1
Q
security techniques (list)
A
- secure baselines
- hardening
- secure wireless devices
- mobile solutions
- wireless security settings
- application security
- monitoring
- sandboxing
2
Q
secure baselines
A
- establish baseline (basics from developers, to then tweak to org’s needs)
- deploy baselines
- Maintain baselines – update as needed, test, avoid conflics between diff tools etc.
3
Q
harden mobile devices
A
- patches, bug fixes
- segment data stored on the device
- control with MDM
4
Q
harden workstations
A
- constant monitoring
- updates, patches
- policy management system
- remove unnecessary software
5
Q
harden network infrastructure devices
A
aka switches, routers, firewalls, etc.
- change default credentials
- patches, security updates
6
Q
harden cloud infrastructure
A
- secure the cloud management workstation
- least privilege
- configure EDR
- backups
7
Q
harden servers
A
- updates, service packs (group patches)
- limit access
- password policy
- network access limitation
- anti-virus/malware
8
Q
harden scada/ics
A
extensive segmentation
9
Q
harden embedded systems
A
-patches
-segment
-firewall
10
Q
harden RTOS
A
- isolated from rest of network
- run w minimum services
- secure communication - firewall
11
Q
harden IoT devices
A
- change defaults
- patches
- segmenttion
12
Q
site surveys
A
determine wireless landscape
13
Q
heat maps
A
identify wireless signal strength
14
Q
mobile solutions
A
- MDM
- Deployment models
- connection methods
15
Q
deployment models (list)
A
BYOD
COPE
CYOD
16
Q
MDM
A
manage company owned/user owned mobile devices
centralized management –> policies, manage access control
17
Q
disadvantages of BYOD
A
difficult to secure
- secure company data * personal data
18
Q
cellular network security concerns
A
traffic monitoring
location tracking
19
Q
securing wireless network
A
- authenticate users
- all communication is encrypted
- integrity of all communication
20
Q
WPA3
A
GCMP block cipher mode –> stronger encryption
has confidentiality & integrity
21
Q
SAE
A
simultaneous authentication of equals//
uses a type of diffie hellmen key exchange
PSK Authentication process
mutual auth.
creates a shared session key without sending it across the network
22
Q
—AAA framework—
A
23
Q
some methods to increase your wireless security posture
A
disable uneeded services
encryption
secure user account
no remote administration
deploy MAC filtering
disable SSID Broadcast
24
Q
authentication protocols (list)
A
RADIUS
EAP
IEEE 802.1X
25
RADIUS
AAA protocol
centralize authentication for users
26
cryptographic protocols?
27
application security methods
- input validation
- secure cookies
- static code analysis
- code signing
- sandboxing
- monitoring
28
--acquisition process--
29
ownership of assets
person owner per asset
for asset tracking
30
classification of assets
type of asset
hard/software etc.
for asset tracking
31
monitoring and asset tracking
inventory
enumeration - list all parts of an asset
add an asset tag (barcode, rfid, tracking number, org name, etc)
32
media sanitization
decommissioning
removing data, no usable info remains
reuse
33
methods of media sanitization
physical - shredder, hammer, em (degaussing), incineration
34
--certificate of destruction--
35
reasons for data retention
- backup of data
- regulatory compliance
- operational needs
36
how to identify vulnerabilities (list)
- vulnerability scans
- application code analysis
- threat feed
- pen testing
- disclosure programs
- audits
37
ways to analyze vulnerabilities (list)
- first need to confirm the vuln
- prioritize it
- use CVSS to determine severity
- CVE
- vuln classification
- exposure factor
- envrionmental variables
- industry/org impact
- risk tolerance
38
exposure factor
loss of value or business activity if vuln is exploited
39
environmental variables
environment associated with the vulnerability
helps with prioritization
(ex. isolated device in lab vs database server in public cloud)
40
risk tolerance
amount of risk acceptable to an org
41
vulnerability remediation (list)
- patching
- insurance
- segmentation
- compensating controls
- exceptions and exemptions
42
compensating controls
optimal security methods may not be available so instead compensate in other ways for a temporary time.
ex. disabling a service, revoking access to application etc.
43
exemptions and exceptions
removing the vuln is optimal
balancing act -- don't want vulnerability but want the service to be operating
exception - formal process
44
validation of remediation (list)
- rescanning
- audit
- verification
45
what do you monitor in systems?
