Validated Digital Signatures and ESP Protocol

Validated Digital Signatures

• Validated digital signatures in email software help detect spam.
• These signatures are based on qualified certificates from a certificate authority, ensuring the key cannot be forced or reproduced.
• Recipients can configure their email to automatically delete emails from specific senders using strong signatures.
• Confidentiality requires encryption, not a signature.
• Without filters, workload does not increase significantly. Direct gateway filters cause less overhead than antivirus software,
• Digital signatures are small, so bandwidth isn't reduced. Even with certificate revocation lists, there is little overhead.

Encapsulating Security Payload (ESP) Protocol

• In transport mode, using ESP protocol instead of authentication header protocol, is beneficial because it provides confidentiality.
• Both ESP and authentication header (AH) provide connectionless integrity.
• Both ESP and AH authenticate data origin.
• IPSec time stamps prevent replay attacks.

Wired to Wireless LAN risk assessment

• Wireless infrastructure increases the risk of war driving attacks where attackers use a wireless Ethernet card and antenna to penetrate the systems from outside.
• Port scanning often targets the external firewall and is not affected by wireless.
• Back doors enable unauthorized system entry.
• Man-in-the-middle attacks intercept and modify messages.

Peer-to-Peer Computing Risks

• Data leakage with peer-to-peer computing is a greater concern than virus infection, network performance issues, or unauthorized software usage.
• Peer-to-peer setups enable sharing of contents of a user's hard drive over the Internet, posing risk of sensitive data exposure.
• P2P's network bandwidth usage creates performance issues.
• P2P use enables the downloading or sharing of unauthorized software, which could be installed from PCs unless pre existing controls inhibit it.

Voice-over Internet Protocol (VoIP)

• When upgrading a virtual private network to support VoIP, reliability and quality of service should be the primary considerations. Voice communications demand a level of service, and can be provided through QoS and class of service controls. Authentication is implemented via VPN tunneling, and privacy of voice transmission is provided via VPN protocol.

Anti-Spam Filtering Methods

• Check-sum based anti-spam filtering has the lowest possibility of false-positive alerts.
• Rule-based filtering triggers false-positive alerts when a keyword is found in the message.
• Heuristic filtering uses shortcuts to quickly find a solution.
• Statistical filtering analyzes word frequency within messages and can ignore suspicious keywords if the overall message is normal, making it prone to false-positive alerts.

Public Key Infrastructure (PKI)

• Within PKI, the certification practice statement describes the process of disabling a compromised private key.
• The certificate revocation list is a list of certificates that have been revoked before their scheduled expiration date.
• The certification practice statement describes policy-based public key infrastructure
• The certificate policy sets the requirements for the CPS.
• The PKI disclosure statement covers warranties, limitations, and obligations.

Biometric Attacks

• The use of residual biometric information to gain unauthorized access is an example of a replay attack.
• Residual biometric characteristics left on a biometric capture device can be reused by an attacker.
• A brute force attack involves feeding the biometric capture device numerous samples.
• Cryptographic attacks targets the algorithm or the encrypted data.
• Mimic attacks reproduces characteristics similar to the enrolled user.

IS Auditor Best course of action

• An IS auditor who reviewing privileged access should first determine whether compensating controls are in place rather than immediately document the issue, recommend an update, or discuss with senior management.
• An excessive number of users with privileged access isn't necessarily an issue if compensating controls are in place.
• An auditor should gather additional information.

Two-Factor Authentication

• Man-in-the-middle attacks can circumvent two-factor authentication.
• A man-in-the-middle attacker pretends to be the legitimate destination and retransmits what is sent by the authorized user with additional transactions approved.
• Denial-of-service attacks do not have a relationship to authentication.
• Brute force and key logging could circumvent only single-factor, but not two-factor, authentication.

Email Authentication

• Organizations ensure recipients can authenticate emails from employees by digitally signing all messages.
• Message authentication is achieved through digital signatures.
• Encryption ensures only the intended recipient can open a message, but not authenticity.
• Compression reduces size but does not ensure authenticity.
• Password protection ensures only those with the password can open the message but not authenticity.

