Untitled Deck Flashcards
(775 cards)
1
Q
A
2
Q
What are the four categories of security mechanisms?
A
Technical, Managerial, Operational, Physical
3
Q
What is a Technical security mechanism?
A
Hardware or software used to manage access to resources and systems
4
Q
Give an example of a Technical security mechanism.
A
Encryption, smart cards, passwords, biometrics, access control lists (ACLs), firewalls
5
Q
What does Managerial security focus on?
A
Policies and procedures defined by an organization’s security policy
6
Q
Provide an example of a Managerial security measure.
A
Policies, procedures, vendor management, hiring practices
7
Q
What is the purpose of Operational security measures?
A
Ensure day-to-day operations comply with overall security
8
Q
List two examples of Operational security procedures.
A
- Backup and recovery procedures
- Awareness training
9
Q
What does Physical security aim to protect?
A
The facility and real-world objects
10
Q
Name a type of Physical security mechanism.
A
Guards, mantraps, fences, lights, motion detectors
11
Q
What is a Preventive security control?
A
Deployed to prevent or stop unwanted or unauthorized activity
12
Q
Give an example of a Preventive security control.
A
Fences, locks, biometrics, alarm systems
13
Q
What is the purpose of Deterrent security controls?
A
Discourage violation of security policies
14
Q
List two Detective security controls.
A
- Security guards
- Intrusion detection systems
15
Q
What measures are included in Corrective security controls?
A
Fixing vulnerabilities or mitigating damage after incidents
16
Q
What is a Compensating security control?
A
Provides options to aid in enforcement of security policies
17
Q
What do Directive security controls aim to do?
A
Guide behavior and enforce compliance with security policies
18
Q
True or False: A single security control can be classified as multiple types.
A
True
19
Q
What does the CIA Triad stand for?
A
Confidentiality, Integrity, Availability
20
Q
Define Confidentiality in the context of security.
A
Ensures sensitive data is only accessible to authorized users
21
Q
What is one method to maintain Confidentiality?
A
Encryption, access controls, passwords
22
Q
What is the purpose of Availability in security?
A
Ensures systems and data are accessible to authorized users
23
Q
List two strategies to enhance Availability.
A
- Backup and recovery
- Redundant Internet connections
24
Q
What does Integrity ensure regarding information?
A
Keeps information correct and unaltered
25
Give an example of a technique used to verify Integrity.
Checksums or digital signatures
26
What is Non-repudiation in security?
Ensures actions cannot be denied by the person or system performing them
27
Name a method that provides Non-repudiation.
Digital signatures, audit logs
28
Fill in the blank: _______ ensures that sensitive data is only accessible to authorized people.
Confidentiality
29
Fill in the blank: _______ involves measures taken to fix vulnerabilities after a security incident.
Corrective
30
Fill in the blank: _______ security mechanisms are focused on providing protection to physical facilities.
Physical
31
32
33
34
ZERO TRUST
35
36
An approach to security architecture in which no entity is trusted by default. Based on three principles:
37
Assume breach
38
Verify explicitly
39
Least privileged access
40
Also known as “never trusty
always verify” replacing the old concept of “trust by verify”
41
Addresses the limitations of the legacy network perimeter-based security model.
42
Assumes compromise / breach in verifying every request.
43
Nothing is trusted by default even inside the private “trusted network”
44
45
46
ACCESS POLICY ENFORCEMENT
47
48
Policy Enforcement Point (PEP)
49
Responsible for enabling
monitoring
50
Acts as the gateway that enforces access control policies.
51
When an access request occurs
the PEP evaluates the request against predefined policies and applies the necessary controls.
52
53
Policy Decision Point (PDP)
54
Where access decisions are made based on various factors such as user identity
device health
55
Evaluates the context of an access request and decides whether it should be allowed
denied
56
Considers the 5 W’s (who
what
57
In short
the PEP enforces policies at the connection level
58
59
60
61
CONTROL PLAN
62
DATA PLAN
63
Adaptive identity :
64
Changes the way the system asks a user to authenticate based on context of the request
65
Example: location
device
66
Implicit trust zones:
67
Part of traditional security approach which firewalls and other security devices formed a perimeter. Systems belonging to the org were placed inside this boundary
68
Threat scope reduction :
69
An end goal of ZTNA
which is to decrease risks to the organization.
70
subject/system:
71
Subject refers to the entity (e.g. user
device
72
user
device
73
System refers to the resource or service the subject is attempting to access.
