Security+ Sy0-401 Course Notes

Front 1

• An OSI layer 2 device• Hardware bridging ASICs (very fast!)• Forwards traffic based on MAC address • The core of an enterprise network• High bandwidth - Many simultaneous packets

Back 1

Switch

Front 2

An OSI layer 3 device• Routes traffic between IP subnets• Routers inside of switches are sometimescalled “layer 3 switches”• Layer 2 = Switch, Layer 3 = Router• Often connects diverse network types -LAN, WAN, copper, fiber

Back 2

Router

Front 3

• OSI layer 4 (TCP/UDP), some firewalls filter through OSI layer 7• Filters traffic by port number• Can encrypt traffic into/out of the networkand between sites• Can proxy traffic - A common security technique• Most firewalls can be layer 3 devices (routers)

Back 3

Firewall

Front 4

• Captures network packets• Decodes each part of the communication• Sees all of the network conversation

Back 4

Protocol analyzer

Front 5

• Stop unsolicited email at the gateway• Whitelist• Only receive email from trusted senders• SMTP standards checking• Block anything that doesn’t follow RFC standards• rDNS - Reverse DNS• Block email where the sender’s domain doesn’t match the IP address• Tarpitting• Intentionally slow down the server conversation• Recipient filtering• Block all email not addressed to a validrecipient email address

Back 5

Spam Filters

Front 6

• Applies rules to HTTP conversations• Allow or deny based on expected input• Protects against exploits like SQL injections and buffer overflows• Focus of Payment Card Industry Data Security Standard (PCI DSS)

Back 6

Web Application Firewall

Front 7

A security appliance that combined multiple security controls into a single solution. UTM appliances can inspect data streams for malicious content and often include URL filtering, malware inspection, and content inspection components.

Back 7

UTM-Unified Threat Management

Front 8

A line bridging device used with T1 and similar lines. It Typically connects with a DSU as a CSU/DSU.

Back 8

CSU-Channel Service Unit

Front 9

An interface used to connect equipment to a T1and si,ilair lines. It typically connects with a CSU as a CSU/DSU.

Back 9

DSU- Data Service Unit

Front 10

• Unified Threat Management (UTM) /Web security gateway• URL filter / Content inspection, malware inspection, spam filter, CSU/DSU, router, switch, firewall, IDS/IPS, bandwidth shaper, VPN endpoint

Back 10

All-in-one security appliance

Front 11

• Network-based Firewalls• Control traffic flows based on the application• Microsoft SQL Server, Twitter, YouTube• Intrusion Prevention Systems• Identify the application• Apply application-specific vulnerability signaturesto the traffic• Host-based firewalls• Work with the OS to determine the application

Back 11

Application-aware Security Devices

Front 12

• Allow or disallow traffic based on security tuples• Source IP, Destination IP, port number,time of day, application, etc.• Evaluated top-to-bottom• There’s an implicit deny at the bottom

Back 12

Configuring firewall rules

Front 13

• Logically separate your switch ports into subnets• Cannot communicate to each other without a router• Group users together by function

Back 13

VLANs- Virtual Local Area Network

Front 14

• Always change the default login / password• Protect configuration file transfers• TFTP - in the clear• SCP - encrypted• HTTPS - encrypted

Back 14

Secure router configuration

Front 15

• IEEE 802.1X• Port-based Network Access Control (PNAC)• Makes extensive use of EAP and RADIUS• Extensible Authentication Protocol• Remote Authentication Dial In User Service• Disable your unused ports• Enable duplicate MAC address checking / spoofing

Back 15

Switch port security

Front 16

Provides central authentication for remote access clients. Uses symmetric encryption to encrypt the password packets and it uses UDP in contrast.

Back 16

RADIUS-Remote Authentication Dial In User Service

Front 17

An authentication framework that provides general guidance for authentication methods.

Back 17

EAP- Extensible Authentication Protocol

Front 18

• Permissions associated with an object• Used in file systems, network devices,operating systems, and more

Back 18

Access Control Lists (ACLs)

Front 19

• Commonly seen on intrusion prevention systems• DoS / DDoS• Denial of Service• SYN floods• Overload a server• Ping floods / ping scans• Overwhelm the network• Identify what’s out there• Port floods / port scans• Identify open ports on a device

Back 19

Flood Guards

Front 20

• IEEE standard 802.1D• Prevents loops in bridged (switched) networks• Built into the switch configuration options

Back 20

Spanning Tree Protocol (STP

Front 21

Separate switches, separate routers, no overlap• Used in sensitive environments• Logical separation• Virtualization of the network infrastructure

Back 21

Network Separation

Front 22

Good for post-event analysis• Can provide useful real-time analysis• Automation and consolidation is the key

Back 22

Log Analysis

Front 23

An important requirement• We are increasingly mobile• Take advantage of encryption technologies• Keep everything private• Consider adding additional authentication technologies (One-time passwords)• Constantly audit your access logs

Back 23

Remote Access

Front 24

• One of the newest digital technologies• And one of the most difficult to secure• Firewalls generally don’t like VoIP technologies• You’ll need protocol-specific application gateways• Don’t forget your legacy telephony!• Long distance still costs money

Back 24

Telephony

Front 25

• A complex technology• But powerful when well engineered• Very useful in large open environments• Universities and large enterprises• Requires a large security infrastructure• Authentication is critical• Redundancy is required

Back 25

Network Access Control

Front 26

• A complex technology• But powerful when well engineered• Very useful in large open environments• Universities and large enterprises• Requires a large security infrastructure• Authentication is critical• Redundancy is required

Back 26

Network Access Control

Front 27

• Huge cost savings• Security has to catch up to the speed of change• The control of physical objects is gone• Also difficult to apply external security components• Requires additional insight• Harder to view intra-server communication• Take advantage of your logs• They’ll tell you much more than you can see

Back 27

Virtualization

Front 28

• No servers, no software, no maintenance team• No hardware of any kind• Someone else handles the platform, you handle the product• You don’t have direct control of the data, people, or infrastructure•

Back 28

Platform as a Service (PaaS

Front 29

• On-demand software, no local installation• Used for common business functions such as payroll services • Data and applications are centrally managed•

Back 29

Software as a service (SaaS)

Front 30

• Sometimes called Hardware as a Service (HaaS)• Equipment is outsourced• You are still responsible for the overall device and application management• You’re also responsible for the security• Your data is out there, but more within your control•

Back 30

Infrastructure as a service (IaaS)

Front 31

Cloud Deployment Models• Private - A virtualized data center• Public - Available to everyone over the Internet• Hybrid - A mix of public and private• Community - Several organizations share the same resources

Back 31

Cloud Deployment Models

Front 32

A ______ could be hardware or software to implement and enforce a policy

Back 32

control

Front 33

Passwords and encryptions those are ____ controls.

Back 33

technical

Front 34

Controls that govern the operation within the business environment and this could be in the form of procedures, standards, and best practices.

Back 34

Operational

Front 35

• A report that isn’t true - a false alarm or mistaken identity• IDS/IPS information - only as good as the signatures• Workstation anti-virus - False positives can remove legit files• Consider a second opinion - http://www.VirusTotal.com

Back 35

False Postitives

Front 36

• A report missed identifying something - no notification• Malicious traffic got through your defenses• It’s difficult to know when this happens - It’s completely silent• Get catch/miss rates with industry tests - IPS, anti-virus

Back 36

False Negatives

Front 37

The password _____ indicates how many passwords a system remembers and how many different passwords must be used before a password can be used.

Back 37

history

Front 38

Password ____ identifies the minimum number of characters.

Back 38

length

Front 39

Password ____ ____ identifies when users must change passwords.

Back 39

maximum age

Front 40

Password _____ _____ identifies the length of time that must pass before users can change a password again.

Back 40

minimum age

Front 41

• Mean time to repair

Back 41

• Mean time to restore (MTTR)

Front 42

The expected lifetime of a product or system

Back 42

• Mean time to failure (MTTF)

Front 43

Predict the time between failures

Back 43

Mean time between failures (MTBF)

Front 44

• Get up and running quickly• Get back to a particular service level

Back 44

• Recovery time objectives (RTO)

Front 45

• How much data loss is acceptable?• Bring the system back online; how far back does data go?

Back 45

• Recovery point objectives (RPO

Front 46

• Control of data• Data in the cloud can potentially be accessed by anyone• Security is managed elsewhere• Your control mechanisms are in the hands of others• Server unavailability / Account lockout• Cloud computing doesn’t guarantee availability

Back 46

Risks with Cloud Computing

Front 47

Compromising the virtualization layer puts all systems at risk• There is little control over VM to VM communication• Support for “virtual firewalls” is an emerging technology• Single physical host contains VMs that have different security profiles• Physical separation is no longer possible• There is potential for loss of separation of duties• System admin controls many servers on a single piece of hardware

Back 47

Risks associated with virtualization

Front 48

Send management messages between devices

Back 48

Internet Control Message Protocol (ICMP)

Front 49

Authentication, intergrity, confidentiality, and encryption.

Back 49

Internet Protocol (Ipsec)

Front 50

udp/161, Gather statistics and manage network device.

Back 50

Simple Network Management Protocol (SNMP)

Front 51

Send management messages between device.

Back 51

Internet Control Message Protocol(ICMP)

Front 52

Remote console login to network devices;tcp23

Back 52

Telecommunication Network(Telnet)

Front 53

Encrypted console login; tcp/22

Back 53

Secure Shell(SSH)

Front 54

Sends and receives files between systems in the clear;tcp/20, tcp/21

Back 54

File Transfer Protocol(FTP)

Front 55

Relatively simple file copy over SSH;tcp/22

Back 55

Secure Copy(SCP)

Front 56

SSH file transfer with file management; tcp/22

Back 56

Secure File Transfer Protocol(SFTP)

Front 57

Convert domain names to IP addresses; udp/53, tcp/53

Back 57

Domain Name Services(DNS)

Front 58

tcp/443; Hypertext Transfer Protocol Secure

Back 58

Hypertext Transfer Protocol Secure

Front 59

tcp/443;Web server communication with encryption.

Back 59

Hypertext Transfer Protocol Secure(HTTPS)

Front 60

tcp/443;Secure protocols for web browsing

Back 60

Transport Layer Security and Secure Sockets Layer(TLS/SSL)

Front 61

Connect to a shared storage device across the network• File-level access

Back 61

Network Attached Storage (NAS)

Front 62

• Looks and feels like a local storage device• Block-level access

Back 62

Storage Area Network (SAN)

Front 63

Run Fiber Channel on Ethernet, not routable

Back 63

Fibre Channel over Ethernet (FCoE)

Front 64

Encapsulate Fibre Channel frames into IP

Back 64

Fibre Channel over IP (FCIP)

Front 65

Send SCSI commands over an IP network

Back 65

iSCSI - Internet Small Computer Systems Interface

Front 66

Register, remove, and find services by name; udp/137

Back 66

NetBIOS name service

Front 67

Connectionless data transfer; udp/138

Back 67

NetBIOS datagram service

Front 68

Connection-oriented data transfer;tcp/139

Back 68

NetBIOS session service

Front 69

A connection-oriented protocol; A reliable protocol.

Back 69

TCP Transmission Control Protocol.

Front 70

no idea whether that traffic made it to the other side or not;unreliable protocol; no reordering of packets. There’s no re transmissions;

Back 70

User Datagram Protocol (UDP)

Front 71

A non-ephemeral port number____ ____ change.

Back 71

does not

Front 72

An ephemeral port is a _____port.

Back 72

temporary

Front 73

tcp/25; Transfer email between mail servers

Back 73

Simple Mail Transfer Protocol(SMTP)

Front 74

udp/69;A very simple file transfer protocl

Back 74

Trivial File Transfer Protocol (TFTP)

Front 75

tcp/80;Web server communication

Back 75

Hypertext Transfer Protocol(HTTP)

Front 76

tcp/110; Receive mail into a mail client.

Back 76

Post Office Protocol version 3(POP3)

Front 77

A newer mail client protocol;tcp/143

Back 77

Internet Message Access Protocol v4(IMAP4 )

Front 78

tcp/443;Web server communication with encryption

Back 78

Hypertext Transfer Protocol Secure(HTTPS)

Front 79

tcp/990, tcp/989; Adds security to FTP with TLS/SSL

Back 79

File Transfer Protocol over Secure Sockets Layer(FTPS)

Front 80

Graphical display of remote device; tcp/3389

Back 80

Remote Desktop Protocol (RDP)

Front 81

Layer 1; Signaling,cabling,connectors,(cables,NICs,hubs)

Back 81

Physical

Front 82

Layer2 ; The switching layer(frames,MAC addresses,EUI+48,EUI+64,switches)

Back 82

Data Link

Front 83

Layer3; The routing layer (IP addresses,routers,packets)

Back 83

Network

Front 84

Layer4;The post office layer (TCP segments,UDP datagrams)

Back 84

Transport

Front 85

Layer 5;Communications between devices (control protocols,tunneling protocols)

Back 85

Session

Front 86

Layer 6;Encoding and encryption (SSL/TLS)

Back 86

Presentation

Front 87

Layer7; The layer we see Google Mail, Twitter, Facebook

Back 87

Application

Front 88

• 64-bit or 128-bit key size• Cryptographic vulnerabilties found in 2001• Is no longer used, because it uses static keys.

