risk management that provides guidelines for managing risks faced by organizations, including principles, a framework, and a process for managing risk. +4. **SSAE SOC 2 Type I/II**: The Statement on Standards for Attestation Engagements (SSAE) is a set of auditing standards that are used to assess the effectiveness of internal controls. SOC 2 is a type of SSAE report that focuses on the controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 Type I reports are designed to evaluate the design of the controls, while SOC 2 Type II reports evaluate both the design and the operating effectiveness of the controls over a period of time. +5. **Cloud Security Alliance**: The Cloud Security Alliance (CSA) is a nonprofit organization that is focused on promoting the use of best practices for secure cloud computing. The CSA has developed a series of guidance documents, best practices, and other resources that are designed to help organizations secure their cloud environments. The CSA Security, Trust & Assurance Registry (STAR) program provides a level of transparency and accountability in the cloud industry by providing independent third-party assessments of cloud service providers. +6. **Cloud Control Matrix**: The Cloud Control Matrix (CCM) is a set of controls that are designed to help organizations assess the security of cloud computing services. The CCM is organized into 17 domains that cover a wide range of security considerations, including data privacy, compliance, risk management, and more. The CCM provides a framework for organizations to evaluate cloud service providers and to ensure that their cloud deployments meet their security requirements. +7. **Reference Architecture**: A reference architecture is a set of standards, guidelines, and best practices that are designed to help organizations design and implement secure IT systems. A reference architecture provides a blueprint for designing and deploying IT systems that are secure, scalable, and reliable. It helps organizations to align their technology investments with their business objectives and to ensure that their IT systems meet their security requirements. + +Compliance with these regulations, standards, or frameworks can help organizations ensure that they have effective security controls in place, and can also help demonstrate to customers and stakeholders that the organization takes security seriously. + +## Benchmarks/secure configuration guides + +Benchmarks, also known as secure configuration guides, **are documents that provide guidance on secure configuration settings for various systems, software, and devices**. These benchmarks are typically created by security organizations, and are based on industry best practices and standards. The goal of benchmarks is to provide organizations with a set of recommended security settings that can help improve their security posture and reduce the risk of cyber threats. By implementing these recommended settings, organizations can reduce the attack surface of their systems and make it harder for attackers to exploit vulnerabilities. + +Additionally, **platform/vendor-specific guides are security guidelines or standards developed by specific vendors or platforms to provide recommendations for securing their products or systems**. These guides are specific to the vendor's products and provide detailed instructions on how to configure and secure them. + +Platform/vendor-specific guides are important because they provide organizations with specific recommendations for securing their technology investments. By following these guidelines, organizations can reduce the risk of security incidents and ensure that their systems are configured and managed in a secure manner. It is recommended that organizations regularly review and update their platform/vendor-specific security guides to ensure that their security posture remains up-to-date and effective. diff --git a/5.0-governance-risk-and-compliance/5.3-explain-the-importance-of-policies-to-organizational-security.md b/5.0-governance-risk-and-compliance/5.3-explain-the-importance-of-policies-to-organizational-security.md new file mode 100644 index 0000000..450d5d1 --- /dev/null +++ b/5.0-governance-risk-and-compliance/5.3-explain-the-importance-of-policies-to-organizational-security.md @@ -0,0 +1,76 @@ +# 5.3 Explain the importance of policies to organizational security + +## Personnel + +A Personnel **policy is a set of guidelines and procedures that an organization has in place to manage the behavior and actions of its employees**. It covers a broad range of areas, from hiring and onboarding to day-to-day operations and separation from the company. + +Some Personnel policies are or cover the following areas: + +- **Acceptable use policy**: This policy outlines the acceptable use of company resources, including computers, internet, email, and social media. It informs employees of what is and is not allowed and what the consequences are if policy is violated. +- **Job rotation**: Job rotation policy involves rotating employees through different job roles within the organization to provide cross-training and prevent fraud. +- **Mandatory vacation**: A mandatory vacation policy requires employees to take a minimum amount of time off each year. This policy helps detect fraud or other illegal activities by giving someone else access to the employee's work during their absence. +- **Separation of duties**: Separation of duties policy requires that no single employee has control over an entire