What are ways to class security controls?
Physical Controls: Applied in the built environment to control access to the sites. Ex. Fences doors, locks
Procedural Controls: Applied and enforced by people. Ex. Incident response process, management oversight, security awareness training.
Logical: Applied and enforced by digital or cyber systems and software. Ex. user authentication, antivirus software, and firewalls.
What is the goal of cybersecurity systems?
The CIA triad
Confidentiality: Ensures sensitive data is only accessible by authorized users.
Integrity: Ensures data is accurate and trustworthy.
Accessibility: Resources are readily available for users to access when they need to.
What’s a framework that can be used to meet the goals of the CIA triad?
IAM (Identity and Access Management).
What are core components of IAM?
Identification: identifying and defining users, devices, and applications withing the system.
Authentication: Identifies users attempting to access resources. Can be done with- passwords, biometrics, MFA.
Authorization: Determines what resources ad actions a user is allowed to access based on their role, responsibilities and permissions.
Access Control: Enforces authorization policies and restricts access to resources based on predefined rules.
What is a ACL?
Access Control List.
A collection of ACE (access control entries) that determines which subjects are allowed or denied access to the object and the privileges they are given (like read only, read write, etc.)
What is ACE?
Access Control Entry.
What is the principal of least privilege?
Means a users should be given the minimum possible access necessary to perform a job.
What is Implicit Deny?
Unless there is a rule specifying that access should be granted, and request for access is denied.
ACL security is typically founded on this principal.
What is a Vulnerability?
A weakness that can be accidentally or purposely exploited to cause a security breach.
What is a Risk?
The likelihood and impact/consequence of a threat actor exploiting a vulnerability.
Vulnerability + Threat = Risk
What is a Threat?
The potential for someone or something to exploit a vulnerability and breach security.
Can be intentional or unintentional.
What are the 3 principal types of cryptographic technology?
Symmetric Encryption
Asymmetric Encryption
Cryptographic Hashing:
What is Symmetric Encryption?
Uses a single secret key to both encrypt and decrypt data.
If the key is stolen or lost that is a security breach.
Speedy.
What is Asymmetric Encryption?
Uses a key pair- a private and and public key that are mathematically linked.
Only one key can perform encryption or decryption on a given message.
Private key must be kept a secret, the public key can be widely and safely distributed.
Message cannot be larger than the key size.
What is Cryptographic Hashing?
A hash takes any amount of data as input and produced a fixed length hash.
cryptographic hash performs this process as a one-way function that makes it impossible to recover the original value from the hash.
used for secure storage of data where the original meaning does not have to be recovered (Ex. Passwords)
What are commonly used cryptographic hash algorithms?
Secure Hash Algorithm (SHA) family of algorithms. SHA-256 and SHA-3 are the most used version of the SHA algorithms.
What is a digital signature and how does it work?
Proves a message or digital certificate has not been altered or spoofed.
A cryptographic hash is used to ensure integrity of the certificate.
What is the purpose of a key exhange?
To allow 2 hosts to know the same symmetric encryption key without any other host finding out what it is.
Asymmetric encryption is used to exchange symmetric cipher keys.
What accounts can a user be setup with in Windows?
A local and a Microsoft account.
What is the difference between a local and a Microsoft account?
A local account is defined on that computer only.
Local user accounts are stored in a database called SAM (Security Account Manager), which is part of the HKEY_LOCAL_MACHINE registry.
Cannot be used to log onto a different computer or access files over the network.
A Microsoft account is manages via a online portal and is identified by an email address.
Can be synchronized between devices via the online portal.
What is a security group and its purpose?
A collection of user accounts.
Used to assign permissions and rights to groups (more efficient than doing it individually).
What are the built in groups and the standard set of rights they have?
Administrator Group: Can perform all management tasks and generally has very high access to all files and other object in the system.
Users Group: The standard account generally only able to configure settings for its profile. Can also shutdown computer, run desktop apps, install and run store apps, and use printers.
Guest group: a group only present for legacy reasons, same default permissions and rights as users/standard.
Power User Group: Meant to have intermediate permissions between administrators and users.
Caused vulnerabilities so now only present to support legacy apps. Same permissions as Standard.
What does the local users and groups management console do?
Manages both user and group accounts.
Can- create, disable and delete accounts, change account properties, reset user passwords, create custom groups, and modify group membership.
What is JIT access?
Just-in-time access.
A security practice where users are granted access to resources only when needed and for only as long as it takes to complete the task.
-
Management Consoles2
-
Remote Desktop Tools4
-
Support Procedures24
-
Different OS File Systems14
-
Config windows45
-
Managing Windows28
-
Command Line tools22
-
Windows Networking7
-
Troubleshoot Windows Networking9
-
Remote Desktop Technologies20
-
Performance and Troubleshooting Tools30
-
Troubleshoot Windows OS Problems26
-
Securing Windows68
-
Installing OS26
-
Other OS47
-
Mac OS19
-
Attacks Threats and Vulnerabilities24
-
Wireless Security9
-
SOHO router info8
