INFO310FINAL Flashcards
(144 cards)
1
Q
Goal of Cybersecurity
A
Protection of Assets, Prevention Detection, and Recovery
2
Q
CIA
A
confidentiality, Integrity, Availability.
3
Q
Confidentiality (CIA)
A
the concealment of information or resources
4
Q
Integrity (CIA)
A
the trustworthiness of data or resources
5
Q
Availability (CIA)
A
Availability: the ability to use information or resources
6
Q
Categories of Threats
A
Deception, Disruption, Disclosure, Usurpation
7
Q
Deception (Category of threat)
A
The acceptance of false data
8
Q
Disruption (Category of threat)
A
the interruption or prevention of correct operation
9
Q
Disclosure (Category of threat)
A
The unauthorized access to information
10
Q
Usurpation (Category of threat)
A
the unauthorized control of some part of a system
11
Q
Snooping or eavesdropping (Type of threat)
A
the unauthorized interception of information, is a form of disclosure
12
Q
Modification or alteration (Type of threat)
A
an unauthorized change of information is a form of usurpation, deception, and disclosure.
13
Q
Masquerading or spoofing (Type of threat)
A
an impersonation of one entity by another, is a form of both deception and usurpation.
14
Q
Repudiation of origin
A
a false denial that an entity sent (or created) something, is a form of deception.
15
Q
Denial of receipt
A
a false denial that an entity received some information or mes- sage, is a form of deception
16
Q
Delay
A
a temporary inhibition of a service, is a form of usurpation, al- though it can play a supporting role in deception.
17
Q
Denial of service
A
a long-term inhibition of service, is a form of usurpation often also used as a mechanism of deception.
18
Q
The Core of Cybersecurity
A
Asset, Threat, Vulnerability, Risk
19
Q
Asset
A
People, property, and information of value
20
Q
Threat
A
Anything that can exploit a vulnerability, intentionally or acciden- tally, and obtain, damage, or destroy an asset.
21
Q
Vulnerability
A
Weaknesses or gaps in a security program that can be exploited by threats to gain unauthorized access to an asset.
22
Q
Risk
A
The potential for loss, damage or destruction of an asset as a result of a threat exploiting a vulnerability.
23
Q
Formula for calculating risk
A
Asset + Threat + Vulnerability = Risk.
24
Q
Polyalphabetic Ciphers
A
Any cipher based on substitution, using multiple substitution alphabets.
25
Scytale Encryption
message wrapped around a rod of a certain size then can be read.
26
Transposition Ciphers
A method of encryption by which the positions held by units of plaintext [...] are shifted according to a regular system, so that the ciphertext constitutes a permutation of the plaintext.
27
Frequency Analysis
The study of the frequency of letters or groups of letters in a ciphertext. The method is used as an aid to breaking classical ciphers.
28
Social Engineering
s the art or better yet, science, of skillfully maneuvering human beings to take action in some aspect of their lives.
29
Phishing (SE)
The practice of sending emails appearing to be from reputable sources with the goal of influencing or gaining personal information.
30
Vishing (SE)
The practice of eliciting information or attempting to influence action via the telephone, may include such tools as phone spoofing.
31
Impersonation (SE)
The practice of pretexting as another person with the goal of obtaining information or access to a person, company, or computer system
32
Properties of encryption
· Ensures Authentication · Ensures Non-Repudiation · Ensures Confidentiality · Ensures Integrity
33
Secret Key Cryptography (SKC) (AKA Symmetric Encryption)
Uses a single key for both encryption and decryption
34
Public Key Cryptography (PKC) (AKA Asymmetric Encryption)
Uses one key for encryption and another for decryption
35
Hash Functions (AKA Checksum)
Uses a mathematical transformation to create a digital fingerprint or message digest
36
The Layers of the Internet Protocol Model
Physical, Link, Network, Transport, and Application
37
Physical layer IPM
Wire, open air, optic fibers
38
Link layer IPM
Ethernet, Wifi, 4G
39
Network layer IPM
Internet protocol, inter control ICMP (nter Control Messaging Protocol)
40
Transport Layer (IPM)
Transmission Control Protocol (TCP) User Datagram Protocol (UDP)
41
Application Layer IPM
Email > Simple Mail Transfer Protocol (SMTP) - Websites>HyperText Transfer Protocol (HTTP) -File Sharing>File Transfer Protocol (FTP)>Server Message Block (smb)
42
Public IP
public domain on the internet. Created by Internet Service Providers (ISP) to connect to other ISPs around the world. Creates the internet.
