Security Plus SY0-701 Domain 1 Handout (1).pdf

SECURITY+ EXAM CRAM Domain 1 Coverage of every topic in the official exam syllabus! with Pete Zerger vCISO, CISSP, MVP Covers SY0-701 SECURITY+ EXAM STUDY GUIDE & PRACTICE TESTS BUNDLE 500 practice questions 100 flashcards 2 practice exams SECURITY+ EXAM STUDY GUIDE & PRACT...

SECURITY+ EXAM CRAM Domain 1 Coverage of every topic in the official exam syllabus! with Pete Zerger vCISO, CISSP, MVP Covers SY0-701 SECURITY+ EXAM STUDY GUIDE & PRACTICE TESTS BUNDLE 500 practice questions 100 flashcards 2 practice exams SECURITY+ EXAM STUDY GUIDE & PRACTICE TESTS BUNDLE 1000 practice questions 2 practice exams Links in video description  1.0 General Security Concepts line-for-line review of the official exam syllabus! 1.0 General Security Concepts 1.1 Compare and contrast various types of security controls Categories Control Types – Technical – Preventive – Managerial – Deterrent – Operational – Detective – Physical – Corrective – Compensating – Directive You should know some examples of each for the exam. Controls can fit into multiple types based on context. Categories of security controls Technical Hardware or software mechanisms used to manage access to resources and systems and provide protection for those resources and systems. Physical Security mechanisms focused on providing protection to the facility and real-world objects. Managerial Policies and procedures, administrative controls defined by an organizations security policy. Use planning and assessment methods to review the organization’s ability to reduce and manage risk. Operational Help ensure that the day-to-day operations of an organization comply with their overall security. Primarily implemented and executed by people instead of systems. Categories of security controls EXAMPLES Technical Physical Managerial Operational Encryption Guards Policies Awareness training Smart cards Fences Procedures Configuration Hiring practices management Passwords Lights Background Media protection Biometrics Motion detectors checks Access control Guard dogs Data classification lists (ACLs) Security training Video cameras Firewalls, routers Risk assessments Alarms IDS/IPS Vulnerability Laptop locks assessments Categories of security controls Technical Technology (HW and SW) Physical Tangible (touchable) Managerial Policy (and policy implementation) Operational People (doing stuff) Security controls Physical Prevent physical attacks on facilities and devices Operational People-centric activities Protect against logical Technical attacks and exploits Managerial policies ASSETS  D O M A I N 1 : CONTROLS Security Controls Security measures for countering and minimizing loss or unavailability of services or apps due to vulnerabilities  D O M A I N 1 : SECURITY CONTROLS Security Controls The terms safeguards and countermeasures may seem to be used interchangeably  D O M A I N 1 : SECURITY CONTROLS Security Controls safeguards are proactive (reduce likelihood of occurrence) countermeasures are reactive (reduce impact after occurrence)  D O M A I N 1 : SECURITY CONTROLS Control Types Deterrent. Deployed to discourage violation of security policies. Preventive. Deployed to thwart or stop unwanted or unauthorized activity from occurring. Detective. Deployed to discover or detect unwanted or unauthorized activity. Compensating. Provides options to other existing controls to aid in enforcement of security policies.  D O M A I N 1 : SECURITY CONTROLS Control Types Corrective. modifies the environment to return systems to normal after an unwanted or unauthorized activity has occurred. Directive. direct, confine, or control the actions of subjects to force or encourage compliance with security policies. CONTROL TYPES EXAMPLES Preventive deployed to stop unwanted or unauthorized activity from occurring, EXAMPLES: fences, locks, biometrics, mantraps, alarm systems, job rotation, data classification, penetration testing, access control methods Deterrent deployed to discourage the violation of security policies. A deterrent control picks up where prevention leaves off. EXAMPLES: locks, fences, security badges, security guards, lighting, security cameras, trespass or intrusion alarms, separation of duties, security policies, and security awareness training CONTROL TYPES Detective deployed to discover unwanted or unauthorized activity. Often are after-the-fact controls rather than real-time controls. EXAMPLES: security guards, guard dogs, motion detectors, job rotation, mandatory vacations, audit trails, intrusion detection systems, violation reports, honey pots, and incident investigations Directive direct, confine, or control the actions of subjects to force or encourage compliance with security policies.. EXAMPLES: policies, procedures, standards, guidelines, physical signage, verbal instructions, contracts and agreements CONTROL TYPES Corrective deployed to restore systems to normal after an unwanted or unauthorized activity has occurred. minimal capability to respond to access violations. EXAMPLES: backups and restores, patching, antivirus/antimalware, forensic analysis, disciplinary action Compensating deployed to provide options to other existing controls to aid in the enforcement and support of a security policy. EXAMPLES: security policy, personnel supervision, monitoring, and work task procedures Control overlap One control, multiple types/functions A single security control can be identified as multiple types, depending on the context of the situation Overlapping Functions Security controls are designed to work together, and their functions often overlap. EXAMPLE: a security camera system is both deterrent (deterring unwanted entry) and detective (recording potential security incidents for later review). Context Matters The classification of a control can depend on how it's implemented and the specific risk it's addressing. EXAMPLE: an access control list can be primarily preventive if it blocks unauthorized access or detective if it mainly logs access for later investigation. Control overlap One control, multiple types/functions A single security control can be identified as multiple types, depending on the context of the situation Focus on keywords Exams often use specific words or phrases to hint at the control