74
Examples: database
cloud services
75
Policy-driven access control :
76
Controls based upon a user’s identity rather than simply their system’s location.
77
Policy enforcement point:
78
When a user or system requests access to resource
the PEP evaluates it against predefined policies and applies the necessary controls.
79
Example: NAC Solution
Cloud CASB
80
Policy administrator :
81
Responsible for communicating the decisions made by the policy engine
82
83
84
Policy engine :
85
Decides whether to grant access to a resource for a given subject
86
PA + PE = PDP
87
88
89
Drives the policy-based decision logic for zero trust
90
Enforces the decision defined in control plane
91
92
93
PHYSICAL SECURITY
94
95
Definition: physical security is the protection of physical assets
including hardware
96
Importance: strong physical security is crucial for information security as it prevents unauthorized access to sensitive data and infrastructure.
97
Key components:
98
Access control: implementing measures to restrict access to authorized personnel only
such as: Biometric authentication (fingerprint
99
Perimeter security: protecting the physical boundaries of the facility
such as: fences and barriers
100
Environmental controls: maintaining optimal environment conditions for hardware and data
including: climate control
101
102
BOLLARDS
103
104
Definition: bollards are sturdy
vertical posts installed to block vehicles or unauthorized personnel from accessing restricted areas.
105
Purpose: they prevent physical breaches
such as ramming attacks
106
Examples of Use: Protecting server rooms
data centers
107
Material: typically made of steel or reinforced concrete for durability and impact resistance.
108
Integration: often used alongside access control systems like gates or barriers for comprehensive perimeter security.
109
110
ACCESS CONTROL VESTIBULE
111
112
An access control vestibule refers to a mechanism or process that provides controlled entry to secure areas or systems. Here’s a brief explanation:
113
Intermediate access point: acts as a transitional space between an unsecured area and a secure one
like an airlock in physical security.
114
Verification layer: enforced multi-factor authentication
identity verification
115
Mitigation of tailgating or piggybacking: prevents unauthorized users from accessing secure areas by ensuring each subject undergoes individual verification.
116
Granular access control: limits access based on specific roles
policies
117
118
FENCES
119
120
Definition: fences are barriers designed to prevent unauthorized physical access to a specific area
typically around facilities
121
Purpose: they server as the first line of defense by creating a clear boundary between secure and public areas.
122
Deterrent: visible fences discourage intrusions and signal that the area is protected.
123
Types: fences can vary based on security needs
including chain-link
124
Integration: often paired with additional security measures like surveillance cameras
motion sensors
125
LIGHTING
126
127
Deterrence: well-lit areas discourage unauthorized access and criminal activities by increasing the risk of detection.
128
Visibility: enhances visibility for security personnel
CCTV cameras
129
Access control: illuminates entry points such as doors
gates
130
Safety: reduces accidents and hazards for authorized personnel by improving navigation in dark areas.
131
Strategic placement: critical in high-risk zones
such as perimeters
132
Integration with Technology: works in conjunction with motion sensors
CCTV
133
134
TYPES OF SENSORS
135
136
Infrared: detects heat signatures in the form of infrared radiation emitted by people
animals
137
Integrated into security cameras and alarm systems to improve detection capabilities.
138
Pressure: designed to detect changes in pressure on a surface or in a specific area
such as a person walking on a floor or stepping on a mat.
139
Used in access control systems to ensure that only authorized individuals can enter.
140
Microwave: uses microwave technology to detect movement within a specific area.
141
Often used with other types of sensors to reduce false alarms.
142
Ultrasonic: emits high-frequency sound waves and measure the time it takes for the sound waves to bounce back after hitting an object or surface.
143
Commonly used in parking assistance
robotic navigation
144
145
DECEPTION TECHNOLOGIES HONEYPOT & HONEYNET
146
147
Honeypot
148
Decoy systems designed to attract and trap attackers.
149
Mimic real vulnerabilities to lure cyber threats.
150
Used to study attackers’ techniques and tools.
151
Provide early warnings for emerging threats.
152
Help organizations improve security defense.
153
154
Honeynet
155
A network of interconnected honeypots.
156
Simulates an entire system environment for attackers.
157
Collects comprehensive data on cyber threats.
158
Deploys and distracts attackers from real assets.
159
Used in advanced threat intelligence and research.
160
161
162
HONEY FILES & HONEY TOKENS
163
164
Honey File
165
Decoy file designed to attract attackers.
166
Placed in strategic locations to monitor unauthorized access.
167
Triggers alerts when accessed and modified.