Back 88

Wired Equivalent privacy(WEP)

Front 89

• Short-term workaround after WEP• Used RC4 cipher as a TKIP (Temporal Key Integrity Protocol)• TKIP has its own vulnerabilities

Back 89

Wi-Fi protected access.(WPA)

Front 90

• Replaced TKIP with CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol)• Replaced RC4 with AES (Advanced Encryption Standard)• WPA2 is the latest and most secure wireless encryption method

Back 90

Wi-Fi protected access 2.(WPA2)

Front 91

WPA2-Enterprise adds 802.1x• RADIUS server authentication

Back 91

Wi-Fi protected access 2-Enterprise

Front 92

• An authentication framework• WPA and WPA2 use five EAP types asauthentication mechanisms

Back 92

EAP (Extensible Authentication Protocol)

Front 93

• Cisco proprietary• Uses passwords only• No detailed certificate management• Based on MS-CHAP(including MS-CHAP security shortcomings)

Back 93

LEAP (Lightweight Extensible Authentication Protocol)

Front 94

• Created by Cisco, Microsoft, and RSA Security• Encapsulates EAP in a TLS tunnel• Only one certificate needed, on the server

Back 94

PEAP (Protected Extensible Authentication Protocol)

Front 95

• Access is controlled through the physical hardware address• It’s easy to find a working _ _ _addresses through wireless LAN analysis• _ _ _ addresses can be spoofed• Security through obscurity

Back 95

MAC (Media Access Control) filtering

Front 96

The name of the wireless network• i.e., LINKSYS, DEFAULT, NETGEAR• Change the _ _ _ _to something appropriate for its use• The _ _ _ _ broadcasts can be disabled• You can still determine the _ _ _ _ through wireless network analysis• Security through obscurity

Back 96

SSID (Service Set Identifier) Management

Front 97

Created when WEP was broken• We needed a stopgap to make 802.11 stronger• Mixed the keys - Combines the secret root key with the IV• Adds sequence counter - Prevents replay attacks• 64-bit Message Integrity Check - Protects against tampering• Used in WPA (Wi-Fi Protected Access) prior to the creation of WPA2

Back 97

Temporal Key Integrity Protocol(TKIP)

Front 98

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol• Replaced TKIP when WPA2 was published• A more advanced security protocol• Based on AES and uses a 128-bit key and a 128-bit block size• Requires additional computing resources• Data confidentiality - Only authorized parties can access the information• Authentication - Provides proof of genuineness of the user• Access control - Allow or disallow access to the network

Back 98

Cypher Block Chaining Message Authentication Code Protocol(CCMP)

Front 99

• Authentication to a network• Common on wireless networks• Access table recognizes a lack of authentication• Redirects your web access to a captive portal page• Username / password• And additional authentication factors• Once proper authentication is provided, the web session continues• Until the captive portal removes your access

Back 99

Captive Portal

Front 100

• One of the most common• Included on most access points• Signal is evenly distributed on all sides• Omni=all• Good choice for most environments• You need coverage in all directions• No ability to focus the signal• A different antenna will be required

Back 100

Omnidirectional Antennas

Front 101

• Focus the signal - Increased distances• Send and receive in a single direction• Focused transmission and listening• Antenna performance is measured in dB• Double power every 3dB of gain

Back 101

Directional Antennas

Front 102

Very directional and high gain

Back 102

Yagi antenna

Front 103

Focus the signal to a single point

Back 103

Parabolic antenna

Front 104

Sample the existing wireless spectrum• Identify existing access points• Work around existing frequencies - layout and plan for interference• Plan for ongoing site surveys - things will certainly change

Back 104

Site Surveys

Front 105

tcp/20, tcp/21

Back 105

FTP

Front 106

tcp/22

Back 106

SSH,SCP, SFTP

Front 107

tcp23

Back 107

Telnet

Front 108

tcp/25

Back 108

SMTP

Front 109

udp/53, tcp/53

Back 109

DNS

Front 110

udp/69

Back 110

TFTP

Front 111

tcp/80

Back 111

HTTP

Front 112

tcp/110

Back 112

POP3

Front 113

udp/137

Back 113

NetBIOSname service

Front 114

udp/138

Back 114

NetBIOSdatagram service

Front 115

tcp/139

Back 115

NetBIOS session service

Front 116

tcp/143

Back 116

IMAP4

Front 117

udp/161

Back 117

SNMP

Front 118

tcp/443

Back 118

HTTPS,TLS/SSL

Front 119

tcp/990, tcp/989

Back 119

FTPS

Front 120

tcp/3389

Back 120

RDP

Front 121

Various

Back 121

IPsec

Front 122

Access control, audit and accountability, identification and authentication, system and communications protection.

Back 122

Technical security controls

Front 123

Security assessment and authorization, planning,risk assessment, system and services acquisition,program management.

Back 123

Management security controls

Front 124

Awareness and training, configuration management, contingency planning, incident response, maintenance, media protection, physical and environmental protection, personnel security, system and information integrity

Back 124

Operational security controls

Front 125

A set of policies that covers many areas of security• Human resource policies• Business policies• Certificate policies• Incident-response policies

Back 125

Security policies

Front 126

• Where are we vulnerable to threats?• OS, applications, 3rd-party connections, Internet• Constant vigilance• New threats discovered all the time• Old threats become popular again

Back 126

Threat Assessment

Front 127

• Annualized Rate of Occurrence (ARO)• How likely is it that a hurricane will hit?In Montana? In Florida?• SLE (Single Loss Expectancy)• What is the monetary loss if a single event occurs?• Laptop stolen = $1,000• ALE (Annual Loss Expectancy)• ARO x SLE• 7 laptops stolen a year (ARO) x $1,000 (SLE) = $7,000• The business impact can be more than monetary• Quantitative vs. qualitative

Back 127

Risk Calculation

Front 128

• Identify significant risk factors• Ask opinions about the significance• Display visually with traffic light grid or similar method

Back 128

Qualitative Risk Assessment

Front 129

• Identify significant risk factors• Ask opinions about the significance• Display visually with traffic light grid or similar method

Back 129

Qualitative Risk Assessment

Front 130

• Where are we vulnerable to threats?• OS, applications, 3rd-party connections, Internet• Constant vigilance• New threats discovered all the time• Old threats become popular again

Back 130

Threat Assessment

Front 131

• Actively scan a network in search of vulnerabilities• Known vulnerabilities• Automated process• For unknown vulnerabilities, consider input validation/fuzzing• Can identify obvious and no-so-obvious vulnerabilities• Lack of application/OS patches• No anti-virus/anti-spyware• Weak passwords

Back 131

Vulnerability Assessment

Front 132

• A flaw or weakness• A door with a broken lock• An operating system library that grants administrative access• This doesn’t mean your system has been breached• Someone first has to know about the vulnerability• Some vulnerabilities were there, but previously unknown• This is why we patch• New vulnerabilities are identified all the time

Back 132

Vulnerabilities

Front 133

• The path that the threat takes to the target• Target: Your computer, mobile device, gaming system• Email: Embedded links, attached files• Web browser: Fake site, session hijack• Wireless hotspot: Rogue access point• Telephone: Social engineering• USB flash drive: Auto-executing malware• And many more...

Back 133

Threat Vectors

Front 134

• Identify actual and potential threats• Regardless of the probability• Identify as many vulnerabilities as possible• Check your OS, your services, and your applications• Nobody said this would be easy• Now you can calculate the likelihood of a successful exploit• There’s no official formula here• Different organizations will have different priorities

Back 134

Threat Probability

Front 135

Stop participating in high-risk activity

Back 135

Risk-avoidance

Front 136

Buy some insurance

Back 136

Risk transference

Front 137

A business decision; we’ll take the risk!

Back 137

Risk acceptance

Front 138

Decrease the risk level

Back 138

Risk mitigation

Front 139

Big dogs, security fences, warning signs

Back 139

Risk deterrence

Front 140

• Bring a new partner into the organization• This is more particular than hiring new staff• Many agreements will be in place• Legalities associated with business and security matters• Implement technical functions• Secure connections between partners• Usually as an IPsec tunnel or physical segmentation• Establish an authentication method• Provide access to shared resources• Audit all security controls• Properly share (and separate) data

Back 140

On-boarding

Front 141

• This process should be pre-planned• You don’t want to decide how to do things at this point• How will the systems be dissolved?• What happens to the data?• When will the final connections be terminated?

Back 141

Off-boarding

Front 142

• Data is everything• The most important asset in an organization• Without the data, there’s no company• The owner of the data has a responsibility• Protection, privacy• Technical / Logical controls• Physical controls• Who owns the data if the third-party agreement ends?• This should be determined prior to that circumstance• Who owns the data?• There’s more than one participant• Is there more than one owner?• What part of the data is owned by which partner?• Data ownership agreements can avoid some of the messy details• Where is the data stored?• Who owns the data when • the relationship is over?• How is data destroyed?

Back 142

Data Ownership

Front 143

• Management of data• Social media data includes privacy concerns• Some of the data is extremely valuable• Your social media reputation• Someone else is tweeting for you• The tone is as important as the message• Account control is important• Social media accounts are shared by a large group• A mistake on one phone can be seen by many

Back 143

Social Media and Third-Party Concerns

Front 144

• Memorandum of Understanding• Informal letter of intent;not a signed contract• Usually includes statements of confidentiality• Service Level Agreement (SLA)• Minimum terms for services provided• Uptime, response time agreement, etc.• Business Partners Agreement (BPA)• Commonly seen between manufacturers and resellers• Interconnection Security Agreement (ISA)• Used by US Federal Government to define security controls

Back 144

Interoperability Agreements

Front 145

Privacy of the individual• Both personal and professional• Legally mandated privacy laws in many European countries• An employer can’t track your personal computer use• Customer data often contains a aspect of privacy• Even benign data can be combined to violate privacy• Third-party agreements must consider privacy• The rules should be in place from the beginning

Back 145

Privacy Considerations

Front 146

Combine two systems• Hopefully get a seamless technical integration• Security must be designed into the project• Usually designed by teams from both organizations• Everyone must be aware of the risks• Security policies must be examined for additional risks• Resources, business requirements, and risk must be balanced• Agreements must be in place• For example: Who does backups?Who gets access to the backups? How are the backups

Back 146

Risk Awareness with Third-Parties

Front 147

Data shared between partners• Network connections may exist• Proper controls may not be in place• Data shared with others• Agreements are usually in place with the data owners• Data is sometimes shared with others without permission

Back 147

Third-party Data Sharing

Front 148

Backups are often overlooked• They contain everything• Data backups are often kept off-site• Yet-another third-party• Losing data from a backup is a very bad thing• Seems to happen more often than you might think• Not all backups are the same• Financial data, health care data, top secret data, etc.

Back 148

Data Backups with Third-Parties

Front 149

The security policy is the weakest link• A badly implemented security policy puts data at risk• Protect information between vendors, partners, and customers• Avoid data modification, disclosure, damage, or destruction• Most of this language is contractual• Everybody understands their responsibilities• Security policies are constantly updated• The threat landscape is constantly changing

Back 149

Security Policy Considerations with Third-parties

Front 150

• Third-party relationships add to the need for security compliance• Shared resources require additional oversight• Compliance can be technically challenging• Cloud-based services add additional complexity• Some compliance requirements are legally mandated• HIPAA - Health Insurance Portability and Accountability Act• PCI DSS - Payment Card Industry Data Security Standard• FISMA - Federal Information Security Management Act• Perform a gap analysis• Determine all gaps in security• Resolve the issues• Some issues can’t be easily resolved• A decision must be made regarding cost vs. benefit• Perform periodic audits• These audits may be involved and far-reaching• More coordination required with the third-party

Back 150

Third-Party Security Compliance

Front 151

Upgrade software, change firewall configuration, modify switch ports• Occurs very frequently• The change management process is often overlooked or ignored• Clear policies are needed• Frequency, duration, installation process, fallback procedures

Back 151

Change Management

Front 152

Series of events that negatively affects the organization• Database hack, stolen laptop, water pipe burst• Who will be contacted when an incident occurs?• Who’s responsible for managing the incident response?• Technical steps for handling systems and preserving evidence• What goes on the report?

Back 152

Incident Management

Front 153

• Series of events that negatively affects the organization• Database hack, stolen laptop, water pipe burst• Who will be contacted when an incident occurs?• Who’s responsible for managing the incident response?• Technical steps for handling systems and preserving evidence• What goes on the report?

Back 153

Incident Management

Front 154

• Management sets the limits• Security team administers the limits• You must translate management requirements into technical access• Periodic audits are useful

Back 154

User Rights and Permissions

Front 155

Does everyone have the correct permissions?• How are your resources used?• Are your systems and applications secure?• Are your disaster recovery plans going to work?• Can you contact the right people at the right time?• Document everything

Back 155

Auditing

Front 156

• Involves process and procedure• Some of the most difficult data policies to implement• It’s very easy to carry large amounts of data around• There are both internal and external threats• You have to protect everywhere• This is a bigger threat every day

Back 156

Preventing data loss or theft

Front 157

On your computer

Back 157

Data Loss Prevention Systems:

Data in use

Front 158

On your network

Back 158

Data Loss Prevention Systems

Data in motion

Front 159

On your server

Back 159

Data Loss Prevention Systems
Data at rest

Front 160

Copy the contents of a disk• Bit-for-bit, byte-for-byte• Get every morsel of information• Software imaging tools• Use a bootable device• Remove the physical drive• Use a hardware write-blocker• Get the backup tapes• Some of this work may have been done for you

Back 160

Capturing System Images

Front 161

• Traffic logs• Firewalls log a lot of information• Switches and routers don’t usually log user-level information• Intrusion Detection/Prevention Systems• Raw network traffic data• Rebuild images, email messages, browser sessions, file transfers

Back 161

Network traffic and logs

Front 162

• A moving record of the event• Gathers information external to the computer and network• Captures the status of the screen and other volatile information• Don’t forget security cameras• The video content must also be archived

Back 162

Capture video

Front 163

Number of 100-nanosecond intervals since January 1, 1601 00:00:00 GMT

Back 163

Windows: 64-bit time stamp

Front 164

• Number of seconds since January 1, 1970 00:00:00 GMT• This stops working on Tuesday, January 19, 2038 at 3:14:07 GMT

Back 164

Unix: 32-bit time stamp

Front 165

Time is stored in local time

Back 165

FAT ( File allocation table)

Front 166

Time is stored in GMT

Back 166

NTFS(New Technology File System)

Front 167

128 bits, displayed as hexadecimal

Back 167

MD5 (Message Digest 5)

Front 168

32 bits, displayed as hexadecimal

Back 168

CRC (Cyclical Redundancy Check)

Front 169

Create an _____ hash for an image, file, or groups of file , and data can be verified at any time

Back 169

MD5

Front 170

Capture the state of the screen• Difficult to reproduce, even with a disk image• External capture• Use digital camera• Internal capture• PrintScreen key• Third-party utility

Back 170

Screenshots

Front 171

• Who might have seen this?• Interview and document• Not all witness statements are 100% accurate• Humans are fallible

Back 171

Witnesses

Front 172

Some incidents can use massive resources• May have an impact on the bottom line• May be required for restitution• Be as accurate as possible

Back 172

Tracking man hours and expense

Front 173

• Controlling and managing the evidence to maintain integrity• Document everyone who contacts the evidence• Use hashes with digital evidence• Label and catalog everything• Seal, sign, and store

Back 173

Chain of custody

Front 174

• Large amounts of data, stored without structure• Incidents can create an enormous amount of data• Diverse log formats and data types• Collecting the data is only the first part• You must also be able to view it• Query the data• A structured language that applies to large scale data• Visualization tools can display the data in unique ways• Graphs• Statistical analysis• Tag clouds

Back 174

Big Data Analysis

Front 175

Laptops, removable media, forensic software, digital cameras• Incident analysis resources

Back 175

Incident handling hardware and software

Front 176

Documentation, network diagrams,baselines, critical file hash values

Back 176

Incident analysis resources

Front 177

Clean OS and application images

Back 177

Incident mitigation software

Front 178

Everyone knows what to do

Back 178

Policies needed for incident handling

Front 179

Periodic analysis, prioritization of risk, disposition of risk

Back 179

Risk assessments

Front 180

Harden the operating system, patches, and ongoing monitoring.