type. Deterrent: "warning," "sign," "visibility," "perception" Preventive: "access control," "authentication," "firewall," "encryption" Directive: "policy," "procedure," "standard," "guideline" EXAMPLES Detective: "monitoring," "audit," "logging," "alert" Corrective: "backup," "restore," "incident response," "patching" Compensating: "alternative," "backup," "redundancy" 1.0 General Security Concepts 1.2 Summarize fundamental security concepts Confidentiality, Integrity, and Policy Engine Pressure Availability (CIA) – Data Plane Microwave Non-repudiation Implicit trust zones Ultrasonic Subject/System Deception and disruption Authentication, Policy Enforcement Point technology Authorization, and Physical security – Honeypot Accounting (AAA) – Bollards – Honeynet – Authenticating people – Access control vestibule – Honeyfile – Authenticating systems – Fencing – Honeytoken – Authorization models – Video surveillance Gap analysis – Security guard Zero Trust – Control Plane – Access badge – Lighting Security controls Adaptive identity – Sensors Threat scope reduction Infrared Policy-driven access control Policy Administrator D O M A I N 1 : SECURITY & RISK MANAGEMENT KNOW BY HEART!  D O M A I N 1 : SECURITY & RISK MANAGEMENT C onfidentiality I ntegrity A vailability  D O M A I N 1 : SECURITY & RISK MANAGEMENT 1 C onfidentiality 2 3 I ntegrity A vailability D O M A I N 1 : SECURITY & RISK MANAGEMENT C onfidentiality Access controls help ensure that only authorized subjects can access objects  D O M A I N 1 : GENERAL SECURITY CONCEPTS I ntegrity Ensures that data or system configurations are not modified without authorization D O M A I N 1 : GENERAL SECURITY CONCEPTS A vailability Authorized requests for objects must be granted to subjects within a reasonable amount of time Non-repudiation Non-repudiation is the guarantee that no one can deny a transaction. Methods to provide non-repudiation Digital Signatures prove that a digital message or document was not modified—intentionally or unintentionally—from the time it was signed. based on asymmetric cryptography (a public/private key pair) the digital equivalent of a handwritten signature or stamped seal. provides non-repudiation in a publicly verifiable manner. Non-repudiation is the ability to defeat/counter a false rejection or refusal of an obligation with irrefutable evidence. REMEMBER: shared accounts/identities prevent non-repudiation! AAA Several protocols provide authentication, authorization, and accounting services. Authentication user/service proves identity with some type of credentials, such as a username and password. Authorization authenticated users are granted access to resources based on the roles and/or permissions assigned to their identity. Accounting methods that track user activity and records these activity in logs. Tracks user activity and resource access as part of the audit trail identification and authentication Subjects claim an identity, and identification Identification can be as simple as a username for a user. Subjects prove their identity by providing Authentication authentication credentials such as the matching password for a username. authorization and accountability After authenticating subjects, systems Authorization authorize access to objects based on their proven identity. after authentication Auditing logs and audit trails record events Accountability including the identity of the subject that provides proof performed an action. identification + authentication + auditing = ACCOUNTABILITY maintaining accountability Why is accountability important? is maintained for individual subjects using auditing. logs record user activities and users can be held accountable for their logged actions. HOW THIS HELPS directly promotes good user behavior and compliance with the organization’s security policy. Provides an audit trail for investigation if needed maintaining accountability But it’s not only for people… In modern enterprises, systems and devices have identities as well! EXAMPLES: In the cloud, VMs have a managed identity (managed by platform) used to access resources, such as data. Client devices have machine identities in mobile device management (MDM) platforms.  D O M A I N 1. 2 : AUTHORIZATION MODELS Non-discretionary Access Control Enables the enforcement of system-wide restrictions that override object-specific access control. RBAC is considered non-discretionary Discretionary Access Control (DAC) Use-based, user-centric A key characteristic of the Discretionary Access Control (DAC) model is that every object has an owner, and the owner can grant or deny access to any other subject. Example: New Technology File System (NTFS) Role Based Access Control (RBAC) A key characteristic is the use of roles or groups. Instead of assigning permissions directly to users, user accounts are placed in roles and administrators assign privileges to the roles. Typically mapped to job roles. Rule-based access control A key characteristic is that it applies global rules that apply to all subjects. Rules within this model are sometimes referred to as restrictions or filters. EXAMPLE: a firewall uses rules that allow or block traffic to all users equally.  MADATORY ACCESS CONTROL “ A key point about the MAC model is that every object and every subject has one or more labels. These labels are predefined, and the system determines access based on assigned labels. EXAMPLE: in military security, data owner does not set access  D O M A I N 1. 2 : AUTHORIZATION MODELS ATTRIBUTE-BASED ACCESS CONTROL access is restricted based on an attribute on the account, such as department, location, or functional designation. For example, admins may require user accounts have the Legal department attribute to view contracts SUBJECTS AND OBJECTS IN ACCESS CONTROL Subjects A user, group, or service accessing resources, known as objects. Resources, such as files, folders, shares, Objects and printers, accessed by subjects These come up often in discussions of access control, so you should be familiar for the exam The authorization model determines how a system grants users access to files and other resources.  