Lesson 20 Flashcards

Question

Backups and Retention Policy

Answer 1

* Short term retention * Version control and recovery from corruption/malware * Long term retention * Regulatory/business requirements * Recovery window * Recovery point objective (RPO)

Answer 2

* Short term retention * Version control and recovery from In the short term, files that change frequently might need retaining for version control. Short-term retention is also important in recovering from malware infection. Consider the scenario where a backup is made on Monday, a file is infected with a virus on Tuesday, and when that file is backed up later on Tuesday, the copy made on Monday is overwritten. This means that there is no good means of restoring the uninfected version of the file. Short-term retention is determined by how often the youngest media sets are overwritten.

Answer 3

* Long term retention | * Regulatory/business requirements

Answer 4

* Recovery window * Recovery point objective (RPO) For these reasons, backups are kept back to certain points in time. As backups take up a lot of space, and there is never limitless storage capacity, this introduces the need for storage management routines to reduce the amount of data occupying backup storage media while giving adequate coverage of the required recovery window. The recovery window is determined by the recovery point objective (RPO), which is determined through business continuity planning. Advanced backup software can prevent media sets from being overwritten in line with the specified retention policy.

Answer 5

See slide or guide. there is a graphic. Full Incremental Differential

Answer 6

* Snapshots * Feature of file system allowing open file copy * Volume Shadow Copy Service (VSS) * VM snapshots and checkpoints * Image-based backup * System images Snapshots are a means of getting around the problem of open files. If the data that you're considering backing up is part of a database, such as SQL data or an Exchange messaging system, then the data is probably being used all the time. Often copy-based mechanisms will be unable to back up open files. Short of closing the files, and so too the database, a copy-based system will not work. A snapshot is a point-in-time copy of data maintained by the file system. A backup program can use the snapshot rather than the live data to perform the backup. In Windows, snapshots are provided for on NTFS volumes by the Volume Shadow Copy Service (VSS). They are also supported on Sun's ZFS file system, and under some enterprise distributions of Linux. Virtual system managers can usually take snapshot or cloned copies of VMs. A snapshot remains linked to the original VM, while a clone becomes a separate VM from the point that the cloned image was made. An image backup is made by duplicating an OS installation. This can be done either from a physical hard disk or from a VM's virtual hard disk. Imaging allows the system to be redeployed quickly, without having to reinstall third-party software, patches, and configuration settings. A system image should generally not contain any user data files, as these will quickly become out of date.

Answer 7

* Image-based backup * System images An image backup is made by duplicating an OS installation. This can be done either from a physical hard disk or from a VM's virtual hard disk. Imaging allows the system to be redeployed quickly, without having to reinstall third-party software, patches, and configuration settings. A system image should generally not contain any user data files, as these will quickly become out of date.

Answer 8

In Windows, snapshots are provided for on | NTFS volumes by the Volume Shadow Copy Service (VSS).

Answer 9

Virtual system managers can usually take snapshot or cloned copies of VMs. A snapshot remains linked to the original VM, while a clone becomes a separate VM from the point that the cloned image was made.

Answer 10

Backup security •Access control and encryption Offsite storage •Distance consideration •Physical transfer •Network/cloud backups Online versus offline backups •Speed of restore operations •Risk to online backup data (offline take more time to get operational but offline offers better security 3-2-1 rule

Answer 11

The 3-2-1 rule states that you should have three copies of your data, across two media types, with one copy held offline and offsite.

Answer 12

Disk •SOHO backups •Lack enterprise-level capacity and manageability Network attached storage (NAS) •File-level/protocol-based access •No offsite option Tape •Enterprise-level capacity and manageability Storage area network (SAN) and cloud •Block-level access to storage devices •Highly configurable •Mix storage technologies to implement performance tiers

Answer 13

Disk •SOHO backups •Lack enterprise-level capacity and manageability Individual removable hard drives are an excellent low-cost option for SOHO network backups, but they do not have sufficient capacity or flexibility to be used within an automated enterprise backup solution.

Answer 14

Network attached storage (NAS) •File-level/protocol-based access •No offsite option A network attached storage (NAS) appliance is a specially configured type of server that makes RAID storage available over common network protocols, such as Windows File Sharing (SMB) or FTP. A NAS appliance is accessed via an IP address and backup takes place at file-level. A NAS can be another good option for SOHO backup, but as a single device, it provides no offsite option. As it is normally kept online, it can be vulnerable to cryptoransomware as well.

