Malware Types and Characteristics
102 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What type of malware attaches itself to a host application and must be executed by the user or system?

  • Worm
  • Armored virus
  • Rootkit
  • Trojan (correct)

    • Pharming is a scamming practice where malicious code is installed on a server, redirecting users to fraudulent websites.

    True

    What type of malware encrypts valuable user files?

    Crypto-malware

    _______ is a string of code embedded into an application or script that executes in response to a specific event.

    <p>Logic bomb</p> Signup and view all the answers

    Which protocol encrypts traffic in transit and can be used to encrypt other protocols such as FTP?

    <p>SSH</p> Signup and view all the answers

    Match the wireless attacks with their descriptions:

    <p>Evil Twin = Rogue AP using the same SSID as a legit AP WPS = Allows users to configure a wireless network by pressing buttons or entering a short PIN Bluejacking = Sending unsolicited message to nearby Bluetooth device RFID = Enables one-way wireless communication, typically for asset tracking</p> Signup and view all the answers

    S/MIME provides security.

    <p>False</p> Signup and view all the answers

    What does LDAPS stand for and what is it used for?

    <p>LDAP over Secure Socket Layer; used to securely communicate with directories such as AD DS</p> Signup and view all the answers

    AES is used to encrypt traffic over ___.

    <p>SRTP</p> Signup and view all the answers

    Match the following email protocols with their respective ports:

    <p>POP3 = Port 995 IMAP4 = Port 993 SMTP = Port 25</p> Signup and view all the answers

    What attack occurs when the hashing algorithm creates the same hash from different passwords?

    <p>Hash Collision</p> Signup and view all the answers

    What type of attack uses a dictionary of words, with variations, as passwords?

    <p>Dictionary Attack</p> Signup and view all the answers

    _______-Steals the hash, uses the list of passwords to produce that hash to identify the password.

    <p>Birthday Attack</p> Signup and view all the answers

    Match the threat actor types with their descriptions:

    <p>Script Kiddies = Download and run scripts developed by others Hacktivist = Conveys a social or political message through hacking Organized Crime = Monetize hacking efforts Nation States/APT = Elite hackers conducting information warfare Insiders = Employees with access to organizational assets Competitors = Seek to copy, steal, or disrupt information assets</p> Signup and view all the answers

    A brute force attack involves guessing all possible character combinations.

    <p>True</p> Signup and view all the answers

    What is the purpose of a Secure Baseline?

    <p>To monitor system compliance with security standards</p> Signup and view all the answers

    HVAC systems have a significant impact on the confidentiality of data centers.

    <p>False</p> Signup and view all the answers

    Define SoC (System on a Chip).

    <p>An integrated circuit that includes all the functionality of a computing system within the hardware.</p> Signup and view all the answers

    ________ is a process of allocating resources based on demand.

    <p>Provisioning</p> Signup and view all the answers

    Match the following cloud deployment models with their descriptions:

    <p>SaaS = Highly scalable, on-demand applications PaaS = Provides fully managed platform for application development IaaS = Provides access to hardware in a self-managed platform</p> Signup and view all the answers

    What is the main purpose of IKE Phase 1?

    <p>Establish a secure authenticated communication channel.</p> Signup and view all the answers

    Aggressive mode in IKE Phase 1 is slower but more secure than Main mode.

    <p>False</p> Signup and view all the answers

    What does ESP stand for in IPsec protocols?

    <p>Encapsulating Security Payload</p> Signup and view all the answers

    In IPSec, _____ provides authentication for the data and the IP header of a packet using one-way hash.

    <p>AH</p> Signup and view all the answers

    Match the IPSec Protocol with its description:

    <p>AH = Provides authentication for data and IP header ESP = Provides confidentiality and authentication for data</p> Signup and view all the answers

    What does NAC stand for?

    <p>Network Access Control</p> Signup and view all the answers

    What tool is used to capture, display, and analyze packets sent over a network?

    <p>Protocol Analyzer</p> Signup and view all the answers

    SSL decryptors use a man-in-the-middle technique to open and re-encrypt SSL/TLS traffic.

    <p>True</p> Signup and view all the answers

    Mobile device management can restrict what ____________ can be installed and prevent unapproved applications.

    <p>application</p> Signup and view all the answers

    Match the following connection methods with their descriptions:

    <p>Wi-Fi = Connect with SSID and Pre-Shared key NFC = Radio communication over short proximity for payment gateway Bluetooth = Supports Classic, high speed, and Low energy modes USB = Physically connect devices</p> Signup and view all the answers

    Which RAID level is block-striped with error check and provides high availability?

    <p>RAID 5</p> Signup and view all the answers

    What is the primary purpose of a Faraday Cage in a data center?

    <p>Prevents illicit monitoring of computer systems through electromagnetic emissions</p> Signup and view all the answers

    Match the following access control model with its description:

    <p>MAC = Uses security labels to determine access DAC = Specifies that every object has an owner with full control ABAC = Uses attributes in policies to grant access Role-based access control = Assigns access to roles instead of users</p> Signup and view all the answers

    NTLM is a legacy protocol that has been replaced by Kerberos.

    <p>True</p> Signup and view all the answers

    ______ is an improvement over RADIUS and uses EAP for better security.

    <p>DIAMETER</p> Signup and view all the answers

    Which authentication method uses a combination of a secret key and an incrementing counter for generating one-time passwords?

    <p>HOTP</p> Signup and view all the answers

    What is the purpose of capturing video in a forensic investigation?

    <p>Record time offset- difference between the system clock and the actual time</p> Signup and view all the answers

    Which backup type backs up all selected data?