Back 180

Host security

Front 181

Firewalls, VPNs, intrusion prevention systems

Back 181

Network security

Front 182

Hosts, email and file servers, application clients

Back 182

Malware prevention

Front 183

Keep your users updated with the latest security techniques

Back 183

User awareness and training

Front 184

Vulnerability scanner in use

Back 184

Incident Precursors• Web server log

Front 185

Monthly Microsoft patch release, Adobe Flash update

Back 185

Incident PrecursorsExploit announcement

Front 186

A hacking group doesn’t like you

Back 186

Incident PrecursorsDirect threats

Front 187

An attack is underway or an exploit is successful

Back 187

Incident Indicators

Front 188

Buffer overflow attempt

Back 188

Incident Indicators-Identified by an intrusion detection/prevention system

Front 189

Deletes from OS an notifies administrator

Back 189

Incident Indicators -Anti-virus software identifies malware

Front 190

Constantly monitors system files

Back 190

Incident Indicators-Host-based monitor detects a configuration change

Front 191

Requires constant monitoring

Back 191

Incident Indicators-Network traffic flows deviate from the norm

Front 192

CIO / Head of Information Security / Internal Response Teams

Back 192

Incident Notification - Corporate / Organization

Front 193

Human resources, public affairs, legal department

Back 193

Incident Notification- Internal non-IT

Front 194

System owner, law enforcement• US-CERT (for U.S. Government agencies

Back 194

Incident Notification- External contacts

Front 195

Notification is ongoing during an event• Status updates, wide-scale notifications• Consider in-band and out-of-band methods• Email, Web (intranet, external, etc.), Telephone calls, In-person updates, Voice mail recordings, Paper flyers, notices

Back 195

Event Notification

Front 196

prevent the destruction

Back 196

Potential damage and thef

Front 197

gather as many details as possible

Back 197

Preserve the evidence

Front 198

The organization must continue

Back 198

Maintain service availability

Front 199

Every task requires resources

Back 199

Implementation resources and time

Front 200

amount of containment

Back 200

Effectiveness

Front 201

Let’s get this over quickly

Back 201

Duration of the mitigation

Front 202

• Generally a bad idea to let things run their course• An incident can spread quickly

Back 202

Isolation and Containment

Front 203

The attacker thinks they’re on a real system, but they’re not

Back 203

Sandboxes

Front 204

• What happened, exactly?• Timestamp of the events• How did your incident plans work?• Did the process operate successfully?• What would you do differently next time?• Retrospective views provide context• Which indicators would you watch next time?• Different precursors may give you better alerts

Back 204

Lessons Learned from Incidents

Front 205

A lot of information is created during an incident• Information should be objective and factual

Back 205

Incident Reporting

Front 206

a pencil and paper is remarkable technology

Back 206

Logbook

Front 207

- a snapshot or movie of a device

Back 207

Digital camera

Front 208

easier to say it and transcribe later

Back 208

Audio recorder

Front 209

capture terminal sessions and digital evidence

Back 209

Laptop

Front 210

Incident status• Summary information• Relationship between incidents• Actions taken by all parties• Chain of custody information• Contact information• Comments from incident handlers• Next steps to be taken

Back 210

Tracking Issues

Front 211

A phased approach - it’s difficult to fix everything at once• Recovery may take months• Large-scale incidents require a large amount work• The plan should be efficient• Start with quick, high-value security changes• Patches, firewall policy changes• Later phases involve much “heavier lifting”• Infrastructure changes, large-scale security rollouts

Back 211

Reconstitution

Front 212

• Very specific tasks for the first person on the scene• Objective is to contain the damage• Don’t disturb the environment• Get the right people in place before poking around• Follow the escalation policy

Back 212

First Responders

Front 213

• Try to determine the attacker• Useful for law enforcement and to stop future breaches• Security must be analyzed and secured• Change passwords, update firewalls • Even across systems that may not appear to be breached• Notify all affected people - customers, partners, employees• Personally Identifiable Information (PII) may require additional notifications

Back 213

Handling a Data Breach

Front 214

• Prevent the spread of damage• Needs to be part of the incident response policy• Virus infection may be handled differently than a DoS attack• Device removal - pull a device from the network• Disconnect the Internet• Every case is a bit different• What’s attacked or damaged?• Can you gather additional details if you leave it in place

Back 214

Damage and Loss Control

Front 215

• All of your policy information is on the Intranet• Provide in-person mandatory training sessions• Train people on general security best practices• Define a company policy for visitors GUI configuration

Back 215

Security policy training and procedures

Front 216

Part of your privacy policy• Not everyone realizes the importance of this data• It should become a normal part of security management

Back 216

Personally identifiable information (PII)

Front 217

no restrictions on viewing the data

Back 217

Unclassified (public)

Front 218

restricted

Back 218

Classified (private / restricted / internal use only)

Front 219

viewing is severely restricted

Back 219

Secret (medium)

Front 220

highly sensitive, must be approved to view

Back 220

Confidential (low)

Front 221

Data is usually saved for a very long time• Document and label everything• Some backups must be legally preserved• Trash and recycling can be a security concern

Back 221

Data labeling, handling and disposal

Front 222

• Non-compliance has serious repercussions

Back 222

Compliance, best practices and standards

Front 223

The Public Company AccountingReform and Investor Protection Act of 2002

Back 223

Sarbanes-Oxley Act (SOX)

Front 224

Extensive standards for storage, use, and transmission of health care information

Back 224

The Health Insurance Portability and Accountability Act (HIPAA)

Front 225

Disclosure of privacy information from financial institutions

Back 225

The Gramm-Leach-Bliley Act of 1999 (GLBA)

Front 226

• Promote good password behaviors• Document data handling processes• Define clean desk policies• Personally owned devices can be a challenge• Tailgating can allow unauthorized people to enter the building

Back 226

User habits

Front 227

New viruses - thousands every week• Phishing attacks• Spyware• Learns personal info, captures keystrokes & browsing information

Back 227

Threat Awareness

Front 228

• You become a file server• All of your content can be exposed• Social networks provide false sense of trust

Back 228

Social networking and P2P

Front 229

• Formative assessment• Constant monitoring, target areas that need work• Summative assessment• High-stakes, final exam, certification exam

Back 229

Gathering Training Metrics

Front 230

• Thermodynamics, fluid mechanics, and heat transfer• Not something you can properly design yourself• Must be integrated into the fire system• Data Center should be separate from the rest of the building• Overheating is a huge issue• Engineer for closed-loop recirculating and positive pressurization• Recycle internal air and air is pushed out

Back 230

HVAC (Heating, Ventilating, and Air Conditioning)

Front 231

Electronics require unique responses to fire• Water is generally a bad thing• Identify with smoke detector, flame detector, heat detector• Suppress with water / dry pipe, wet pipe, preaction• Suppress with chemicals• Halon is no longer manufactured• Use Dupont FM-200 / American Pacific Halotron

Back 231

Fire Suppression

Front 232

• Computers produce large amounts of EMI• Metal shielding inside of a computer case can minimize EMI• Appears as noise on video and analog audio

Back 232

Electromagnetic Interference Shielding

Front 233

• Optimize your cooling infrastructure• Constantly monitor and log the environment• Many servers include internal temperature sensors• Portable or emergency cooling may be valuable

Back 233

Environmental Monitoring

Front 234

Lock and key, deadbolt, electronic, token-based, biometric, multi-factor smart card

Back 234

Hardware locks

Front 235

Multiple doors that only unlock one at a time

Back 235

Mantraps

Front 236

closed-circuit television

Back 236

Video surveillance

Front 237

a perimeter

Back 237

Fencing

Front 238

deter crime and provide camera lighting

Back 238

Proper lighting

Front 239

- specific instructions, fire exits, warning signs

Back 239

Signs

Front 240

access lists, physical protection

Back 240

Guards

Front 241

channel people through a particular access point

Back 241

Barricades

Front 242

physically secured cabling

Back 242

Protected Distribution System (PDS) -

Front 243

circuit-based, motion detection

Back 243

Alarms

Front 244

Controls implemented using systems

Back 244

Technical

Front 245

Controls that determine how people act

Back 245

Administrative

Front 246

Discourages an intrusion attempt

Back 246

Deterrent

Front 247

Physically control access

Back 247

Preventive

Front 248

Identifies and records any intrusion attempt

Back 248

Detective

Front 249

Restores using other means

Back 249

Compensating

Front 250

• What are your critical business functions?• Is there loss of revenue, legal requirements, or customer service?• How long will you be impacted?• What’s the impact to the bottom line?

Back 250

Business Impact Analysis

Front 251

• Make a list of critical systems - this is an involved process• List business processes - Accounting systems, manufacturing application, VoIP call center, etc.• Associate tangible and intangible assets and resourceswith the business processes

Back 251

Critical Systems

Front 252

• A single event can ruin your day• Network redundancy with multiple devices• Backup power, multiple cooling devices• Plan for additional people and other locations• There’s no practical way to remove all points of failure

Back 252

Removing Single Points of Failure

Front 253

buildings, furniture, equipment, data,paper documents

Back 253

Tangible assets

Front 254

Ideas, commercial reputation, brand

Back 254

Intangible assets

Front 255

• Assign a dollar value to risk• Single Loss Expectancy (SLE) - How much loss for one event?• Annual Loss Expectancy - SLE x Annual Rate of Occurrence (ARO)

Back 255

Quantitative Risk Assessment

Front 256

• Identify significant risk factors• Ask opinions about the significance• Display visually with traffic light grid or similar method

Back 256

Qualitative Risk Assessment

Front 257

• Business processes are interrelated• HR drives payroll, IT provides payroll system, accounting provides the money• Almost everything business-related relies on IT• Involve the entire company• It can be difficult to document the company operations

Back 257

Continuity of operations

Front 258

• Plan for both small disasters and large disasters• Can be managed through a 3rd-party• Take advantage of geographically diverse areas• Many variables, the unknown can bite you

Back 258

Disaster Recovery

Front 259

Develop the contingency planning policy statement

Back 259

Seven-step contingency planning process
(Step1)

Front 260

Conduct the business impact analysis

Back 260

Seven-step contingency planning process(Step 2)

Front 261

Identify preventive controls

Back 261

Seven-step contingency planning process(Step 3)

Front 262

Create contingency strategies

Back 262

Seven-step contingency planning process(Step 4)

Front 263

Develop an information system contingency plan

Back 263

Seven-step contingency planning process(Step 5)

Front 264

Ensure plan testing, training, and exercises

Back 264

Seven-step contingency planning process(Step 6)

Front 265

Ensure plan maintenance

Back 265

Seven-step contingency planning process(Step 7)

Front 266

• Manage the leadership of the company• A gap can cause a vacuum or financial impact• Management can leave the company, retire, die• Often a deputy who can assume the role• Travel restrictions may apply

Back 266

Succession Planning

Front 267

• Performing a full-scale disaster drill can be costly• Many of the logistics can be determined through analysis• You don’t physically have to go through a disaster or drill• Get key players together for a tabletop exercise• Talk through a simulated disaster

Back 267

Tabletop Exercises

Front 268

• Maintain uptime - the organization continues to function• No hardware failure - servers keep running• No software failure - services always available• No system failure - network performing optimally

Back 268

Redundancy and Fault Tolerance

Front 269

• Redundancy doesn’t always mean always available• HA (high availability) - always on, always available• May include many different components working together• Watch for single points of failure

Back 269

High Availability

Front 270

in the box, turned off

Back 270

Cold spare

Front 271

may be racked and powered, but not connected• Software and configurations may occasionally be updated

Back 271

Warm spare

Front 272

powered on, always updated

Back 272

Hot spare

Front 273

no hardware, no data, no people

Back 273

Cold site

Front 274

hardware is waiting, you bring the data

Back 274

Warm site

Front 275

an exact replica, stocked with hardware and software• Flip a switch and everything moves

Back 275

Hot site

Front 276

Striping without parity; high peromance, no fault tolerence

Back 276

RAID 0

Front 277

Mirrioring; duplicates data for fault tolernce, but requires twice the disk space.

Back 277

RAID1

Front 278

striping wit parity; Fault tolerant only requires an additional disk for redundancy.

Back 278

Raid 5

Front 279

Multiple RAID types; Combine RAID methods to increase redundancy.

Back 279

RAID 0+1, RAID1+0, RAID, 5 +1, etc.