168
169
Honey Token
170
Decoy data (e.g. fake credentials
API keys).
171
Embedded in systems or documents to track misuse.
172
Generates alerts when used
indicating a breach.
173
174
CHANGE MANAGEMENT & CONFIGURATION MANAGEMENT
175
176
Change Management
177
A structured process to plan
evaluate
178
Ensures minimal disruption
proper documentation
179
180
Configuration Management
181
The process of maintaining and controlling the settings of IT systems.
182
Ensures consistency
traceability
183
184
CHANGE MANAGEMENT & CHANGE CONTROL
185
186
Change Control
187
A subset of change management focused on evaluating
approving
188
Ensures changes are assessed for risks and align with organizational policies.
189
190
Difference
191
Change Management: Broader process covering planning
communication
192
Change Control: A step within change management
ensuring each change is reviewed and approved before implementation.
193
194
195
196
BUSINESS PROCESSES IMPACTING SECURITY OPERATIONS
197
198
A change management program should address important business process issues
including:
199
Approval process
200
Ensures changes are reviewed and authorized to prevent unauthorized modifications.
201
Ownership
202
Clearly defines responsibility for implementing and managing changes securely.
203
Stakeholders
204
Involves relevant parties to address security
operational
205
Impact analysis
206
Assesses now changes affect security
systems
207
Test Results
208
Validates the security and functionality of changes before deployment.
209
Backout plan
210
Provides a strategy to revert changes if issues or risks arise.
211
Maintenance Window
212
Allocates a secure time frame to implement changes with minimal disruption.
213
Standard operating procedure (SOP)
214
Defines consistent
secure methods for executing changes.
215
216
TECHNICAL IMPLICATIONS
217
218
There are several technical implications that should be considered as part of the change management process.
219
220
Allow Lists/Deny Lists
221
Changes may require updates to security policies or firewall rules.
222
Impact: Modifications can affect system access or communication
potentially causing disruptions.
223
224
Restricted Activities
225
Specific activities may be limited to authorized personnel only.
226
Impact: can slow down change processes and affect efficiency.
227
228
Downtime
229
Changes may require planned downtime to prevent conflicts and ensure stability.
230
Impact: Downtime must be scheduled carefully to minimize business disruptions.
231
232
233
234
DOCUMENTATION
235
236
The process of documentation current state of and changes to the operating environment.
237
238
Records all aspects of the change process
including planning
239
Ensures traceability by documenting the reasons
risks
240
Facilitates accountability
allowing teams to review and analyze past changes.
241
Supports compliance by maintaining detailed logs for audits and regulatory requirements.
242
Helps in future planning by providing insights for similar changes.
243
244
245
VERSION CONTROL
246
247
Tracks changes to files
documents
248
Helps manage updates and ensures the integrity of configurations
software
249
Facilities collaboration
allowing multiple users to work on the same files without conflicts.
250
Enables rollback to previous versions in case of errors or security issues.
251
Critical for secure development by managing changes to sensitive files and maintaining audit trails.
252
PUBLIC KEY INFRASTRUCTURE (PKI)
253
254
PKI (Public Key Infrastructure) is a system used to manage digital keys and certificates for secure communication.
255
Purpose: Ensures that data transmitted over the internet is encrypted
secure
256
Components:
257
Public Key: shared key used for encryption.
258
Private Key: secret key used for decryption
kept secure.
259
Digital certificates: verify the identity of users and devices.
260
261
262
263
264
CA & CHAIN OF TRUST
265
266
CA (Certificate Authority)
267
A trusted organization that issues and manages digital certificates.
268
Verifies the identity of entities (e.g. users
websites) before issuing certificates to ensure secure communication.
269
270
Chain of Trust
271
A sequence of trusted certificates that starts from a root CA and ends at the end-entity certificate.
272
Ensures the validity of digital certificates by verifying each certificate’s authenticity in the chain.
273
If each link in the chain is trusted
the entire certificate is trusted.
274
275
276
CRL (Certificate Revocation List)
277
Definition: A list of digital certificates that have been revoked before their expiration.
278
Purpose: Allows systems to check if a certificate is still valid or has been compromised.
279
Managed by CA: The Certificate Authority maintains and updates the CRL.
280
Revocation Reasons: Certificates may be revoked due to compromise
expiration
281
Usage: Helps ensure trust by preventing the use of invalid or compromised certificates.
282
283
284
285
286
ONLINE CERTIFICATE STATUS PROTOCOL (OCSP) & CERTIFICATE SIGNING REQUEST
287
288
OCSP (Online Certificate Status Protocol)
289
A protocol used to check the status of a digital certificate in real-time.