    <p>Full</p> Signup and view all the answers

    Data sovereignty implies that data originating within a country must be stored outside that country.

    <p>False</p> Signup and view all the answers

    ______ is a process for moving from a normal operational capability to the continuity-of-operations version of the business.

    <p>Failover</p> Signup and view all the answers

    Match the location selection with the appropriate description:

    <p>Off-site backups = Copy of backup in a separate geographic location Distance = Some backups need to be close for easy retrieval, while others need to be far away for protection from geographical disasters</p> Signup and view all the answers

    What does TOTP stand for and how does it differ from HOTP?

    <p>TOTP stands for Time based OTP. It uses a timestamp instead of a counter and typically expires after 30 seconds. HOTP stands for HMAC-based One-Time Password and generates an OTP value of 6-8 digits.</p> Signup and view all the answers

    Which type of accounts should not be used to ensure IAAA (Identification, Authentication, Authorization, and Accountability) can be implemented?

    <p>Shared and generic accounts/credentials</p> Signup and view all the answers

    Standard Operating Procedures (SOPs) are step-by-step instructions that employees can use to perform uncommon tasks.

    <p>False</p> Signup and view all the answers

    _______ identifies potential risks related to Personally Identifiable Information (PII) to ensure compliance with laws and regulations.

    <p>Privacy impact assessment</p> Signup and view all the answers

    Match the following Risk Management concepts with their definitions:

    <p>RTO = Recovery Time Objective RPO = Recovery Point Objective MTBF = Mean Time Between Failures MTTR = Mean Time to Restore/Repair</p> Signup and view all the answers

    What is an Armored virus designed to do?

    <p>Make it difficult to reverse engineer</p> Signup and view all the answers

    Social Engineering may involve tactics like Whaling and Vishing.

    <p>True</p> Signup and view all the answers

    What is the primary purpose of a Keylogger?

    <p>Keep track of every single keystroke</p> Signup and view all the answers

    What type of software learns users' habits for targeted advertising? ______________

    <p>Adware</p> Signup and view all the answers

    Match the wireless attack type with its description:

    <p>Replay = Capture and modify data to impersonate parties Evil Twin = Rogue access point using the same SSID as a legit AP RFID = One way wireless communication for asset tracking Disassociation = Disassociate wireless client from the network</p> Signup and view all the answers

    What is NAC used for?

    <p>Host health checks</p> Signup and view all the answers

    What does SSL decryptors do?

    <p>Opens SSL/TLS traffic using man-in-the-middle technique, screens the traffic, and re-encrypts it.</p> Signup and view all the answers

    Containerization isolates and protects applications and their data.

    <p>True</p> Signup and view all the answers

    ______ is a protocol analyzer that captures, displays, and analyzes network packets.

    <p>Wireshark</p> Signup and view all the answers

    Match the mobile device connection methods with their descriptions:

    <p>Wi-Fi = Connect to SSID with Pre-Shared key Bluetooth = Supports Classic, high speed, and Low energy modes NFC = Radio communication over a short proximity, commonly used for payments USB = Used to physically connect devices</p> Signup and view all the answers

    Which type of attack occurs when the hashing algorithm creates the same hash from different passwords?

    <p>Collision attack</p> Signup and view all the answers

    What are Rainbow tables used for?

    <p>To find passwords from password hashes</p> Signup and view all the answers

    Hackers use _______ attack to guess all possible character combinations.

    <p>brute force</p> Signup and view all the answers

    In a collision attack, the attacker steals the hash and uses a list of passwords to find the matching one.

    <p>True</p> Signup and view all the answers

    Match the following network security tools with their functions:

    <p>Nmap &amp; Zenmap = Port Scanner Wireshark = Traffic Analyzer Nessus = Vulnerability Scanner Tripwire = File integrity checker</p> Signup and view all the answers

    What is the purpose of a VPN concentrator?

    <p>To secure communication channels</p> Signup and view all the answers

    Which protocols are used for protecting user data in IPsec?

    <p>Both AH and ESP</p> Signup and view all the answers

    What is the purpose of IKE Phase 1 in IPsec?

    <p>To establish a secure channel for negotiating IPsec SAs</p> Signup and view all the answers

    Aggressive mode in IKE Phase 1 is more secure than Main mode.

    <p>False</p> Signup and view all the answers

    What is the purpose of a Split tunnel in VPNs?

    <p>Avoid encryption bottlenecks</p> Signup and view all the answers

    ______ provides authentication for the data and the IP header of a packet in IPsec using a one-way hash.

    <p>AH</p> Signup and view all the answers

    What does LDAPS stand for and what port is it commonly used on?

    <p>Lightweight Directory Access Protocol Secure; port 636</p> Signup and view all the answers

    Which protocol uses port 22 for file transfer and encryption?

    <p>SFTP</p> Signup and view all the answers

    TLS has replaced SSL for securing traffic on the internet.

    <p>True</p> Signup and view all the answers

    Secure POP3 commonly uses port 995, whereas IMAP4 with SSL uses port ____.

    <p>993</p> Signup and view all the answers

    Match the protocol with its primary usage:

    <p>SSH = Encrypt data-in-transit FTPS = Secure file transfer TLS = Replace SSL for encryption VLANs = Provide increased network segmentation</p> Signup and view all the answers

    What is the purpose of a parity drive in RAID 5?

    <p>Block-striping with error checking</p> Signup and view all the answers

    Explain the purpose of a Faraday Cage in physical security.

