1.0 General Security Concepts

Question 1

What do technical controls entail?

Answer 1

File storage policies, Block instead of patch, backup recovery, system logs, splash screen (login page), firewall

Question 2

What do Managerial controls entail?

Answer 2

People policies like on-boarding, threat of demotion, Login reports, reporting issues, seperation of duties, compliance politices

Question 2

What do Operational controls entail?

Answer 2

Awareness programs for IT security, using people to set controls, guard shack, security policy training, require multiple security staff, contact authorities, property patrols, reception desk, guard shack

PEOPLE

Question 3

What do Physical controls entail?

Answer 3

Locks, warning signs, Fire extinguishers, power generators authorized personel signs, badge readers

PHYSICAL THINGS

Question 4

What is the CIA traid?

Answer 4

Availability, Integrity, Confidentiality

Question 5

What does non-repudiation mean?

Answer 5

Way to prove that the person who sent a piece of data says who they are

Question 6

What is proof of integrity and how to validate this?

Answer 6

Prove that the data is the same from when its sent. No tampering involved.

• Hashing algoirhtms

Question 7

What is proof of origin and how to validate this?

Answer 7

Proof that the person who sent it is actually them

• Private public keys
• Certificates

Question 8

What is a CA? and what does it do?

Answer 8

CA is a certificate authority that give sout certificates. They do the signing

Question 9

How is a CA verified?

Answer 9

By a root CA that allows these CAs to create tickets

Question 10

Best model for allowing multiple people to access certain files/data?

Answer 10

Role based access

Question 11

What is Gap Analysis?

Answer 11

Comparing where you are now to where you want to be

Question 12

What are the two planes for zero trust?

Answer 12

Data Plane and Control Plane

Question 13

How does data plane differ from control plane?

Answer 13

Data plane is the one actually moving the data while the control plane focuses on rules/policies for how that data is transferred

Question 14

What are two frameworks for gap analysis and what is the goal of frameworks here?

Answer 14

ISO/IEC 27001 and NIST special publication 800-171 revision

Goal is to establish a baseline of where your company is at for different levels of security, CIA traid etc…

Question 15

How does ISO/IEC 270001 and NIST differ?

Answer 15

ISO/IEC 270001 focuses on information security management systems while NIST special publication 800-171 revision focus on protecting controlled unclassified information in nonfederal systems and organization

Question 16

What are Honeypots, honeynets, honey files, honey tokens

Answer 16

Honeypots - Delicious files or data for attackers
Honeynets - Bunch of honeypots that look like an actual system or as real as we can get
Honeyfiles - files that contain fake information
Honeytokens - ways to track this piece of data if a hacker gets it

Question 17

In change management such as patching or updating, what are some key ideas to think about before updating?

Answer 17

Only the owner can update and must make sure everything/everyone is on the same page and working
- Have a backout plan
- Maybe first test in a sandbox
- make sure a approval for all changes is given prior

Question 18

In technical change management, what are some key ideas here?

Answer 18

Allow and deny lists
- Downtime annoucement
- Restart annoucement
- Legacy Applications
- Dependices - what depends on what if you do update
- Documentation of policies

Question 19

What is symmetric encryption and what is it good for?

Answer 19

A single shared key, you decrypt and encrypt with it.

Good for small limited uses

Question 20

What is asymmetric encryption and what is it good for?

Answer 20

A public-private key system where the public key is seen by everyone while the private key is only available for one person.

Encrypt with public keys but only the private key can decrypt it

Question 21

Key escrow

Answer 21

Someone else holds your decryption keys, third trusted parties

Question 22

If you wanted to transport data through the internet safely, what would you use?

Answer 22

HTTPS, VPN

Question 23

What do client based VPNs use?

Answer 23

SSL/TLS

Question 24

What do site to site VPN use?

Answer 24

IPsec a suite of protocols that provides security for IP network communications by authenticating and encrypting data packets, commonly used in VPNs to create secure, encrypted tunnels for data transmission.

Question 25

Which encryption algo is best, AES or DES?

Answer 25

AES Because its more secure, more widly accepted in modern systems, and faster/stronger

Question 26

What is key stretching?

Answer 26

Hashing multiple times, hashing the hash Makes it harader to brute force

Question 27

What are the two types of key exchange?

Answer 27

Out of band and in band key exchange Basically in person or over the internet

Question 28

If we do in band what would we need to add to ensure safety?

Answer 28

Protect key with additional encyprtion like a short timed encrypt decrypt key pair Temp public private key

Question 29

What is a symmetric key?

Answer 29

A symmetric key is a single key used for both encryption and decryption in cryptography. Both the sender and receiver must share this same secret key. Example: AES (Advanced Encryption Standard) is a symmetric key algorithm.

Question 30

What are some encryption technologies in our computers?

Answer 30

Trusted Platform Module (TPM) and Hardware Security Module (HSM)

Question 31

What is the difference between TPM and HSM?

Answer 31

TPM (trusted platform module) is usually a little piece of hardware attached to your computer's hardware that stores keys and protects the device incase stolen HSM (Hardware security module) is used for more large scale cryptographic keys, has redundant power, keybackup and secure storage

Question 32

What is Obfuscation?

Answer 32

Opposite of abstraction, making things harder

Question 33

What is steganography?

Answer 33

Hide information in an image

Question 34

What is Data Obfuscation?

Answer 34

Making data harder to decypher - Like adding **** to a credit card

Question 35

What are tokenization for security?

Answer 35

replace sensitive data with a token - used in credit card transactions (tokens the transfer of that transaction then decyphers it once delivered)

Question 36

What is a Raindbow Table and how does it relate to salting?

Answer 36

Rainbow table is how to unhash all passwords, you salt each password hash so that the password is different compared to what is on the rainbow table

Question 37

What is the standard format for certs?

Answer 37

X.509

Question 38

What does a cert contain?

Answer 38

A lot of data about itself like signature algo used, the issuer, extensions and more

Question 39

What is a root of trust?

Answer 39

The piece of hardware/software that we can 100% trust on to be correct that then can allow other hardware/software to be trusted

Question 40

What are wildcard certs?

Answer 40

Certs that cover a wide range of domains Usually shown by *.example.com Will cover domains with example.com at the end

Question 41

What is key/cert revocation and why can it be a problem?

Answer 41

List of certs/keys that are no longer good Can be a problem because the list/file that contains all of these revoked lists are HUGE

Question 42

How to get around the issue of huge revocation lists?

Answer 42

OCSP stapling Basically, when you send a file/data you attach the OCSP staple that says "hey, this is already validated"

Question 43

What is created when you want to create a cert?

Answer 43

a CSR (certificate signing request) The CA will sign and give it back