All auditors should have independence, but attestations from Gap analysis external auditors carry more weight (higher confidence) A common task performed on a recurring basis, and often in preparation for external audits is the gap analysis. Auditors will follow a standard (often ISO 27001) and then compare standard requirements to the org’s current operations. Deficiencies versus the standard will be captured in the audit report as gaps, sometimes called control gaps. Control gap a discrepancy between the security measures an organization should have in place versus controls actually in place. The outcome of an audit is an attestation, which is a formal statement made by the auditor on controls and processes in place. Zero trust An approach to security architecture in which no entity is trusted by default Zero Based on three principles: Trust 1) Assume breach 2) Verify explicitly 3) Least privilege access Has largely replaced trust but verify and its network perimeter strategy. Supported by defense in depth, that advises a layered approach to security. Zero Trust Security addresses the limitations of the legacy network perimeter-based security model. treats user identity as the control plane assumes compromise / breach in verifying every request. no entity is trusted by default VERIFY MANAGE MANAGE PROTECT IDENTITY DEVICES APPS DATA Access policy enforcement Policy Enforcement Point responsible for enabling, monitoring, and terminating connections between a subject (such as a user or device) and an enterprise resource. acts as the gateway that enforces access control policies. when an access request occurs, the PEP evaluates the request against predefined policies and applies the necessary controls. For example, PEP might enforce Multi-Factor Authentication (MFA) for access requests from unexpected locations. Dynamic based on conditions/context Policy Decision Point is where access decisions are made based on various factors such as user identity, device health, and risk assessment. evaluates the context of an access request and decides whether it should be allowed, denied, or subjected to additional controls. considers the 5 W’s (who, what, when, where, and why) In short, the PEP enforces policies at the connection level, while the PDP makes access decisions based on contextual information. Access policy enforcement The key elements of Zero Trust Network Architecture: Control Plane Data Plane ✓ Adaptive Identity ✓ Implicit Trust Zones ✓ Threat Scope Reduction ✓ Subject/System ✓ Policy-Driven Access Control ✓ Policy Enforcement Point ✓ Policy Administrator Enforces the decisions defined in ✓ Policy Engine control plane Drives the policy-based decision logic for zero trust Described in NIST SP 800-207 Zero trust CONTROL PLANE Adaptive Identity changes the way that the system asks a user to authenticate based on context of the request. EXAMPLES: location, device, app, risk Threat Scope Reduction an end goal of ZTNA, which is to decrease risks to the organization. Policy-Driven Access Control controls based upon a user’s identity rather than simply their system’s location. EXAMPLE: Conditional Access in MSFT Entra ID Policy Administrator (PA) PA + PE = Policy Decision Point (PDP) responsible for communicating the decisions made by the policy engine. Policy Engine (PE) EXAMPLE: MSFT Entra ID (Azure Active Directory) decides whether to grant access to a resource for a given subject. Zero trust DATA PLANE Implicit Trust Zones part of traditional security approach in which firewalls and other security devices formed a perimeter. Systems belonging to the org were placed inside this boundary. Subject/System A subject is a user who wishes to access a resource. A system is a non-human entity, often the device used by the user, to access the resource. Policy Enforcement Point when a user or system requests access to a resource, the PEP evaluates it against predefined policies and applies the necessary controls. EXAMPLE: MSFT Entra ID (Azure Active Directory) conditional access enforcing “conditions of access” image credit: Microsoft signal > decision > enforcement Zero Trust (logical diagram) Where policy decisions are made Policy Decision Point Policy Engine Data Access CDM System Policy Policy Administrator Industry PKI Compliance Control Plane Threat Data Plane Identity Intelligence Management Untrusted Policy Enforcement Trusted Activity Logs Point SIEM System Subject and Enterprise Supporting System Resource Supporting Components Components Where security controls are applied  SECURITY+ EXAM CRAM A quick tour of Conditional Access EXAMPLE FOR CONTEXT – The Security+ exam is vendor-agnostic. physical security There is no security without physical security Without control over the physical environment, no amount of administrative or technical/logical access controls can provide adequate security. If a malicious person can gain physical access to your facility or equipment, they can do just about anything they want, from destruction to disclosure and alteration. bollard A short, sturdy vertical post, usually made of concrete, steel, or other heavy-duty materials. They can be fixed in place or retractable. Act as physical barriers, preventing vehicles from forcibly entering a restricted area. Delineate pedestrian areas, parking lots, and bollard sensitive zones to minimize accidental damage Primarily used to control traffic flow and protect buildings or areas from vehicle-based attacks. Access control vestibule Previously called a mantrap A physical security system comprising a small space with two interlocking doors. Only one door can be opened at a time. Designed to strictly control access to highly secure areas by allowing only one person at a time to pass through. Protects against Access control Tailgating (slipping in on someone else's badge) vestibule Piggybacking (like tailgating, but with bad intent) Unauthorized entry of any kind FENCES Efficacy of fences by height 3-4 feet deters the casual trespasser Fence is a DETERRENT control PIDAS is a DETECTIVE control 6-7 feet too difficult to climb easily may block vision (providing additional security) 8-feet (topped with barbed wire) EXPENSIVE and may will deter determined intruders generate false positives PIDAS (perimeter intrusion detection and assessment system) will detect someone attempting to climb a fence. FENCES Efficacy of fences by height 3-4 feet deters the casual trespasser Fence is a DETERRENT control PIDAS is a DETECTIVE control 6-7 feet too difficult to climb easily may block vision (providing additional security) 8-feet (topped with barbed wire) will deter determined intruders To augment fences some orgs may erect stronger barricades, or zig-zag paths to prevent a vehicle from ramming a gate.  