Answer 15

Tape •Enterprise-level capacity and manageability - slow Digital tape systems are a popular choice for institutions with multi-terabyte storage requirements. Tape is very cost effective and, given a media rotation system, tapes can be transported offsite. The latest generation of tape will store about 10-12 terabytes per cartridge or up to about 30 TB with compression. The main drawback of tape is that it is slow, compared to disk-based solutions, especially for restore operations.

Answer 16

Storage area network (SAN) and cloud •Block-level access to storage devices •Highly configurable •Mix storage technologies to implement performance tiers A RAID array or tape drive/autoloader can be provisioned as direct attached storage, where a server hosts the backup devices, usually over serial attached SCSI (SAS). Direct attached storage has limited scalability, so enterprise and cloud storage solutions often use storage area networks (SAN) as a layer of abstraction between the file system objects presented to servers and the configuration of the actual storage media. Where NAS uses file-level access to storage, a SAN is based on block-level addressing. A SAN can incorporate RAID arrays and tape systems within the same network. SANs can achieve offsite storage through replication.

Answer 17

A complex facility such as a data center or campus network must be reconstituted according to a carefully designed order of restoration. If systems are brought back online in an uncontrolled way, there is the serious risk of causing additional power problems or of causing problems in the network, OS, or application layers because dependencies between different appliances and servers have not been met. 1. Power delivery systems 2. Switch infrastructure then routing appliances and systems 3. Network security appliances 4. Critical network servers 5. Backend and middleware and verify data integrity 6. Front-end applications 7. Client workstations and devices and client browser access

Answer 18

Separate compute instance from data •Snapshot/revert to known state •Rollback to known configuration •Live boot media Provisioning •Master image •Automated build from template Configuration validation

Answer 19

Separate compute instance from data •Snapshot/revert to known state •Rollback to known configuration •Live boot media When recovering systems, it may be necessary to ensure that any artifacts from the disaster, such as malware or backdoors, are removed when reconstituting the production environment. This can be facilitated in an environment designed for nonpersistence. Nonpersistence means that any given instance is completely static in terms of processing function. Data is separated from the instance so that it can be swapped out for an "as new" copy without suffering any configuration problems. There are various mechanisms for ensuring nonpersistence:

Answer 20

Provisioning •Master image •Automated build from template When provisioning a new or replacement instance automatically, the automation system may use one of two types of mastering instructions: • Master image—this is the "gold" copy of a server instance, with the OS, applications, and patches all installed and configured. This is faster than using a template, but keeping the image up to date can involve more work than updating a template. • Automated build from a template—similar to a master image, this is the build instructions for an instance. Rather than storing a master image, the software may build and provision an instance according to the template instructions.

Answer 21

Another important process in automating resiliency strategies is to provide configuration validation. This process ensures that a recovery solution is working at each layer (hardware, network connectivity, data replication, and application). An automation solution for incident and disaster recovery will have a dashboard of key indicators and may be able to evaluate metrics such as compliance with RPO and RTO from observed data.

Answer 22

Configuration management ensures that each component of ICT infrastructure is in a trusted state that has not diverged from its documented properties. Change control and change management reduce the risk that changes to these components could cause service disruption. * Service assets * Configuration items (CIs) * Assets that require configuration management * Baseline configuration * Configuration management system (CMS) * Creating and updating diagrams * Workflows * Physical and logical network topologies * Network rack layouts * …

Answer 23

Service assets are things, processes, or people that contribute to the delivery of an IT service.

Answer 24

* Configuration items (CIs) * Assets that require configuration management A Configuration Item (CI) is an asset that requires specific management procedures for it to be used to deliver the service. Each CI must be identified by some sort of label, ideally using a standard naming convention. CIs are defined by their attributes and relationships, which are stored in a configuration management database (CMDB).

Answer 25

baseline configuration is the template of settings that a device, VM instance, or other CI was configured to, and that it should continue to match. You might also record performance baselines, such as the throughput achieved by a server, for comparison with monitored levels.

Answer 26

* Configuration management system (CMS) * Creating and updating diagrams * Workflows * Physical and logical network topologies * Network rack layouts * … A configuration management system (CMS) is the tools and databases that collect, store, manage, update, and present information about CIs and their relationships.A small network might capture this information in spreadsheets and diagrams; there are dedicated applications for enterprise CMS. Diagrams are the best way to capture the complex relationships between network elements. Diagrams can be used to show how CIs are involved in business workflows, logical (IP) and physical network topologies, and network rack layouts. Remember, it is not sufficient simply to create the diagram, you must also keep the diagram up to date.