    <p>Faraday Cage prevents illicit monitoring of computer systems through electromagnetic fields.</p> Signup and view all the answers

    Key cards are more secure than metallic keys because they can be remotely revoked. True or False?

    <p>True</p> Signup and view all the answers

    LDAP stands for Lightweight Directory ________ Protocol.

    <p>Access</p> Signup and view all the answers

    Match the biometric factor with its corresponding description:

    <p>Fingerprint Scanner = Identification and authentication using fingerprints Retinal Scanner = Identification based on blood vessel patterns in the eye Iris Scanner = Authentication based on iris patterns Facial Recognition = Identification using facial features</p> Signup and view all the answers

    What does a Secure baseline document specify?

    <p>Minimum specifications for a secure application, system, or service</p> Signup and view all the answers

    Integrity measurement involves monitoring whether an application, system, or service complies with the security baseline.

    <p>True</p> Signup and view all the answers

    SCADA/ICS stands for Industrial Control System and is controlled by a Supervisory Control and ________.

    <p>Data</p> Signup and view all the answers

    What is the core engine of Smart devices/IoT often based on?

    <p>Linux-type kernel</p> Signup and view all the answers

    Match the development life-cycle model with its description:

    <p>Waterfall = Finish one stage before moving to the next, cannot go back Agile = Uses iterative cycles, each creating a working product Extreme Programming (XP) = Advocates frequent releases in short cycles Scrum = Framework centered on a 30-day cycle process, focused on perspective</p> Signup and view all the answers

    What is the abbreviation for 'Time based OTP'?

    <p>TOTP</p> Signup and view all the answers

    Which system is used by the Department of Defense (DOD) for military personnel and contractors?

    <p>CAC</p> Signup and view all the answers

    Two-phase commit ensures that if a portion of a transaction cannot complete, the entire transaction is still performed.

    <p>False</p> Signup and view all the answers

    ______ is a technical control where users or processes are granted only those rights and permissions needed to perform their assigned tasks or functions.

    <p>Least privilege</p> Signup and view all the answers

    Match the following concepts with their descriptions:

    <p>RTO = How long it takes to restore a system after an outage MTTF = Expected lifetime of a non-repairable system SLE = Product of Exposure Factor and Asset Value Chain of custody = Assures that the evidence has been controlled and handled properly after collection</p> Signup and view all the answers

    What is the purpose of taking hashes in digital forensics?

    <p>provides integrity of the captured images</p> Signup and view all the answers

    What is the main purpose of witness interviews in digital forensics?

    <p>first hand report</p> Signup and view all the answers

    What does DRP (disaster recovery plan) include?

    <p>Information on disaster recovery strategy</p> Signup and view all the answers

    ______ captures the data at a point in time and is a fast way to restore the system.

    <p>Snapshot</p> Signup and view all the answers

    Failover involves moving from normal operations to the business continuity version of the organization.

    <p>True</p> Signup and view all the answers

    What is the primary objective of fault tolerance in a system or service?

    <p>To provide high availability</p> Signup and view all the answers

    What is the main purpose of a RAID 1 configuration?

    <p>To provide redundancy and high availability</p> Signup and view all the answers

    What is the primary function of a mantrap in a data center?

    <p>To control access to the data center</p> Signup and view all the answers

    What is the purpose of a Faraday Cage in a data center?

    <p>To block electromagnetic interference</p> Signup and view all the answers

    What is the primary benefit of using a redundant system design?

    <p>To achieve high availability</p> Signup and view all the answers

    What is the primary purpose of using signs in a physical security context?

    <p>To provide visual cues</p> Signup and view all the answers

    What is the primary benefit of using a distributed allocation system?

    <p>To enhance system scalability</p> Signup and view all the answers

    What is the primary purpose of a lock in a physical security context?

    <p>To control access to restricted areas</p> Signup and view all the answers

    What is the primary function of an air gap in a physical security context?

    <p>To isolate a system from the network</p> Signup and view all the answers

    What is the primary benefit of using RAID 5 configuration?

    <p>To achieve high availability and redundancy</p> Signup and view all the answers

    Study Notes

    Threats, Attacks, and Vulnerabilities

    Malware

    • Viruses: attach themselves to a host application
      • Types:
        • Sparse infector virus: behaves sporadically and unpredictably
        • Multipartite virus: can infect both program files and the boot sector
        • Stealth virus: uses multiple techniques to evade detection
    • Worms: self-replicating malware that travels through a network without host application or user interaction
    • Armored virus: makes it difficult to reverse-engineer
    • Crypto-malware: encrypts valuable user files (e.g., ransomware)
    • Trojans: appear to be useful but contain a malicious component
    • Rootkits: have root-level or kernel-level access, can modify system files and system access
    • Keyloggers: keep track of every keystroke
    • Adware: learns user habits for targeted advertising (e.g., pop-ups)
    • Spyware: monitors user computer activity and sends information to a third party
    • Bots: multiple computers acting as software robots, functioning together in a network for malicious purposes (e.g., sending spam, launching DDoS)
    • Logic bombs: strings of code embedded into an application or script, execute in response to an event or specific time
    • Backdoors: provide another way of accessing a system, often created by malware