process or system. This helps prevent fraud, errors, and unauthorized access. +- **Least privilege**: Least privilege policy limits employee access to the minimum amount of data and systems necessary to perform their job. +- **Clean desk space**: Clean desk policy requires employees to keep their work area clear of confidential or sensitive information. This helps prevent unauthorized access to sensitive information. +- **Background checks**: Background checks policy outlines the procedures for conducting background checks on potential employees, vendors, and contractors. +- **Non-disclosure agreement (NDA)**: NDA policy requires employees to sign an agreement that they will not disclose company confidential information. This helps protect the company's sensitive information. +- Social media analysis: Social media policy outlines guidelines for employee use of social media to ensure that employees do not harm the company's reputation. +- **Onboarding**: Onboarding policy outlines the procedures for integrating new employees into the organization. This includes orientation, training, and support. +- **Offboarding**: Offboarding policy outlines the procedures for separating employees from the organization. This includes exit interviews, returning company assets, and revoking access to systems and data. +- **User training**: User training policy outlines the requirements for employee training in cybersecurity awareness, including gamification, capture the flag exercises, phishing campaigns and simulations, computer-based training (CBT), and role-based training. + - Gamification: Gamification is the use of game elements such as points, rewards, and competition to make learning cybersecurity awareness more engaging and enjoyable for employees. + - Capture the flag: Capture the flag exercises are cybersecurity challenges that simulate real-world attacks to teach employees about vulnerabilities and threats. + - Phishing campaigns and simulations: Phishing campaigns and simulations are training exercises that simulate phishing attacks to teach employees how to recognize and respond to them. + - Computer-based training (CBT): CBT is a form of training that uses interactive computer-based modules to teach employees cybersecurity awareness. + - Role-based training: Role-based training is customized cybersecurity awareness training based on an employee's job role and level of access to systems and data. + +## Diversity of training techniques + +Diversity of training techniques **refers to the use of various methods and approaches to provide training and education to individuals in an organization**. This can include traditional classroom-style training, computer-based training (CBT), role-playing, gamification, and simulations, among others. The use of a variety of training techniques can help to engage individuals with different learning styles, promote active learning, and enhance knowledge retention. It can also help to make training more interesting and enjoyable for individuals, increasing their motivation to participate and learn. + +## Third-party risk management + +Third-party risk management **policies refer to the set of policies and procedures that an organization uses to manage the risks associated with its relationships with external entities, such as vendors, suppliers, business partners, and contractors**. + +Some third-party risk management policies are or cover the following areas: + +- **Vendors**: Third-party vendors provide products and services to organizations. Vendors may have access to sensitive information, systems, or networks, which may pose a risk to the organization's security posture. Vendor management policies are put in place to ensure that vendors meet the organization's security standards and compliance requirements. +- **Supply chain**: A supply chain consists of all the entities involved in the production, distribution, and delivery of a product or service. Managing supply chain risks is important to ensure the security and integrity of the products and services that an organization delivers to its customers. +- **Business partners**: Business partners are entities that an organization works with to achieve common business goals. Managing the security risks associated with business partnerships is crucial to protecting the organization's assets and reputation. +- **Service level agreement (SLA)**: An SLA is a contract between an organization and its vendor or service provider that outlines the agreed-upon level of service and performance. The SLA should also include provisions for security and data protection. +- **Memorandum of understanding (MOU)**: An MOU is a formal agreement between two or more parties that outlines the terms and details of a business arrangement, including security and privacy requirements. +- **Measurement systems analysis (MSA)**: MSA is a statistical analysis technique used to evaluate the performance and accuracy of a measurement system. In the context of third-party risk management policies, MSA may be used to evaluate the effectiveness of a vendor's security controls. +- **Business partnership agreement (BPA)**: A BPA is a legal document that establishes a formal relationship between two or more parties. The BPA may include provisions for security and data protection. +- **End of life (EOL)**: EOL refers to the date when a product or service is no longer supported by the vendor. It is important for organizations to have a plan for managing the security risks associated with