Access assurance

• Two-factor authentication provides the best assurance that only authorized users connect over the Internet for production support.
• Single sign-on authentication is a single access point to system resources, no the best solution in this case.
• Password complexity requirements are not as effective as two-factor authentication.
• Internet Protocol addresses change too easily and are not the best form of authentication in this kind of scenario.
• Two-factor authentication is the best method to provide a secure connection because it uses two factors, typically "what you have" (for example, a device to generate one-time-passwords), "what you are" (for example, biometric characteristics) or "what you know" (for example, a personal identification number or password)

Secure transmission assurance

• Establishing an encrypted virtual private network tunnel would best ensure that the transmission of information was secure.
• Secret key encryption is not feasible.
• Dynamic Internet Protocol addresses and ports are not effective.
• Cryptographic hash functions wouldn't be useful for remotely connecting production supporting teams.

Data Leak Prevention Software

• The primary purpose of data leak prevention software is to control confidential documents leaving the internal network.
• Access privileges will be controlled through digital rights management (DRM) software.
• Potential system attacks would normally be controlled through an intrusion detection system (IDS) and intrusion prevention system (IPS).
• Controlling what external systems can access internal resources is the function of a firewall rather than a DLP system.

Reducing Internal Fraud Risk

• Registering and review of changes is a control that can be implemented to reduce risk of internal fraud if application programmers are allowed to move programs into the production environment in a small organization.
• Independent postimplementation testing would not be as effective because the system could be accepted by the end user without detecting the undocumented functionality.
• An independent review of the changes to the program can identify potential unauthorized changes, versions, or functionality.
• Independent review of user requirements or user acceptance would not be as effective because the system could meet user requirements/be accepted and still include unapproved functionalities.

User Datagram Protocol (UDP)

• A characteristic of User Datagram Protocol (UDP) in network communications is packets may arrive out of order.
• UDP uses a simple transmission model without implicit handshaking routines for providing reliability, ordering or data integrity. UDP provides an unreliable service where datagrams may arrive out of order duplicated or dropped

Application users

• The most effective control to ensure accountability is audit trails that capture which user, at what time, has performed the transaction, helping to establish accountability among application users.
• Two-factor authentication enhances security while logging in, but doesn't establish accountability for subsequent actions.
• Digital certificates enhance login security but do not establish accountability without an audit trail.

Dynamic Host Configuration Protocol

• Disabling Dynamic Host Configuration Protocol at all wireless access points reduces the risk of unauthorized network access.
• With DHCP disabled, static IP addresses must be used requiring administration support or technical skill to gain Internet access.

Information Security Awareness Program

• The best indication of how effective an information security awareness program is, is the amount of incident response reporting by employees .
• Reporting incidents implies employees are acting due to the awareness program.

Separation of Networks control

• A firewall is the best control to ensure separation of two networks along authorized users to wireless and wired networks.
• A firewall is used as a strong control to allow authorized users on the wireless network to access the wired network.

Classifying Information Assests

• From a control perspective, the primary objective of classifying information assets is to establish guidelines for the level of access controls that should be assigned.
• Information has varying degrees of sensitivity and criticality meeting business objectives, establishing guidelines for access control based on classes or levels can be assigned.

Client- Server

• An IS auditor reviewing access controls for a client-server environment should FIRST: identify the network access points.
• Review Identity management then application access.

Firewall setup

• To prevent Internet Protocol (IP) spoofing attacks, a firewall should be configured to drop a packet for which the sender of a packet specifies the route.
• With the option enabled, an attacker can insert a spoofed source IP address.

A single point leased line

• the way to make sure the is the safest way to connect Telnet

Data loss and the key to SSO policy

• Having strong passwords is great for preventative control in SSO environments

Discover the uniformed resource

-Phishing is always a potential problem

Proper network to have an IDS

• Having and knowing where the device is the most important during set up

Security and the balance

• Including a lot of details into accounts

Code with sensitive data

• When people right have have no one with a clear responsibility for user access.

Make network to have different connections.

• A great way is a virtual private network tunnel