Module 5 Review Exam

Common Security Terminology

• Vulnerability: A weakness in a system, application, or process that a threat actor can exploit to gain unauthorized access or cause damage. Examples include software bugs, misconfigurations, or poor security practices like an outdated operating system.
• Threat: Any potential event or actor that can exploit a vulnerability to harm a system, network, or data. Threats can be intentional (e.g., hackers, malware) or unintentional (e.g., human error, natural disasters).
• Threat Actor: An individual, group, or entity that targets systems, networks, or data by exploiting vulnerabilities to achieve malicious objectives, such as data theft, operational disruption, or unauthorized access.
• Exploit: A method or tool a threat actor uses to attack. Examples include malicious code, scripts, or procedures designed to compromise a target, such as a phishing email containing a link to a website exploiting a browser vulnerability to install malware.
• Risk: Potential loss, damage, or harm when a threat actor exploits a security breach or vulnerability. It measures the likelihood of a threat exploiting a vulnerability and its impact.

Confidentiality, Integrity, and Availability (CIA)

• Confidentiality: Protecting information and ensuring only authorized subjects (users, processes, systems) can access it. In a healthcare organization, securing patient medical records with encryption is an example.
• Integrity: The information will be protected against modification by unauthorized subjects. Changes are monitored and alerted to prevent tampering with transaction information in an online banking system.
• Availability: Ensuring reliable access to information when needed for authorized subjects, ensuring timely access to the information.

Logical Security

• Encryption: A cybersecurity process that converts readable information (plaintext) into an unreadable format (ciphertext) using algorithms and cryptographic keys. It ensures confidentiality during transmission. 
• Data in Transit: Data transferred between locations, such as over a network. Encryption protects data traversing networks.
• Protocols: Methods to secure data in transit like TLS, SSL, and IPsec. TLS secures web traffic (e.g., HTTPS), email, file transfer and other application-level communications. IPsec provides encryption and authentication at the network layer.
• SSH: Encrypts command-line access to remote devices. 
• Logical security: The use of software and rules to protect a network and ensure data security from unauthorized access 

Encrypting Data at Rest

• Data at Rest: Digital information stored on a device that is not being used or transmitted.
• Full Disk Encryption: Encrypts the entire storage device, including the operating system, applications, and user data.
• File-Level Encryption: Encrypts individual files rather than the entire device.
• Third-Party Software: Tools such as 7-Zip, AxCrypt, and GPG are used for file encryption.

Symmetric and Asymmetric Encryption

• Symmetric Key Cryptography: Uses a single shared key for both encryption and decryption.
• Asymmetric Key Cryptography: Uses a separate public key and private key (key pair). Public key used for encryption, and the private key used for decryption. Common is RSA and ECC.

Public Key Infrastructure (PKI)

• Certificates: Electronic ID cards proving owner identity and securely distributing public keys.
• Certificate Authority (CA): Trusted party issuing, signing, and storing digital certificates.
• Public Key Infrastructure (PKI): A framework managing certificate creation, distribution, and validation for secure communication like web traffic or emails.

Certificate Revocation List (CRL)

• CRL: List of revoked and suspended certificates.
• Validity Check: Browsers check certificates' validity (publication date, expiry, and revocation).
• Updates: Browsers typically download CRL updates to maintain correct certificate status.
• OCSP: An alternative method to retrieve certificate information in real time.

Self-Signed Certificates

• Self-signed Certificates: Certificates signed by the entity using the certificate, meaning there is no validation from a trusted CA. Use for development or test purposes, not production environments.
• Security risk: Should not be used for securing critical assets.

Identity & Access Management (IAM)

• IAM: A framework to manage access to resources and ensure the right personnel, devices, and things have access at the appropriate time. A centralized user directory is commonly used.
• Authentication: Proving that the user is who they claim to be.
• Multifactor Authentication (MFA): Using a combination of authentication factors to strengthen security.
• Something you Know: Knowledge factor like passwords, PINs.
• Something you Have: Possession factor like smart cards, USB keys.
• Something you Are: Inherence factor like biometrics.

Somewhere You Are Factor

• Location-based Factor: Locating a device in a defined space and enforcing access or security changes. Example- a device crossing a border and triggering an alarm. This can be done internally or for external connections.

Time-Based Authentication (TOTP)

• Time-based One-Time Passwords (TOTP): Generate ephemeral, unique codes based on a shared secret and current time. Used for extra authentication.
• TOTP generation: Code is generated using a secret key and current time.
• Implementation: Using mobile apps or software.