end-of-life products and services. +- **End of service life (EOSL)**: EOSL refers to the date when a product or service is no longer supported by the vendor and is no longer receiving security updates or patches. Organizations should have a plan for managing the security risks associated with end-of-service-life products and services. +- **NDA**: A non-disclosure agreement (NDA) is a legal agreement between two or more parties that outlines the confidential information that they will share and how it will be used and protected. NDAs are commonly used in the context of third-party relationships to protect sensitive information. + +## Data + +Data policies **are guidelines and procedures that an organization implements to manage data effectively and securely**. Here are some elaborations on three types of data policies: + +1. **Classification**: This policy outlines how data should be categorized based on its sensitivity, value, and criticality. Classification enables an organization to identify and prioritize protection measures based on the level of risk and potential impact if the data is compromised. +2. **Governance**: This policy defines how data should be collected, stored, managed, and used across the organization. It ensures that data is used ethically and legally and is compliant with relevant laws and regulations. Data governance policies help to maintain the quality, accuracy, completeness, consistency, and security of data throughout its lifecycle. +3. **Retention**: This policy specifies how long data should be retained, where it should be stored, and when it should be deleted or destroyed. Retention policies help organizations to manage their legal and regulatory compliance obligations, minimize risks and liabilities, and optimize data storage and usage. Retention policies may vary depending on the type and classification of data, as well as the industry and jurisdiction. + +Overall, data policies provide a framework for effective data management and protection, and they should be regularly reviewed and updated to reflect changes in business, technology, and regulatory environments. + +## Credential policies + +Credential policies **are guidelines and procedures that organizations implement to protect their credentials and sensitive data from unauthorized access, theft, or misuse**. It includes policies for managing, storing, and protecting passwords, usernames, and other forms of credentials used to access the organization's information systems. The following are some of the credential policies and their elaborations: + +- **Personnel**: The personnel credential policy defines guidelines for creating and managing employee credentials, such as usernames, passwords, and security questions. This policy includes guidelines for password complexity, minimum password length, password expiration, and password reuse. It also includes guidelines for access control and authentication, such as the use of multifactor authentication (MFA) and biometric authentication. +- **Third-party**: The third-party credential policy defines guidelines for managing third-party vendor credentials, such as usernames and passwords used to access the organization's systems. This policy includes guidelines for vetting vendors and assessing their security controls, as well as guidelines for managing and monitoring third-party access to the organization's systems. +- **Devices**: The device credential policy defines guidelines for managing device credentials, such as usernames and passwords used to access network devices and endpoints. This policy includes guidelines for managing default credentials, ensuring secure storage of device credentials, and implementing password complexity and expiration policies. +- **Service accounts**: The service account credential policy defines guidelines for managing service account credentials used by applications and services. This policy includes guidelines for managing and rotating service account passwords, ensuring secure storage of service account credentials, and limiting access to service accounts. +- **Administrator/root accounts**: The administrator/root credential policy defines guidelines for managing administrative account credentials, such as usernames and passwords used to access critical systems and data. This policy includes guidelines for implementing strong password policies, limiting the use of administrative accounts, and monitoring administrative account access for unauthorized activity. + +## Organizational policies + +Organizational policies **are a set of guidelines and procedures that govern the activities and behavior of an organization's employees**. These policies provide a framework for decision-making and ensure that the organization operates in a consistent and efficient manner. Two important types of organizational policies are change management and asset management. + +**Change management is the process of controlling changes to the organization's IT infrastructure, including hardware, software, and networks**. + +**Change control is the process of managing changes to IT assets in a controlled manner, ensuring that changes are made only after proper review and approval**. + +**Asset management is the process of tracking and managing the organization's IT assets, including hardware, software, and data**. This includes asset inventory, tracking asset utilization, and ensuring that assets are properly secured and maintained throughout their lifecycle. diff --git