    Social Engineering

    • Pharming: misdirecting users to fraudulent websites without their knowledge or consent
    • Phishing: emailing users to trick them into revealing personal information or clicking a malicious link
    • Spimming: phishing using instant messages (e.g., Facebook Messenger)
    • Spear phishing: targeted form of phishing, sending emails to specific users or groups
    • Whaling: targeting high-level executives with phishing attacks
    • Vishing: phishing using phone calls
    • Tailgating: following an employee through a door without showing credentials
    • Impersonation: identity theft
    • Dumpster diving: searching through trash to gain information from discarded documents
    • Shoulder surfing: looking over someone's shoulder to obtain sensitive information
    • Hoax: false message, often an email claiming a virus exists and encouraging deletion of files or changing system configuration
    • Watering hole attack: infecting a website frequently visited by the target group with malware

    Types of Attacks

    • DoS (Denial of Service): disrupting services provided by another system
    • DDoS (Distributed Denial of Service): attack from multiple computers to a single target
    • Man-in-the-Middle (MitM): intercepting and modifying communications between two parties
    • Buffer overflow: exploiting an application that receives more data than it can handle
    • Injection: inserting malicious code or input to alter system behavior
    • Cross-site Scripting (XSS): injecting malicious scripts into a website
    • Cross-Site Request Forgery (CSRF): tricking users into performing unintended actions on a web application
    • Privilege Escalation: exploiting a programming flaw or buffer overflow to gain admin-level or root-level access
    • ARP Poisoning: modifying the ARP cache to redirect traffic
    • DNS Poisoning: modifying DNS records to redirect users to malicious websites
    • Domain Hijacking: taking control of a domain name without authorization
    • Man-in-the-Browser: intercepting and modifying communications between a browser and a website
    • Zero-day Exploit: exploiting an undocumented or unknown vulnerability
    • Replay Attack: capturing and re-transmitting data to impersonate one party in a session
    • Pass-the-Hash: capturing password hashes and using them to authenticate

    Threat Actor Types and Attributes

    • Script Kiddies: novice hackers using existing tools and scripts
    • Hacktivists: using hacking to convey a social or political message
    • Organized Crime: monetizing hacking efforts
    • Nation States/APT (Advanced Persistent Threat): elite hackers conducting information warfare
    • Insiders: employees or contractors with authorized access to an organization
    • Competitors: using hacking to gain an advantage
    • Attributes:
      • Internal/External
      • Level of sophistication
      • Resources/Funding
      • Intent/Motivation
      • Use of Open-Source Intelligence (OSINT)### Network Security Threats
    • Improper input validation can lead to memory overflow, pointer dereference, and unexpected results.
    • DLL injection can add malicious functionality to a system.
    • System sprawl and undocumented assets can allow attackers to traverse the network more easily.
    • New threats and zero-day attacks can exploit unknown vulnerabilities.
    • Improper certificate and key management can lead to data insecurity.

    Firewalls

    • A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
    • A dual-homed firewall is a firewall with two network interfaces.
    • ACLs (Access Control Lists) identify what traffic is allowed and what is blocked based on networks, subnets, IP addresses, ports, and some protocols.
    • Packet filtering firewalls are based on ACLs and only examine the packet header.
    • Application-based firewalls are installed on a host and can analyze traffic on a deeper level.
    • Stateful firewalls inspect traffic and make decisions based on the context or state of the traffic.
    • Stateless firewalls use ACLs to make decisions.

    VPNs

    • A VPN (Virtual Private Network) provides a means of cryptographically securing a communication channel.
    • A VPN concentrator is the endpoint for VPN activity.
    • Remote access VPNs allow a remote host to connect to a network.
    • Site-to-site VPNs connect two networks from remote sites.
    • TLS (Transport Layer Security) provides Layer 6 encryption services for Layer 7 applications.
    • SSL Portal VPNs are used to securely access the web from a browser.
    • SSL Tunnel VPNs allow secure access to applications and other network services.

    IPSec

    • IPSec (Internet Protocol Security) is an encryption protocol that defines the rules for encryption, authentication, and key management for TCP/IP transmissions.
    • IKE (Internet Key Exchange) is a hybrid protocol that negotiates, establishes, modifies, and deletes security associations.
    • IKE uses IKE phase 1 to establish a secure authenticated communication channel and IKE phase 2 to negotiate IPsec security associations.
    • IPSec protocols include AH (Authentication Header) and ESP (Encapsulating Security Payload).

    VPN Modes

    • Split tunneling routes only some traffic through the VPN.
    • Full tunneling encrypts all traffic, including internet traffic.
    • Always-on VPNs self-configure and connect once an internet connection is sensed.

    NIPS/NIDS

    • NIPS (Network-based Intrusion Prevention System) and NIDS (Network-based Intrusion Detection System) analyze traffic in the network.
    • NIPS can stop traffic if it detects a signature match or anomaly.
    • NIDS can alert the admin of suspicious connections or potential threats.
    • Anomaly-based detection can detect a wide range of zero-day attacks.

    Router Security

    • ACLs can be used to identify what traffic is allowed and what is blocked.
    • Anti-spoofing can be used to prevent spoofing attacks.
    • NAT (Network Address Translation) can be used to hide internal IP addresses.
    • Port security can be used to disable unused ports and limit the number of MAC addresses per port.

    Switch Security

    • Port security can be used to disable unused ports and limit the number of MAC addresses per port.
    • Loop prevention can be used to prevent switching loops.
    • Flood guard can be used to detect and block traffic to prevent flooding attacks.

    Proxy Servers

    • A proxy server acts as an Internet gateway, firewall, and Internet caching server for a private network.
    • Forward proxy forwards requests for services from clients.
    • Reverse proxy receives requests on behalf of clients.
    • Transparent proxy accepts and forwards requests without modifying them.
    • Load balancers can be used to distribute traffic across multiple servers.