Answer 27

Inventory/asset management database Asset identification and standard naming conventions •Barcodes and RFID tags •Standard naming conventions for asset IDs •Attribute fields and tags ``` Internet protocol (IP) schema •Static allocation versus DHCP ranges •IP address management (IPAM) software suites ```

Answer 28

An asset management process tracks all the organization's critical systems, components, devices, and other objects of value in an inventory. It also involves collecting and analyzing information about these assets so that personnel can make more informed changes or otherwise work with assets to achieve business goals.

Answer 29

There are many software suites and associated hardware solutions available for tracking and managing assets. An asset management database can be configured to store as much or as little information as is deemed necessary, though typical data would be type, model, serial number, asset ID, location, user(s), value, and service information.

Answer 30

Asset identification and standard naming conventions •Barcodes and RFID tags •Standard naming conventions for asset IDs •Attribute fields and tags Tangible assets can be identified using a barcode label or radio frequency ID (RFID) tag attached to the device (or more simply, using an identification number). An RFID tag is a chip programmed with asset data. When in range of a scanner, the chip activates and signals the scanner. The scanner alerts management software to update the device's location. As well as asset tracking, this allows the management software to track the location of the device, making theft more difficult. A standard naming convention for hardware assets, and for digital assets such as accounts and virtual machines, makes the environment more consistent. This means that errors are easier to spot and that it is easier to automate through scripting. The naming strategy should allow administrators to identify the type and function of any particular resource or location at any point in the CMDB or network directory. Each label should conform to rules for host and DNS names (support.microsoft.com/en-us/ help/909264/naming-conventions-in-active-directory-for-computers-domains-sitesand). As well as an ID attribute, the location and function of tangible and digital assets can be recorded using attribute tags and fields or DNS CNAME and TXT resource records.

Answer 31

``` Internet protocol (IP) schema •Static allocation versus DHCP ranges •IP address management (IPAM) software suites ``` The division of the IP address space into subnets should be carefully planned and documented in an Internet Protocol (IP) schema. Using a consistent addressing methodology makes it easier to apply firewall access control lists (ACLs) and perform security monitoring (tools.cisco.com/security/center/resources/security_ip_addressing. html). It also makes configuration errors less likely and easier to detect. Within each subnet, the schema should identify IP addresses reserved for manual or static allocation versus DHCP address pools. IP address management (IPAM) software suites can be used to monitor IP usage.

Answer 32

``` Change control •Assesswhethera change shouldbemade •Classifying change (reactive, proactive, risk) •Request for Change (RFC) •Change Advisory Board (CAB) ``` Change management •Ensurechanges are appliedwithminimum disruption •Rollback plan - Every change should be accompanied by a rollback (or remediation) plan, so that the change can be reversed if it has harmful or unforeseen consequences.

Answer 33

Alternate processing sites/recovery sites •Provideredundancy for damage to resources stored on the primary site •Failover to alternate processing site (or system) Hot site •Instantaneous failover Warm site •Some delay or manual configuration before failover occurs Cold site •Significant delay and configuration before failover can occur

Answer 34

Hot site •Instantaneous failover A hot site can failover almost immediately. It generally means that the site is already within the organization's ownership and is ready to deploy. For example, a hot site could consist of a building with operational computer equipment that is kept updated with a live data set.

Answer 35

Warm site •Some delay or manual configuration before failover occurs A warm site could be similar, but with the requirement that the latest data set will need to be loaded.

Answer 36

Cold site •Significant delay and configuration before failover can occur A cold site takes longer to set up. A cold site may be an empty building with a lease agreement in place to install whatever equipment is required when necessary.

Answer 37

Layered security and defense in depth Technology and control diversity •Provision different classes and types of controls •Mix technical, administrative, and physical controls •Deploy controls to prevent, deter, detect, and correct Vendor diversity •Use more than one supplier Crypto diversity

Answer 38

Layered security is typically seen as improving cybersecurity resiliency because it provides defense in depth. The idea is that to fully compromise a system, the attacker must get past multiple security controls, providing control diversity. These layers reduce the potential attack surface and make it much more likely that an attack will be deterred or prevented, or at least detected and then prevented by manual intervention.