43
Private IP
private to a Local Area Network (LAN). Private IPs are assigned in a LAN by the Dynamic Host Configuration Protocol (DHCP).
44
Internet Protocol (IP) Address
it is a unique identifier. An IP address has two components: the network address and the host address. A subnet mask then sep- arates the IP address into network and host addresses.
45
Authentication
the process of verifying that an individual, entity or website is who it claims to be. Authentication in the context of web applications is commonly performed by submitting a username or ID and one or more items of private information that only a given user should know
46
Credential
An attestation of identity, qualification, competence, or authority issued to an individual by a third party
47
Web Session
sequence of network HTTP request and response transactions associated to the same user. [...] sessions provide the ability to establish variables - such as access rights and localization settings - which will apply to each and every interaction a user has with the web application for the duration of the session.
48
Client side code
is almost exclusively in Javascript (JS) runs with an interpreter. Makes web pages come alive. Credential information is stored and sent from the client
49
Server Side
Server side services listen for a request and then respond to that request part of the N-tier application design
50
N-Tier Application
Presentation, logic, data
51
Presentation tier
Translates data in to something the user can understand
52
Logic Tier
Coordinates the application, processes commands makes logical decisions and evaluations and performs calculations. Provides communication between the presentation and data tier
53
Data Tier
Information is stored and retrieved from a database, datastore or filesystem. Provides information back to the logic tier
54
Hub
does nothing except provide a pathway for the electrical signals to travel along
55
Switch
are the connectivity points of an Ethernet network that forward data only to the port that connects to the destination device. It does this by learning the MAC address of the devices attached to it, and then by matching the destination MAC address in the data it receives.
56
Router
ill normally create, add, or divide on the Network Layer as they are normally IP-based devices.Receives a packet of data, it reads the header of the packet to define the destination address
57
Wireless Access Point
use the wireless infrastructure network mode to provide a connection point between WLANs and a wired Ethernet LAN.
58
Virtual Private Network (VPN)
Encrypted Connection over the internet from a device to a network
59
Firewall
A networking device, either hardware or software based, that controls access to your organization's network.
60
Software Firewalls
Use network operating systems such as Linux/Unix, Windows Servers and Mac OS Servers
61
Hardware Firewalls
Dedicated network device Many routers and WAPs have firewall functionality built in
62
Subnet Mask
a 32-bit number that masks an IP address, and divides the IP address into network address and host address. network bits to all "1"s and setting host bits to all "0"s
63
Classless inter-domain routing (CIDR)
is a set of Internet protocol (IP) standards that is used to create unique identifiers for networks and individual devices.
64
CVE - Common Vulnerabilities and Exposures
A dictionary of CVE attempting to standardize across the industry
65
Goals of Vulnerability Management Program (4)
Maintain accurate inventory of assets Define and set stan- dards>Maintain awareness and detect new vulnerabilities>Reme- diate or mitigate identified vulnerabilities >Continuously monitor IT environment
66
Remediation
Apply Patches -Update configurations -Deactivate unnecessary services and channels
67
Mitigation
Compensating Network Controls - Procedural or Physical Controls
68
Script Kiddies
tend to lack motivation and rely on script created by more ad- vanced hackers. They utilize easy to use software to do things such as port scanning. Blue hats are "vindictive script kiddies".
69
Green Hat
newbie hackers. Unlike script kiddies, green hat hackers have the drive to become a more advanced hacker
70
Black Hat
malicious hacker who hacks for personal gain, typically financial
71
White Hat/Ethical Hackers
Use their skills in order to help individuals, businesses and gov- ernment.
72
Grey Hat
: shifts between ethical and non-ethical hacking practices
73
Hacktivists:
Digital vigilantes working to right a perceived wrong in the world
74
Nation State Hackers (AKA APT)
government employees who attempt to acquire classified informa- tion about other governments
75
Malicious Insider
: a disgruntled employee or corporate spy
76
Microsoft secure development lifecycle 12 parts
1) Provide training 2)Define security requirements 3)Define met- rics and compliance reporting 4) Perform threat modeling 5) Establish design requirementsà6) Define and use cryptography standards 7)Manage the security risk of using 3rd party compo- nentsà8) Use approved tools 9) Perform SAST 10) Perform DAST 11)Perform penetration testing 12) Establish a standard incident response process
77
permission Read (r)
Having read permissions grants the right to read the contents of the file and read the permissions of a directory.