- authentication --> logins, from where, what time, etc.
- server monitoring - service activity, backups, software versions
46
what do you monitor in applications?
- availability --> uptime, response times
- data transfers --> increases or decrease in rates
- security notifications - from developer
47
what do you monitor in infrastructure?
- remote access systems, employees, vendors, guests
- firewall and IPS reports
48
Methods to monitor all this info?
log aggregation thru SIEM
central database, for centralized reporting
49
Scanning
to check all systems and devices
find potential anomalies
50
monitoring activities (list)
- siem (log aggregation)
- alerting
- scanning
- reporting
- archiving
- alert response/validation
51
alert response and remediation
quarantine
alert tuning
52
alert response: quarantine
quarantine the system , isolate it, prevent attacker additional access to it, prevent spread to other systems
53
alert response: tuning
prevent false positives & negatives
54
alerting & monitoring tools
SCAP
benchmarks
agents/agentless
SIEM
antivirus
DLP
SNMP traps
NetFlow
Vuln Scanners
55
SCAP
security content automation protocol //
allows tools to identify and act on same critera
tools can communicate with each, same language, to identify vulns
56
benchmarks
apply security best practices to everything
57
agent/agentless
software agent on device; always on, always running, must update the agent
agentless - no install, performs the check then disappear, no ongoing updates, nothing permanantly installed
58
SNMP Traps
??
59
NetFlow
??
60
vuln scans
passive
port scan
identify systems
test from outside & inside
61
NGFW
works in application layer (7) - block/allow by application
62
firewall rules
start matching top to bottom. Top - more specific rules
63
implicit deny
step thru each rule in succession. if no rule matches, then it will automatically be denied.
64
ACLs
groupings by categories
ex. source, dest ip, time of day, port number, application
65
ingress/egress point
where the firewall is usually put.
point where the internet separates from the internal network
66
screened subnet
additional layer of security between network and internet.
access to public resources
but private data stays protected
67
IPS rules
usually integrated in NGFW
monitoring traffic in real time
can be signature or anomaly based
68
signature based ips rules
loaded onto the IPS
recognizes malicious software. must be a perfect match.
69
anomaly based IPS rules
build a baseline of what's normal
anything that deviates is flagged.
70
IPS Ruleset
list of vulns, and IPS should block/allow, send alert etc.
71
content filtering purposes
filter out certain types of data
inappropriate content
malicious software
parental controls
sensitive material
72
url scanning
allow/restrict based on URL or URI
integrated into an NGFW
73
agent based content filters
installed on user's device
74
proxy
sits between users and external network.
user makes request, proxy receives that and forwards that request on the user's behalf
useful for caching info, access control, URL filtering, content scanning
75
explicit proxy
application uses proxy for communication instead of directly to server
76
forward proxy
for user access to internet
77
Reputation
filter urls based on perceived risk
78
DNS filtering
content filtering w/o NGFW, proxy, or URL Filter
DNS lookup, malicious sites are blocked (IP address isn't sent back to user) based on real time threat intelligence commerical & public lists
79
OS Security
80
Active directory
database of everything on network (computers, user accounts, file shares, printers, groups)
centralized access control, manage authentication
81
group policy
security policies, diff permissions or configs, for each individual user/device
82
SELinux
security enhanced linux//
security patches for the linux kernel
linux automatically uses DAC (discretionary access control)
but SELinux uses MAC (mandatory access control) limits application access, least privilege.
83
use secure protocols: Telnet
SSH
Remote console
84
use secure protocols: HTTP (port 80)
HTTPS
port 443
Web browsing
85
use secure protocols: IMAP
IMAPS
email client access
86
use secure protocols: FTP
SFTP
file transfer
87
open access point
no transport-level encryption
88
Different ways of secure transport method
802.11 wireless - WPA3
VPN
89
mail gateway
evaluates source of inbound email messages. blocks at gateway before it reaches the user.
90
SPF
sender policy framework//
sender configures a list of all servers authorized to send emails for a domain
91
DKIM
domain keys identified mail//
mail server digitally signs all outgoing mail. validated by the receiving mail servers
92
DMARC**?
domain based message authentication reporting and conformance//
93
FIM
file integrity monitoring
94
what files should you monitor in FIM?
os and application files
95
SFC
system file checker//
on windows os (built-in)
will scan all critical os files, makes sure no modifications have been made, but if there are changes, will replace with a good version
96
Tripwire
tool for FIM on Linux
97
tools for FIM
windows: SFC
Linux: Tripwire
host based IPS - diff than network based; on os itself and can monitor all files.