Front 280

Certain information should only be known to certain people• Encryption - Encode messages so only certain people can read it• Access controls - Selectively restrict access to a resource

Back 280

Confidentiality

Front 281

• Conceal information within another piece of information• Commonly associated with hiding information in an image

Back 281

Steganography

Front 282

Data is stored and transferred as intended• Any modification to the data would be identified

Back 282

Integrity

Front 283

Map data of an arbitrary length to data of a fixed length

Back 283

Hashing

Front 284

Verify the integrity of data

Back 284

Digital signatures

Front 285

Combine with a digital signature to verify an individua

Back 285

Certificates

Front 286

Provides proof of integrity

Back 286

Non-repudiation

Front 287

Information is accessible to authorized users

Back 287

Availability

Front 288

Redundancy

Back 288

Build services that will always be available

Front 289

System will continue to run with failures

Back 289

Fault tolerance

Front 290

Stability, close security holes

Back 290

Patching

Front 291

Keep out the unwanted

Back 291

Fencing

Front 292

Protect assets, especially at night

Back 292

Lighting

Front 293

Closed-circuit television - video camera monitoring

Back 293

CCTV

Front 294

Best way out of an area

Back 294

Escape plans and routes

Front 295

Test and adjust

Back 295

Drills

Front 296

Test against physical and digital security

Back 296

Testing controls

Front 297

• Can gather information• Can capture your keystrokes• Often controlled over the ‘net• Can show you advertising• May install an OS backdoor

Back 297

Malware

Front 298

• Malware that can reproduce itself• It doesn’t need you to click anything• It needs you to execute a program• Reproduces through file systems or the network• Just running a program can spread a virus• Some viruses are invisible, some are annoying• Anti-virus software is very common• There are thousands of new viruses every week

Back 298

Virus

Front 299

Installs into the drive boot area

Back 299

Boot sector viruses

Front 300

Part of a legitimate application

Back 300

Program viruses

Front 301

Operating system and browser-based

Back 301

Script viruses

Front 302

Common in Microsoft Office

Back 302

Macro viruses

Front 303

Infects and spreads in multiple ways

Back 303

Multipartite viruses

Front 304

Malware that self-replicates without human intervention• Uses the network as a transmission medium• Can infect many PCs very quickly• Firewalls and IDS/IPS can mitigate many worm infestations

Back 304

Worms

Front 305

• Your computer shows you advertisements• May cause performance issues• May be included with other software installations• Be careful of software that claims to remove adware

Back 305

Adware

Front 306

• Malware that spies on you• Advertising, identity theft, affiliate fraud• Can trick you into installing• Monitors your browser activity• Logs your keystrokes• Send this information back to a central server

Back 306

Spyware

Front 307

• Software that pretends to be something else• Replicating isn’t the primary requirement• Circumvents your existing security because you ran it yourself• Anti-virus may catch it when it runs• The better _____are built to avoid and disable AV• Once it’s inside it has free reign• May then open the gates for other programs

Back 307

Trojan Horse

Front 308

• Why go through normal authentication methods? Just walk in the back door• Often placed on your computer through malware• Some malware software can take advantageof ____ created by other malware• Bad software can have a_____ as part of the app

Back 308

Backdoors

Front 309

• Modifies core system files• May be part of the kernel• Designed to be invisible to the operating system• You won’t see it in Task Manager• Also invisible to traditional anti-virus utilities

Back 309

Rootkits

Front 310

Waits for a predefined event;Difficult to identify• Difficult to recover if it goes off;

Back 310

Logic Bomb

Front 311

Based on time or date

Back 311

Time bomb

Front 312

• Robot networks• Once your machine is infected, it becomes a bot• You usually do not know that you’re a bot• May be installed as part of a malware• Waits around until receiving commands from the mothership

Back 312

Botnets

Front 313

• The bad guys want your money• They’ll take your data in the meantime• May be a “fake”_____• Locks your computer “by the police”• The ransom may be avoided• A security professional can remove these kinds of malware

Back 313

Ransomware

Front 314

• Changes itself to avoid signature detection• Every download is different• The attack code doesn’t change• Just everything around it• Encrypt the malware executable• Use a different key pair every time• Create signatures that look for a specific payload• One signature can stop many variants• Use heuristic detection systems• Be ready to use some additional resources

Back 314

Polymorphic Malware

Front 315

Virus writers don’t want their work to be discovered• Makes the anti-virus software look elsewhere• If found, make it difficult to deconstruct• Security researchers disassemble the virus code• The virus is usually obfuscated with unnecessary and nonsense code• The virus writer’s goal is to make it as painful as possible to identify and block• The longer the research, the more widespread the infection

Back 315

Armored Virus

Front 316

Redirects your traffic, then passes it on to the destination• You never know your traffic was redirected•_ _ _ has no security, relies on security in the switch

Back 316

ARP Poisoning, Spoofing, and Man-in-the-Middle

Front 317

Force a service to fail• Overload the service• Take advantage of a design failure or vulnerability• Cause a system to be unavailable• Can be used to create a smokescreen for some other exploit• May be a precursor to a DNS spoofing attack• Not usually a very complicated attack• Turning off your power is an uncommon but effective DoS

Back 317

Denial of service

Front 318

• Useful information is transmitted over the network• Network Tap is used to access to the raw network data• ARP poisoning can redirect traffic• Malware on the victim computer gathers information• Data is replayed to appear as someone else

Back 318

Replay Attack

Front 319

When ______ a password a session ID is only in use for the duration of that session.

Back 319

Salting

Front 320

• Pretend to be something you aren’t• Fake web server, fake DNS server, etc.• Email address spoofing• The sending address of an email isn’t really the sender• Man-in-the-middle attacks• The person in the middle of the conversation pretends to be both endpoints• Caller ID spoofing• The incoming call information is completely fake

Back 320

Spoofing

Front 321

Modify the DNS server• Modify the client host file• Send a fake response to a valid DNS request

Back 321

DNS Poisoning

Front 322

• Redirection to a bogus site• Combines farming with phishing• Everything appears legitimate to the user

Back 322

Pharming

Front 323

Harvest large groups of people

Back 323

Farming

Front 324

Collect access credentials

Back 324

Phishing

Front 325

Unsolicited email, traditionally for advertising• Can also be used to spread trojans/botnets

Back 325

Spam

Front 326

Spam over IM• Links in IM can be malicious

Back 326

Spim

Front 327

Spam over internet telephony• VoIP providers have made this difficult to practically implement

Back 327

Spit

Front 328

to only allow known senders

Back 328

White list

Front 329

to remove the bad senders

Back 329

Black list

Front 330

can filter based on certain words/phrases

Back 330

Bayesian filtering

Front 331

check email before it arrives

Back 331

Cloud-based spam services

Front 332

• Send a carefully crafted packet to a host• URG, PUSH, and FIN are set - 00101001• Lit up “like a Christmas tree”• May slow down the remote device (DoS)• Easy to see this attack with an IPS• Most modern devices will drop these packets

Back 332

Xmas Tree Attack

Front 333

• Gain higher-level access to a system• Exploit a vulnerability, might be a bug or design flaw• Higher-level access means more capabilities• This commonly is the highest-level access• These are high-priority vulnerability patches• You want to get these holes closed very quickly• Any user can be an administrator• Horizontal privilege escalation• User A can access user B resources

Back 333

Privilege Escalation

Front 334

• Patch quickly - Fix the vulnerability• Updated anti-virus/anti-malware software• Data Execution Prevention• Address space randomization• Prevent a buffer overrun at a known memory address

Back 334

Mitigating privilege escalation

Front 335

• We give people a lot of access• This is why we have the concept of least privilege• You have more access than others by entering the building• Lock away your documents• Harms your organization’s reputation• Can cause a critical system distruption• May include loss of confidential or proprietary information

Back 335

Insider Threats

Front 336

• Servers are more secure than ever• Attack the client - Bad programming makes it easier• Browsers, media players, office applications, email clients• A single insecurity can reveal all information• Keep operating system and applications updated• A single vulnerability can own a computer

Back 336

Client-side attacks

Front 337

Guess the password, calculate the hash

Back 337

Brute force

Front 338

Use common words as passwords

Back 338

Dictionary attack

Front 339

Combine brute force and dictionary attacks

Back 339

Hybrid attack

Front 340

The same hash value for two plain texts

Back 340

Birthday attack

Front 341

An optimized, pre-built set of hashes

Back 341

Rainbow tables

Front 342

Typosquatting / brandjacking• Take advantage of poor spelling• Outright misspelling• professormesser.com vs. professermesser.com• A typing error• professormeser.com• A different phrase• professormessers.com• Different top-level domain• professormesser.org

Back 342

URL Hijacking

Front 343

Determine which website the victim group uses• Educated guess - Local coffee shop, industry-related sites• Infect one of these third-party sites• Site vulnerability, email attachments• Infect all visitors, even if you’re just looking for specific victims

Back 343

Watering Hole Attack

Front 344

• You have access to important information, and people want it• This is surprisingly easy• Airports / flights, coffee shops• Surf from afar with binoculars / telescopes• Webcam monitoring

Back 344

Shoulder Surfing

Front 345

• Control your output• Be aware of your surroundings• Use privacy filters

Back 345

Preventing Shoulder Surfing

Front 346

• Important information can be thrown out with the trash• Easily gather details that can be used for a different attack• Secure your garbage with a fence and lock• Shred/destroy important documents

Back 346

Dumpster Diving

Front 347

Using someone else to gain access to a building• Blend in with clothing• Once inside, there’s little to stop you• Most security stops at the border

Back 347

Tailgating

Front 348

Pretend to be someone you aren’t• Use some of those details you got from the dumpster• You can trust me, I’m with your help desk

Back 348

Impersonation

Front 349

• Never volunteer information• Don’t disclose personal details• Always verify before revealing info

Back 349

Protecting against Impersonation

Front 350

• A threat that doesn’t actually exist, but SEEMS real• Still often consume lots of resources• Forwarded emailst, printed memorandums, wasted time• Often an email or social network post• A _____ about a virus can waste as much time as a regular virus

Back 350

Computer Hoaxes

Front 351

• It’s difficult to identify _____ with traditional security devices• Passes through the firewall and IPS• Difficult to train• Consider using practical exercises

Back 351

Stopping the Whale Hunts

Front 352

• Constantly changing• You never know what they’ll use next• May involve multiple people• And multiple organizations• There are ties connecting many organizations• May be in person or electronic• Phone calls from aggressive “customers”• Emailed funeral notifications of a friend or associate

Back 352

Effective Social Engineering

Front 353

• A significant potential backdoor• Very easy to plug in a wireless AP• Schedule a periodic wireless survey• Consider using 802.1X (Network Access Control)

Back 353

Rogue Access Points

Front 354

• Buy a wireless access point• Configure it exactly the same way as an existing network• Same SSID and security settings• May not require the same physical location• Use HTTPS and a VPN to help mitigate

Back 354

Evil Twins

Front 355

• Radio waves can be disrupted• Intentional jamming or disruption of wireless signalsis illegal in the United States (and elsewhere)• Degrades or completely denies service• May be used in conjunction with a wireless “evil twin

Back 355

Wireless Interference

Front 356

• Combine WiFi monitoring and a GPS• Gather a huge amount of intel in a short period of time• All of this is free with tools like Kismet, inSSIDer• You can also use Warflying, warbiking

Back 356

Wardriving

Front 357

• Historical footnote to 802.11 wireless networking• Created in June 2002,publicized by Matt Jones• If you find a node, let someone else know• By the time this was a big problem,it wasn’t a problem anymore

Back 357

Warchalking

Front 358

Sending of unsolicited messages to another device via Bluetooth• Typical functional distance is about 10 meters• Bluejack with an address book object, instead of contact name a message is written• “You are Bluejacked! Add to contacts?”• Third-party software may also be used, Blooover, Bluesniff

Back 358

Bluejacking

Front 359

• A rare attack that takes advantage of a vulnerability• Access a Bluetooth-enabled device and transfer data• Exploited through security weakenesses• Must be fixed with a patch• If you know the file, you can download it without authentication

Back 359

Bluesnarfing

Front 360

No key management, everyone usually has the same key• The WEP IV is 24-bits long - relatively small• 16,777,216 possible RC4 cypher streams for a given WEP key• IV values eventually are reused• Some “weak” IVs don’t properly provide for goodencryption, and makes it easy to discover the key• The bad guys will inject frames to intentionally duplicateIVs and make key identification easier

Back 360

WEP IV

Front 361

• Most information over the network is “in the clear”• Relatively difficult to capture data over wired networks• Wireless networks are incredibly easy to monitor• Some network drivers won’t capture wireless information• Free capture software - http://www.wireshark.org

Back 361

Wireless Packet Analysis

Front 362

• Use WPA2 encryption on your wireless access point• Use encryption for authentication• Use end-to-end VPN• Use encrypted proxy services and virtual tunnel networks

Back 362

Protecting against packet analysis

Front 363

• Two-way wireless communication• Payment systems, i.e., Google wallet and MasterCard• Bootstrap for other wireless - _ _ _helps with Bluetooth pairing• Access token, identity “card” - Short range with encryption

Back 363

Near Field Communication (NFC)

Front 364

• Remote capture - It’s a wireless network• Frequency jamming - Denial of service• Relay attack - Man in the middle• Loss of RFC device control - Stolen/lost phone

Back 364

NFC Security Concerns

Front 365

• WPA-Personal / WPA-PSK• WPA with a pre-shared key• Everyone uses the same 256-bit key• The only way in is a brute force / dictionary attack• Some cloud-based services already have the hashes• Use a complex set of letters and numbers / Avoid words• WPA-Enterprise / WPA-802.1X• Authenticates users individually with an authentication server• No practical attacks

Back 365

WPA Attacks

Front 366

PIN is an eight-digit number• Really seven digits and a checksum• Seven digits, 10,000,000 possible combinations• The WPS process validates each half of the PIN• First half, 4 digits. Second half, 3 digits.• First half, 10,000 possibilities. Second half, 1,000 possibilities• It takes about four hours to go through all of them• Most devices never considered a lockout function