Can you see how each may also Physical security serve to deter potential attacks? Video surveillance Detective control Cameras and closed-circuit television (CCTV) systems provide video surveillance and reliable proof of a person’s identity and activity. Many cameras include motion and object detection capabilities. Security guards Preventive control a preventive physical security control, and they can prevent unauthorized personnel from entering a secure area. can recognize people and compare an individual’s picture ID for people they don’t recognize. Access badges Preventive control can electronically unlock a door and help prevent unauthorized personnel from entering a secure area. lighting Deterrent control When planning lighting, think about location, efficiency and protection. Location installing lights at all the entrances and exits to a building can deter attackers from trying to break in. Efficiency a combination of automation, light dimmers, and motion sensors to save on electricity costs without sacrificing security. automatically turn on at dusk, automatically turn off at dawn. Protection protect the lights. If an attacker can remove the light bulbs, it defeats the control. either place the lights high enough so that they can’t be reached or protect them with a metal cage. Infrared sensors detects heat signatures in the form of infrared radiation emitted by people, animals, or objects. integrated into security cameras and alarm systems to improve detection capabilities Pressure designed to detect changes in pressure on a surface or in a specific area, such as a person walking on a floor or stepping on a mat. used in access control systems to ensure that only authorized individuals can enter Microwave uses microwave technology to detect movement within a specific area. often used with other types of sensors to reduce false alarms Ultrasonic emits high-frequency sound waves and measure the time it takes for the sound waves to bounce back after hitting an object or surface. commonly used in parking assistance, robotic navigation, and intrusion detection Deception and disruption Lure bad people into doing bad things. Lets you watch them. Honeypot Only ENTICE, not ENTRAP. You are not allowed to let them download items with “Enticement”. A group of honeypots For example, allowing download of a fake is called a honeynet. payroll file would be entrapment. Goal is to distract from real assets and isolate in a padded cell until you can track them down. Deception and disruption Honeyfile a decoy file deceptively named so it attracts the attention of an attacker. a fake record inserted into a database Honeytoken to detect data theft. These are all intended to deceive attackers and disrupt attackers, divert them from live networks and allow observation. 1.0 General Security Concepts Explain the importance of change management processes 1.3 and the impact to security. WHAT do these solve for? Why do we use them? Business processes Technical implications Documentation impacting security operation – Allow lists/deny lists – Updating diagrams – Approval process – Restricted activities – Updating policies/procedures – Ownership – Downtime Version control – Stakeholders – Service restart – Impact analysis – Application restart – Test results – Legacy applications – Backout plan – Dependencies – Maintenance window – Standard operating procedure  ORGANIZATIONAL POLICIES Configuration & Change Management Can prevent security related incidents and outages Configuration Management ensures that systems are configured similarly, configurations are known and documented. Ensures true ‘current state’ is known to all Baselining ensures that systems are deployed with a common baseline or starting point, and imaging is a common baselining method. Change Management the policy outlining the procedures for processing changes helps reduce risk associated with changes, including outages or weakened security from unauthorized changes. Requires changes to be requested, approved, tested, and documented.  ORGANIZATIONAL POLICIES Change Management vs Change Control Change Control refers to the process of evaluating a change request within an organization and deciding if it should go ahead. requests are sent to the Change Advisory Board (CAB) to ensure that it is beneficial to the company. Change Management Change Control policy that details how changes will process of evaluating a change request be processed in an organization to decide if it should be implemented Guidance on the process The process in action  BUSINESS PROCESSES impacting security operation A change management program should address important business process issues, including: Approval process: ensures that every proposed change is properly reviewed and cleared by management before it takes place. Ensure alignment across teams Ownership: clearly defines who is responsible for each change by designating a primary owner who will be the key decisionmaker and sponsor of the change. Stakeholder analysis: identifies all the individuals and groups within the organization and outside the organization that might be affected by the change. Enables team to contact and coordinate with all relevant stakeholders Impact analysis: review of potential impacts of a change, including side effects. Ensures team considers impact to systems and stakeholders Testing: confirms that the change will work as expected by validating it in a test environment before production rollout. Test results should be captured in the change approval request  BUSINESS PROCESSES impacting security operation A change management program should address important business process issues, including: Backout plan: provides detailed step-by-step sequence that the team should follow to roll back if the change goes wrong. Ensures systems can be quickly restored to an operational state Maintenance windows: Standing window of time during which changes can be implemented that minimizes impact to business, often outside of business hours. For critical services, may be defined in customer contracts REMEMBER: Any change that affects system or data exposure may impact security! These elements together can define a standard operating procedure for change management.  