    Access Points

    • SSID (Service Set Identifier) identifies the name of a wireless network.
    • MAC filtering can be used to block unauthorized devices.
    • Signal strength can be used to determine the distance and quality of a wireless connection.
    • Antenna types and placement can affect the quality of a wireless connection.

    SIEM

    • SIEM (Security Information and Event Management) classifies and analyzes security data from numerous sources.
    • Time synchronization can be used to correlate events across the entire enterprise.
    • Aggregation can be used to collect information in a central place.
    • Correlation can be used to connect events based on time, common events, and behavior.
    • Automated alerting and triggers can be used to issue alerts or react to events.

    DLP

    • DLP (Data Loss Prevention) detects and blocks data loss.
    • USB blocking can be used to prevent data loss.
    • Cloud-based DLP detects and blocks data moved to the cloud.
    • Email DLP detects and blocks data loss via email.

    NAC

    • NAC (Network Access Control) uses agents to inspect clients for health.
    • Agent code can be stored in the host machine or deployed to memory.
    • Permanent agents are pre-deployed to the endpoints.
    • Dissolvable agents are deployed when needed and removed after use.
    • Host health checks can be used to restrict access to unhealthy clients.

    Other Security Tools

    • Protocol analyzers capture, display, and analyze packets sent over a network.
    • Network scanners search for live hosts, open ports, and TCP/UDP services.
    • Rogue system detection helps detect unknown devices on a network.
    • Vulnerability scanners recognize weaknesses like open ports, weak passwords, and default accounts and passwords.
    • Configuration compliance scanners establish a baseline configuration and set to measure deviations.
    • Exploitation frameworks assist with the tasks associated with exploiting vulnerabilities.
    • Data sanitization tools destroy or purge a system before retiring and disposing of it.
    • Steganography tools hide messages in images, videos, or audio files.
    • Honeypots divert attackers from live networks.
    • Backup utilities back up critical data.### Network Security Fundamentals
    • ARP (Address Resolution Protocol) is used to identify MAC addresses from IP addresses.
    • ipconfig/ip/ifconfig shows TCP/IP configuration, including IP address, subnet mask, default gateway, MAC address, and DNS server.
    • tcpdump is a command-line packet analyzer for Linux, similar to Wireshark.
    • nmap is a network scanner that identifies active hosts, addresses, protocols, and services running on each host, as well as the OS of the host.

    Troubleshooting Common Security Issues

    • Unencrypted credentials/clear text: avoid using obsolete protocols that transfer passwords in clear text.
    • Log and event anomalies: record event anomalies and decide what to log and what not to log.
    • Permission issues: outdated user rights lists can create permission issues.
    • Access violations: should be logged and alerted.
    • Certificate issues: occur when a user attempts to use a certificate that lacks a complete chain of trust back to a trusted root.
    • Data exfiltration: attacker attempts to steal data.

    Analyze and Interpret Output from Security Technologies

    • HIDS/HIPS: alert on behaviors based on signatures.
    • Antivirus: alerts, prevents, and logs malicious attack attempts.
    • File Integrity check: compares the original hash and calculated hash.
    • Host-based firewall: firewall in the host machine.
    • Application whitelisting: only allows special applications to be installed.
    • Removable media control: prevents data exfiltration using encryption technology.
    • Advanced malware tools: specialized malware removal and recovery tools.
    • Patch management tools: help patch OS and applications.
    • UTM: all-in-one security, acting as a firewall, IDS/IPS, anti-malware, anti-spam, and content filtering.
    • DLP: detects and prevents data transfer.
    • Data execution prevention: OS works with the CPU to prevent programs from executing in certain parts of memory.

    Deploy Mobile Devices Securely

    • Connection methods: cellular, Wi-Fi, SATCOM, Bluetooth, NFC, Infrared, and USB.
    • Mobile device management concepts: application management, content management, remote wipe, geofencing, geolocation, screen locks, push notification services, passwords and pins, biometrics, context-aware authentication, containerization, storage segmentation, and full device encryption.

    Implement Secure Protocols

    • Protocols: DNSSEC, SSH, S/MIME, SRTP, LDAPS, SFTP, FTPS, SNMPv3, SSL, TLS, and HTTPS.
    • DNSSEC: prevents DNS cache poisoning by providing validation for DNS responses.
    • SSH: encrypts traffic in transit and can be used to encrypt other protocols.
    • S/MIME: provides encryption and authentication for email.

    Architecture and Design

    • Frameworks: industry-standard frameworks, regulatory frameworks, national frameworks, and industry-specific frameworks.
    • Secure configuration guides: CIS, OWASP, and vendor-specific guides.
    • Defense-in-depth/Layered security: implementing multiple layers of protection.
    • Vendor diversity: implementing security controls from different vendors.
    • Control diversity: using different security control types.

    Implement Secure Network Architecture Concepts

    • Zones/topologies: DMZ, extranet, intranet, wireless, guest, and honeynets.
    • Segregation/segmentation/isolation: physical, logical (VLAN), virtualization, and air gaps.
    • Tunneling/VPN: site-to-site, remote access, and IPSec.
    • Security device/technology placement: sensors, collectors, correlation engines, filters, proxies, firewalls, VPN concentrators, SSL accelerators, load balancers, and DDoS mitigators.
    • SDN: uses virtualization technologies to route traffic instead of using hardware routers and switches.

