Qns Flashcards
(79 cards)
Explain what is a security assessment.
It is a joint collaboration between sech arch team, pentest and sadly team to identify security risks at the start of creating an application and verify if it complies with visa’s security standards
As a security accessor, explain how you will approach a security assessment?
Si
Scoping - identify the scope of the change in the application
Ensure that the application aligns with visa security standards.
break down the change into diff parts, find out where the data is being stored. What kind of data i need to protect, PII PAN, how do i break it down into components, what part of the network is being exposed.
What are the stages in a Cyber Security Incident Response.
identify protect prepare detect respond recover (+review)
DLP
Data loss prevention - prevent unauthorised data loss or leakage - one is at host level, one is at network level - if you are sending anything out illegal on the network level
WAF
Web application firewall (cloudflare)- monitor filter and block http traffic between web application and internet
- http payload inspection - tls stripping, get payload, contains private keys of visa to extract and read the payload
- whitelist IP
IAM
Identity and access management - people who provision accounts and permissions
Application Layer
7: Interfaces with the user and provides network services.
Eg: HTTP, FTP, SMTP, DNS
Controls: - Application firewalls- Input validation- Authentication mechanisms- Data encryption
Presentation Layer
6: Translates data formats, encrypts/decrypts, and compresses data.
Eg: JPEG, SSL/TLS, ASCII
Controls: - Strong encryption protocols (e.g., TLS)- Data format validation- Secure coding practices
Session Layer
5: Manages sessions and controls dialogs between systems.
NetBIOS, PPTP, RPC
Controls: - Session encryption- Secure session management (e.g., session timeouts)- Multi-factor authentication
Transport Layer
4: Provides end-to-end communication and error recovery.
TCP, UDP
Controls: - Transport Layer Security (TLS)- Port filtering- Anti-DDoS measures
network layer
3: Routes data packets between devices across different networks.
IP, ICMP, ARP, OSPF
Controls: - Firewall rules- Network segmentation- Intrusion Detection Systems (IDS)
Data link layer
2: Handles data transfer between nodes and error detection.
Ethernet, PPP, MAC
Controls: - MAC address filtering- VLANs (Virtual LANs)- ARP inspection
Physical layer
Concerned with physical hardware connections and signaling.
Cables, switches, NIC
Controls: - Physical security (locks, surveillance)- Secure hardware (e.g., tamper-proof devices)- Regular hardware audits
MAC vs IP, which layer, description
Mac: layer 2 (data), identifying devices on the same network, (local)
on layer 2, devices use mac address to deliver frames to correct destination
48bit hexadecimal format
Ip: layer3 (network), identify devices across networks
Routes data packets across networks. Used for internet routing - global
IPv4 (32) / IPv6 (128)
STRIDE S
Impersonation of a trusted entity, such as a user or system.
Unauthorized access to systems or data
- Use strong authentication (e.g., MFA). - Implement identity verification mechanisms. - Use secure protocols (e.g., HTTPS, TLS).
STRIDE T
Unauthorized modification of data in transit or at rest.
Data corruption, loss of integrity
- Use cryptographic techniques like hashing and digital signatures. - Encrypt data in transit and at rest. - Implement checksums and audits.
STRIDE R
Lack of evidence or logging to prove an action occurred, allowing denial of actions.
Fraud, accountability issues - Implement logging and auditing mechanisms.
- Use tamper-proof logs (e.g., immutable logs with cryptographic hashes). - Employ digital receipts.
STRIDE I
Unauthorized access to or exposure of sensitive information.
Data leaks, privacy violations
- Use data encryption (e.g., AES). - Implement access controls and data masking. - Apply secure coding practices to prevent data exposure.
STRIDE D
Disruption of service availability through resource exhaustion or targeted attacks.
Service downtime, loss of availability
- Use rate limiting and throttling. - Deploy DDoS protection (e.g., cloud-based services like AWS Shield). - Implement resource allocation limits.
STRIDE E
Exploiting vulnerabilities to gain unauthorized privileges or permissions.
Unauthorized actions, full system compromise
- Enforce least privilege principles. - Regularly patch vulnerabilities. - Use privilege separation and role-based access controls (RBAC).
Dmz
physical and logical subnet that seperates local area network (LAN) and other untrusted networks. Provides network segmentation to protect corporate network
Attackers need to pass through firewall before getting into dmz, > dmz > internal firewall. And these actions shd have set off alarms to prevent attacks from happening
How to identify threats early in the DMZ
Network Traffic Monitoring: Analyze traffic to and from the DMZ for abnormal patterns (e.g., high traffic volumes, unauthorized access attempts).
Intrusion Detection Systems (IDS) Deploy IDS tools in the DMZ to detect suspicious activities like scanning, brute force attempts, or unusual traffic patterns.
Vulnerability Scanning Regularly scan DMZ systems for unpatched vulnerabilities or misconfigurations.
TLS Process
Client verify server
1. Client Hello
2. Server hello - send out cert to prove identity
3. Cert validation - client check if valid CA (asymmetric)
4. Key Exchange - shared session key using either RSA or Diffie Hellman methods
5. Secure communication using shared session key (symmetric key to encrypt data)
How would you secure an API
- Access to API
1. VPVP / VDP are of API Gateway
2. Authentiation —> API Key + Shared Secret, mTLS OR LDAP
3. Authorization —> AD Groups (LDAP), Client ID - JWT Token / API Token (Keberos)
1. First you authenticate
2. You recieve 15min timeout, you can use token to gain access to in scope systems
3. When you present the token, they will validate the token and then check if its still applicable.
4. JWT MUST BE SIGNED