Back 366

WPS Attacks

Front 367

• Web site allows scripts to run in user input /search box• Bad guy may email a link• Email link runs a script that sendscredentials/session IDs/cookies to the bad guy• Script embedded in URL executes in the victim’sbrowser, as if it came from the server• Bad guys use credentials/session IDs/cookiesto steal victim’s information without their knowledge

Back 367

Non-persistent (reflected) XSS attack

Front 368

• Bad guy posts a message to a social network thatincludes a malicious payload (it’s now “persistent”)• Everyone gets the payload• No specific target• For social networking, this can spread quickly• Everyone who views the message can have it posted totheir page, where someone else can view it and

Back 368

Persistent (stored) XSS attack

Front 369

• Be careful when clicking untrusted links• Consider disabling JavaScript, or control with an extension• Keep your browser and applications updated• Keep your web server applications updated

Back 369

Protecting Against XSS

Front 370

• Adding information into a data stream• Applications should be developed to properlyhandle input and output• Used with many different data types

Back 370

Code Injection

Front 371

Extensible Markup Language

Back 371

XML

Front 372

XML injection modifies XML requests• A good application will validate all input• LDAP - Lightweight Directory Access Protocol• LDAP injection modifies LDAP requests to manipulate

Back 372

XML Injection and LDAP Injection

Front 373

• The most common relational database managementsystem language• SQL Injection modifies SQL requests in the browser• The application should be written to prevent this

Back 373

SQL (Structured Query Language) Injection

Front 374

A misconfigured server allows inappropriate access• Command injection can be dangerous when this happens• Run unauthorized commands from your browser• Combine with directory traversal for really scary results

Back 374

Directory Traversal

Front 375

• Overwriting a buffer of memory• Spills over into other memory areas• Developers need to perform bounds checking• The bad guys spend a lot of time looking for openings• A really useful buffer overflow is repeatable

Back 375

Buffer Overflows

Front 376

Usually has a fixed boundary• Vulnerable software may allow an integer to go out of bounds• This integer may allocate a memory location for a buffer• The buffer will now be too small, and overflow may occur

Back 376

Integer Overflow

Front 377

• Many applications have undiscovered vulnerabilities• Someone is working hard to find the next big vulnerability• A ___ ___ vulnerability has not been detected or published• Zero-day exploits are increasingly common• Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/

Back 377

Zero-day Attacks

Front 378

______ contain browser information stored on your computer• Used for tracking, personalization, session management• Not executable, not generally a security risk• Could be considered be a privacy risk• Session IDs are often stored in the ______ • Used with _____ to masquerade as another person

Back 378

Browser Cookies and Session IDs

Front 379

• Also called Flash Cookies• Used by Adobe Flash Player to store data• Information is saved on the user’s computer• On by default• Applies to all browsers• Data is stored in a common directory• Can only be read by the domain that created the LSO• www.example.com can only be read by www.example.com• Unless specifically passed to another domain

Back 379

Locally Shared Objects

Front 380

• Attachments may be files sent via email• All attachments should be considered a security risk• Add-ons extend your browser functionality• Add-ons tend to be more trusted

Back 380

Malicious Add-ons and Attachments

Front 381

The attacker runs whatever they want• An attacker takes over a process• The original executable is vulnerable to this attack• No elevated rights needed for many attacks• Infect with malware or adware• Remote code execution• Attack a machine from a remote device• Extremely dangerous vulnerability

Back 381

Arbitrary and Remote Code Execution

Front 382

• Huge source of detailed network information• Routers, switches, firewalls, IDS/IPS, anti-virus scanners,applications, authentications, etc.• Contain data on servers, applications, security

Back 382

Monitoring System Logs

Front 383

Details of normal activity• Not remarkably useful in the moment, very useful after the fact• Huge storage requirements• Logs from everything - Servers, routers, switches, firewalls

Back 383

Event Logs

Front 384

• Changes must be controlled• Can recognize legitimate activity• Firewall policy change, file permission update• Can recognize unapproved activity, unapproved changes• Not as many logs as event log, but perhaps more important

Back 384

Audit Logs

Front 385

Many different instances of access• Files, VPN connection, partners, customers• Many different formats - Servers, application logs, etc.• Important to know who’s coming in and out, and who is failing• Automation can limit the attack vector• Very useful when rebuilding after an attack

Back 385

Access Logs

Front 386

• Focused on security-related events• Very specific events• Not necessarily useful to the rest of the organization• Many diverse devices• Firewall, VPN concentrator, IPS, content filter, authenticationserver, router, switch, email gateway, anti-virus manager, etc.• Often requires it’s own logging strategy

Back 386

Security Logs

Front 387

Increase the security of your operating system• Constant maintenance to patch vulnerabilities• One configuration error can inadvertently create an opening• Plan a regular preventive maintenance cycle

Back 387

Operating System Hardening

Front 388

• This is a good best-practice• Requires additional maintenance and constant vigilance• Plan on periodic reviews using the switch management console

Back 388

Physical Port Security

Front 389

• Find devices that should not be on the network and remove them• Visual audit - Check ports and switches for incursion• Network mapping - Automated functions for finding devices• Wireless audits - Walk around and find rogue access points• Network Access Control (NAC)• Require authentication before gaining access to the network

Back 389

Rogue Machine Detection

Front 390

• Initial ______Configuration• Determine the minimum level of protection required• Continuous Security Monitoring• New threats are announced every day• Systems are constantly modified and updated• Remediation network• Access may be based on the missing security• Access allowed once the device is back to full security posture

Back 390

Security Posture

Front 391

• Every device contains information• Define metrics to monitor (throughput, authentications, etc.)• Define thresholds per metric - Up/down, Percentage, Exact value• Disposition - Email, SMS

Back 391

Alarms and Alerts

Front 392

• Identify details that would be otherwise invisible• Monitoring intervals and reporting timeframes• You’re collecting a LOT of data - age it out as you go• Focus on security metrics - Malware activity, patch failures,increase in bandwidth, etc.

Back 392

Trends

Front 393

_____ are identified every day• National ____ Database (http://nvd.nist.gov/)• Applications, operating systems, services• Scan a device to determine susceptibility to a known _____• Can be quite invasive• Scan general OS, web servers, application, database servers

Back 393

Vulnerability Scanning

Front 394

• Scanners aren’t perfect• Network-level challenges with firewalls• Device-level challenges with OS changes, patch updates, application versions

Back 394

Interpreting Vulnerability Scans

Front 395

• No interaction• Gather information external to the device• Packet capture

Back 395

Passive tools

Front 396

The device can see you looking• Vulnerability scanners, honeypots, port scanners,banner grabbing

Back 396

Active tools

Front 397

Capture and display network traffic, Packet by packet• Wireshark, a popular open-source option• Valuable vulnerability recon - Encrypt your traffic

Back 397

Protocol Analyzer

Front 398

Identify vulnerabilities in web servers, database servers, etc.•

Back 398

Application scanners

Front 399

Identify operating system vulnerabilities for Windows, Linux, Mac OS, etc

Back 399

OS scanners

Front 400

Attract the bad guys and trap them there• Makes for interesting recon• Single-use/single-system traps• • More than one ___on a network

Back 400

Honeypots and Honeynets

Front 401

Identify open ports on a system• Identify firewalls and packet filters• Identify operating systems and services• Based on simple packet requests and responses• Identify applications without authenticating

Back 401

Port scanners

Front 402

• Applications can be chatty• The banner is always there• Capture it with telnet or an automated tool

Back 402

Banner Grabbing

Front 403

Assign a dollar value to risk• Single Loss Expectancy (SLE)• How much loss for one event?• Annual Loss Expectancy• SLE x Annual Rate of Occurrence (ARO)

Back 403

Quantitative Risk Assessment

Front 404

Identify significant risk factors• Ask opinions about the significance• Display visually with traffic light grid or similar method

Back 404

Qualitative Risk Assessment

Front 405

Actively scan a network in search of known vulnerabilities• Usually an automated process• For unknown vulnerabilities, consider input validation/fuzzing

Back 405

Vulnerability Assessment

Front 406

Baseline Reporting• Determine risk• Determine which metrics and resources to monitor• Changes might indicate security concern• The baseline is constantly changing

Back 406

Assessment Techniques

Front 407

• Audit your in-house applications• Examine the source code• Test for input validation, injection attacks, etc.

Back 407

Code Review

Front 408

Review the database engine, Web server, browser type• Consider confidentiality, integrity and availability• Not all servers provide the same security posture

Back 408

Architecture Review

Front 409

• Simulate an attack• Similar to vulnerability scanning, except we actually try to exploit the vulnerabilities

Back 409

Penetration Testing (Pentest)

Front 410

Stay up-to-date• Reference the National Institute of Standards andTechnology National Vulnerability Database• http://nvd.nist.gov• Perform regular vulnerability scans

Back 410

Verify a threat exists

Front 411

Force your way in• People in the organization may bypass security controls

Back 411

Bypass Security Controls

Front 412

Attempt to circumvent the same controls as the bad guys• Test with different techniques• This should represent what the bad guys see

Back 412

Actively Test Security Controls

Front 413

• Try to break into the system• This might cause a denial of service or loss of data• Buffer overflows can cause instability• You may need to try many different vulnerability types• Password brute-force• Social engineering• Database injections• Buffer overflows• You’ll only be sure you’re vulnerable if you can successfully exploit a system• If you can get through, the bad guys can get throug

Back 413

Exploiting Vulnerabilities

Front 414

A “blind” test• The pentester knows nothing about the systems

Back 414

Black box

Front 415

Full disclosure - The pentester knows everything

Back 415

White box

Front 416

A mix of black and whiteFocus on certain systems or applications

Back 416

Grey box

Front 417

• A passive test, unlike a penetration test• May include port scanning• Test froGather information, don’t try to exploit a vulnerability

Back 417

Vulnerability Scanning

Front 418

Gather information, don’t try to exploit a vulnerability

Back 418

Non-intrusive scans

Front 419

You’ll try out the vulnerability to see if it works

Back 419

Intrusive scans

Front 420

The scanner can’t login to the remote device

Back 420

Non-credentialed scans

Front 421

You’re a normal user, emulates an insider attack

Back 421

Credentialed scan

Front 422

The scanner looks for many vulnerability types• The vulnerabilities can be cross-referenced online• Some vulnerabilities cannot be definitively identified

Back 422

Identify Vulnerabilities

Front 423

• Many results can be identified:• Lack of security controls• No firewall• No anti-virus• No anti-spyware• Misconfigurations• Open shares• Guest access• Real vulnerabilities

Back 423

Vulnerability Scan Results

Front 424

A vulnerability is identified that doesn’t really exist• This is different than a low-severity vulnerability• It’s real, but it may not be your highest priority

Back 424

False positives

Front 425

A vulnerability exists, but you didn’t detect it• Update to the latest signatures• Work with the vulnerability detection manufacturer• They may need to update their signatures

Back 425

False negatives

Front 426

Send random input to an application• Fault-injecting, robustness testing, syntax testing, etc.• Looking for something out of the ordinary, such as an application crash, server error, exception • Many different fuzzing utilities and options• Fuzzing is time and resource heavy• Many fuzzing engines use high-probability tests

Back 426

Fuzzing

Front 427

• There’s a balance between time and quality• Programming with security in mind is often secondary• The Quality Assurance (QA) process tests applications• Vulnerabilities will eventually be found

Back 427

Secure Coding Concepts

Front 428

• What happens when an error occurs?• Network connection fails, server hangs, database unavailable• Think of every possible problem• Mishandled exceptions can allow execution of code

Back 428

Error and Exception Handling

Front 429

Called cross-site because of browser security flaws• Information from one site can be shared with another• One of the most common vulnerabilities• Used by malware that uses JavaScript vulnerabilities

Back 429

Cross-site Scripting (XSS)

Front 430

Web site allows scripts to run in user input /search box• Bad guy may email a link• Email link runs a script that sends credentials/session IDs/cookies to the bad guy• Script embedded in URL executes in the victim’s browser, as if it came from the server• Bad guys use credentials/session IDs/cookies to steal victim’s information without their knowledge

Back 430

Non-persistent (reflected) XSS attack

Front 431

• Bad guy posts a message to a social network that includes a malicious payload (it’s now “persistent”)• Everyone gets the payload• No specific target• For social networking, this can spread quickly• Everyone who views the message can have it posted totheir page, where someone else can view it andpropagate it further...