290
Provides information on whether a certificate is valid
revoked
291
More efficient than checking certificates revocation lists (CRLs) as it reduces the need for large data downloads.
292
CSR (Certificate Signing Request)
293
A message sent to a Certificate Authority (CA) to request a digital certificate.
294
Contains information about the entity (e.g. domain name
public key) requesting the certificate.
295
Must be generated before obtaining an SSL/TLS certificate for securing communications.
296
CERTIFICATE TYPES
297
298
User Certificate: Authenticates an individual user’s identity for secure access.
299
Root Certificate: The foundation of a trust hierarchy
issued by a Certificate Authority (CA).
300
Domain Validation (DV) Certificate: Confirms ownership of a domain
providing basic encryption.
301
Extended Validation (EV) Certificate: Provides the highest level of trust by verifying the organization’s identity.
302
Wildcard Certificate: Secures a domain and all its subdomains under a single certificate.
303
Code Signing Certificate: Ensures software code integrity and authenticity.
304
Self-Signed Certificate: Created by the entity itself
not issued by a trusted CA
305
Machine/Computer Certificate: Used to identify and authenticate devices within network.
306
Email Certificate: Secures email communication with encryption and digital signatures.
307
Third-Party Certificate: Issued by an external CA to validate trust for non-affiliated entities.
308
Subject Alternative Name (SAN) Certificate: Secures multiple domain names and subdomains in a single certificate.
309
310
LEVELS OF ENCRYPTION
311
312
File Encryption: Protects individual files by encrypting their content
ensuring only authorized users with the correct decryption key can access them.
313
Example: Encrypting a document with a password.
314
Volume Encryption: Encrypts a specific logical storage space or partition
securing all data within that volume while leaving other parts of the disk accessible.
315
Example: Encrypting the “D:” drive in Windows.
316
Disk Encryption: Encrypts the entire storage device
including system and non-system files
317
Example: Full disk encryption with BitLocker.
318
319
320
DATA PROTECTION AT REST DRIVE ENCRYPTION
321
322
Full Disk Encryption (FDE): Encrypts the entire contents of a storage drive
including the operating system and user data
323
Example: BitLocker or FileVault.
324
Self-Encrypting Drive (SED): A hardware-based encryption method where the drive itself automatically encrypts and decrypts data using a built-in encryption module
providing seamless and fast encryption. Anything that is written to that drive is automatically stored in encrypted form.
325
Example: Samsung T7 SED.
326
327
DATA PROTECTION AT REST
328
329
Cloud Storage Encryption: Encrypts data stored in the cloud
at rest ensuring unauthorized access is prevented.
330
Example: AWS S3 server-side encryption.
331
Transparent Data Encryption (TDE): Encrypts database files automatically at the storage level
protecting data at rest while allowing authorized applications to access it seamlessly.
332
Example: Microsoft SQL Server TDE.
333
334
DATA PROTECTION IN TRANSIT
335
336
SSL (Secure Sockets Layer): Encrypts data transmitted between a user’s device and a server
preventing unauthorized access or interception during transit.
337
Example: Encrypting email communication.
338
HTTPS (Hypertext Transfer Protocol Secure): A secure version of HTTP that uses SSL/TLS to encrypt web traffic
ensuring secure communication between a browser and a website.
339
Example:Accessing a banking site via https://.
340
341
DATA PROTECTION IN USE
342
343
Protection of Data in Use (or During Processing): Refers to safeguarding data while it is being actively accessed
processed
344
How it is Done:
345
Secure Enclaves: Isolates sensitive computations in a hardware-protected (e.g. Intel SGX).
346
Homomorphic Encryption: Allows computations on encrypted data without decrypting it.
347
Access Controls: Restrict who or what can process the data to ensure only authorized entities access it.
348
349
SYMMETRIC VS ASYMMETRIC
350
351
Symmetric Encryption
352
Uses the same key (shared secret) for both encryption and decryption.
353
Fast and efficient.
354
Less scalable.
355
Requiring secure key sharing.
356
Example: AES (Advanced Encryption Standard)
357
358
Asymmetric Encryption
359
Uses a pair of keys - a public key & private key pair
360
Slower compared to Symmetric key encryption
361
Supports scalability and Key distribution
362
Viding secure key exchange but being slower.
363
Example: RSA (Rivest-Shamir-Adleman).