78
Permission write(w)
Implies the ability to change the contents of a file. Or create new files in a directory
79
Permission Execute (x)
the right to execute the files if they are programs. Regarding directories, it allows you to enter any directories and access files
80
Privilege escalation
exploiting a bug or design flaw to gain elevated access to re- sources that are normally protected from a user or application
81
Vertical privilege escalation
o a lower level privilege user accesses functions or content revised for higher privilege users or applications
82
Horizontal privilege escalation
o a normal user accesses functions or content reserved for other normal users
83
Role Based Access Controls
Type of permissions that only allow a person to have the permis- sions necessary to complete their role. For example, an employ will only be given permissions needed to complete their job. Pre- vents lower level employees from accessing additional information that is not relevant to them
84
Threat Modeling
a process by which potential threats, such as structural vulnera- bilities or the absence of appropriate safeguards, can be identi- fied, enumerated, and mitigations can be prioritized. This is about finding problems should be done early in the development.
85
Asset based approach (TM)
lists all of the assets and considers how attacker could threaten them
86
Modeling Attacker
Talking about human threat agents can make the threat seem real
87
Software model
models that focus on software being built or system being de- ployed
88
Trust boundary
any place where entities of different privilege interact. Threats tend to cluster around trust boundaries
89
Dataflow Diagrams (DFD) (Software model)
follows the flows of data often ideal for threat modeling
90
Unified modeling language (UML) (Software model)
Fairly complex if starting from scratch likely can be adapted
91
Swim line diagrams (Software model)
o represent flows between various participants; each lane edge is labeled to identify a participant; each message is represented by a line between participants.
92
state diagram (Software model)
represents the various states a system could be in and the tran- sitions between those states.
93
STRIDE
STRIDE: A well accepted approach to thinking of threats when threat modeling: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of privilege.
94
spoofing
Pretending to be someone or something other than yourself. This VIOLATES AUTHENTICATION.
95
Tampering
Modification of something on a disk in memory or network. This VIOLATES INTEGRITY
96
Repudiation
claiming that you did not do something VIOLATES NONREPUDI- ATION o Information disclosure - providing information to someone not authorized to see it VIOLATES CONFIDENTIALITY
97
Denial of Service
Absorbing the resources needed to provide a service. VIOLATES AVAILABILITY.
98
Information Disclosure
providing information to someone not authorized to see it VIO- LATES CONFIDENTALLITY
99
elevation of privilege
Allowing someone to do something they are not authorized to do. Violates AUTHORIZATION
100
Data tier languages and Protocols List them
SQL, Network file system NFS, Standard messaging block (SMB), Rsyslog
101
SQL
o Structured Query Language - SQL - A language used in programming and designed to manage data held in databases. PORTS: 3306 (MySQL/MariaDB)>5432 Postgres>1433 MS SQL
102
Network file system (NFS)
Distributed file system protocol runs on port: 2249
103
Standard messaging block (SMB)
o A network protocol for shared access to files printers and serial ports (445 or 139)
104
Rsyslog
A utility for sending logs to remote log systems
105
Protecting Data (5 rules)
Minimize attack surface, Principle of least privilege, Encryption, Tokenization, Federation
106
Minimize attack surface
Minimize the attack surface area: Implement physical, Network, logistical controls on data.
107
Principle of least privilege
access to data should be controlled by permissions that are veri- fied before allowing users to access the data.
108
Encryption
prevents data visibility in the event of unauthorized access or theft
109
Tokenization
Substituting sensitive data with non-sensitive equivalent. The to- ken is then used to map back to the data
110
Federation
A type of meta-database file system that is geographically de- centralized and transparently maps multiple databases in to one single one.
111
NICE: National Initiative for Cybersecurity Education (parts and what they do
o Categories: provide organizational structure o Specialty Areas: subgroups of categories containing cybersecu- rity work.o Work Roles: the most detailed grouping of cybersecurity related work which includes KSAs and tasks for the role.o Knowledge, skills and abilities: The skills required to perform a work role.o Task - specific task assigned to the work role
112
OWASP
Open Web Application Security Project
113
OWASP TOP 10: list them
Top ten critical security risks to applications A1: Injection A2: Bro- ken authentication A3: Sensitive data exposure A4: XML External Entities A5: Broken access control A6: Security misconfiguration A7: Cross Site Scripting (XSS) A8: Insecure deserialization A9: Vulnerable components A10: Insufficient logging and monitoring.
114
SQLi
Injection of a string in to a query in order to modify a response: attacker sends hostile data in to an interpreter How does it work: There are flaws in the code that when a specific string is injected do something different than they were meant to do.