98
DLP + types of DLP solutions
data loss prevention//
look for sensitive data across the network and block that traffic in real time. constantly monitoring the network or stored on the device.
1. endpoint
2. network
3. on server
4. cloud based
99
endpoint DLP
software DLP solution that's on the computer (aka endpoint)
monitors data in use (in memory of that device)
100
DLP on the network
protects data in motion
monitoring packets in real time. could be standalone appliance or integrated in NGFW
101
DLP on your sever
if monitor files on OS filesystem (aka data at rest). runs as software on the OS directly or server directly
102
Cloud based DLP
103
what does "edge" mean?
part of network where inside meets "outside" or internet part of network.
104
posture assessment
check devices if all security stuff is up to standards.
105
posture assessment process
when device first accesses the network or logs in network remotely
parameters to check:
- trusted device?
- security utilities -> anti-virus, running, updated with latest signatures
- corporate application? latest versions?
- encryption?
106
types of posture assessments (how it is deployed)
1. persistent agents - permanently installed on the device and can run anytime. must be updated.
2. dissolvable agent - no formal installation. executes during a login or connection process. once assmessment is done, it terminates itself
3. agentless NAC (network access control) - integrated with Active Directory. runs when you log in/log out of active directory database. can't be scheduled.
107
EDR
endpoint detection and response//
bahevioral analysis, ml, process monitoring.
lightweight agent on the endpoint
root cause analysis (how and why an event happened)
respond to threat automatically (isolate, quarantine, rollback)
108
XDR
extended detection and response//
improve missed detection, false positives, and long investigation times.
can correlate multiple data types from more than one system
109
user behavior analytics
xdr uses this
interprets user activity to build a baseline of normal activity
requires data analysis over an extended period of time
110
IAM
identity and access management //
111
steps of IAM process**:
1. provisioning
2.
112
provisioning/deprovisioning
creating user accounts/removal
113
goals of IAM
roles, permissions is just enough for the person's jobs
storage/files can be private to the user
no privileged access to the os
114
identity proofing
Resolution: verifies the user is who they say they are
Validation: gathering info from users (password, security questions)
Attestation: verification. additional details (passport, etc.)
115
Attestation**
116
SSO
single sign on
provide credentials one time and get access to all assigned resources.
117
LDAP
lightweight directory access protocol//
authentication protocol
for reading & writing directories over an IP network.
118
SAML
security assertion markup language//
open standard for authentication and authorization
authenticate user to a third party database
119
OAuth
authorization framework, NOT An authentication PROTOCOL
determines what resources a user will have access to.
120
Federation
network access without using a local authentication database.
between two organizations (ex. login with facebook)
third parties establishes the trust relationship
121
interoperability
everything must work together/be compatible.
122
Least privilege
permissions and rights exactly what they need to do their job. nothing more.
123
mac
mandatory access control//
each resource/object gets label (ex. confidential, top secret)
124
dac
discretionary access control//
owner decides who gets access, permissions etc.
125
rbac
role based access control//
based on the role in your org (manager, director, etc)
rights gained implicitly (through groups)
126
rule based access control
access determined through system-enforced rules.
127
abac**
attribute based access control//
considers many parameters
128
time of day restrictions
restrict access during certain times or days of the week.
129
mfa
prove who you are
130
factors
you know
you have
somewhere you are
something you are
131
something you know
passwords
PINs
pattern
132
something you have
smart card
USB security key
hardware/software tokens
phone (sms a code to your phone)
133
something you are
biometrics - finger, voice, retinal, etc
134
somewhere you are
only works if you are in a certain geographical location
ip address, mobile device location services
135
password best practices
-complexity and length
no words, no walks, mix upper and lower case, symbols, etc.
- password age and expiration. periodic reset
- no reuse, diff passwords for diff accounts
136
password manager
use different passwords for each account. keep all of them in a single database. this must be encrypted, mfs, extra protection
137
just-in-time permissions
grant admin access for a limited time.