a/5.0-governance-risk-and-compliance/5.4-summarize-risk-management-processes-and-concepts.md b/5.0-governance-risk-and-compliance/5.4-summarize-risk-management-processes-and-concepts.md new file mode 100644 index 0000000..51c80a7 --- /dev/null +++ b/5.0-governance-risk-and-compliance/5.4-summarize-risk-management-processes-and-concepts.md @@ -0,0 +1,78 @@ +# 5.4 Summarize risk management processes and concepts + +## Risk types + +Risk types **refer to the various categories or classifications of potential risks that organizations face**. Each type of risk presents unique challenges and requires specific strategies and controls to mitigate. + +The following are some examples of risk types: + +1. **External risks**: These are risks that originate outside of the organization, such as natural disasters, cyber attacks, or economic downturns. +2. **Internal risks**: These are risks that arise from within the organization, such as employee theft, fraud, or mismanagement. +3. **Legacy systems risks**: These are risks that arise from the use of outdated technology or systems, which can be vulnerable to security threats or may fail to meet compliance requirements. +4. **Multiparty risks**: These are risks that arise from interactions with third-party vendors, partners, or other entities, such as supply chain disruptions or vendor breaches. +5. **IP theft risks**: These are risks that arise from the theft or unauthorized use of intellectual property, such as trade secrets or patents. +6. **Software compliance/licensing risks**: These are risks that arise from noncompliance with software licensing agreements, which can result in legal penalties or financial losses. + +Each of these risk types requires specific controls and strategies to manage and mitigate their potential impact on the organization. + +## Risk management strategies + +Risk management strategies **are the methods used by organizations to identify, evaluate, and prioritize risks and then implement controls or other measures to mitigate or manage those risks**. The following are the commonly used risk management strategies: + +1. **Risk acceptance**: This strategy involves accepting the potential consequences of a risk and making a decision to do nothing about it. This can be appropriate when the cost of addressing the risk is higher than the potential impact of the risk. +2. **Risk avoidance**: This strategy involves avoiding or eliminating the risk altogether. For example, an organization might decide not to pursue a particular business opportunity if it involves a risk that is considered too high. +3. **Risk transference**: This strategy involves transferring the risk to another party. This can be done through various means, including purchasing insurance, outsourcing the risk to a third-party vendor, or entering into a contract with another party that specifies the allocation of risk. +4. **Risk mitigation**: This strategy involves implementing controls or other measures to reduce the likelihood or impact of a risk. This can include implementing technical controls, developing policies and procedures, or providing employee training. + +## Risk analysis + +Risk analysis **is the process of identifying, assessing, and evaluating potential risks to an organization's assets, systems, operations, and objectives**. It is an important aspect of information security management that helps organizations identify vulnerabilities and develop strategies to mitigate risk. The following are some key terms related to risk analysis: + +- **Risk register**: A document that lists all identified risks, including their likelihood, impact, and associated risk mitigation strategies. +- **Risk matrix/heat map**: A visual representation of the likelihood and impact of various risks, used to prioritize risks for mitigation. +- **Risk control assessment**: An evaluation of the effectiveness of existing risk controls and their ability to reduce or eliminate risk. +- **Risk control self-assessment**: A self-assessment process used by individuals or teams to identify and assess risks within their areas of responsibility. +- **Risk awareness**: The level of awareness and understanding of risks within an organization, including the potential consequences of a risk event. +- **Inherent risk**: The level of risk before any controls or mitigation strategies are implemented. +- **Residual risk**: The level of risk remaining after controls or mitigation strategies have been implemented. +- **Control risk**: The risk that a control will fail or not operate as intended. +- **Risk appetite**: The level of risk that an organization is willing to accept in pursuit of its objectives. +- **Regulations that affect risk posture**: Laws, regulations, or industry standards that impact an organization's risk posture or risk management strategies. +- **Risk assessments**: Two types of risk assessment methods used to evaluate risks. Qualitative risk assessments involve subjective judgments and opinions, while quantitative risk assessments involve the use of mathematical calculations and objective data to determine risk levels. +- **Likelihood of occurrence**: The probability or chance that a risk event will occur. +- **Impact**: The effect or consequence of a risk event on an organization's assets, systems, operations, or objectives. +- **Asset value**: The estimated value of an organization's assets, including physical assets, intellectual property, and data. +- **Single-loss expectancy (SLE)**: The estimated monetary loss associated with a single occurrence