TECHNICAL IMPLICATIONS There are several technical implications that should be considered as part of the change management process. Allow lists/deny lists Restricted activities WHY? Downtime To avoid service disruptions Application restarts and security vulnerabilities Legacy applications Dependencies  TECHNICAL IMPLICATIONS There are several technical implications that should be considered as part of the change management process. Allow lists/deny lists firewall rules, application allow/deny lists, and access control lists (ACLs) may need to be updated. Restricted activities some activities may need to be restricted, such as data updates during database replication/migration. Downtime some changes may cause service interruption, resulting in direct impact to the business. This is where our ‘maintenance window’ comes into play  TECHNICAL IMPLICATIONS There are several technical implications that should be considered as part of the change management process. Application restarts putting controls around risky activities, such as application and service restarts. Legacy applications use case for private or hybrid cloud modifications to legacy apps that may not support some changes, such as component/service version updates. Dependencies tracking dependencies between systems and services to identify downstream effects of current and future changes. documentation The process of documentation current state of and changes to the operating environment. Provides team members with a repository of information about the way that systems and applications are designed and configured. Serves as a reference for current and future team members Change management processes should ensure that changes are not closed out until all documentation and diagrams are updated. It is a continuous process across new deployments and changes Documentation applies not only to environment, but to policies and procedures that direct operation and support of the environment. Provides benefits to IT and security operations, BC/DR, incident response, and future design and planning iterations. documentation The process of documentation current state of and changes to the operating environment. Provides team members with a repository of information about the way that systems and applications are designed and configured. Serves as a reference for current and future team members Change management processes should ensure that changes are not closed out until all documentation and diagrams are updated. It is a continuous process across new deployments and changes Documentation applies not only to environment, but to policies and procedures that direct operation and support of the environment. You cannot fully secure a system or service for which you do not have a true picture of current state! Version control A formal process used to track the current versions of software code and system/application configurations. Most organizations use a formal version control system that is integrated into their software development processes. For most orgs, this is some platform based on Git. Developers modify the code and check it into a version control system that identifies conflicts in their changes with those made by other devs. It also tracks the current dev, test, and production versions of code. Code for different environments is tracked in Git using code ‘branches’ FOR THE EXAM: Focus on the functions of version control, not on any specific version control system. 1.0 General Security Concepts Explain the importance of using appropriate cryptographic 1.4 solutions. Public key infrastructure (PKI) Tools – Certificate revocation lists – Public key – Trusted Platform Module (TPM) (CRLs) – Private key – Hardware security module – Online Certificate Status – Key escrow (HSM) Protocol (OCSP) Encryption – Key management system – Self-signed - Level – Secure enclave – Third-party Full-disk Obfuscation – Root of trust Partition – Steganography – Certificate signing request File – Tokenization (CSR) generation Volume – Data masking – Wildcard Database Hashing Record Salting – Transport/communication Digital signatures – Asymmetric Key stretching – Symmetric – Key exchange Blockchain – Algorithms Open public ledger – Key length Certificates - Certificate authorities Public key infrastructure (pki) CONCEPTS Key management management of cryptographic keys in a cryptosystem. Operational considerations include dealing with the generation, exchange, storage, use, crypto-shredding (destruction) and replacement of keys. Design considerations include cryptographic protocol design, key servers, user procedures, and other relevant protocols. Certificate authority (CA) Certification Authorities create digital certificates and own the policies. PKI hierarchy can include a single CA that serves as root and issuing CA, but this is not recommended. Also called a ‘certification authority’ by some vendors Public key infrastructure (pki) CONCEPTS Usually maintained in an offline state Root CA Issues certs to new subordinate CAs CHAIN OF TRUST Also called a Policy CA or Intermediate CA Subordinate CA Issues certs to new issuing CAs Certificates for clients, servers, devices, Issuing websites, etc. issued from here CA Can be consolidated to fewer servers, creating a 1 or 2-level hierarchy. Public key infrastructure (pki) CONCEPTS Certificate revocation list (CRL) Contains information about any certificates that have been revoked due to compromises to the certificate or PKI hierarchy. CRL of issuing CA contains info on revocation of certs it has issued CAs are required to publish CRLs, but it’s up to certificate consumers if they check these lists and how they respond if a certificate has been revoked. Each CRL is published to a file, that the client must download to check, which can grow large over time Public key infrastructure (pki) CONCEPTS Online Certificate Status Protocol (OCSP) Offers a faster way to check a certificate’s status compared to downloading a CRL. With OCSP, the consumer of a certificate can submit a request to the