    Threats, Attacks, and Vulnerabilities

    Malware

    • Viruses: attach themselves to a host application
      • Types:
        • Sparse infector virus: behaves sporadically and unpredictably
        • Multipartite virus: can infect both program files and the boot sector
        • Stealth virus: uses multiple techniques to evade detection
    • Worms: self-replicating malware that travels through a network without host application or user interaction
    • Armored virus: makes it difficult to reverse-engineer
    • Crypto-malware: encrypts valuable user files (e.g., ransomware)
    • Trojans: appear to be useful but contain a malicious component
    • Rootkits: have root-level or kernel-level access, can modify system files and system access
    • Keyloggers: keep track of every keystroke
    • Adware: learns user habits for targeted advertising (e.g., pop-ups)
    • Spyware: monitors user computer activity and sends information to a third party
    • Bots: multiple computers acting as software robots, functioning together in a network for malicious purposes (e.g., sending spam, launching DDoS)
    • Logic bombs: strings of code embedded into an application or script, execute in response to an event or specific time
    • Backdoors: provide another way of accessing a system, often created by malware

    Social Engineering

    • Pharming: misdirecting users to fraudulent websites without their knowledge or consent
    • Phishing: emailing users to trick them into revealing personal information or clicking a malicious link
    • Spimming: phishing using instant messages (e.g., Facebook Messenger)
    • Spear phishing: targeted form of phishing, sending emails to specific users or groups
    • Whaling: targeting high-level executives with phishing attacks
    • Vishing: phishing using phone calls
    • Tailgating: following an employee through a door without showing credentials
    • Impersonation: identity theft
    • Dumpster diving: searching through trash to gain information from discarded documents
    • Shoulder surfing: looking over someone's shoulder to obtain sensitive information
    • Hoax: false message, often an email claiming a virus exists and encouraging deletion of files or changing system configuration
    • Watering hole attack: infecting a website frequently visited by the target group with malware

    Types of Attacks

    • DoS (Denial of Service): disrupting services provided by another system
    • DDoS (Distributed Denial of Service): attack from multiple computers to a single target
    • Man-in-the-Middle (MitM): intercepting and modifying communications between two parties
    • Buffer overflow: exploiting an application that receives more data than it can handle
    • Injection: inserting malicious code or input to alter system behavior
    • Cross-site Scripting (XSS): injecting malicious scripts into a website
    • Cross-Site Request Forgery (CSRF): tricking users into performing unintended actions on a web application
    • Privilege Escalation: exploiting a programming flaw or buffer overflow to gain admin-level or root-level access
    • ARP Poisoning: modifying the ARP cache to redirect traffic
    • DNS Poisoning: modifying DNS records to redirect users to malicious websites
    • Domain Hijacking: taking control of a domain name without authorization
    • Man-in-the-Browser: intercepting and modifying communications between a browser and a website
    • Zero-day Exploit: exploiting an undocumented or unknown vulnerability
    • Replay Attack: capturing and re-transmitting data to impersonate one party in a session
    • Pass-the-Hash: capturing password hashes and using them to authenticate

    Threat Actor Types and Attributes

    • Script Kiddies: novice hackers using existing tools and scripts
    • Hacktivists: using hacking to convey a social or political message
    • Organized Crime: monetizing hacking efforts
    • Nation States/APT (Advanced Persistent Threat): elite hackers conducting information warfare
    • Insiders: employees or contractors with authorized access to an organization
    • Competitors: using hacking to gain an advantage
    • Attributes:
      • Internal/External
      • Level of sophistication
      • Resources/Funding
      • Intent/Motivation
      • Use of Open-Source Intelligence (OSINT)### Network Security Threats
    • Improper input validation can lead to memory overflow, pointer dereference, and unexpected results.
    • DLL injection can add malicious functionality to a system.
    • System sprawl and undocumented assets can allow attackers to traverse the network more easily.
    • New threats and zero-day attacks can exploit unknown vulnerabilities.
    • Improper certificate and key management can lead to data insecurity.

    Firewalls

    • A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
    • A dual-homed firewall is a firewall with two network interfaces.
    • ACLs (Access Control Lists) identify what traffic is allowed and what is blocked based on networks, subnets, IP addresses, ports, and some protocols.
    • Packet filtering firewalls are based on ACLs and only examine the packet header.
    • Application-based firewalls are installed on a host and can analyze traffic on a deeper level.
    • Stateful firewalls inspect traffic and make decisions based on the context or state of the traffic.
    • Stateless firewalls use ACLs to make decisions.

    VPNs

    • A VPN (Virtual Private Network) provides a means of cryptographically securing a communication channel.
    • A VPN concentrator is the endpoint for VPN activity.
    • Remote access VPNs allow a remote host to connect to a network.
    • Site-to-site VPNs connect two networks from remote sites.
    • TLS (Transport Layer Security) provides Layer 6 encryption services for Layer 7 applications.
    • SSL Portal VPNs are used to securely access the web from a browser.
    • SSL Tunnel VPNs allow secure access to applications and other network services.

    IPSec

    • IPSec (Internet Protocol Security) is an encryption protocol that defines the rules for encryption, authentication, and key management for TCP/IP transmissions.
    • IKE (Internet Key Exchange) is a hybrid protocol that negotiates, establishes, modifies, and deletes security associations.
    • IKE uses IKE phase 1 to establish a secure authenticated communication channel and IKE phase 2 to negotiate IPsec security associations.
    • IPSec protocols include AH (Authentication Header) and ESP (Encapsulating Security Payload).

    VPN Modes

    • Split tunneling routes only some traffic through the VPN.
    • Full tunneling encrypts all traffic, including internet traffic.
    • Always-on VPNs self-configure and connect once an internet connection is sensed.