Back 431

Persistent (stored) XSS attack

Front 432

• Be careful when clicking untrusted links• Consider disabling JavaScript, or control with an extension• Keep your browser and applications updated• Keep your web server applications updated

Back 432

Protecting Against XSS

Front 433

• Determine a security baseline for every application• Monitor the baseline over time• Perform scheduled scans• Once-a-month security patches and service packs• May require security testing after major updates

Back 433

Application Configuration Baseline

Front 434

Update the operating system• Apply security patches and service packs• Update application software• Restrict user accounts to “least privilege” access• Restrict additional software installations

Back 434

Application Hardening

Front 435

• May provide additional features• Patches may fix bugs• Close any open security holes

Back 435

Application Patch Management

Front 436

Use Windows Update for client-initiated updates• Centralize patch management with Windows Server Update Services (WSUS)• Mac OS - update from the Apple menu / Software Update• Linux - update using rpm, yum, apt-get, software update GUI

Back 436

Updating Operating Systems

Front 437

A bug fix might introduce others• Updating one application might break another• Security updates are important• Don’t forget your security check after updating,based on your application security baseline

Back 437

The Patch Management Challenge

Front 438

Keep important information centralized• In a format that allows for easy retrieval

Back 438

SQL Databases

Front 439

• Not Only SQL• Not SQL, not relational• A good choice for large datasets• Scales very large• Can analyze very large unstructured data sets• Big data• Grab as much data as you can and put it into a database• There might be relationships between the data, or perhaps not• The database needs to be able to handle anything

Back 439

NoSQL Databases

Front 440

Relies on a hash table to locate and represent data

Back 440

Key-value store

Front 441

• Large data stores can reference multiple columns with a single key

Back 441

Column family store

Front 442

Similar to key-value stores• Contains documents that are collections of other key-value collections

Back 442

Document database

Front 443

Instead of a spreadsheet, use nodes, node properties, and the relationship between the nodes

Back 443

Graph database

Front 444

• Attack an application through the user input• Provide data the application isn’t expecting• Unexpected results may occur• SQL injection• Gain access to the database• Filenames• Traverse the file system• Perform extensive tests before releasing app• Fuzzing or random input testing

Back 444

Validating Data

Front 445

All checks occur on the server• Helps protect against malicious users• Bad guys may not even be using your interface

Back 445

Validation Points

Front 446

The end-user’s app makes the validation decisions• Can filter legitimate input from genuine users• May provide additional speed to the user

Back 446

Client-side validation

Front 447

BYOD

Back 447

Bring Your Own Device

Front 448

• Manage company-owned and user-owned mobile devices• Centralized management of the mobile devices• Specialized functionality• Set policies on apps, data, camera, etc.• Control the remote device• The entire device or a “partition”• Manage access control• Force screen locks and PINs on these single user devices

Back 448

Mobile Device Management

Front 449

• Scramble all of the data on the mobile device• Even if you lose it, the contents are safe• Devices handle this in different ways• Strongest/stronger/strong ?• Encryption isn’t trival• Uses a lot of CPU cycles• Don’t lose or forget your password!• There’s no recovery

Back 449

Device Encryption

Front 450

• Remove all data from your mobile device• Even if you have no idea where it is• Connect and wipe from the web• Nuke it from anywhere• Need to plan for this• Configure your mobile device now

Back 450

Remote Wipe / Sanitation

Front 451

All mobile devices can be locked• Keep people out of your data• Simple passcode or strong passcode• Numbers vs. Alphanumeric• Fail too many times?• Erase the phone• Define a lockout policy• Create aggressive lockout timers• Completely lock the phone

Back 451

Screen Lock

Front 452

• An MDM can control exactly what’s loaded• Only approved corporate applications• Unapproved applications are restricted or removed• The MDM has complete control• Some MDM software segments corporate data• A separate area of the mobile device• Run personal and corporate without conflict• Some devices support removable storage• Control where organization’s data is stored• Individual and unused features can also be disabled• Bluetooth, video camera, etc.

Back 452

Application Control and Storage Segmentation

Front 453

Precise tracking details - Tracks within feet• Can be used for good - Find your phone• Can be used for bad - Find you• Most phones provide an option to disable• Limits functionality of the phones

Back 453

GPS Tracking

Front 454

• Encrypted data is important to mobile devices• Keep your information safe as it moves around• Is information encrypted when stored on the device?• Every application does this differently• Data across the network• Use the device APIs to send traffic via SSL• SSL requires a stored group of trusted Certificate Authorities (CA)• Locally-created CA certificates can be added through an MDM

Back 454

Encryption and key management

Front 455

• Usernames and passwords• Always separated from the application code• Credential details are almost always server-based• Easier to protect and manage• Credentials are usually communicated over SSL• Sometimes the app doesn’t actually encrypt anything!• Use a transitive trust for authentication• Login with Facebook, Google, etc

Back 455

Credential Managment

Front 456

• Your phone knows where you are• Location Services, GPS• Adds your location to document metadata• Longitude, latitude, Photos, videos, etc.• Every document may contain geotagged information• You can track a user quite easily• This may cause security concerns• Take picture, upload to social media

Back 456

Geo-tagging

Front 457

Managing mobile apps are a challenge• Mobile devices install apps constantly• Not all applications are secure• Android malware is a rapidly growing security concern• Manage application use through whitelists• Only approved applications can be installed• Managed through the MDM• A management challenge• New applications must be checked and added

Back 457

Application Whitelisting

Front 458

Corporate control of a personal device• Users must accept the integration of work onto the mobile device• Mobile Device Managers (MDMs) will be used• Specific security controls ensure adherence to corporate policies• May be a different acceptable use policy (AUP) for BYOD devices• A personal device, but used for business - Which policy wins?

Back 458

User Acceptance and Adherence to Corporate Policies

Front 459

• Not all devices can be reasonably managed• The organization may create a list of approved devices• All devices must be managed through the MDM• The device manager may have limitations on the type and number of devices• MDMs must be purchased, installed, etc.• Training costs, ongoing management costs• May require specific connectivity to the Internet• The MDM must talk to the mobile devices directly

Back 459

Architecture and infrastructure considerations

Front 460

• The organization now supports the device• If lost, the first call is to the corporate help desk• Not the wireless provider• Corporate office needs to wipe data• Or selectively remove the organization’s informationv• On-boarding and off-boarding is more involved• Carve out the organization’s section of the device• Remove just the organization’s data• I would completely nuke and rebuild

Back 460

Support ownership and on/off-boarding

Front 461

• Mobile devices are used everywhere• In the building, out of the building• New applications are installed all the time• With the potential for malware and viruses each time• Some patches may break other features• Or important corporate applications• On-device anti-virus may be required• Manage through the MDM

Back 461

Patch and Anti-virus Management

Front 462

The device belongs to a person• Some of the data belongs to the organization• Some of the data is very private• Use policies to determine data ownership• Document and communicate detailed security policy• Use technology to determine data ownership• Storage segmentation can build walls around employer data• Separate apps, separate data in the enterprise “box”

Back 462

Data Ownership and Privacy

Front 463

A corporate and social challenge• Privacy concerns, industrial espionage• Some policies restrict the use of the camera• Always available or always disabled• Some MDMs allow for geo-fencing• Restrict or allow features when in a particular area(The camera might only work when outside the office)

Back 463

On-board Camera and Video

Front 464

Post-attack actions• What forensic processes are followed?• With a desktop, the entire device is quarantined• The organization may not own the mobile device• The mobile device contains personal data• The forensics process may need to look at all information• Does the organization have a legal right to the device/data?• Does the user have a legal requirement of privacy to their data?

Back 464

Forensics and Legal Concerns

Front 465

Access to files and groups

Back 465

User rights

Front 466

Event log detail and log forwarding• File permissions

Back 466

Log settings

Front 467

Not all registry hives should be accessible

Back 467

Registry permissions

Front 468

What each user can and cannot do

Back 468

Account policies

Front 469

Millions of virus signatures are known• Always install an anti-virus application• Always keep the signatures current!• No anti-virus application can stop everything

Back 469

Anti-Virus

Front 470

Unsolicited emails (buy my stuff)• Phishing attempts to obtain your username and password• Many email clients include anti-spam technology• Your ISP may include this in the cloud

Back 470

Anti-Spam

Front 471

• Messages appear in separate windows in your browser• Became popular as an advertising method• Malware is especially good at popping windows• Legitimate applications may use pop-up windows

Back 471

Pop-up Blockers

Front 472

• Protect against others on the network• Can restrict access to your personal computer• Protect wherever you go• Important for laptops and mobile devices• Restricts by application and network port numbers

Back 472

Host-based Firewalls

Front 473

• Incredibly important• Provides system stability• May include security fixes and service packs• Provides emergency out-of-band updates• Protect against 0-day and important security discoveries

Back 473

Patch Management

Front 474

Nothing runs unless it’s approved• Very restrictive

Back 474

Whitelisting (App)

Front 475

• Decisions are made in the operating system• Often built-in to the operating system management

Back 475

Examples of Application Management

Front 476

Only allows applications with this unique identifier

Back 476

Application hash

Front 477

Allow digitally signed apps from certain publishers

Back 477

Certificate

Front 478

Only run applications in these folders

Back 478

Path

Front 479

The apps can only run from this network zone

Back 479

Network zone

Front 480

• Evaluation Assurance Levels• Common Criteria for Information Technology Security Evaluation• Also called Common Criteria (or CC)• Very common reference for US Federal Government• Evaluation Assurance Level (EAL) - EAL1 through EAL7• Trusted operating system• The operating system is EAL compliant• EAL4 is the most accepted minimum leve

Back 480

Trusted OS

Front 481

“Personal” firewalls• More than personal these days• Included in many operating systems• 3rd-party solutions also available• Stops unauthorized network access “Stateful” firewall• Blocks traffic by application• Windows Firewall• Filters traffic by port number and application

Back 481

Host-Based Firewalls

Front 482

Started as a separate application• Now integrated into many “endpoint” products• Protect based on signatures• Constantly growing database• Protect based on activity• Why are you modifying that file?

Back 482

Host-Based Intrusion Prevention

Front 483

• Temporary security• Connect your hardware to something solid• Cable works almost anywhere, useful when mobile• Most devices have a standard connector• Reinforced notch• Not designed for long-term protection• Those cables are pretty thin

Back 483

Cable Locks

Front 484

Secure your important hardware and media• Protection against fire and water• Very heavy and difficult to steal• Access must be carefully managed

Back 484

Safe

Front 485

Data center devices may be managed by different groups• Responsibility lies with the owner• Racks can have enclosed cabinets with locks• Ventilation on front, back, top, and bottom

Back 485

Locking Cabinets

Front 486

Security baselining• Determine what the application requires• Host resources, network connectivity, etc.• Need to tighten down operating system• Host-based firewall• Application execution restrictions• Limit access to certain folders• Useful for configuring external security devices• Firewall security policies• Allow or restrict application communication

Back 486

Host Software Baselining

Front 487

• Web server, cloud based• The application is centralized• Other services may be using the same physical hardware• Difficult to completely secure and limit access• Redundancy may be required• Protect against downtime• Denial of Service (DoS)• Hardware failures• Network outages

Back 487

Software on the Server

Front 488

• One physical computer, many operating systems• Mac OS X, Windows 7, Linux, all at the same time!• Separate OS, independent CPU, memory, network, etc.• Host-based virtualization runs all OSes on your desktop

Back 488

Virtualization

Front 489

• Every guest is self-contained in a single file• Virtual hosts can be versioned• Take snapshots at any point, revert instantly• Store multiple snapshots• Easy to recover to a specific date and time• Historical analysis - determine when a vulnerability was exploited

Back 489

Snapshots and Security

Front 490

Provide resources when demand requires it• Scale down when things are slow

Back 490

Elasticity

Front 491

• New server deployed with a few mouse clicks• Virtualization integrates a layer of orchestration• Automate the deployment and movement of virtual hosts• Servers can be added or moved to other data centers• All of the management systems follow the servers

Back 491

Host availability

Front 492

• Virtualized hosts are perfect for spinning up a custom host• Network scans, vulnerability scanning, penetration testing• Sandboxing• Don’t click that link! Don’t launch that attachment!• Unless you’re in a sandbox• Individual sandboxes• Or centralized sandboxes for everyone

Back 492

Using Virtual Hosts for Security

Front 493

© 2014 Messer Studios, LLCEnsuring Data Securityhttp://www.ProfessorMesser.comProfessor Messer’s CompTIA SY0-401 Security+ Course Notes - Page 26SAN Data Security• The network is the SAN• You’re in one place, the data is in another• Physically secure SAN• Restricted physical access• Protected data center• Self-encrypting drives• Encrypt data when it leaves the protected area• Network-to-network (switch-to-switch)• Backup tapes• Plan for encryption overhead in CPU and network use

Back 493

SAN Data Security

Front 494

Massive datasets• Normal access controls may not apply• Doesn’t fit a “need to know” principle• You don’t even know what’s in there• An important part of big data is hunting for patterns• Consider removing Personally Identifiable Information (PII)• Difficult to completely remove an individual’s identification• Difficult to audit every bit of information accessed• Log just the queries• Implement Data Loss Prevention (DLP) techniqu

Back 494

Securing Big Data

Front 495

Massive datasets• Normal access controls may not apply• Doesn’t fit a “need to know” principle• You don’t even know what’s in there• An important part of big data is hunting for patterns• Consider removing Personally Identifiable Information (PII)• Difficult to completely remove an individual’s identification• Difficult to audit every bit of information accessed• Log just the queries• Implement Data Loss Prevention (DLP) techniques

Back 495

Securing Big Data

Front 496

• Serious data protection - Every bit and byte is encrypted• Perfect for mobile devices - But not exclusive to laptops• Built-in protection - BitLocker• Commercial and open-source options - PGP, TrueCrypt• Key management is incredibly important• Lose the key, lose your data

Back 496

Full-Disk Encryption

Front 497

• Relatively impractical to encrypt an entire database• Huge files, lots of access• Encryption based on the Database Management System (DBMS)• Different capabilities across different software platforms• Individual columns/fields are usually encrypted• Don’t encrypt your key fields!