issuing CA to obtain the status of a specific certificate. Certificate signing request (CSR) Records identifying information for a person or device that owns a private key as well as information on the corresponding public key. It is the message that's sent to the CA in order to get a digital certificate created. CN (common name) the Fully Qualified Domain Name (FQDN) of the entity (e.g. web server) Public key infrastructure (pki) CONCEPTS Online vs. offline CA. Online CA is always running, offline CA is kept offline except for specific issuance and renewal operations. Offline is best practice for your root CA. Stapling. a method used with OCSP, which allows a web server to provide information on the validity of its own certificate. Done by the web server essentially downloading the OCSP response from the certificate vendor in advance and providing it to browsers. Pinning. a method designed to mitigate the use of fraudulent certificates. Once a public key or certificate has been seen for a specific host, that key or certificate is pinned to the host. Should a different key or certificate be seen for that host, that might indicate an issue with a fraudulent certificate. Public key infrastructure (pki) CONCEPTS Certificate chaining Refers to the fact that certificates are handled by a chain of trust. You purchase a digital certificate from a certificate authority (CA), so you trust that CA’s certificate. In turn, that CA trusts a root certificate. Trust model A model of how different certificate authorities trust each other and how their clients will trust certificates from other certification authorities. The four main types of trust models that are used with PKI are bridge, hierarchical, hybrid, and mesh. Public key infrastructure (pki) Key escrow Addresses the possibility that a cryptographic key may be lost. The concern is usually with symmetric keys or with the private key in asymmetric cryptography. If that occurs, then there is no way to get the key back, and the user cannot decrypt messages. Organizations establish key escrows to enable recovery of lost keys.  CERTIFICATE FORMATS X.509 certificate formats and descriptions FORMAT EXT PRI KEY DESCRIPTION Distinguished encoding rules DER NO Secure remote access (Linux and network) Privacy enhanced mail PEM YES Secure copy to Linux/Unix Personal information PFX YES Supports storage of all certificates in path exchange Base64-encoded CER NO Storage of a single certificate. PKCS#12 standard P12 YES Supports storage of all certificates in path Cryptographic Message Supports storage of all certificates in path. P7B NO Syntax Standard KCS #12 is the successor to Microsoft's "PFX“. EXT = File extension PRI KEY = File includes private key? Certificates are not whole without the private key! Types of certificates User Root Used to represent a user's digital identity. CA In most cases, a user certificate is mapped back to a user account. Root This is the “root of trust” A trust anchor in a PKI environment is the root certificate from which the whole chain of trust is derived; this is the root CA. Subordinate Domain validation CA A Domain-Validated (DV) certificate is an X.509 certificate that proves the ownership of a domain name. Extended validation Extended validation certificates provide a higher level of trust in identifying the entity that is using the certificate. Issuing Commonly used in the financial services sector. CA Root of trust Think of the certificate of root CA as “root of trust” In a PKI, the root certificate serves as the trust anchor, Root as it is the most trusted component of the system. CA Your org’s root certificate will be deployed to your org’s devices to the list of trusted certificate authorities. Your CA’s root certificate is generally only known and trusted within your organization Subordinate CA For external customer-facing use cases For resources accessed externally, you will buy a certificate from a trusted third party. e.g. Digicert, Entrust, GlobalSign, GoDaddy Issuing CA Root certificates from widely trusted sources are pre- installed on most devices (computers, phones, etc.) SECURITY+ EXAM CRAM Certificates, certificate authority & root of trust Types of certificates Wildcard Supports multiple FQDNs in the same domain Can be used for a domain and a subdomain. For example: In the contoso.com domain, there are two servers called web and mail. The wildcard certificate is *.contoso.com and, when installed, it would work for the Fully Qualified Domain Names (FQDNs) for both of these. A wildcard can be used for multiple servers in the same domain, saving costs. Code signing Provides proof of content integrity When code is distributed over the Internet, it is essential that users can trust that it was actually produced by the claimed sender. An attacker would like to produce a fake device driver or web component (actually malware) that is claimed to be from some legitimate software vendor. Using a code signing certificate to digitally sign the code mitigates this danger. Types of certificates Self-signed A self-signed certificate is issued by the same entity that is using it. However, it does not have a CRL and cannot be validated or trusted. It is the cheapest form of internal certificates and can be placed on multiple servers. Machine/computer A computer or machine certificate is used to identify a computer within a domain. Email Allow users to digitally sign their emails to verify their identity through the attestation of a trusted third party known as a certificate authority (CA). Allow users to encrypt the entire contents (messages, attachments, etc.) Third-party A certificate issued by a widely trusted external provider such as GoDaddy or Digicert. Preferred for TLS on public-facing services, such as company website. Types of certificates Subject alternative name (SAN) an extension to the X. 509 specification that allows users to specify additional host names for a single SSL certificate. Is standard practice for SSL certificates, and it's on its way to replacing the use of the common name. You can also insert other information into a SAN certificate, such as an IP address. Enables support for FQDNs from multiple domains in a single certificate. Expiration certificates are valid for a limited period from the date of