    NIPS/NIDS

    • NIPS (Network-based Intrusion Prevention System) and NIDS (Network-based Intrusion Detection System) analyze traffic in the network.
    • NIPS can stop traffic if it detects a signature match or anomaly.
    • NIDS can alert the admin of suspicious connections or potential threats.
    • Anomaly-based detection can detect a wide range of zero-day attacks.

    Router Security

    • ACLs can be used to identify what traffic is allowed and what is blocked.
    • Anti-spoofing can be used to prevent spoofing attacks.
    • NAT (Network Address Translation) can be used to hide internal IP addresses.
    • Port security can be used to disable unused ports and limit the number of MAC addresses per port.

    Switch Security

    • Port security can be used to disable unused ports and limit the number of MAC addresses per port.
    • Loop prevention can be used to prevent switching loops.
    • Flood guard can be used to detect and block traffic to prevent flooding attacks.

    Proxy Servers

    • A proxy server acts as an Internet gateway, firewall, and Internet caching server for a private network.
    • Forward proxy forwards requests for services from clients.
    • Reverse proxy receives requests on behalf of clients.
    • Transparent proxy accepts and forwards requests without modifying them.
    • Load balancers can be used to distribute traffic across multiple servers.

    Access Points

    • SSID (Service Set Identifier) identifies the name of a wireless network.
    • MAC filtering can be used to block unauthorized devices.
    • Signal strength can be used to determine the distance and quality of a wireless connection.
    • Antenna types and placement can affect the quality of a wireless connection.

    SIEM

    • SIEM (Security Information and Event Management) classifies and analyzes security data from numerous sources.
    • Time synchronization can be used to correlate events across the entire enterprise.
    • Aggregation can be used to collect information in a central place.
    • Correlation can be used to connect events based on time, common events, and behavior.
    • Automated alerting and triggers can be used to issue alerts or react to events.

    DLP

    • DLP (Data Loss Prevention) detects and blocks data loss.
    • USB blocking can be used to prevent data loss.
    • Cloud-based DLP detects and blocks data moved to the cloud.
    • Email DLP detects and blocks data loss via email.

    NAC

    • NAC (Network Access Control) uses agents to inspect clients for health.
    • Agent code can be stored in the host machine or deployed to memory.
    • Permanent agents are pre-deployed to the endpoints.
    • Dissolvable agents are deployed when needed and removed after use.
    • Host health checks can be used to restrict access to unhealthy clients.

    Other Security Tools

    • Protocol analyzers capture, display, and analyze packets sent over a network.
    • Network scanners search for live hosts, open ports, and TCP/UDP services.
    • Rogue system detection helps detect unknown devices on a network.
    • Vulnerability scanners recognize weaknesses like open ports, weak passwords, and default accounts and passwords.
    • Configuration compliance scanners establish a baseline configuration and set to measure deviations.
    • Exploitation frameworks assist with the tasks associated with exploiting vulnerabilities.
    • Data sanitization tools destroy or purge a system before retiring and disposing of it.
    • Steganography tools hide messages in images, videos, or audio files.
    • Honeypots divert attackers from live networks.
    • Backup utilities back up critical data.### Network Security Fundamentals
    • ARP (Address Resolution Protocol) is used to identify MAC addresses from IP addresses.
    • ipconfig/ip/ifconfig shows TCP/IP configuration, including IP address, subnet mask, default gateway, MAC address, and DNS server.
    • tcpdump is a command-line packet analyzer for Linux, similar to Wireshark.
    • nmap is a network scanner that identifies active hosts, addresses, protocols, and services running on each host, as well as the OS of the host.

    Troubleshooting Common Security Issues

    • Unencrypted credentials/clear text: avoid using obsolete protocols that transfer passwords in clear text.
    • Log and event anomalies: record event anomalies and decide what to log and what not to log.
    • Permission issues: outdated user rights lists can create permission issues.
    • Access violations: should be logged and alerted.
    • Certificate issues: occur when a user attempts to use a certificate that lacks a complete chain of trust back to a trusted root.
    • Data exfiltration: attacker attempts to steal data.

    Analyze and Interpret Output from Security Technologies

    • HIDS/HIPS: alert on behaviors based on signatures.
    • Antivirus: alerts, prevents, and logs malicious attack attempts.
    • File Integrity check: compares the original hash and calculated hash.
    • Host-based firewall: firewall in the host machine.
    • Application whitelisting: only allows special applications to be installed.
    • Removable media control: prevents data exfiltration using encryption technology.
    • Advanced malware tools: specialized malware removal and recovery tools.
    • Patch management tools: help patch OS and applications.
    • UTM: all-in-one security, acting as a firewall, IDS/IPS, anti-malware, anti-spam, and content filtering.
    • DLP: detects and prevents data transfer.
    • Data execution prevention: OS works with the CPU to prevent programs from executing in certain parts of memory.

    Deploy Mobile Devices Securely

    • Connection methods: cellular, Wi-Fi, SATCOM, Bluetooth, NFC, Infrared, and USB.
    • Mobile device management concepts: application management, content management, remote wipe, geofencing, geolocation, screen locks, push notification services, passwords and pins, biometrics, context-aware authentication, containerization, storage segmentation, and full device encryption.

    Implement Secure Protocols

    • Protocols: DNSSEC, SSH, S/MIME, SRTP, LDAPS, SFTP, FTPS, SNMPv3, SSL, TLS, and HTTPS.
    • DNSSEC: prevents DNS cache poisoning by providing validation for DNS responses.
    • SSH: encrypts traffic in transit and can be used to encrypt other protocols.
    • S/MIME: provides encryption and authentication for email.

