exam Flashcards
(140 cards)
The MITRE ATT&CK frameworks contain domain-adapted knowledge of attacker
tactics and techniques e.g. for enterprise systems or industrial control systems. Its
main use is to place detected adversary activity within a framework, which allows
the identification of likely related activities and indicators of compromise.
Can such a framework also be utilised to synthesise attack patterns such as for use in
training exercises? Give a reasoned answer why this may or may not be
appropriate. [25]
negative: the matrices are restrained in how the attack is constructed and its hard to discern the intent of the attacker. (which is critical for apt style attacks)
In assessing the criticality of a given node in a network, a number of centrality
metrics can be used. Two examples of such metrics are vertex degree centrality (i.e.
counting the number of directly adjacent nodes to a given node) and betweenness
centrality (i.e. ranking vertices by the number of shortest paths between other
vertices in the graph that contain the given node).
Assume that we know that a given network is characterised by a power law degree
distribution. Which metric would be the preferred metric to determine the criticality
(e.g. overall loss of connectivity in case of failure or attack) of a node? Include both
the accuracy of the metric and the computational cost in your considerations and
give a reasoned answer. [25]
> In this case, both are similar
in a power law distribution, paths between non adjacent vertices will need to traverse higher degree vertices
we choose degree centrality because counting adjacent nodes is less costly than calculating several shortest paths per vertices.
The Input-Output Inoperability model proposed by Haimes and Jiang allows the
study of interconnected systems to determine the degree to which a particular
component or sector is affected (i.e. its level of dysfunction, such as the fraction of
intended production or service level).
For this, the model requires the availability of an interdependency matrix capturing
how each component (sector) depends on all others.
Identify and briefly describe two examples of limitations of the IIM for capturing the
impact of an attack. [25]
Issue 1:
IIM only captures a linear combination of inputs.
this is appropriate for absolutes like physical items but can be limiting for services with nonlinear dependsencies
Issue 2:
IIMs only consider settles, steady dependencies. They do not capture the immediate effects of disruption or any attempts and successes at substitution
Consider a company for which Internet connectivity, particularly to globally
distributed partners and suppliers is essential.
Explain why in this case the selection of multiple, redundant Internet Service
Providers (ISP) for connectivity is critical, and which metrics and questions the
company should approach each ISP with in order to ascertain that a given
combination of providers offers adequate levels of resilience and redundancy. [25]
The main problem is the AS connectivity of the provides via BGP.
just having several neighbours is not enough: we need to know that the paths of different providers are vertex disjoint and that there are several paths, so that if a vertex or segment goes down, we still have paths.
describe a power law distribution
> most vertices have a small degree
the number of nodes with a high degree decreases exponentially, they don’t follow a normal distribution
these high degree nodes are called HUBS
also known as scale free
What is BGP?
Border Gateway Protocol
> used for routing in the internet
> every network needs a unique AS (Autonomous System) number
> every AS is connected to 2+ other ASs
describe AS connection
each AS has several border gateways
each border gateway is a router that connects to a specific border gateway in another AS
A well-resourced adversary wishes to both discredit the product quality of a
vaccine manufacturer and to steal trade secrets from the R&D system at the
same time.
Assume that the relevant R&D data is held on a separate network not
connected to the Internet. How can the adversary learn about the
location of the data and successfully exfiltrate these if only a remote cyber
attack is possible?
Give a description of possible steps taken by the adversary beginning with
intelligence gathering; do not merely reproduce a generic framework, but
address how such an air-gapped system can still be compromised
> they don’t want to disrupt the network, just retrieve information from it
the network is air gapped but still has several vulnerabilities.
Seeing as we just want info, gaining access to a company computer that has the ability to request info from the database is enough to retrieve whatever we need.
if we know what information we want precisely and just need proof to discredit the company, the attack could be as simple as sending a phishing email to an employee and convincing them to send the information, or using the email to gain access to their system to see the information
there are some constant vulnerabilities no matter how protected a network is, like external connections and the people with access
To discredit the product quality, the attacker identified
seeks to disrupt production processes in such a way that quality control
processes will detect anomalies.
The attacker could not penetrate into the production system, but has
successfully compromised systems on the business network also used to
prepare shipments of the vaccine to an independent testing laboratory.
Can a manipulation of systems and databases call the product quality
into question? Briefly identify a scenario and elaborate how the adversary
would achieve a violation of quality requirements.
The vaccine process is likely automated, from the production of vaccines, to the regulation and the testing. If the data at any one of these stages is accessed and changed, it calls the quality into question and can discredit the effectiveness of the whole batch of vaccines.
Which insights can the target of a persistent attacker obtain by setting up a second, air-gapped
system without the actual production facilities? Which additional measures
would be required for such a decoy to be effective?
> it would have to be unknown to employees as a decoy
its data would need to formatted the same as the actual data
everything should be the same except its actual contents
it should be audited to know who has attempted access
define a network
a collection of nodes and connections
what is a diagram with edges on one axis and vertices on the other called?
incidence matrix
What is Isomorphism?
G1 and G2 are isomorphic if there exists a 1-1 mapping V1 -> V2
define a walk
a sequence between nodes going through vi, vi+1, vi+2 …
define a trail
a walk with distinct edges
define a path
a walk with distinct vertices
what is w(G)
the number of components in G
what is a component?
a subgraph such that it is not a subgraph of anything but the graph
when is V* a vertex cut?
if w(G - V*) > w(G)
when is E* an edge cut?
if w(G - E*) > w(G)
what is k(G)?
the size of a minimal vertex cut. G is k connected
what is lambda(G)?
a minimal edge cut
What are the preliminaries of Menger’s Theorem?
a graph G where u and v aren’t adjacent
what is menger’s theorem?
the minimum number of vertices in a vertex cut that disconnects u and v = the max number of pairwise vertex-independent paths between u and v. (same for edges)