issuance, as specified on the certificate. Current industry guidance on maximum certificate lifetime from widely trusted issuing authorities (like Digicert) is currently 1 year (398 days). LEVEL (Scope) of encryption LOW operates at the individual file level, meaning File files could have unique encryption keys. Useful for files containing sensitive info Encryption e.g. financial info, PHI, PII encryption targets a specific partition or volume Volume within the physical drive. Scope Useful when different volumes need varying Encryption levels of protection. data volume vs system volume Disk automatically encrypts data when it is written to or read from the entire disk. Encryption Bitlocker on Windows, dm-crypt on Linux. HIGH LEVEL (Scope) of encryption HIGH operates at the individual file level, meaning File files could have unique encryption keys. Useful for files containing sensitive info Encryption e.g. financial info, PHI, PII encryption targets a specific partition or volume Granularity Volume within the physical drive. Useful when different volumes need varying Encryption levels of protection. data volume vs system volume Disk automatically encrypts data when it is written to or read from the entire disk. Encryption Bitlocker on Windows, dm-crypt on Linux. LOW Volume vs partition Partition It represents a distinct section of storage on a disk. In Windows, the C drive is typically a primary partition Is a distinct PHYSICAL section of storage Volume Represents a logical division of a storage device. Represents a single accessible storage area. Can span multiple partitions or disks. Assembles one or more partitions into a unified storage area Drive encryption FDE Full Disk Encryption is built into the Windows operating system. Full Disk Encryption Bitlocker is an implementation of FDE. Bitlocker protects disks, volumes, and partitions SED Self-Encrypting Drive encryption on a SED that’s built into the hardware of the drive itself. anything that’s written to that drive is automatically stored in encrypted form. A good SED should follow the ‘Opal Storage Specification’ Protecting data at rest Full Disk Encryption (FDE) “under the hood” Trusted Platform Module (TPM): is on the motherboard and is used to store the encryption keys so when system boots, it can compare keys and ensure that the system has not been tampered with. A TPM is a HRoT Hardware Root of Trust: When using certificates for FDE, they use a hardware root of trust that verifies that the keys match before the secure boot process takes place. Self-Encrypting Drives (SEDs) The OPAL storage specification is the industry standard for self-encrypting drives. This is a hardware solution, and typically outperform software-based alternatives. They don't have the same vulnerabilities as software and therefore are more secure. SEDs are Solid State Drives (SSDs) and are purchased already set to encrypt data at rest. The encryption keys are stored on the hard drive controller. They are immune to a cold boot attack and are compatible with all operating systems SED is effective in protecting the data on lost or stolen devices (such as a laptop). Only the user and vendor can decrypt the data. Protecting data at rest How can we encrypt different types of data at rest? Cloud Storage Encryption CSPs usually protect data at rest by automatically encrypting before persisting it to managed disks, blob storage, file, or queue storage. Transparent data encryption (TDE) Helps protect SQL Database and data warehouses against threat of malicious activity with real-time encryption and decryption of database, backups, and transaction log files at rest without requiring app changes. CSP = Cloud Service Provider Transport/communication How can we encrypt different types of data in transit? “ Data in transit is most often encrypted using TLS or HTTPS This is typically how a session is encrypted “ before a user enters the credit card details. While similar in function, TLS has largely replaced SSL Transport/communication Also called “data in motion” How can we encrypt different types of data in transit? “ Data in transit is most often encrypted using TLS or HTTPS This is typically how a session is encrypted “ before a user enters the credit card details. TLS is common for encrypting network communications, such as VPN Protecting data in use / in processing How can we encrypt different types of data in use? Data-in-use/in processing occurs when we launch an application such as Microsoft Word or Adobe Acrobat Apps not running the data from the disk drive but running the application in random access memory (RAM). This is volatile memory, meaning that, should you power down the computer, the contents are erased. In some cases, data in-memory will be encrypted  DATA PROTECTION IN RELATIONAL DATABASES Encrypting Records Many relational databases support row or column level encryption. Row-level encrypts an entire record, column-level encrypts specific fields within the record. Commonly implemented within the database tier, but also possible in code of frontend applications  DATA PROTECTION IN RELATIONAL DATABASES Database Encryption Transparent data encryption is full database-level encryption (database files, logs, backups) Requires no changes in application and comes with virtually no performance impact Offered on most relational database management (RDBMS) platforms, like MSSQL, MySQL, and PostgreSQL CONCEPT: Symmetric vs Asymmetric Relies on the use of a shared secret key. Symmetric Lacks support for scalability, easy key distribution, and nonrepudiation Public-private key pairs for communication Asymmetric between parties. Supports scalability, easy key distribution, and nonrepudiation asymmetric key types Public keys are shared among communicating parties. Private keys are kept secret. DATA To encrypt a message: use the recipient’s public key. To decrypt a message: use your own private key. DIGITAL SIGNATURE To sign a message: use your own private key. To validate a signature: use the sender’s public key. each party has both a private key and public key! common uses How are different algorithm types used? Symmetric Typically used for bulk encryption / encrypting large amounts of data. Asymmetric Distribution of symmetric bulk encryption keys (shared key) Identity authentication via digital signatures and certificates Non-repudiation services and key agreement Key exchange in asymmetric cryptography Franco sends a message to Maria, requesting her public key Maria sends her public key to Franco Franco uses Maria’s public key to encrypt the message and sends it to her Maria uses her private key to decrypt the message  1.4 ENCRYPTION ALGORITHMS Common symmetric encryption algorithms AES (Advanced Encryption Standard): The current industry gold standard. Highly efficient and widely implemented. It offers various key lengths (128, 192, 256 bits), providing flexibility in security levels. 