Seguridad Informática - Chat GPT.

Cybersecurity Elements Overview

• Cybersecurity includes firewalls, proxy servers, update servers, network-managed antivirus software, SIEM, and log records.

CIA Triad: Confidentiality

• Confidentiality ensures only authorized individuals gain information access.
• It stands as a core principle within the CIA Triad.

Application-Level Firewalls

• A Web Application Firewall (WAF) operates at the application level.
• WAFs protect web applications from threats like SQL injection and XSS attacks.

SIEM Systems

• SIEM systems correlate security events.
• SIEM systems centralize this correlation for detecting complex threat patterns.

Proxy Servers

• Proxy servers filter requests using predefined security rules.
• These rules dictate what traffic is allowed or blocked.

Hardware Firewalls

• Hardware firewalls offer high performance and capacity.
• Ideal firewall type for protecting complex internal networks.

WSUS for Local Updates

• WSUS is a Microsoft solution to manage OS updates in local networks.
• It stands for Windows Server Update Services

SIEM Log Centralization

• Centralizing logs in SIEM enables faster threat detection.
• It allows SIEM to correlate events and quickly spot attack patterns.

DDoS Attacks

• A Distributed Denial of Service (DDoS) attack overloads a system with concurrent requests.
• The aim of a DDoS attack is to render the system inoperable.

Anonymous Proxy Servers

• Anonymous proxy servers anonymize user requests.
• Anonymous proxy servers hide the user's identity on the internet.

Software Firewalls

• Software firewalls protect a specific computer.
• Software firewalls installs and operates directly on a computer system.

Aspects Not Managed by WSUS

• Real-time log management is not handled by update servers like WSUS.
• Real-time log management is typical of SIEM systems.

SQL Injection Attacks

• SQL injection involves inserting malicious SQL commands.
• The aim of a SQL injection is to manipulate databases.

Essential SIEM Component

• Event logs are an essential component for a SIEM to correlate events and detect threats.
• Logs provide the raw data for SIEM analysis.

Network Firewalls

• Network firewalls control traffic based on ports and specific protocols.
• They are designed for controlling traffic according to specified ports and protocols.

Reverse Proxy Functionality

• Reverse proxies protect servers from external requests.
• They act as intermediates by filtering incoming solicitation.

Log Management Best Practices

• Modifying logs is not a good practice.
• Modifying logs compromises integrity and hinders audits.

Mitigating Ransomware Impact

• Centralized antivirus is a tool to mitigate the impact of ransomware.
• Centralized antivirus detects and blocks ransomware threats before spread.

Man-in-the-Middle Attacks

• Man-in-the-middle attacks intercept traffic between two parties.
• This interception is for manipulating or spying.

CIA Triad: Availability

• Data backups relate to availability in the CIA Triad.
• Backups ensure data remains available even after incidents.

WAF Actions Against XSS

• WAFs detect and block Cross-Site Scripting (XSS) attacks.
• WAFs blocks XSS attacks that inject malicious scripts into web applications.

Security Event Correlation

• SIEM tools correlate multiple security events.
• This correlation helps identify attack patterns and creates alerts.

Network Firewall Characteristics

• Network firewalls filter traffic.
• Network firewalls analyses and controls traffic at the network level.

Proxy Server Main Objective

• A proxy server intermediates and filters traffic between clients and servers.
• Proxy servers act to control and filter requests.

Enhancing Complex Attack Detection

• SIEM enhances the detection of complex attacks.
• SIEM does this by correlating security events.

Securing WAF Access

• Access Control Lists (ACL) should be properly configured to prevent unauthorized access in a WAF.
• ACLs define users or IPs allowed to access WAF-protected applications.

Network Firewall Monitoring

• Network firewalls monitor HTTPS, SMTP, and FTP.
• Network firewalls can monitor and filter these protocols, among others.

Bypassing Web Restrictions

• Anonymous proxies enable access to blocked sites.
• Anonymous proxies obscure user identity and bypass access restrictions.

Defining Ransomware Attacks

• Ransomware encrypts data.
• Ransomware demands a ransom for data decryption.

Protecting Against XSS Attacks

• A WAF is effective for protecting against Cross-Site Scripting (XSS) attacks.
• WAFs are designed to block XSS and other web application threats.

Ensuring Data Integrity

• Data integrity is ensured through hashing algorithms.
• Hashing algorithms verify data hasn't been altered.

Proxy Types

• Reverse proxies protect servers.
• Direct proxies protect clients.
• Direct proxies manages outgoing client requests, while reverse proxies manages incoming server requests.

Centralized Security Management

• SIEM centralizes security management in corporate networks.
• SIEM centralizes the collection, correlation, and analysis of security events.

Web Content Filtering

• Content proxies filter web content by category.
• Content proxies filter access to websites based on defined categories or policies.

Protecting Identity

• Anonymous proxies are suitable for protecting identities.
• They are ideal for use on public networks.

Preventing Ransomware

• Network segmentation prevents ransomware spread.
• Network segmentation limits lateral movement of ransomware.

Non-SIEM Actions

• Content filtering is not a Security Information and Event Management (SIEM) function.
• Content filtering is a function of proxy servers.

Web Protocols and WAF

• HTTP is commonly attacked without a WAF.
• HTTP is vulnerable to XSS and SQL injection without a WAF..

Reducing Unauthorized Log Access

• Encryption reduces the risks of unauthorized log access.
• Encryption protects logs by making them unreadable without proper keys.

CIA Triad and Firewalls

• Firewalls are associated with confidentiality.
• Firewalls protect confidentiality by blocking unauthorized data access.

Automating Local Updates

• WSUS automates update distribution in a local network.

Detecting Suspicious Activity

• SIEM detects suspicious activity based on traffic patterns.
• SIEM does so by correlating events and generating security alerts.

Filtering Traffic

• Network firewalls filter traffic based on predefined rules.
• Network firewalls filters according to administrator-defined rules.

Exploiting Databases

• SQL injection attacks databases through manipulated queries.
• This injection exploits vulnerabilities.

Protecting Web Apps

• A Web Application Firewall (WAF) is for protecting web applications from malicious attacks.
• WAFs block threats like XSS and SQL injection.

Real-Time Access Monitoring

• SIEM helps detect unauthorized access attempts in real-time.
• SIEM does so through centralized logs and event correlation.

Overloading Servers

• DDoS attacks overload servers or systems.
• DDoS achieves this by sending massive traffic.

Blocking Malicious Scripts

• WAF is a tool that protects web applications from malicious scripts.
• A WAF identifies and blocks malicious scripts like XSS attacks.

Securing Data

• Encryption secures data by granting authorized access.
• Encryption does this by encoding communications.

Gaining Unauthorized Access

• Phishing is an attack to impersonate and gain unauthorized access.
• Phishing decieves users into providing credentials or personal information.

Filtering Outbound Traffic

• Direct proxies filter outbound traffic.
• Direct proxies filters and manages traffic from clients to servers.