138
password vaulting
primary credentials stored in a password vault. vault controls who gets access
139
automation benefits
- saves time
- minimal human error
- enforces baselines
- standard infrastructure configs
- automate boring tasks
- speed
- secure scaling
- employee retention
- reaction time - computer is faster than human
- workforce multiplier
140
automation use cases
user and resource provisioning
**guard rails - automated validations
security groups - add/remove from security groups, monitoring, etc.
ticket creation
escalation - correct issues before involving human
enabling/disabling services
continuous integration and testing -
integrations and application programming interfaces (API) -
141
automation considerations
complexity
cost
single point of failure
technical debt - covering up the real problem with more and more scripts
ongoing supportability
142
security incident lifecycle
preparation
detection
analysis
containment
eradication
recovery
lessons learned
143
NIST for incident response
sp 800-61
144
preparing for an incident
communication methods
hardware and software
(laptions, removable media, forensic software, camera etc)
resources (documentation, network diagrams, baselines, file hash values etc.)
mitigation software - clean OS, application images
relevant policies
145
detection phase: challenges
many sources, different levels of details
146
analysis phase?
147
methods for isolation and containment
sandboxes
148
issues with isolation
malware detects its in a sandbox and behaves differently
149
recovery phase
replace the bad software with known good software
150
eradicating bug methods
- remove malware
- disable breached user accounts
- fix vulnerabilities
151
recovering system methods
- restore from known good backups
- rebuild from scratch
- harden so attackers can't get back in
152
lessons learned phase
learn and improve
post-incident meeting
how to resolve issue more efficiently next time
have a better plan for the next incident
153
what things should be discussed in a post-incident meeting
- timeline of events
- how effective the plan worked?
- what would work differently.
- update incident response plan
- any warnings? how to improve monitoring
154
IR Training
- BEFORE an incident occurs
- documentation, testing, training, of IR plan
- IR team needs to know investigation plan, IR reporting, etc.
155
types of IR testing
- simulations
- tabletop
156
important parts of conducting an IR test
specific rules of engagement (roles, responsibilities, what systems, etc)
specific scenario, limited time to run the event
evaluate the response, document everything
157
Tabletop Exercise
sitting at table, logistically going through procedure and policies in the certain scenario
158
Simulation
a real simulated event
ex. phishing
159
root cause analysis
determine the ultimate cause of the incident.
160
threat hunting
proactive hunt to find vulnerabilities and mitigate before attacker finds it and exploits it
161
digital forensics
collect and protect info relating to an intrusion in relation to legal proceedings
162
legal hold
legal technique to preserve relevant info
prepare for impeding litigation, initiated by legal counsel
163
chain of custody
data must remain in its unmodified form for the duration of the analysis.
process to ensure the integrity of the data, but since many people need to access this data during the investigation, a chain of custody is used to determine who accesses the data.
how? hashes and digital signatures
164
forensics: acquisition of data
obtain the data -- thru the disk, RAM, firmware, OS files...etc
165
forensics: reporting of data
document findings, how data was found/acquired, and how its stored
166
forensics: Preservation
protecting data is first priority.
analyze without alterations. work from copies.
167
e-discovery
collect, prepare, review, interpret, and produce electronic documents.
acquiring data (not analysis)
works in conjunction with forensics
168
different log data sources
firewall
application
endpoint
os-specific security
IPS/IDS
metadata
network
169
security log files
could show...
- blocked/allowed traffic
- exploit attempts
- blocked URL categories
- DNS sinkhole traffic
170
firewall logs
traffic flows through a firewall
contains info including:
- source, destination IP addresses
- port numbers
- disposition (allowed or blocked)
- if NGFW is being used --> reveals what applications are being used, URL filtering categories, anomalies and suspicious data
171
where to find application logs
windows - event viewer
Linux - /var/log
172
endpoint logs
data on the endpoint (device)
ex.
- logon events
- policy changes
- system events or processes
- account management
- directory services
173
IPS/IDS logs
info about predefined vulnerabilities
known OS vulns, generic security events
data points such as timestamps, type of class of attack, source and destination IP, source and destination ports
174
network logs
(switches, routers, access points, VPN concentrators)
find any network changes: routing updates, authentication issues, network security issues
175
metadata
data that describes other data sources
ex. email: header details, sending servers, destination address; phone: type of phone, GPS location; Web: OS, browser type, IP; Files: name, address, phone number, title
176
Data Sources
vulnerability scans
automated reports
dashboards
packet captures
Sec+ 701
flashcards
Decks in class (6)
# Cards