of a risk event. +- **Annualized loss expectancy (ALE)**: The estimated annual monetary loss associated with a risk event, calculated by multiplying the SLE by the annualized rate of occurrence. +- **Annualized rate of occurrence (ARO)**: The estimated number of times a risk event will occur in a given year. + +## Disasters + +Disasters **are events or incidents that can have significant and negative impacts on individuals, organizations, and society**. Disasters can be caused by a wide range of factors, including natural phenomena, human error, or malicious activities. + +Some common types of disasters include environmental, person-made, internal and external. + +**Environmental disasters are caused by natural events** such as earthquakes, hurricanes, floods, or wildfires. These disasters can have a significant impact on infrastructure, supply chains, and the economy, as well as on human life and the environment. + +**Person-made disasters**, on the other hand, **are caused by human activities** such as accidents, negligence, or intentional actions. These disasters can include things like industrial accidents, transportation accidents, and cyberattacks. + +**Internal disasters are those that occur within an organization**, such as data breaches, insider threats, or system failures. **External disasters**, on the other hand, **are events that occur outside of an organization but can still have a significant impact on it**, such as natural disasters or terrorist attacks. + +It is important for organizations to have disaster recovery and business continuity plans in place to minimize the impact of disasters and ensure that critical business functions can continue in the event of an unexpected disruption. + +## Business impact analysis + +Business impact analysis (BIA) **is a process used to identify and evaluate the potential effects of disruptions to business operations**. The BIA assesses the impact of disruptions on critical business functions, systems, and processes, and identifies the recovery time objectives (RTO) and recovery point objectives (RPO) necessary to resume normal business operations. + +Here are some key terms related to BIA: + +- **Recovery time objective (RTO)**: the maximum amount of time allowed for the restoration of critical business processes after a disruption. +- **Recovery point objective (RPO)**: the maximum amount of data loss that can be tolerated in the event of a disruption. +- **Mean time to repair (MTTR)**: the average time it takes to repair a failed system or component. +- **Mean time between failures (MTBF)**: the average time between failures of a system or component. +- **Functional recovery plans**: plans for restoring critical business processes and systems in the event of a disruption. +- **Single point of failure**: a component or system that, if it fails, would cause a critical business process to fail. +- **Disaster recovery plan (DRP)**: a plan for recovering critical systems and data in the event of a disaster. +- **Mission essential functions**: the critical functions and processes that an organization must perform to achieve its mission. +- **Identification of critical systems**: the identification of the systems and processes that are critical to an organization's operations. +- **Site risk assessment**: an assessment of the potential risks that could affect an organization's facilities, including natural disasters, man-made disasters, and other hazards. diff --git a/5.0-governance-risk-and-compliance/5.5-explain-privacy-and-sensitive-data-concepts-in-relation-to-security.md b/5.0-governance-risk-and-compliance/5.5-explain-privacy-and-sensitive-data-concepts-in-relation-to-security.md new file mode 100644 index 0000000..4470162 --- /dev/null +++ b/5.0-governance-risk-and-compliance/5.5-explain-privacy-and-sensitive-data-concepts-in-relation-to-security.md @@ -0,0 +1,81 @@ +# 5.5 Explain privacy and sensitive data concepts in relation to security + +## Organizational consequences of privacy and data breaches + +Organizational consequences of privacy and data breaches can be severe and can result in a wide range of negative impacts. These consequences can include: + +- **Reputation damage**: Privacy and data breaches can significantly damage an organization's reputation, leading to a loss of trust among customers, partners, and stakeholders. This loss of trust can impact the organization's ability to attract and retain customers, partners, and employees. +- **Identity theft**: Privacy breaches can lead to the theft of personal information, such as Social Security numbers, birth dates, and financial data. This stolen data can be used to commit identity theft, which can have serious consequences for individuals and the organization responsible for protecting their data. +- **Fines**: Organizations that fail to comply with data protection regulations can face significant fines. For example, the General Data Protection Regulation (GDPR) in the European Union imposes fines of up to 4% of an organization's global annual revenue or €20 million, whichever is greater. +- **IP theft**: Privacy breaches can also result in the theft of intellectual property (IP), including trade secrets, proprietary technology, and sensitive business information. This theft can have significant financial and competitive impacts on the organization. + +In addition to these consequences, privacy and data breaches can also result in legal action, lost productivity, and damage to relationships with partners and vendors. It