    Architecture and Design

    • Frameworks: industry-standard frameworks, regulatory frameworks, national frameworks, and industry-specific frameworks.
    • Secure configuration guides: CIS, OWASP, and vendor-specific guides.
    • Defense-in-depth/Layered security: implementing multiple layers of protection.
    • Vendor diversity: implementing security controls from different vendors.
    • Control diversity: using different security control types.

    Implement Secure Network Architecture Concepts

    • Zones/topologies: DMZ, extranet, intranet, wireless, guest, and honeynets.
    • Segregation/segmentation/isolation: physical, logical (VLAN), virtualization, and air gaps.
    • Tunneling/VPN: site-to-site, remote access, and IPSec.
    • Security device/technology placement: sensors, collectors, correlation engines, filters, proxies, firewalls, VPN concentrators, SSL accelerators, load balancers, and DDoS mitigators.
    • SDN: uses virtualization technologies to route traffic instead of using hardware routers and switches.

    Social Engineering Principles

    • Authority: Respect for authority figures is used to manipulate individuals
    • Intimidation: Bullying tactics are used to create fear and compliance
    • Scarcity: Limited-time offers or exclusive deals create a sense of urgency
    • Consensus: Fake reviews or testimonials are used to build trust
    • Familiarity: People are more likely to trust someone they like or have a connection with
    • Shoulder surfing and tailgating: Using social engineering to gain physical access to restricted areas
    • Trust: Building trust to gain access or manipulate individuals
    • Urgency: Creating a sense of urgency to prompt action

    Application/Service Attacks

    • DoS: Attack from a single source to disrupt services
    • DDoS: Attack from multiple computers to a single target
    • Man-in-the-Middle: Using a separate computer to intercept, read, and modify traffic
    • Buffer overflow: Overflowing a buffer with malicious data to crash or compromise systems
    • Use of patches and input validation to prevent buffer overflow attacks

    Vulnerability Identification

    • Identifying weaknesses: Open ports, weak passwords, default accounts, and security/configuration errors
    • Identifying lack of security controls: Missing security controls, outdated patches, and lack of antivirus software
    • Identifying common misconfigurations: Incorrectly configured ports, weak protocols, and incorrect configuration of networking devices
    • Intrusive vs. non-intrusive testing: Scanning for vulnerabilities vs. simulating attacks to identify vulnerabilities
    • Credentialed vs. non-credentialed testing: Scanning with admin privileges vs. gaining admin access using escalation techniques

    Impact of Vulnerabilities

    • Race conditions: When two or more applications attempt to access a resource at the same time
    • Vulnerabilities due to End-of-life systems, embedded systems, and lack of vendor support
    • Use of third-party source code escrow to gain access to source code when vendors go out of business

    Network Access Control (NAC)

    • Agent vs. agentless: Agent code stored on the host machine vs. code residing on the network
    • Permanent vs. dissolvable agents: Pre-deployed agents vs. deployed when needed and removed after use
    • Host health checks: Inspecting clients for health, including up-to-date antivirus software and restricting access to unhealthy clients

    Mail Gateway Security

    • Spam filter: Blocking spam using solutions like Appriver and Mimecast
    • DLP: Implementing Data Loss Prevention policy to prevent data leaks
    • Encryption: Encrypting mail traffic using solutions like PGP and S/MIME

    Network Segregation and Encryption

    • Bridge: Network segregating device operating in layer 2
    • SSL/TLS accelerators: Using transparent devices to encrypt traffic instead of larger web servers
    • SSL decryptors: Opening SSL/TLS traffic using man-in-the-middle technique and re-encrypting it

    Hardware Security Modules

    • Managing and storing encryption keys

    Deploying Mobile Devices Securely

    • Connection methods: Cellular, Wi-Fi, SATCOM, Bluetooth, NFC, ANT, and Infrared
    • Mobile device management concepts: Application management, content management, remote wipe, and distributive allocation
    • Redundancy and fault tolerance: Designing systems to remain operational with minimal downtime

    Physical Security Controls

    • Lighting: Allowing observation of people and activities
    • Signs: Visual cues to keep people away from restricted areas
    • Fencing/gate/cage: Building a perimeter to restrict access
    • Security guards: Monitoring and controlling access to restricted areas
    • Alarms: Providing accurate and useful alerts
    • Safe and secure cabinets/enclosures: Physically securing equipment and data
    • Protected distribution/protected cabling: Securing cables to prevent tapping and DoS
    • Air gap: Isolating an entity to separate it from everything else
    • Mantrap: Preventing tailgating and controlling access to data centers
    • Faraday Cage: Preventing illicit monitoring of computer systems through Van Eck emissions
    • Lock types: Using smart locks and cipher locks that can be programmable

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    CompTIA Security+ -training-1.pdf

    Description

    Learn about the different types of malware, including viruses, worms, and armored viruses. Understand their characteristics and behaviors.

    More Like This

    Computer Malware and Virus Names Quiz
    10 questions

    Computer Malware and Virus Names Quiz

    TimelyBaltimore avatar
    TimelyBaltimore
    Types of Malicious Software (Malware)
    5 questions

    Types of Malicious Software (Malware)

    PersonalizedEarthArt avatar
    PersonalizedEarthArt
    Sources and Types of Malware Quiz
    40 questions

    Sources and Types of Malware Quiz

    AdorableMaple avatar
    AdorableMaple
    Types of Malware Quiz
    10 questions

    Types of Malware Quiz

    WorthEmpowerment1870 avatar
    WorthEmpowerment1870
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser