2.1 - Logical Security

Question 1

Least privilege

Answer 1

• Rights and permissions should be set to the bare
  minimum
  – You only get exactly what’s needed to
  complete your objective
• All user accounts must be limited
  – Applications should run with minimal privileges
• Don’t allow users to run with administrative privileges
  – Limits the scope of malicious behavior

Question 2

Access Control Lists (ACLs)

Answer 2

• Used to allow or deny traffic
  – Also used for NAT, QoS, etc.
  – Commonly used on the ingress or egress of
  a router interface
• ACLs evaluate on certain criteria
  – Source IP, Destination IP,
  – TCP port numbers, UDP port numbers, ICMP
• Deny or permit
  – What happens when an ACL matches the traffic?
• Also used in operating systems
  – Allow or deny access to the filesystem

Question 3

Multi-factor authentication

Answer 3

• More than one factor
  – Something you are, something you have,
  something you know, somewhere you are,
  something you do
• Can be expensive
  – Separate hardware tokens

Question 4

Software tokens

Answer 4

• Authenticator application
  – Pseudo-random number generator
  – Can’t guess it
  – Changes constantly
• Saves money
  – Free smartphone applications
  – No separate device to lose

Question 5

Short message service (SMS)

Answer 5

• Text messaging
  – Includes more than text these days
• Login factor can be sent via SMS to a
  predefined phone number
  – Provide username and password
  – Phone receives an SMS
  – Input the SMS code into the login form
• Security issues exist
  – Phone number can be reassigned to
  a different phone
  – SMS messages can be intercepted
  – SMS spoofing

Question 6

Voice call

Answer 6

• A phone call provides the token
  – The computer is talking to you
  – “Your code is 1-6-2-5-1-7.”
• Similar disadvantages to SMS
  – Phone call can be intercepted or forwarded
  – Phone number can be added to another phone

Question 7

Email filtering

Answer 7

• Unsolicited email
  – Stop it at the gateway before it reaches the user
  – On-site or cloud-based
• Scan and block malicious software
  – Executables, known vulnerabilities
  – Phishing attempts
  – Other unwanted content