364
365
ASYMMETRIC KEYS USAGE
366
367
Key Sharing
368
Public keys are shard among communicating partners
369
Private keys are kept secret by each partner
370
371
Data Encryption
372
For encryption use the recipient’s public key
373
For decryption the recipient’s uses his/her own
374
375
Digital Signature
376
Use your own private key to sign a message
377
Use the sender’s public keys to validate the signature
378
379
380
USE CASES OF SYMMETRIC & ASYMMETRIC ALGORITHMS
381
382
Symmetric
383
Data at rest encryption: Used for bulk data encryption such as database and full disk encryption
384
VPN traffic encryption: Securing data transmitted through VPNs.
385
Example: Using AES for tunneling protocols like IPSec VPN.
386
387
Asymmetric
388
Secure Key Exchange: Exchanging symmetric keys securely over an untrusted network.
389
Example: RSA used in TLS handshakes. Use the sender’s public keys to validate the signature
390
Digital Signatures: Verifying the authenticity of a message or document.
391
Example: Signing an email using an RSA private key.
392
393
394
395
BLOCK AND STREAM CIPHERS
396
397
Block Ciphers:
398
Encrypts data in fixed-size blocks (e.g
128 bits).
399
Processes plaintext in chunks
applying the same encryption algorithm to each block.
400
Example: AES (Advanced Encryption Standard).
401
Slower but more secure for bulk data encryption.
402
403
Stream Ciphers:
404
Encrypts data one bit or byte at a time
continuously.
405
Typically faster and more efficient for real-time applications.
406
Example: RC4 (Rivest Cipher 4).
407
Often used in applications requiring high-speed encryption like audio and video streaming.
408
409
TRUSTED PLATFORM MODULE (TPM)
410
411
Definition: A dedicated microchip designed to secure hardware by storing cryptographic keys and other sensitive data.
412
Data Protection: Protects against unauthorized access and tampering by securely storing encryption keys
passwords
413
Secure Boot: Ensures only trusted software runs on a system during startup by verifying the integrity of the boot process.
414
Use Cases: Full disk encryption (e.g. bitlocker)
digital right management (DRM)
415
Compliance: helps meet security standards like GDPR and enhances enterprise security posture.
416
417
418
HARDWARE SECURITY MODULE (HSM)
419
420
Definition: A physical device used to generate
store
421
Purpose: Provides high-level protection for sensitive data
ensuring secure encryption and decryption operations.
422
Uses: common in industries like banking
government
423
Security: Resistant to tampering and physical attacks
ensuring data integrity and confidentiality.
424
Compliance: Often used to meet regulatory standards like FIPS 140-2 for cryptographic security.
425
426
427
KEY MANAGEMENT SYSTEM (KMS)
428
429
Centralized Management: Manages cryptographic keys for encryption
decryption
430
Security: Ensures secure generation
storage
431
Compliance: Helps organizations meet regulatory requirements (e.g.
PCI DSS
432
Automation: Automates key rotation
expiration
433
Integration: Often integrates with other security systems like encryption solutions and digital certificate authorities.
434
435
SECURE ENCLAVE
436
437
Isolated Environment: A hardware-based
isolated execution environment within a processor that protects sensitive data.
438
Encryption: Data processed inside the enclave is encrypted and never exposed to the rest of the system.
439
Integrity: Ensures data integrity and confidentiality even from privileged users or malware.
440
Use Cases: Commonly used for secure computations
cryptocurrency wallets
441
Example: Intel SGX (Software Guard Extensions) and Apple’s Secure Enclave.
442
443
444
STEGANOGRAPHY
445
446
Definition: The practice of concealing secret information within non-suspicious data (e.f. Images
audio
447
Purpose: Used to hide the existence of a message
making it undetectable to unauthorized users.
448
Techniques: Common methods include hiding data in the least significant bits of an image or audio file.
449
Applications: Employed for covert communication
digital watermarking
450
Difference from Encryption: Unlike encryption
which makes data unreadable
451
452
453
454
455
TOKENIZATION
456
457
Data Replacement: Replaces sensitive data (e.g.
credit card numbers) with unique
458
Security: Reduces the risk of data breaches by ensuring sensitive data is never stored or transmitted.
459
Irreversibility: Tokens cannot be reversed back to the original data without access to the secure tokenization system.
460
Compliance: Helps meet compliance requirements (e.g.
PCI DSS) by securing sensitive data.
461
Usage: Common in payment processing
healthcare
462
463
464
PSEUDONYMIZATION & ANONYMIZATION
465
466
Pseudonymization:
467
Replaces identifiable data with pseudonyms (e.g.
code numbers or aliases).