is therefore critical for organizations to take appropriate steps to protect sensitive data and ensure compliance with relevant regulations and standards. + +## Notifications of breaches + +Notification of a breach **refers to the process of informing individuals and entities whose data may have been affected by the breach**. Notification is a critical component of breach response, as it helps to minimize the potential damage caused by a breach and to restore trust with affected parties. + +**Escalation** is one method of notification, which **involves notifying higher-level management or other stakeholders within an organization about a breach**. This may include notifying executives, legal teams, or the board of directors. Escalation is typically used when a breach is significant or when it involves sensitive or high-value data. + +**Public notifications and disclosures** are another method of breach notification, which **involves informing the public or affected parties about a breach through public channels**. This may include issuing press releases, posting notifications on websites or social media, or sending out email or text notifications. Public notification is typically required by law in many jurisdictions, and it is often used to inform affected parties about the steps they can take to protect themselves from potential harm resulting from the breach. + +## Data types + +- **Data classifications**: Public, Private, Sensitive, Confidential, Critical and Proprietary: These classifications are used to determine the level of access and protection required for different types of data. Public data is not confidential and can be shared with anyone, while private data is only accessible to authorized personnel. Sensitive data includes information that requires extra protection, such as health or financial data. Confidential data is information that requires a high level of protection due to legal or ethical requirements. Critical data is essential for the operation of an organization, while proprietary data is unique to an organization and provides a competitive advantage. +- **Personally identifiable information (PII)**: This refers to any data that can be used to identify an individual, such as name, address, phone number, social security number, etc. PII must be protected to prevent identity theft and other malicious activities. +- **Health information**: This refers to data that is related to an individual's health or medical condition. Health information is protected by law under the Health Insurance Portability and Accountability Act (HIPAA) and must be kept confidential. +- **Financial information**: This refers to data related to an individual's financial status, such as bank account numbers, credit card information, and tax returns. Financial information must be protected to prevent fraud and theft. +- **Government data**: This refers to data owned or produced by a government entity, including classified information. Government data must be protected to ensure national security. +- **Customer data**: This refers to data related to customers, such as contact information, purchase history, and preferences. Customer data must be protected to maintain customer trust and prevent identity theft or fraud. + +## Privacy enhancing technologies + +Privacy-enhancing technologies (PETs) **refer to a set of tools, techniques, and approaches that can be used to protect and enhance privacy in information systems and networks**. These technologies aim to provide effective privacy protection while still allowing for the use and sharing of data. + +Here are some examples of PETs: + +- **Data minimization**: The principle of collecting, processing, and storing only the minimum amount of data necessary to achieve a specific purpose or goal. +- **Data masking**: A technique used to obscure or mask sensitive data by replacing it with nonsensitive data or symbols. This technique can be used to protect data during storage or transmission. +- **Tokenization**: A process that replaces sensitive data with a randomly generated token or reference number. This technique is commonly used in payment card systems to protect cardholder data. +- **Anonymization**: The process of removing or altering identifying information from data so that individuals cannot be re-identified. Anonymization techniques may include removing names, addresses, or other identifying information from data sets. +- **Pseudo-anonymization**: A technique used to replace identifying information with a pseudonym or unique identifier. This technique is commonly used in health care systems to protect patient privacy. + +PETs can help organizations comply with privacy laws and regulations, protect sensitive data, and maintain customer trust. However, it's important to note that PETs are not foolproof and can still be subject to attacks or breaches. Therefore, it's crucial to implement a comprehensive security strategy that includes PETs as well as other security measures such as access controls, encryption, and monitoring. + +## Roles and responsibilities + +Roles and responsibilities **refer to the various individuals or positions within an organization that have specific duties related to the handling of data**. These roles and responsibilities are important for ensuring that data is managed and protected in accordance with relevant laws and regulations. Some of the key roles and responsibilities related to data privacy and protection include: + +- **Data owners**: Individuals or