115
SQLi mitigation (3 parts)
requires keeping data separate from commands and queries. Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid."o Never Insert Untrusted Data Except in Allowed Locations o HTML Escape Before Inserting Untrusted Data into HTML Ele- ment Contento Use a trusted library"
116
XSS - Cross Site Scripting
A type of application attack where the attacker takes advantage of scripting and input validation vulnerabilities in an interactive website to attack legitimate users.
117
Reflected XSS:
The application or API includes invalidated or un-escaped user input as HTML output.
118
Stored XSS
The application or API stores unsanitized user input that can be viewed at a later date.
119
DOM XSS
JavaScript frameworks, single-page applications, and APIs that dynamically include attacker-controllable data to a page are vul- nerable to DOM XSS
120
XSS mitigation
Escaping untrusted HTTP request data based on the context in the HTML output, Using frameworks that automatically escape XSS by design, such as the latest Ruby on Rails and React JS.
121
Static Application Security Testing (SAST):
the analysis of computer software that is performed WITHOUT executing programs.
122
Dynamic Application Security Testing (DAST)
the analysis of computer programs DURING their execution. DAST does not require the source code and therefore detects vulnera- bilities by performing attacks itself.
123
Private: cloud infrastructure
operated solely for a single organization
124
Public cloud infrastructure
services are rendered over a network that is open for public use
125
Hybrid cloud
a composition of public cloud and private environment
126
Infrastructure as a service
refers to online services that provide high-level APIs used to deref- erence various low-level details of underlying network infrastruc- ture like physical computing resources,location, data partitioning, scaling, security, backup etc.
127
Platform as a service
consumer does not manage or control the underlying cloud infra- structure. This includes the network, servers, operating systems or storage. The user does control the deployed applications and possible the configuration settings for the application hosting en- vironment.
128
Software as a Service (SaaS)
the applications are accessible via a thin client interface such as a web browser or program interface. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, storage and even individual application capabilities.
129
Networking Security Logs
Primarily contain computer security-related information
130
Operating System logs
contains system events and audit records
131
Application logs
contains application level events or audit information
132
Viruses
typically hidden within another seemingly innocuous program. It can create copies of itself and insert them into other programs and files to perform a harmful action. Uncommon today and comprises less than 10% of all malware
133
Worms
distinctive trait is that it is self-replicating and can spread without user action. Viruses require the user to interact with the corrupt- ed/malicious file
134
Trojan Horse
Masquerades as a legitimate program but contains malicious code. A trojan requires the user to execute the corrupted/malicious file. Typically spread via social engineering
135
Ransomware
most ransomware programs are trojans, which means they must be spread through social engineering of some sort. Once the user executes the corrupted/malicious file, it looks for and encrypts the users' files. The hacker then holds the files as hostage in exchange for a ransom. Can be prevented by creating a good backup. According to studies, about 25% of victims choose to pay the ransom while 30% do not get their files unlocked
136
Rootkit
if you get infected with a Rootkit, you're basically ****ed. Rootkits allow the hacker to have "root" privilege and create/edit/delete files as they please. Rootkits can conceal themselves from anti-mal- ware systems and are very difficult to detect. This is because "root" privilege is greater than that of the victim/user. Rootkits are extraordinarily hard to create and only the most advanced attacks utilize them. Tech companies are very proactive about patching vulnerabilities that are susceptible to a Rootkit.
137
Backdoor
a method of bypassing normal authentication procedures, typically over a connection to a network such as the internet. Backdoor allow the hacker to spy, invisibly, on the victims activities. May be installed by Trojan horses, worms, implants or "other methods".
138
Adware
attempts to expose the victim to unwanted and potentially ma- licious advertising. Common adware programs may re-direct a user's browser searches to a copycat page that contains promo- tions for other products
139
Botnet
a logical collection of internet-connected devices whose security has been compromised and control ceded to a third party. Each compromised device is known as "bot". Botnets are rented out by cyber criminals as commodities for a variety of purposes (such as a DDoS attack)
140
Signature Based Detection
many viruses have a "signature", or a recognizable series of ones and zeros. Signature based anti-virus programs work by spotting these signatures and stopping the files before they can cause damage
141
Behavior Based Detection
monitors system processes to determine if a program is attempt- ing to engage in malicious behavior against the operating system
142
Quarantining Removal
the most common first step, works by moving the malicious file into a protected area on the hard drive. This area is separate from any other file that could activate the malicious software
143
Startup Detection/Removal
aims to stop the initialization and spread of the virus during the start up process
144
Restore points
Operating system "restore points" provides administrators with a known working point to which they can restore the settings back to.