468
Allows re-identification if additional information is available.
469
Retains some data utility for processing while enhancing privacy.
470
Example: Replacing a name with a user ID.
471
472
Anonymization:
473
Removes all personally identifiable information (PII) from data
making re-identification possible.
474
Ensures data cannot be linked back to individuals under any circumstances.
475
Example: Removing names
addresses
476
477
Difference:
478
Pseudonymization allows re-identification if paired with additional data
while Anonymization makes re-identification impossible.
479
Pseudonymization provides more utility for analysis
whereas anonymization prioritizes privacy over data usability.
480
481
DATA MASKING
482
483
Definition: the process of obscuring sensitive data by replacing it with fictitious or scrambled values while retaining its original format.
484
Purpose: Protects sensitive information (e.g.
credit card numbers
485
Types: Static Data Masking (SDM) and Dynamic Data Masking (DDM).
486
Usage: Common in application development
testing
487
Benefits: Enhances data privacy
minimizes risk of exposure
488
489
490
491
492
HASHING VS ENCRYPTION
493
494
Hashing:
495
Converts data into a fixed-length string using a mathematical function.
496
One-way process; cannot be reversed to reveal original data.
497
Used for data integrity checks and password storage.
498
Example: SHA-256
MD5.
499
500
Encryption:
501
Transforms data into an unreadable format using a key
allowing reversal with the correct key.
502
Two-way process; original data can be retrieved.
503
Used for protecting data confidentiality during storage or transmission.
504
Example: AES
RSA.
505
506
USES OF DIFFERENT ALGORITHMS
507
508
Symmetric Encryption Uses:
509
Securing file storage (e.g.
AES for encrypted drives).
510
Encrypting database records (e.g.
credit card details).
511
Securing communication channels (e.g.
VPNs
512
513
Asymmetric Encryption Uses:
514
Secure key exchange (e.g.
TLS handshake).
515
Digital signatures to ensure authenticity (e.g.
signing emails).
516
Encrypting small amounts of data like passwords or keys.
517
518
Hash Function Uses:
519
Storing hashed passwords securely.
520
Verifying data integrity (e.g.
checksums for file transfers).
521
Digital signatures and certificates (e.g.
hashing documents before signing).
522
523
524
HASH FUNCTION REQUIREMENTS
525
526
Deterministic: The same input always produces the same hash output.
527
Fast Computation: Quickly generates a hash value for any given input.
528
Collision Resistance: Two different inputs should not produce the same hash output.
529
Pre-image Resistance: It should be computationally infeasible to reverse a hash to its original input.
530
Avalanche Effect: A small change in input should result in a significantly different hash.
531
532
SALTING
533
534
Definition: Adding a random value (salt) to data before hashing to enhance security.
535
Purpose: Protects against precomputed attacks like rainbow tables.
536
Uniqueness: Each salt is unique for every input
ensuring unique hash outputs even for identical inputs.
537
Storage: Salt is typically stored alongside the hashed value.
538
Use Case: Commonly used in password hashing for secure authentication systems.
539
540
DIGITAL SIGNATURE
541
542
Definition: A cryptographic method that uses asymmetric encryption to verify the authenticity and integrity of digital data.
543
How it Works: Created using the sender’s private key and verified with their public key.
544
Use Case:
545
Authentication: Positive identification of the data sender. Private key owner = Signer
546
Non-repudiation: The sender can’t deny sending the message because only he/she has the access to private key.
547
Integrity: Provide assurance that the data or message has not been altered in transit.
548
KEY STRETCHING
549
550
Definition: A technique to strengthen weak keys or passwords by applying a computationally intensive process multiple times.
551
Purpose: Increase the time required to crack passwords using brute force or dictionary attacks.
552
Methods: Uses algorithms like PBKDF2
bcrypt
553
How it Works: Iteratively hashes a password with added salt
making it computationally expensive to process.
554
Benefits: Enhances password security without requiring users to create longer passwords.
555
556
BLOCKCHAIN
557
558
Definition: A decentralized
distributed ledger that records transactions across multiple nodes securely and transparently.
559
Structure: Data is stored in blocks
linked together in chronological order to form a chain.
560
Immutability: Once recorded
data in a block cannot be altered without altering all subsequent blocks.
561
Consensus Mechanism: Ensures agreement among nodes
such as Proof of Work (POW) or Proof of Stake (PoS).
562
Use Cases: Cryptocurrencies (e.g.
Bitcoin)
563
564
BLOCKCHAIN VS OPEN PUBLIC LEDGER
565
566
Blockchain:
567
A type of distributed ledger that organizes data into linked
immutable blocks.
568
Uses cryptography and consensus mechanisms to ensure security and transparency.
569
Can be public
private
570
Example: Bitcoin blockchain.
571
572
Open Public Ledger:
573
A general term for any ledger that is publicly accessible and records transactions transparently.
574
May not necessarily use blockchain technology.
575
Focused on transparency and accessibility without needing cryptographic validation.
576
Example: Land ownership registries in some countries.
577
578
COMMON CRYPTOGRAPHIC CONCEPTS EXAM TIPS
579
580
Low Power Devices: Devices with limited battery or processing power need efficient encryption ECC
which provide strong security without draining resources.
581
Low latency requirements: For real-time applications like video calls
use fast encryption like stream ciphers (e.g.
582
Supporting Integrity: To check if data is unchanged
use hashing algorithms like SHA-256 or HMAC to verify data.
583
Supporting Authentication: To confirm identities
use digital signatures (e.g.
584
Supporting non-repudiation: to ensure someone cannot deny sending a message
use digital signatures combined with PKI to provide proof of origin.
585
586
587
588
CRYPTOGRAPHY LIMITATION
589
590
Speed: Cryptographic algorithms
especially asymmetric ones
591
Weak Keys: poorly chosen or short keys are vulnerable to brute-force attacks
undermining security.
592
Longevity: algorithms may become insecure as attackers find weaknesses
requiring frequent updates to cryptographic systems.
593
Predictability: poor implementation or predictable random number generators can make cryptographic systems easier to attack.
594
Reuse: Reusing keys or initialization vectors (IVs) compromises security by exposing patterns in encrypted data.
595
Entropy: Insufficient randomness (low entropy) in key generation weakens cryptographic strength
making it easier to crack.
596
597
THREAT ACTORS
598
599
Definition: threat actors are individuals
groups
600
601
Examples:
602
Nation State
603
Unskilled attacker
604
Hacktivist
605
Insider Threat
606
Organized Crime
607
Shadow IT
608
609
NATION-STATE
610
Definition: Government-sponsored attackers targeting specific organizations
nations
611
Motivation: Espionage
disrupting critical infrastructure
612
Skill Level: Highly skilled
employing advanced persistent threats (APTs).
613
Resources: Significant funding
access to zero-day vulnerabilities
614
Examples: Stuxnet attack
SolarWinds breach.
615
616
617
UNSKILLED ATTACKER (SCRIPT KIDDIE)
618
619
Definition: individuals with limited technical knowledge relying on pre-written scripts or tools.
620
Motivation: Curiosity
personal amusement
621
Skill Level: Low; lack deep understanding of security systems.
622
Resources: Publicly available hacking tools and resources.
623
Example: Using tools like LOIC (Low Orbit Ion Cannon) for basic DDoS attacks.
624
625
626
HACKTIVIST
627
628
Definition: Attackers driven by ideological or political goals to promote their agenda.
629
Motivation: Advocacy for social
political
630
Skill Level: Varies; can range from low (defacing websites) to highly skilled (data breaches).
631
Resources: Community-driven; relies on crowd-sourced tools and techniques.
632
Example: Anonymous targeting government or corporate websites.
633
634
INSIDER THREAT
635
636
Definition: Employees
contractors
637
Motivation: Financial gain
revenge
638
Skill Level: Moderate to high; depends on role and knowledge of internal systems.
639
Resources: Access to organizational systems
sensitive data
640
Examples: Edward Snowden’s disclosure of classified NSA data.
641
642
ORGANIZED CRIME
643
644
Definition: Criminal groups engaging in cybercrime for financial profit.
645
Motivation: Monetary gain through fraud
ransomware
646
Skill Level: High; often employs experts in hacking. Phishing
and malware development.
647
Resources: Well-funded operations with access to sophisticated tools.
648
Examples: Ransomware gangs like REvil or Conti.
649
650
SHADOW IT
651
652
Definition: Technology
devices
653
Motivation: Employees seek faster
more convenient tools to meet their needs.
654
Risks: Can lead to data breaches
compliance violations
655
Examples: Using personal cloud storage (e.g.
Google Drive) for work files without approval.
656
Mitigation: Implement policies
increase awareness
657
658
THREAT ACTORS MOTIVATION
659
660
Data exfiltration
661
Stealing sensitive or proprietary information
such as trade secrets or personal data.