Back 497

Database Encryption

Front 498

• Many different options• Built-in to the OS• 3rd-party applications• Some files are encrypted others are not• Pick and choose your security• And your resource management• Many of those still require key management• Backup your keys, protect your keys

Back 498

Individual File Encryption

Front 499

• Big concern• Where’s my USB drive?• Administrative controls over removable media• Require encryption• Again with the key management• This can be automated in many operating systems• No USB storage at all• An extreme case

Back 499

Removable Media Encryption

Front 500

Practically all mobile devices encrypt user data• The key is on the device• Email and apps using “Data Protection” are encrypted in iOS• The key is based on the passcode• Even if stolen, you can get the data• Some information may not be encrypted in iOS• On Android, configure encryption in Settings > Security• Full-disk encryption, the key is based on the passcode

Back 500

Mobile Devices

Front 501

• A specification for cryptographic functions• Cryptographic processor with random number generator, key generators• Persistent memory • Comes with unique keys burned in during production• Versatile memory• Storage keys, hardware configuration information• Password protected

Back 501

Trusted Platform Module (TPM)

Front 502

• High-end cryptographic hardware• Plug-in card or separate hardware device• Key backup in secured storage• Cryptographic accelerators for offloading CPU overhead• Used in large environments

Back 502

Hardware Security Module (HSM)

Front 503

Hardware-based AES encryption as part of the drive• Includes trusted browser, identity software• Can be used as secure tokens withtwo-factor authentication and single sign-on• Remote management included to unlock or reset remotely

Back 503

USB Encryption

Front 504

Data transmitted over the network• Also called data in-motion• Not much protection as it travels• Many different switches, routers, devices• Provide transport encryption• TLS (Transport Layer Security), IPsec (Internet Protocol Security)

Back 504

Data In-Transit

Front 505

• The data is on a storage device• Encrypt the data• Whole disk encryption, database encryption• File- or folder-level encryption• Apply permissions• Access control lists - only authorized users can access the data

Back 505

Data At-Rest

Front 506

• The data is in memory• System RAM, CPU registers and cache• The data is almost always decrypted• Otherwise, you couldn’t do anything with it• The bad guys can pick the decrypted information out of RAM

Back 506

Data In-Use

Front 507

• Permissions associated with an object• Used in file systems, network devices, operating systems, and more• List the permissions• Bob can read files• Fred can access the network• James can access network 192.168.1.0/24 using • tcp ports 80, 443, and 8088• Many operating systems use ACLs to provide access to files• A trustee and the access rights allowed

Back 507

Access Control Lists

Front 508

• Remote removal of data• The administrator can delete all or part of live data• Retiring hardware• Hard drives contain a lot of information• Overwrite all disk data before disposing• May be based around device loss or employee off-boarding• The organization controls the location of data at all times

Back 508

Data Wiping

Front 509

Some information cannot be disposed of• Legal requirements for maintaining information• Some information is destroyed to make room for more• Archived data, especially with high storage costs• Personal data may have a very short life• Only store for however long as is necessary• Sensitive information may be destroyed to control distribution• Keep the information out of the hands of others

Back 509

Disposing of Data

Front 510

• Keep files that change frequently for version control• Files change often - Keep at least a week, perhaps more• Recover from virus infection• Infection may not be identified immediately• May need to retain 30 days of backups• Consider legal requirements for data retention• Email storage may be required over years• Some industries must legally store certain data types• Different data types have different storage requirements

Back 510

Data Retention

Front 511

• User can’t change very much, unlike a PC• Very useful for security - Easier to protect and defend Even static environments can be updated• Firmware upgrades are common

Back 511

Static Environments

Front 512

A computing system designed to• perform a specific, dedicated function• Intravenous drip-rate meter, water treatment plant controls

Back 512

Embedded systems

Front 513

Supervisory Control and Data Acquisition System• Large-scale, multi-site Industrial Control Systems (ICS)• Runs on normal PCs, manages equipment• Power generation, refining, manufacturing equipment• Traditionally not built with security in mind• This has obviously been a problem these days• Huge emphasis in securing all SCADA systems• Enormous improvements in a short time

Back 513

SCADA and HVAC

Front 514

• All-in-one or multifunction devices (MFD)• Everything you need in one single device• No longer a simple printer - very sophisticated firmware• Some images are stored locally on the device• Can be retrieved externally• Logs are stored on the device• Contain communication and fax details

Back 514

Printers, Scanners, and Fax Machines

Front 515

Huge amount of computing power in a car• Navigation, in-vehicle entertainment• Engine electronics• Embedded technology for fuel consumption and engine functions• Telemetry• Event data recorder “black box”• Acceleration, braking, position

Back 515

In-Vehicle Computing Systems

Front 516

Operating system for many different products• iPod, iPhone, iPad• Closed operating system• Derived from Unix• Apps available in the App Store• Developers must submit their apps for approval• Only one place to download applications• Very closed environment• Security issues are relatively mitigated

Back 516

Apple iOS

Front 517

• Open Handset Alliance• Driven by Google• A more open model than iOS• Open-source operating system• A more open app distribution system• Completely distributed, no centralized store• More susceptible to malware• Applications have limited access to user data• Unless the user allows it

Back 517

Android

Front 518

Connect TV, Hybrid TV• Combine a computer with a television• Stream video/audio, video on demand, games, social networking, etc. - Video without an antenna• Most use a Linux kernel• Security concerns associated with JavaScript,HTML5, Java, etc.• Disable if features aren’t needed• Office conference room, OTA-only

Back 518

Smart Televisions

Front 519

Legacy systems - Proprietary operating systems• Still used for large-scale applications• Bulk data, transaction processing• Very reliable and redundant• Can run interrupted for decades• Not many mainframe-specific attacks exist• A unique OS with relatively few installations• Attacks tend to be from the inside• Very specialized, attacking specific data source

Back 519

Mainframes

Front 520

Very similar to a PC - Specific hardware and a purpose-built OS• Xbox and PlayStation - Windows and Linux• Large storage and CPU capacity - Perfect to use as a server• Rooting or jailbreaking - Gain access to the hardware and/or the OS• Network-centric - Keep away from the corporate network

Back 520

Game Consoles

Front 521

Layered security• Defense-in-depth - You need more than just one type of security• The security controls should be diverse• If you get over one hurdle, there’s another one to stop you• Avoid any single points of failure• Security also needs redundancy• Multiple firewalls, multiple IPS, multiple management system

Back 521

Security Layers and Control Redundancy

Front 522

Separate logical sections of the organization• Internet, DMZ, storage, management, corporate, etc.• Physical separation• Completely different infrastructure• Logical separation• Firewall rules, based on zones or IP address ranges• Specific policies for types of data per zone• No PII in the DMZ, no credit card information on the Internet

Back 522

Network Segmentation

Front 523

Puts a wrapper between the network and the service• Used ACLs to filter access to services• A very early form of application control

Back 523

TCP Wrapper

Front 524

Filters traffic based on the application• Can provide very detailed application control• Can protect specialized applications

Back 524

Application firewalls -

Front 525

Embedded systems have relatively few updates• Some embedded systems can’t be updated easily• Many embedded systems require manual updates• There’s no automated process or external management• More time consuming• May be seen as less of a priority

Back 525

Firmware Version Control

Front 526

• Authentication protocol for almost everything• A very common AAA service• Modems, routers, switches, firewalls, etc.• A common authentication method for 802.1X• Secure authentication - sends passwords as a hash

Back 526

RADIUS (Remote Authentication Dial-in User Service)

Front 527

• Remote authentication protocol, RFC 1492• Created to control access to dial-up lines to ARPANET• XTACACS (Extended TACACS)• A Cisco-created (proprietary) version of TACACS• Additional support for accounting and auditing• TACACS+• The latest Cisco proprietary version of TACACS• Not backwards compatible• More authentication requests and response codes

Back 527

TACACS (Terminal Access Controller Access-Control System)

Front 528

• Protocol for reading and writing directories over an IP network• X.500 specification was written by the International Telecommunications Union (ITU) • LDAP is lightweight, and uses TCP/IP (tcp/389 and udp/389)• LDAP is the protocol used to query and update an X.500 directory• Used in Windows Active Directory, Apple OpenDirectory, Novell eDirectory, etc.

Back 528

LDAP (Lightweight Directory Access Protocol)

Front 529

LDAP User Access and Security• Simple Authentication and Security Layer (SASL) in LDAP v3• Usually two levels of access - Read-only (query) and read-write (update)

Back 529

X.500 Directory Information Tree

Front 530

LDAP over SSL - Encrypt with SSL/TLS• Commonly configured in Microsoft environments - Active Directory uses TCP port 636

Back 530

Secure LDAP

Front 531

• You need access to resources on a service provider• You can authenticate through a third-party• Service provider• You need access to this web server• Client• The user that needs access, often from a browser• Identity Provider• The owner of the identities and credentials

Back 531

SAML(Security Association Markup Language)

Front 532

Identification associates a user with an action• Authentication proves a user is who it claims to be• The access control process• Prove a user is who they say they are (authorization)• Prove a user performed an action (non-repudiation)

Back 532

Identification vs. authentication

Front 533

Proves a user or process is who it claims to be• Provide a username and a secret passphrase• Many different authentication types

Back 533

Authentication

Front 534

Now you’re identified - What rights and permissions do you have?• Policy definition - What rights and permissions should apply?• Policy enforcement - Only authorized rights are exercised• Allow and deny based on defined policies

Back 534

Authorization

Front 535

Now you’re identified - What rights and permissions do you have?• Policy definition - What rights and permissions should apply?• Policy enforcement - Only authorized rights are exercised• Allow and deny based on defined policies

Back 535

Authorization

Front 536

Authorization• Ensure only authorized rights are exercised (policy enforcement)• The process of determining rights (policy definition)

Back 536

Access Control

Front 537

A generic term for following the rules• Access is determined through system-enforced rules

Back 537

Rule-based access control

Front 538

The owner is in full control• Very flexible but very weak security

Back 538

Discretionary access control (DAC)

Front 539

Access is based on the role of the user• Rights are gained implicitly instead of explicitly• Windows Groups can provide role-based access control

Back 539

Role-based access control (RBAC)

Front 540

Based on security clearance levels• Every object gets a label• Labeling of objects uses predefined rules

Back 540

Mandatory Access Control (MAC)

Front 541

Unless otherwise stated, there’s no access of any kind

Back 541

Implicit Deny

Front 542

Unless otherwise stated, there’s no access of any kind

Back 542

Implicit Deny

Front 543

Access control changes depending on the time of day

Back 543

Time of Day Restrictions

Front 544

Something you know -

Back 544

Password, PIN

Front 545

Something you have

Back 545

Smart card, token

Front 546

Something you are

Back 546

Fingerprint, iris scan

Front 547

More than one factor

Back 547

Multi-factor Authentication

Front 548

Somewhere you are

Back 548

Biometrics

Front 549

GPS information, IP address

Back 549

Somewhere you are

Front 550

Handwriting analysis, typing technique

Back 550

Something you do

Front 551

HOTP - HMAC-based One-Time Password• The keys are based on a secret key and a counter• Token-based authentication• The hash is different every time• Hardware and software tokens available• You’ll need additional technology to make this work

Back 551

One-Time Password Algorithms

Front 552

Use a secret key and the time of day• Secret key is configured ahead of time• Timestamps are synchronized via NTP• Timestamp usually increments every 30 seconds• Put in your username, password, and TOTP code• One of the more common OTP methods• Used by Google, Facebook, Microsoft, etc.

Back 552

TOTP Time-based One-Time Password

Front 553

____ is clear-text authentication• Unsophisticated, insecure

Back 553

PAP (Password Authentication Protocol)

Front 554

• Encrypted challenge sent over the network• Three-way handshake• After link is established, server sends a challenge message• Client responds with a password hash• Server compares received hash with stored hash

Back 554

CHAP (Challenge-Handshake Authentication Protocol)

Front 555

Authenticate one time• Kerberos authentication and authorization• 3rd-party options

Back 555

Single Sign-on (SSO)

Front 556

• Authenticate one time• No constant username and password input• Not everything is Kerberos-friendly

Back 556

SSO with Kerberos

Front 557

Software as a Service (SaaS)Many 3rd-party services are available

Back 557

SSO for everything

Front 558

• Provide network access to others - Not just employees• Third-parties can establish a federated network• Authenticate and authorize between the two organizations• Login with your Facebook credentials• The third-parties much establish a trust relationship• And the degree of the trust

Back 558

Federation

Front 559

Domain B trusts Domain A, Domain A doesn’t trust Domain B

Back 559

One-way trust

Front 560

Both domains are peers, both trust each other equally

Back 560

Two-way trust

Front 561

A trust is specifically created and applies only to that trust

Back 561

Non-transitive trust

Front 562

Domain A trusts Domain B, Domain B trusts Domain C,therefore Domain A trusts Domain C

Back 562

Transitive trust

Front 563

Define groups based on a user’s role• Make the definitions tight enough to apply security controls• There may be different permissions in the same department• A user can logically only have rights for one role at a time

Back 563

Role-based Management

Front 564

Authentication details for one account is known by more than one person• Sharing accounts makes auditing very difficult, • Breaks non-repudiation• Activities on a shared account can be challenged• The account credentials are more likely to be compromised• Changing the password will involve many people

Back 564

Shared Accounts

Front 565

All that stands between the outside world and all of the data• Passwords must not be embedded in the application• Everything needs to reside on the server, not the client• Communication across the network should be encrypted• Authentication traffic should be impossible to see

Back 565

Protecting Credentials

Front 566

Apply security and admin settings across many computers• Different than NTFS or Share permissions• Control the use of the operating system• Linked to Active Directory administrative boundaries• Sites, domains, organization units (OUs)• Define by groups, locations, etc.