Answer 39

Technology and control diversity •Provision different classes and types of controls •Mix technical, administrative, and physical controls •Deploy controls to prevent, deter, detect, and correct Allied with defense in depth is the concept of security through (or with) diversity. Technology diversity refers to environments that are a mix of operating systems, applications, coding languages, virtualization solutions, and so on. Control diversity means that the layers of controls should combine different classes of technical and administrative controls with the range of control functions: prevent, detect, correct, and deter. Consider the scenario where Alan from marketing is sent a USB stick containing designs for a new billboard campaign from an agency. Without defense in depth, Alan might find the USB stick on his desk in the morning, plug it into his laptop without much thought, and from that point is potentially vulnerable to compromise. There are many opportunities in this scenario for an attacker to tamper with the media: at the agency, in the post, or at Alan's desk. Defense in depth, established by deploying a diverse range of security controls, could mitigate the numerous risks inherent in this scenario: • User training (administrative control) could ensure that the media is not left unattended on a desk and is not inserted into a computer system without scanning it first. • Endpoint security (technical control) on the laptop could scan the media for malware or block access automatically. • Security locks inserted into USB ports (physical control) on the laptop could prevent attachment of media without requesting a key, allowing authorization checks to be performed first. • Permissions restricting Alan's user account (technical control) could prevent the malware from executing successfully. • The use of encrypted and digitally signed media (technical control) could prevent or identify an attempt to tamper with it. • If the laptop were compromised, intrusion detection and logging/alerting systems (technical control) could detect and prevent the malware spreading on the network.

Answer 40

Vendor diversity •Use more than one supplier As well as deploying multiple types of controls, you should consider the advantages of leveraging vendor diversity. Vendor diversity means that security controls are sourced from multiple suppliers. A single vendor solution is a tempting choice for many organizations, as it provides interoperability and can reduce training and support costs. Some disadvantages could include the following: • Not obtaining best-in-class performance—one vendor might provide an effective firewall solution, but the bundled malware scanning is found to be less effective. • Less complex attack surface—a single vulnerability in a supplier's code could put multiple appliances at risk in a single vendor solution. A threat actor will be able to identify controls and possible weaknesses more easily. • Less innovation—dependence on a single vendor might make the organization invest too much trust in that vendor's solutions and less willing to research and test new approaches.

Answer 41

This concept can be extended to the selection of algorithms and implementations of cryptography. Adoption of methods such as blockchain-based IAM (ibm.com/ blogs/blockchain/2018/10/decentralized-identity-an-alternative-to-password-basedauthentication) or selecting ChaCha in place of AES as a preferred cipher suite (blog.cloudflare.com/it-takes-two-to-chacha-poly) forces threat actors to develop new attack methods.

Answer 42

Asymmetry of attack and defense Active defense Fake/decoy assets •Honeypots, honeynets, and honeyfiles •Breadcrumbs ``` Disruption strategies •Bogus DNS records •Decoy directories and resources •Port spoofing to return fake telemetry/monitoring data •DNS sinkholes ```

Answer 43

The practice of cybersecurity is often described as asymmetric warfare; the defenders have to win every encounter and be ready all the time. The threat actors can choose when to attack and only have to win once. Some cybersecurity tactics aim to reduce that asymmetry by increasing the attack cost. This means that a threat actor has to commit more resources to even plan an attack.

Answer 44

Active defense means an engagement with the adversary, but this can be interpreted in several different ways. One type of active defense involves the deployment of decoy assets to act as lures or bait. It is much easier to detect intrusions when an attacker interacts with a decoy resource, because you can precisely control baseline traffic and normal behavior in a way that is more difficult to do for production assets.

Answer 45

Fake/decoy assets •Honeypots, honeynets, and honeyfiles •Breadcrumbs •Disruption strategies

Answer 46

A honeypot is a computer system set up to attract threat actors, with the intention of analyzing attack strategies and tools, to provide early warnings of attack attempts, or possibly as a decoy to divert attention from actual computer systems. Another use is to detect internal fraud, snooping, and malpractice. A honeynet is an entire decoy network. This may be set up as an actual network or simulated using an emulator.

Answer 47

A honeypot or honeynet can be combined with the concept of a honeyfile, which is convincingly useful, but actually fake, data. This honeyfile can be made trackable, so that when a threat actor successfully exfiltrates it, the attempts to resuse or exploit it can be traced.

Answer 48

``` Disruption strategies •Bogus DNS records •Decoy directories and resources •Port spoofing to return fake telemetry/monitoring data •DNS sinkholes ```

Answer 49

Using bogus DNS entries to list multiple hosts that do not exist.

Answer 50

Configuring a web server with multiple decoy directories or dynamically generated pages to slow down scanning.

Answer 51

Using port triggering or spoofing to return fake telemetry data when a host detects port scanning activity. This will result in multiple ports being falsely reported as open and will slow down the scan. Telemetry can refer to any type of measurement or data returned by remote scanning. Similar fake telemetry could be used to report IP addresses as up when they are not, for instance.

Answer 52

Using a DNS sinkhole to route suspect traffic to a different network, such as a honeynet, where it can be analyzed.