Module 10 Flashcards
Learning Unit 6 (70 cards)
Security Risks Overview
• Security risk varies by organization type and data sensitivity • Key questions: o What is at risk? o What is the potential loss if stolen, damaged, or destroyed? • Data breach: unauthorized access/use of sensitive data • Understanding risks requires familiarity with security terms and threats
Hackers and Their Intentions
• Hacker (original meaning): skilled in understanding computer systems deeply • Current usage: individuals gaining unauthorized access (malicious or not) • Hacking: also means creative problem-solving or resource manipulation Categories of Hackers: • White Hat Hacker: o Ethical hackers hired to find security weaknesses o Operate under contracts and laws o Do not compromise private data outside agreed scope • Black Hat Hacker: o Malicious actors bypassing security to cause harm or steal data o Ignore legal restrictions o May be hired for malicious agendas • Gray Hat Hacker: o Act with mixed ethics, sometimes illegal but often for education/help o May report vulnerabilities without causing damage or theft o Risk legal prosecution; often remain anonymous
Vulnerabilities and Exploits
• Vulnerability: weakness in system/process/architecture that risks unauthorized access or data compromise • Exploit: act of taking advantage of a vulnerability • Example: o Low fence = vulnerability o Climbing over fence = exploit/crime • Evil Twin Attack: o Malicious access point mimics legitimate Wi-Fi (same SSID, settings) o Tricks clients to connect, allowing data theft or system access o Exploits open SSID broadcasts and client scanning
Tracking Vulnerabilities (CVE System)
• Managed by MITRE Corporation, funded by U.S. Department of Homeland Security • CVE (Common Vulnerabilities and Exposures): o Public dictionary assigning unique IDs to vulnerabilities o Tracks vulnerabilities across systems o Accessible and free to use; only MITRE can modify entries o Website: cve.mitre.org
Zero-Day Exploits
• Exploit vulnerabilities unknown or very recently made public • Dangerous because no patches or fixes exist yet • Example: Microsoft Patch Tuesday (regular security updates) o Hackers study updates to attack unpatched systems immediately o Day after Patch Tuesday called “Exploit Wednesday” due to quick exploitation • Most vulnerabilities are known and patched regularly
Security Risk Interactions
• Exploits often chained: one breach leads to another • Example attack sequence: o Hacker observes username during login o Uses password-cracking to gain access o Plants malicious code to overwhelm network (DoS attack) • No risk stands alone; one vulnerability can lead to multiple threats
Human Risks to Network Security
• Human error, ignorance, omission = >50% of security breaches • Common source: social engineering • Prevention = regular employee training, awareness programs • Company responsibility: enforce security policies, ensure compliance • Consequences: potential data breaches, litigation costs
Social Engineering Techniques (Part 1)
Phishing • Fake communication from a “legitimate” source • Requests credentials or personal info • Uses urgency, branding, formatting to appear authentic • Links often lead to malicious websites • May include mismatched company names or odd URLs Baiting • Malware disguised as a free item (e.g., music file, USB) • Victim installs it, unknowingly infecting their system • Common at hacking conventions Quid pro quo • Offers free gift/service for info or access • Preys on untrained users
Social Engineering Techniques (Part 2)
Tailgating • Unauthorized person follows authorized user into secure area • Happens without the authorized person’s knowledge Piggybacking • Attacker deceives employee into granting access • Examples: “holding the door” or distracting conversation Shoulder Surfing • Observing someone enter credentials/access codes • Protection: cover keypad, be aware of surroundings
Social Engineering Attack Lifecycle
Research o Collect info about target o May begin with harmless questions 2. Build Trust o Use gathered info to establish rapport 3. Exploit o Victim unknowingly grants access or data 4. Exit o Attacker leaves without raising suspicion o May restart cycle for deeper access
Countermeasures: Social Engineering
• Frequent employee training & updates • Mandatory compliance checks, pass rates • Training = consistent exposure (use it or lose it) • IT staff should share current threats, countermeasures • Training must be well-designed to boost engagement • Simulations = test employee readiness
Insider Threats
• Trusted individuals with malicious intent • Examples: employees, ex-employees, contractors • High risk: have knowledge of systems/security • May bypass multiple layers of protection
Mitigating People Risks
• Background checks for hires/contractors • Least privilege: only enough access to do job • Checks and balances: o Scheduled access o Mandatory vacations o Job rotations • DLP (Data Loss Prevention): o Identifies sensitive data o Prevents external transfers (USB, email, cloud)
OSI Layer Technology Risks
• Attacks can target any of the 7 OSI layers. • Common targets: transmission media, NICs, access methods (e.g., Ethernet), switches, routers, APs, gateways. • Eavesdropping on switched networks needs tools like protocol analyzers (e.g., Wireshark). • Routers vulnerable to TCP/IP flood attacks → disrupt legitimate traffic.