Back 566

Group Policy

Front 567

Remove Add or Remove Programs• Prohibit changing sounds• Allow font downloads• Only allow approved domains to use• ActiveX controls without prompt

Back 567

Group Policy Control

Administrative policies

Front 568

Specify minimum password length• Require smart card• Maximum security log size• Enforce user login restrictions

Back 568

Group Policy Control

Security policies

Front 569

Make your password strong• No single words, no obvious passwords• Mix upper and lower case, use special characters• A strong password is at least 8 characters• Prevent password reuse

Back 569

Password Complexity and Length

Front 570

All passwords should expire, change every 30 days, 60 days, etc.• Critical systems might change more frequently• The recovery process should not be trivial!• Some organizations have a very formal process

Back 570

Password Expiration and Recovery

Front 571

Too many bad passwords will cause a lockout• This can cause big issues for service accounts• Disabling accounts is usually part of the normal change process• You don’t want to delete accounts, at least not initially

Back 571

Account lockout and disablement

Front 572

Put users into a single group, then set privileges on the group• Add/remove users from the group to assign privileges• Users can be members of multiple groups• Group permissions can overlap

Back 572

Group Management

Front 573

Individual users are granted specific rights• Difficult to make global changes• Doesn’t scale very well

Back 573

User Management

Front 574

Based on the role of the user• Administrators, Users, HR managers, Accounting analysts• Users can be moved in and out of a role as their job changes• A user should only have rights for one role at a time

Back 574

Role-based Management

Front 575

• There can be misconfigurations, changes in user policies• Auditing should occur often• Monitor group membership• Review access control lists• Identify and disable unused accounts• Disable unnecessary accounts

Back 575

User Access Review

Front 576

Keep a list of every action, i.e., application, security, audit• This can be an enormous database• Don’t turn these off!• Use to detect unauthorized access to a resource

Back 576

Monitoring Event Logs

Front 577

An unencrypted message (in the clear)

Back 577

Plaintext

Front 578

An encrypted message

Back 578

Ciphertext

Front 579

The algoithm used to encrypt and/or decrypt

Back 579

Cipher

Front 580

The art of cracking encryption

Back 580

Cryptanalysis

Front 581

Substitute one letter with another - ROT13• “Uryyb Jbeyq” is “Hello World”• Transposition Cipher• Keep the letters, change the order - “HLOOLELWRD”• Hack these ciphers with a frequency analysis

Back 581

Substitution Cipher (Caesar cipher)

Front 582

Germany’s Enigma machine (WW II)

Back 582

Mechanical Cipher

Front 583

Use complex algorithms to encrypt

Back 583

Mathematical Ciphers

Front 584

The plaintext was combined with a shared “pad” of text to produce the ciphertext• The decryption would be done with the same pad of text

Back 584

One-time pad

Front 585

A single, shared key• Encrypt with the key, decrypt with the same key• If the key is found, all data can be decrypted• Very fast to use, not a lot of overhead• Often combined with asymmetric encryption

Back 585

Symmetric Encryption

Front 586

Public key cryptography• Private key - keep this private• Public key - give to everyone• The private key is the only key that can decrypt dataencrypted with the public key• You can’t derive the private key from the public key

Back 586

Asymmetric encryption

Front 587

Don’t send the symmetric key over the ‘net• Telephone, courier, in-person, etc.

Back 587

Out-of-band key exchange

Front 588

It’s on the network• Protect the key with additional encryption• Often uses asymmetric encryption to deliver a symmetric key

Back 588

In-band key exchange

Front 589

There’s a need for fast security • Without compromising the security part• Share a symmetric session key using asymmetric encryption• Client encrypts a random (symmetric) key witha server’s public key• The server decrypts this shared key and uses it to encrypt data• This is the session key• Implement session keys carefully• Need to be changed often (ephemeral keys)• Need to be unpredictable

Back 589

Real-time Encryption/Decryption

Front 590

• Used in symmetric encryption• Not used in asymmetric encryption• Encrypt fixed-length groups (blocks)• Often 64-bit or 128-bit blocks• Pad added to short blocks to fill the block size

Back 590

Block Ciphers

Front 591

The key-to-ciphertext relationship should be very complicated• You can’t determine the key based on the ciphertext

Back 591

Confusion

Front 592

Output should depend on the input in a complex way• If you change one bit of the input, at least 50% of the output should be different

Back 592

Diffusion

Front 593

Also used with symmetric encryption• Encryption is done one bit or byte at a time• High speed, low hardware complexity• The starting state should never be the same twice• Key is often combined with an initialization vector (IV)

Back 593

Stream Ciphers

Front 594

Proof of integrity• Proof of origin, with high assurance of authenticity• Used for digital signatures• Digitally “sign” your files/messages with your private key• Others check with your public key

Back 594

Non-repudiation

Front 595

Represent data as a short string of text (a message digest)• Impossible to recover the original message from the digest• Used to store passwords and provide confidentiality• Can be a digital signature for authentication,non-repudiation, and integrity• A well designed hash will not collide• Different messages will not have the same hash

Back 595

Hashes

Front 596

A trusted third-party holds the keys• Allows for recovery of encrypted dataSomeone else holds your decryption keys• Your private keys are in the hands of a 3rd-party• This can be a legitimate business arrangement• A business might need access to employee information• Government agencies may need to decrypt partner data

Back 596

Key Escrow

Front 597

• Symmetric encryption - Hide a key in a safe• Asymmetric encryption - Add an additional private decryption key• The process is just as important as the key• When do you get the key? Who has access? Is there more than one key?

Back 597

Key escrow with encryption types

Front 598

Greek for “concealed writing”• Message is invisible, but it’s really there• The covertext is the container document or file• Network based steganography• Embed messages in TCP packets• Embed a message in an image• Use (nearly) invisible watermarks• Yellow dots on printers

Back 598

Steganography

Front 599

Asymmetric encryption• Need large integers composed of two or morelarge prime factors• Instead of numbers, use curves!• Smaller storage and transmission requirements• Perfect for mobile devices

Back 599

Elliptic curve cryptography (ECC)

Front 600

Use quantum physics to provide cryptographic references• Quantum key distribution (QKD)• Used to communicate a shared key between two users• If a third-party tries to get in the middle, the data is disturbed

Back 600

Quantum cryptography

Front 601

Don’t use the server’s RSA key pair• Use Elliptic curve, Diffie-Hellman ephemeral• The keys aren’t kept around• You can’t recover the key, so you can’t decrypt• PFS requires more computing power - Not all servers use PFS• The browser must support PFS• Check your SSL/TLS information for details

Back 601

Perfect Forward Secrecy (PFS)

Front 602

First published: April 1992• Replaced MD4• 128-bit hash value• 1996: Vulnerabilities found - not collision resistant• December 2008: Researchers created CA certificatethat appeared legitimate when MD5 is checked

Back 602

MD5 Message Digest Algorithm

Front 603

Developed by the National Security Agency (NSA)• A US Federal Information Processing Standard

Back 603

Secure Hash Algorithm (SHA)

Front 604

Widely used• 160-bit digest• 2005: Collision attacks published

Back 604

SHA-1

Front 605

The preferred SHA variant• Up to 512-bit digests• SHA-1 is now retired for most US Government use

Back 605

SHA-2

Front 606

A family of message digest algorithms• RACE Integrity Primitives Evaluation Message Digest• RACE - Research and Development in AdvancedCommunications Technologies in Europe• Original RIPEMD was found to have collision issues (2004)• Effectively replaced with RIPEMD-160 (no known collision issues)• Based upon MD4 design but performs similar to SHA-1• RIPEMD-128, RIPEMD-256, RIPEMD-320

Back 606

RIPEMD

Front 607

Combine a hash with a secret key• e.g., HMAC-MD5, HMAC-SH1• • Verify data integrity and authenticity• No fancy asymmetric encryption required• • Used in network encryption protocols• IPsec, TLS

Back 607

HMAC-Hash-based Message Authentication Code

Front 608

One of the Federal Information Processing Standards (FIPS)• 64-bit block cipher• 56-bit key (very small in modern terms)

Back 608

Data Encryption Standard - DES

Front 609

Use the DES algorithm three times• Three keys, two keys, or the same key three times• Superseded by AES (Advanced Encryption Standard)

Back 609

3DES

Front 610

• US Federal Government Standard• 128-bit block cipher - 128-, 192-, and 256-bit keys• Used in WPA2 - Powerful wireless encryption

Back 610

AES (Advanced Encryption Standard)

Front 611

Designed in 1993 by Bruce Schneier• 64-bit block cipher, variable length key (1 to 448 bits)• No known way to break the full 16 rounds of encryption• One of the first secure ciphers not limited by patents

Back 611

Blowfish

Front 612

Successor to Blowfish• 128-bit block size, key sizes up to 256• No patent, public domain

Back 612

Twofish

Front 613

Ron Rivest, Adi Shamir, and Leonard Adelman (1977)• Public-key cryptography system• Based on the product of two large prime numbers• You must know the factors to decode• Now released into the public domain• Used extensively for web site encryption and DRM

Back 613

RSA

Front 614

A key exchange method over an insecure communications channel, published in 1976• Witfield Diffie and Martin Hellman (and Ralph Merkle)• DH does not itself encrypt or authenticate• It’s an anonymous key-agreement protocol• Used for Perfect Forward Secrecy• Ephemeral Diffie-Hellman (EDH or DHE)• Combine with elliptic curve cryptography for ECDHE

Back 614

Diffie-Hellman Key Exchange

Front 615

1917 - Built to encrypt teletype communication• Mixed a paper tape (message) with another paper tape (key)• The “pad” is a pad of paper• Very simple encryption and decryption process• Very secure encryption - Unbreakable when used correctly

Back 615

One-Time Pad

Front 616

• Microsoft and 3Com network operating system• Hash challenge, similar to CHAP• Somewhat insecure• All uppercase ASCII, password is 14-characters max• Passwords over 7 characters are split and encrypted separately• Passwords are not salted

Back 616

LAN Manager (LANMAN)

Front 617

Some Windows password databases contain LM hash versions of the passwords• NTLM is vulnerable to a credentials forwarding attack

Back 617

NTLM vulnerabilities

Front 618

Used in early versions of Windows NT• Password is Unicode and up to 127 characters long• Stored as a 128-bit MD4 hash

Back 618

NTLM (NT LAN Manager)

Front 619

• New password response• MD4 password hash (same as NTLMv1)• HMAC-MD5 hash of username and server name• Variable-length challenge of timestamp,random data, domain name

Back 619

NTLMv2 was first seen on Windows NT SP4

Front 620

• Developed by Netscape in 1996• TLS (Transport Layer Security) - Derived from SSL• HTTPS uses SSL/TLS to encrypt web server communication

Back 620

SSL (Secure Sockets Layer)

Front 621

Encrypted console communication• Used often for remote administration• Includes secure file transfer (SFTP) and secure file copy (SCP)

Back 621

SSH (Secure Shell)

Front 622

• Security for OSI Layer 3• Encrypts IP packets (tcp/udp 1293)• Provides confidentiality and integrity/anti-replay• Encryption and packet signing• Very standardized• Two core IPsec protocols are Authentication Header (AH)and Encapsulation Security Payload (ESP)

Back 622

IPsec

Front 623

Transport mode• Only IP payload is encryptedand/or authenticated Tunnel mode• Entire packet is encrypted and/or authenticatedAH (Authentication Header)• Data integrity• Origin authentication• Replay attack protection• Keyed-hash mechanism• No confidentiality (encryption)Building the Authentication Header• Hash of the packet and a shared key• Often uses a well-known hash• MD5, SHA-1, or SHA-2• The AH is added to the packet header

Back 623

IPsec Authentication Header (AH)

Front 624

• Data confidentiality (encryption)• Limited traffic flow confidentiality• Data integrity• Anti-replay protection

Back 624

ESP (Encapsulating Security Payload)

Front 625

Combine the data integrity of AH with the confidentiality of ESP

Back 625

AH and ESP

Front 626

Practically everything can be brute forced• Strong algorithms have been around for a while• That’s part of the reason that they are strong• Wired Equivalent Privacy (WEP) was found to have design flaws• Strong algorithms - PGP, AES• Weak algorithms - DES (56-bit keys), WEP (design flaw)

Back 626

The Strength of Encryption

Front 627

A weak key is a weak key - by itself, it’s not very secure• Make a weak key stronger by performing multiple processes• Hash a password. Hash the hash of the password. And continue...• Brute force attacks would require reversing each of those hashes• The attacker has to spend much more time, even though the key is small

Back 627

Key Stretching

Front 628

bcrypt• Generates hashes from passwords• An extension to the UNIX crypt library• Uses Blowfish cipher to perform multiple rounds of hashing• Password-Based Key Derivation Function 2 (PBKDF2)• Part of RSA public key cryptography standards(PKCS #5, RFC 2898)

Back 628

Key stretching libraries

Front 629

• Built-in to your browser• Purchase your web site certificate• It will be trusted by everyone’s browser• Create a key pair, send the public key to the CA to be signed• A certificate signing request (CSR)• May provide different levels of trust and additional features• Add a new “tag” to your web site

Back 629

Commercial certificate authorities

Front 630

• You are your own CA - build it in-house• Needed for medium-to-large organizations• Implement as part of your overall computing strategy• Windows Certificate Services• OpenCA

Back 630

Private certificate authorities

Front 631

Certificate Revocation List (CRL)• Maintained by the Certificate Authority (CA)

Back 631

Key Revocation

Front 632

The browser can check certificate revocation• Messages usually sent to an ____responder via HTTP• Not all browsers support ____• Early Internet Explorer versions did not support ___

Back 632

OCSP Online Certificate Status Protocol

Front 633

You manage your own certificates• You must find others to sign your certificate, and those people must be trusted by others• Plan to revoke your key with a revocation certificate• You can also enable others to create revocation certs for your key

Back 633

Web-of-Trust Key Revocation

Front 634

• Policies, procedures, hardware, software,people to manage digital certificates• Create, distribute, manage, store, revoke• Requires extensive planning• Also refers to the binding of public keys to people

Back 634

Public Key Infrastructure (PKI)

Front 635

Create a key with the requested strengthusing the proper cipher

Back 635

Key generation

Front 636

Allocate a key to a user

Back 636

Certificate generation

Front 637

Makes the key available to the user

Back 637

Distribution

Front 638

Secure storage and protection against unauthorized use

Back 638

Storage

Front 639

Manage keys that have been compromised

Back 639

Revocation

Front 640

A certificate may only have a certain “shelf life”

Back 640

Expiration

Front 641

Your private key is valuable• Backup and store private keys• Use “M of N” control to restrict access• Built-in to Windows Server CA and other 3rd-party CAs

Back 641

Key Recovery

Front 642

The Key Pair• Asymmetric encryption, Public Key Cryptography• Both the public and private key are built at the same time• Lots of randomization and large prime numbers

Back 642

Public Keys and Private Keys

Front 643

Sign with the private key• The message doesn’t need to be encrypted• Verify with the public key• Any change in the message will invalidate the signature

Back 643

Digital Signatures

Front 644

Use public and private key cryptography to create a symmetric key

Back 644

Symmetric key from asymmetric keys

Front 645

The Registration Authority (RA) provides the PKI role thatensures the public key is bound to the individual• Important for non-repudiation• This can range from a casual verification to a formal,multi-step verification• Federal Public Key Infrastructure Policy AuthorityX.509 Certificate Policy for the U.S. Federal Government

Back 645

Key Registration