662
Used to sell on the dark web
gain a competitive advantage
663
664
Espionage
665
Gaining unauthorized access to gather intelligence
often for strategic or geopolitical purposes.
666
Typically associated with nation-states targeting governments
corporations
667
668
Service disruption
669
Aiming to interrupt normal operations
such as disabling websites or critical infrastructure.
670
Methods include DDoS attacks or ransomware locking systems.
671
672
Blackmail
673
Threatening to release sensitive data or disrupt services unless a ransom or demand is met.
674
Often executed through ransomware or leaks of compromising information.
675
676
Financial gain
677
Primary motivation for cybercriminals targeting individuals or organizations for monetary profit.
678
Methods include phishing
ransomware
679
680
Philosophical/ Political beliefs
681
Motivated by ideology to make a statement or promote a cause.
682
Common with hacktivists targeting governments or corporations.
683
684
Ethical
685
Motivated by the desire to improve systems by identifying vulnerabilities (e.g.
ethical hacking).
686
Often involves reporting issues responsibly without malicious intent.
687
688
Revenge
689
Personal grievances leading to malicious actions against an individual or organization.
690
Common in insider threats or former employees seeking retribution.
691
692
Disruption/ Chaos
693
Creating disorder for amusement
notoriety
694
Often linked to unskilled attackers or cyber vandals.
695
696
War
697
Using cyberattacks as part of a nation-state’s warfare strategy.
698
Targets include critical infrastructure
communication networks
699
700
701
Threat Actor
702
Skill Level
703
Motivation
704
Nation-State
705
Highly skilled (APTs)
706
Espionage
disruption
707
Unskilled Attacker (Script Kiddie)
708
Low (Uses pre-written tools)
709
Curiosity
personal amusement
710
Hacktivist
711
Varies (low to high)
712
Philosophical/political beliefs
advocacy
713
Insider Threat
714
Moderate to high
715
Revenge
financial gain
716
Organized Crime
717
High
718
Financial gain
blackmail
719
720
721
722
ACTOR ATTRIBUTES
723
Threats from Internal vs. External Actors
724
Internal Threats:
725
Direct access to sensitive systems and data increases potential damage.
726
Difficult to detect due to legitimate access rights.
727
Examples: Data leaks
sabotage
728
External Threats:
729
Can exploit vulnerabilities in network defenses or social engineering.
730
Persistent and adaptable
often bypassing traditional security measures.
731
Examples: phishing attacks
ransomware
732
733
Threats Based on Resources/Funding
734
Low-Resource Threat Actors:
735
Can still cause significant harm by leveraging widely available tools or vulnerabilities.
736
Examples: Malware kits
brute-force attacks
737
Well-Funded Threat Actors:
738
Utilize advanced tools
zero-day vulnerabilities
739
Examples: Sophisticated espionage campaigns
ransomware-as-a-service (RaaS).
740
741
Threats Based on Level of Sophistication/Capability
742
Low Sophistication:
743
May rely on poorly configured systems or known vulnerabilities.
744
Less targeted but can exploit weak security practices.
745
High Sophistication:
746
Targeted attacks using advanced techniques
such as APTs or spear-phishing.
747
Capable of long-term infiltration and significant data compromise.
748
749
750
ATTACK SURFACE
751
752
Definition: The total number of points or path through which an attacker could try to access or exploit a system.
753
Examples:
754
External attack surface: Public-facing servers
websites
755
Internal attack surface: Vulnerabilities in internal software
misconfigured databases
756
Physical attack surface: Office doors
USB ports
757
758
THREAT VECTOR
759
760
Definition: Specific methods or pathways used by attackers to breach or compromise a system.
761
Examples:
762
Email phishing: Sending malicious links or attachments.
763
Malware delivery: Using infected software or USB drives.
764
Network-based attacks: Exploiting unpatched systems via open ports or weak firewalls.
765
Insider threats: Employees with malicious intent or careless actions.
766
767
768
THREAT VECTOR VS ATTACK SURFACE - AN ANALOGY
769
770
Think of your System or Network as a house:
771
The attack surface is like all the potential entry points into the house - front
door
772
Threat vectors are the ways a burglar might exploit those entry points - picking the lock
breaking a window
773
774
Relationship:
775
The attack surface represents the possible places an attack could occur
while threat vectors represent the techniques used to exploit those places. A house with more entry points (larger attack surface) offers a burglar more opportunities to choose a specific threat vector.