groups within an organization who are responsible for the overall management and security of data, including ensuring that it is accurate, up-to-date, and properly secured. +- **Data controller**: An individual or organization that determines the purposes and means of processing personal data. The data controller is responsible for ensuring that data processing is carried out in compliance with applicable laws and regulations. +- **Data processor**: An individual or organization that processes personal data on behalf of a data controller. The data processor is responsible for ensuring that data processing is carried out in accordance with the instructions of the data controller and applicable laws and regulations. +- **Data custodian/steward**: Individuals within an organization who are responsible for the day-to-day management and security of data, including ensuring that it is properly stored, accessed, and maintained. +- **Data protection officer (DPO)**: An individual within an organization who is responsible for ensuring compliance with data protection regulations, including GDPR. The DPO is responsible for advising on data protection matters, monitoring compliance, and serving as a point of contact for data subjects and regulatory authorities. + +## Information life cycle + +The information life cycle **refers to the stages that data and information go through from their creation to their eventual disposal**. It encompasses the processes and procedures involved in the creation, collection, use, storage, dissemination, archiving, and destruction of information assets. + +The stages of the information life cycle include: + +1. Creation: Information is created and entered into a system or application. +2. Collection: Information is collected from various sources and is incorporated into the system. +3. Processing: Information is manipulated and processed for its intended use. +4. Storage: Information is stored in a secure and accessible manner. +5. Dissemination: Information is shared with authorized parties as needed. +6. Archiving: Information is stored for long-term retention and preservation. +7. Destruction: Information is securely destroyed when it is no longer needed or required by law or policy. + +Effective management of the information life cycle is essential to ensure the confidentiality, integrity, and availability of information assets throughout their entire life cycle. + +## Impact assessment + +Impact assessment **is the process of evaluating the potential consequences and effects of a specific event or incident on an organization or system**. It involves analyzing the various aspects of the event or incident, such as the scope, severity, duration, and likelihood of occurrence, in order to determine the potential impact on the organization's operations, assets, personnel, reputation, and other key areas. The goal of an impact assessment is to identify and prioritize the risks associated with the event or incident, and to develop strategies and plans to mitigate those risks and minimize the impact on the organization. Impact assessments are commonly used in the context of disaster planning, risk management, and information security. + +## Terms of agreement + +Terms of agreement, also known as terms of service or terms and conditions, **refer to the legal agreement between a service provider and its customers or users that outlines the terms and rules of using the service**. The terms of agreement typically cover important information such as the acceptable use policy, payment terms, liability limitations, disclaimers, intellectual property rights, termination and cancellation policies, and privacy policies. By accepting the terms of agreement, users agree to abide by the rules and guidelines set forth by the service provider, and failure to comply with these terms may result in account suspension or termination. + +## Privacy notice + +A privacy notice **is a public statement that informs individuals about how an organization collects, uses, and protects their personal information**. It is typically a document posted on the organization's website or provided to individuals when they provide their personal information. A privacy notice typically includes information such as the types of personal information collected, the purposes for which the information is used, how it is shared with third parties, and the measures taken to secure the information. The privacy notice is an important part of an organization's privacy program, as it helps build trust with individuals by providing transparency about how their personal information is handled. diff --git a/5.0-governance-risk-and-compliance/README.md b/5.0-governance-risk-and-compliance/README.md index 8577fde..c6b42f7 100644 --- a/5.0-governance-risk-and-compliance/README.md +++ b/5.0-governance-risk-and-compliance/README.md @@ -1 +1,11 @@ -# 5.0 Governance, Risk, and Compliance \ No newline at end of file +# 5.0 Governance, Risk, and Compliance + +* [5.1 Compare and contrast various types of controls](./5.1-compare-and-contrast-various-types-of-controls.md) + +* [5.2 Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture](./5.2-explain-the-importance-of-applicable-regulations-standards-or-frameworks-that-impact-organizational-security-posture.md) + +* [5.3 Explain the importance of policies to organizational security](./5.3-explain-the-importance-of-policies-to-organizational-security.md) + +* [5.4 Summarize risk management processes and