DoS and DDoS Attacks
• DoS attack: Floods a system → legitimate users can’t access resources. o Simple to execute (e.g., looping email script). o Can also occur due to faulty software. • DDoS attack: o Uses multiple compromised machines (zombies). o Controlled remotely via bots by a bot herder. o Forms a botnet or zombie army. o Harder to mitigate than DoS. • DRDoS attack (Distributed Reflection DoS): o Uses uninfected reflectors. o Spoofed source IP → reflectors send traffic to victim. • Amplified DRDoS: o Small requests → large responses. o Exploits protocols: DNS, NTP, ICMP, SNMP, LDAP. • PDoS attack (Permanent DoS): o Destroys firmware → “bricks” device. o Targets: routers, switches. • Friendly DoS: o Accidental (e.g., flash sale traffic overload). o Not malicious in intent.
Wireless & On-Path Attacks
• On-Path Attack (formerly MitM): o Attacker intercepts & redirects transmissions. o Example: Evil Twin → rogue AP impersonates legitimate AP. o Can steal credentials or redirect users to malicious sites. • Deauth Attack: o Exploits unencrypted deauthentication frames in Wi-Fi. o Sends spoofed frames to AP, client, or all users. o Kicks clients off network. o Enables further attacks (e.g., on-path). o Essentially a Wi-Fi DoS.
Insecure Protocols
• Many TCP/IP protocols are insecure by default: o IP: spoofable. o UDP: lacks authentication. o TCP: weak authentication. o FTP: vulnerable (e.g., FTP bounce attack). Attacker uses FTP server to connect to third-party host. Used to scan ports or deliver payloads. o HTTP: use HTTPS (SSL/TLS) instead. o Telnet: use with IPsec or avoid. o SNMPv1/v2: use SNMPv3 instead.
DNS & Software Vulnerabilities
• DNS poisoning / spoofing: o Alters DNS records to redirect traffic to malicious sites. o Affects multiple levels: DNS servers, ISPs, local devices. o Can spread globally (e.g., Great Firewall of China incident in 2010). • Back Doors: o Hidden or intentional vulnerabilities in software. o Allow unauthorized access. o Common in outdated/legacy systems. o Patch management is essential.
Malware Types
• Malware = malicious software designed to harm or exploit systems • Virus o Self-replicates o Spreads via networks, piggybacking on files or devices o May damage files/systems or annoy users • Trojan Horse o Disguised as useful software o Does not self-replicate o Example: a fake game that deletes files or spams contacts • Worm o Independent program o Travels across networks (e.g., via email attachments) o Can carry and hide viruses • Bot o Autonomous process (malicious or benign) o Connects to C&C server to join botnet o Functions: DoS attacks, data theft, backdoor access • Ransomware o Encrypts user/system files o Demands ransom for decryption o Can encrypt cloud, removable, and backup data o May delete data over time or leak files online o Backups (disconnected) = best defense o Paying ransom ≠ guaranteed recovery
Malware Characteristics
• Encryption o Hides malware from signature-based scanners • Stealth o Masquerades as legit programs or modifies legit code • Polymorphism o Changes structure/appearance per infection o Alters size, byte order, internal instructions • Time Dependence o Activates on set date or condition o Example: logic bomb (code that triggers on specific event/date)
Cyberattack & Threat Monitoring Tools
• Kaspersky CyberMap o Interactive global threat visualization o Displays attack stats by country o Access: cybermap.kaspersky.com • SonicWall Security Center o Live attack tracking o Categories: malware, ransomware, spam, cryptojacking, IoT malware o IoT malware ↑ >350% YoY (notable spike in Oct 2019) o Access: securitycenter.sonicwall.com • McAfee Threat Center o Updated malware info, characteristics, removal techniques o Access: mcafee.com/enterprise/en-us/threat-center.html
Ransomware Details
• Infection Vector o System + backups + cloud services (e.g., Dropbox, OneDrive) • Ransom Note o Instructions via on-screen message o Uses untraceable online payment systems • Threats o Deletes data on countdown o Leaks/stolen data if unpaid • Defensive Strategy o Frequent, offline backups o Ransom payments not always effective
Botnet & Bot Details
• Bot o Runs without user interaction o Controlled via command-and-control (C&C) server • Botnet o Network of infected devices o Used for DoS, spam, spreading malware, opening backdoors • Risks o Distributed & stealthy—hard to detect o Fast propagation
Layers of Risk Management
• Security risk assessment: Evaluates threats/vulnerabilities to the network • Business risk assessment: Evaluates impact of threats on business processes • Understand key business processes (e.g. operations, manufacturing) • Goal: Minimize security threat impact on processes