Single Sign-On (SSO)

• Single Sign-On (SSO): Authenticate once and gain access to multiple associated resources without further authentication.

Lightweight Directory Access Protocol (LDAP)

• Lightweight Directory Access Protocol (LDAP): Open, vendor agnostic protocol used by applications to query, update, and add data. Used for storing & accessing user credentials, etc., often with SSO systems.

Security Assertion Markup Language (SAML)

• SAML: Used for securely exchanging authentication/authorization data between an identity provider and service provider.

Authorization

• Authorization: Restricting what users can do within a system once they have authenticated. Permissions and privileges are assigned.

Role-Based Access Control (RBAC)

• RBAC: Systems assign permissions based on roles, not just identity.
• Least Privilege: Assign only necessary permissions to individuals, reducing security risks.

Account Management, Provisioning & Deprovisioning

• Provisioning: The process of creating and implementing resources and services to allow execution of specific activities.
• Deprovisioning: Revokes access to an account when a user leaves an organization, changing roles or moving.

Remote Authentication Dial-In User Service (RADIUS)

• RADIUS: Centralized AAA (Authentication, Authorization, Accounting) services for secure remote access using usernames/passwords or certificates.

Terminal Access Controller Access Control System Plus (TACACS+)

• **TACACS+: **AAA protocol for managing access to network devices and separating features.

Geofencing

• Geofencing: A logical security method using geographical boundaries. Access restrictions can be applied within a geographic boundary, and monitoring can be applied.

Internet of Things (IoT) & Industrial Internet of Things (IIoT)

• IoT / IIoT: Networked physical devices, including smart devices (home or business) in manufacturing.
• Vulnerabilities: Lack of built-in security features making them susceptible to attacks.
• Security: Network segmentation required to isolate these devices from rest of the network.

Supervisory Control and Data Acquisition (SCADA)

• SCADA: Used in industrial environments for long-distance monitoring and control.

Guest Networks

• Guest Networks: Designated sections of a network for visitors or temporary users, preventing access to internal systems.

Deception & Disruption

• Deception Technologies: Used to attract and learn about attacker behavior & tools.
• Honeypots: Mimic crucial services or systems to lure attackers, capture data about their techniques and activities.

Physical Security

• Security Cameras and Surveillance: Monitor activity in restricted areas and sensitive locations for audits and investigations.
• Locks: Security and control of access.

Audits and Regulatory Compliance

• Audits and Compliance: Enforces security practices.
• Data Locality: Restricting data processing and storage to certain geographic regions.
• Payment Card Industry Data Security Standards (PCI DSS): Framework for securing payment systems and cardholder data.
• General Data Protection Regulation (GDPR): Protects personal data and privacy.

Social Engineering

• Social Engineering: Manipulates users into revealing sensitive information.
• Phishing Attacks: Pretending to be a trustworthy entity to gain access.
• Techniques: Emails, SMS, fake pages imitating legitimate sites.
• Protection Measures: Validate sender info, check URLs, be cautious of attachments, and use two-factor authentication (2FA).

Dumpster Diving

• Dumpster Diving: Accessing discarded documents or materials to gather sensitive information.
• Detection: Educate employees on waste disposal procedures, use cross-cut shredders.

Denial of Service (DoS) Attacks

• Denial of Service (DoS): Attacks aimed at making a service unavailable to legitimate users. 
• Buffer Overflow: Exploit vulnerabilities leading to crashes and security breaches.
• Flooding: Overwhelming the target with requests.
• Distributed Denial of Service (DDoS): Multiple sources overwhelming target.

On-path Attack

• On-path Attack: Attackers intercepting communications between devices.
• Forms: Passive (monitor communications), active (inject or modify data).
• Methods: Wi-Fi eavesdropping, DNS spoofing, session hijacking & ARP spoofing.

VLAN Hopping

• VLAN Hopping: Exploiting VLAN configurations to gain unauthorized access to other VLANs.
• Methods: Switch spoofing, double tagging to gain access to different VLANS on a network.

Device Hardening

• Device Hardening: Strengthening the security of each device by changing default settings to reduce vulnerabilities.
• Methods: Disable unused ports and services, change default user credentials and passwords, use secure protocols (802.1x), and use port security & MAC filtering.

Key Management

• Key Management: The process and practices related to keys across the whole lifecycle.
• Methods: Key generation, distribution, storage, rotation & revocation; securing data in transit & at rest.