concepts](./5.4-summarize-risk-management-processes-and-concepts.md) + +* [5.5 Explain privacy and sensitive data concepts in relation to security](./5.5-explain-privacy-and-sensitive-data-concepts-in-relation-to-security.md) diff --git a/README.md b/README.md index 5cacc22..f003993 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,27 @@ # CompTIA Security+ SY0-601 -This is just a WIP, the final version of these materials will be found at my [blog](https://binaricoders.dev). This are -just the drafts for the different articles. +This is just a WIP, the final version of these materials will be found on my [blog](https://binaricoders.dev). These are just the drafts for the different articles. -This repository is not going to be a coding repository. The purpose of this repository is to store my notes about the ' -CompTIA Security+ SY0-601' learning and study. +This repository is not going to be a coding repository. The purpose of this repository is to store my notes about the 'CompTIA Security+ SY0-601' learning and study. The reason to use this format instead of the usual blog format, [Binary Coders]((https://binaricoders.dev)), is that this is going to be a live project, I wanted to be free to edit, change or redo the different sections and be able to write this in a non-linear way. Be able to review things and add new information to the sections already finished. -I hope, if you have landed here, this document can be of any use for you. +I hope, if you have landed here, this document can be of any use to you. + +To experiment with recent developments in generative language models based on the 'transformer' architecture, instead of writing all the content myself as I did for previous series related to *InfoSec* certification (i.e., [CEH](https://binarycoders.dev/2020/06/07/ceh-i-preamble-and-index/)), I am going to execute the following steps: + +- [x] Generate the content using ChatGPT, and a few manual modifications based on common sense or obvious missing content. +- [ ] Answer a collection of exam questions using solely the generated content. +- [ ] Edit and modify the content to add any extra information missing based on the reviewed questions. +- [ ] Continue the reviewing process till a satisfaying number of questions can be answered solely based on these notes. + +Why doing it in this way? + +- First, because I think is a more fun way to study the CompTIA Security+ SY0-601 material than just trying to brute-force memorise them. +- Second, becasue I am curious about how to work with generative language models, and how to interact with them to improve performance. And, I think that having a goal and trying to achieve it can help me to improve my skills interacting with such a models. +- Finally, becasue... let's see what happens. Is it possible that this needs to be re-written manually as I did for the CEH contents? yes. Is is possible with the help of the generative language model I can finish a taskthat it will take me a few months in a few weeks? Yes. Is it possible the generated content needs no review? Yes. And, this is why this is the final reason, just pure curiosity. ## Exam Objectives (Domains) @@ -21,20 +32,18 @@ I hope, if you have landed here, this document can be of any use for you. | 3.0 Implementation | 25% | | 4.0 Operations and Incident Response | 16% | | 5.0 Governance, Risk, and Compliance | 14% | +| **Total** | **100%** | ## Sections * [1.0 Threats, Attacks, and Vulnerabilities](./1.0-threats-attacks-and-vulnerabilities/README.md) -* [2.0 Architecture and Design](./2.0-archiecture-and-design/README.md) +* [2.0 Architecture and Design](./2.0-architecture-and-design/README.md) * [3.0 Implementation](./3.0-implementation/README.md) * [4.0 Operations and Incident Response](./4.0-operations-and-incident-response/README.md) * [5.0 Governance, Risk, and Compliance](./5.0-governance-risk-and-compliance/README.md) ## Information references -* CompTIA Security+ Certification Exam Objectives (SY0-601) -* [Norton](https://us.norton.com) -* [Wikipedia](https://en.wikipedia.org) -* [Microsoft](https://docs.microsoft.com) -* [OWASP](https://owasp.org) -* [Acunetix](https://www.acunetix.com) +* CompTIA Security+ SY0-601 Exam Objectives (3.0) +* ChatGPT +* Mike Meyers' CompTIA Security+ Certification Guide, Third Edition (Exam SY0-601) diff --git a/security-plus-all.py b/security-plus-all.py new file mode 100755 index 0000000..7e9683d --- /dev/null +++ b/security-plus-all.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python3 + +import os +import re + +SECURITY_PLUS_FILENAME = "security-plus-sy0-601-all" +MD_EXTENSION = ".md" +PDF_EXTENSION = ".pdf" + +def generate_security_plus_file(): + markdown_file = f"{SECURITY_PLUS_FILENAME}{MD_EXTENSION}" + pdf_file = f"{SECURITY_PLUS_FILENAME}{PDF_EXTENSION}" + + with open(markdown_file, "w") as f: + f.write("# **CompTIA Security+ (SY0-601)**\n\n") + folders = [f for f in os.listdir() if os.path.isdir(f) and re.match(r"\d\.\d-[a-z-]+", f)] + folders = sorted(folders) + for folder in folders: + folder_path = os.path.join(os.getcwd(), folder) + files = [f for f in os.listdir(folder_path) if os.path.isfile(os.path.join(folder_path, f)) and re.match(r"\d+\.\d+-[a-zA-Z-]+\.md", f)] + files = sorted(files) + if files: + folder_title = "-".join(folder.split("-")[1:]).replace("-", " ").title() + f.write(f"# **{folder_title}**\n\n") + for file in files: + with open(os.path.join(folder_path, file), "r") as fp: + f.write(fp.read() + "\n") + f.write("\n") + +if __name__ == "__main__": + generate_security_plus_file()