3.2 - Given a scenario, implement host or application security solutions. Flashcards
(42 cards)
Antivirus
– Refers specifically to a type of malware
– Trojans, worms, macro viruses
– Anti-virus software is also anti-malware software now
Anti-malware
– Anti-malware stops spyware, ransomware,
fileless malware
EDR
-Endpoint detection and response
A different method of threat protection
– Scale to meet the increasing number of threats
Detect a threat
– Signatures aren’t the only detection tool
– Behavioral analysis, machine learning,
process monitoring
– Lightweight agent on the endpoint
Investigate the threat
– Root cause analysis
Respond to the threat
– Isolate the system, quarantine the threat, rollback
to a previous config
– API driven, no user or technician intervention required
DLP
Stop the data before the attacker gets it
– Data “leakage”
So many sources, so many destinations
– Often requires multiple solutions
– Endpoint clients
– Cloud-based systems
– Email, cloud storage, collaboration tools
NGFW
-Next-generation firewall
The OSI Application Layer - All data in every packet
Can be called different names
– Application layer gateway
– Stateful multilayer inspection, deep packet inspection
Broad security controls
– Allow or disallow application features
– Identify attacks and malware
– Examine encrypted data
– Prevent access to URLs or URL categories
HIPS
-Host-based intrusion prevention system
– Recognize and block known attacks
– Secure OS and application configs, validate
incoming service requests
– Often built into endpoint protection software
HIPS identification
– Signatures, heuristics, behavioral
– Buffer overflows, registry updates, writing files to the Windows folder
– Access to non-encrypted data
HIDS
- Host-based intrusion detection
system
-Uses log files to identify intrusions
-Can reconfigure firewalls to block
Host-based firewall
Software-based firewall
– Personal firewall, runs on every endpoint
Allow or disallow incoming or outgoing
application traffic
– Control by application process
– View all data
Identify and block unknown processes
– Stop malware before it can start
Manage centrally
Gibson 88
-monitors traffic going in/out of single host (server/workstation/etc)
-monitors traffic passing thru NIC + can prevent intrusion into comp via the NIC
-allow u to configure rules to allow/restrict inbound + outbound traffic
-many orgs use personal firewalls along with network firewalls (important to use personal firewalls when accessing internet in public place)
Boot integrity
*
The attack on our systems is constant
– Techniques are constantly changing
*
Attackers compromise a device
– And want it to stay compromised
*
The boot process is a perfect infection point
– Rootkits run in kernel mode
– Have the same rights as the operating system
*
Protecting the boot process is important
– Secure boot, trusted boot, and measured boot
– A chain of trust
Boot security/Unified Extensible Firmware Interface (UEFI)
*
Secure Boot
– Part of the UEFI specification
*
UEFI BIOS protections
– BIOS includes the manufacturer’s public key
– Digital signature is checked during a BIOS update
– BIOS prevents unauthorized writes to the flash
*
Secure Boot verifies the bootloader
– Checks the bootloader’s digital signature
– Bootloader must be signed with a trusted certificate
– Or a manually approved digital signature
Measured boot
-nothing on computer has changed
UEFI stores a hash of the firmware, boot drivers, and
everything else loaded during the Secure Boot and
– Trusted Boot process
– Stored in the TPM
Remote attestation
– Device provides an operational report to a
verification server
– Encrypted and digitally signed with the TPM
*
Attestation server receives the boot report
– Changes are identified and managed
Boot attestation
Remote attestation
– Device provides an operational report to a
verification server
– Encrypted and digitally signed with the TPM
Attestation server receives the boot report
– Changes are identified and managed
Database
Protecting stored data + transmission of that data
Intellectual property storage
Compliance issues
– PCI DSS, HIPAA, GDPR, etc.
Keep business running
– sec provides continuity
Breaches r expensive - Keep costs low
Tokenization
Replace sensitive data wth a non-sensitive placeholder
– SSN 266-12-1112 is now 691-61-8539
Common wth credit card processing
– Use a temp token during payment
– perp capturing the card #s can’t use them later
ISN’T encryption OR hashing
– The OG data + token aren’t mathematically related
– No encryption overhead
Salting
Salt = Random data added to a password when hashing
Every usr gets their own random salt
->salt is commonly stored wth the pswd
Rainbow tables won’t work with salted hashes
->Additional random value added to OG pswd
Slows things down the brute force process
->doesn’t completely stop reverse engineering
Hashing
Hashes represent data as fixed-length string of text
Won’t have a collision (hopefully)
– diff inputs won’t have same hash
One-way trip
– Impossible to recover the OG message from the digest
– common way to store pswds
Application security
Input validations
What is the expected input?
->Validate actual vs. expected
Document all input methods
->Forms, fields, type
Check and correct all input (normalization)
-> EX: zip code should be only X characters long
with a letter in the X column
->Fix any data with improper input
-The fuzzers will find what you missed
Secure cookies
Cookies = info stored on ur comp by the browser
-Used 4;
->tracking
->personalization
->session mgmt
-Not executable, generally not a sec risk UNLESS someone gets access to them
-sec cookies have a sec attribute set
->Browser will only send it over HTTPS
-Sensitive info shouldn’t be saved in a cookie
->This isn’t designed to be secure storage
Hypertext Transfer
Protocol (HTTP) headers
*
An additional layer of security
*
Add these to the web server configuration
*
You can’t fix every bad application
*
Enforce HTTPS communication
*
Ensure encrypted communication
*
Only allow scripts, stylesheets, or images from
the local site
*
Prevent XSS attacks
*
Prevent data from loading into an inline frame
(iframe)
*
Also helps to prevent XSS attacks
Code signing
-app deployed, usrs run app executable or scripts
->need to confirm that app was written by a specific developer
-app code can be digitally signed by the dev
->Asymmetric encryption
->A trusted CA signs the devs public key
->Dev signs code with their priv key
->4 internal apps, use your own CA
Allow list
Nothing runs unless it’s approved - Very restrictive
Block list/deny list
Nothing on the “bad list” can be executed
Anti-virus, anti-malware
Secure coding practices