3DES (Triple DES): A variation of DES applying encryption three times. Being phased out and replaced by AES Twofish: A finalist in the competition to select AES, known for its flexibility and security. Blowfish: Predecessor to Twofish, also known for its strength and speed. Symmetric algorithms are used for bulk data encryption  1.4 ENCRYPTION ALGORITHMS Common asymmetric encryption algorithms RSA (Rivest–Shamir–Adleman): One of the oldest and most widely used asymmetric algorithms. Often used for key exchange and digital signatures. Its security relies on the difficulty of factoring large prime numbers. ECC (Elliptic Curve Cryptography): A more modern approach using elliptic curves. Offers similar security levels to RSA but with smaller key sizes, making it suitable for resource-constrained environments. Diffie-Hellman: Primarily a key exchange protocol, allowing two parties to establish a shared secret key over an insecure channel. ElGamal: An algorithm based on the difficulty of the discrete logarithm problem. Used for encryption and digital signatures. common uses of algorithms How are different algorithm types used? Symmetric Example: AES256 Typically used for bulk encryption / encrypting large amounts of data. Asymmetric Example: RSA, DH, ECC Distribution of symmetric bulk encryption keys (shared key) Identity authentication via digital signatures and certificates Non-repudiation services and key agreement TYPES OF CIPHERS Stream cipher is a symmetric key cipher where plaintext digits are combined with a pseudorandom cipher digit stream (keystream). each plaintext digit is encrypted one at a time with the corresponding digit of the keystream, to create a digit of the ciphertext stream. Block cipher is a method of encrypting text in which a cryptographic key and algorithm are applied to a block of data (for example, 64 contiguous bits) at once as a group rather than to one bit at a time. Considered to be more secure than stream ciphers TYPES OF CIPHERS Substitution cipher uses the encryption algorithm to replace each character or bit of the plaintext message with a different character. Examples include Caesar cipher, Vigenère cipher Transposition cipher rearranges order of plaintext letters according to a specific rule. the message itself is left unchanged, just the order is scrambled. Examples include Rail Fence and Columnar Transposition  CRYPTOGRAPHIC KEY LENGTH An effective means to increase the strength of an algorithm is by increasing its key length The relationship between key length and work factor is exponential. A small increase in key length leads to a significant increase in the amount of work required to break the encryption. Asymmetric RSA (Rivest-Shamir-Adleman), the primary public key EXAMPLES cryptography algorithm used on the Internet. It supports key sizes of 1024, 2048, and 4096 bits. NIST recommends minimum key length of 2048  CRYPTOGRAPHIC KEY LENGTH An effective means to increase the strength of an algorithm is by increasing its key length The relationship between key length and work factor is exponential. A small increase in key length leads to a significant increase in the amount of work required to break the encryption. Symmetric Advanced Encryption Standard (AES) is the go-to EXAMPLES algorithm for the US Federal gov’t. It supports key sizes of 128, 192, and 256 bits. 256-bit key is recommended for quantum resistance  CRYPTOGRAPHIC KEY LENGTH An effective means to increase the strength of an algorithm is by increasing its key length The relationship between key length and work factor is exponential. A small increase in key length leads to a significant increase in the amount of work required to break the encryption. Doubling key length from 128 to 256 does not make the key twice as strong. It makes it 2 1 28 times as strong!  CRYPTOGRAPHIC KEY LENGTH Static versus Ephemeral Keys The two primary categories of asymmetric keys are static and ephemeral. Static Keys RSA uses static keys. Static keys are semi-permanent and stay the same over a long period of time. A certificate includes an embedded public key matched to a private key. This key pair is valid for the lifetime of a certificate. Certificates have expiration dates and systems continue to use these keys until the certificate expires. 1-2 years is a common certificate lifetime A certification authority (CA) can validate a certificates static key with a certificate revocation list (CRL) or using the Online Certificate Status Protocol (OCSP).  CRYPTOGRAPHIC KEY LENGTH Static versus Ephemeral Keys The two primary categories of asymmetric keys are static and ephemeral. Ephemeral Keys Ephemeral keys have very short lifetimes and are re-created for each session. An ephemeral key pair includes a private ephemeral key and a public ephemeral key. Systems use these key pairs for a single session and then discard them. Some versions of Diffie-Hellman use ephemeral keys.  1.4 TOOLS A chip that resides on the motherboard of the Trusted device. Multi-purpose, for storage and management of Platform keys used for full disk encryption (FDE) solutions. Module Provides the operating system with access to keys, TPM but prevents drive removal and data access TPM is also leveraged by the secure OS boot process  1.4 TOOLS Hardware Security Module (HSM) a physical computing device that safeguards and manages digital keys, performs encryption and decryption functions for digital signatures, strong authentication and other cryptographic functions. Like a TPM, but are often removable or external devices  1.4 TOOLS Hardware Root of Trust A line of defense against executing unauthorized firmware on a system And when certificates are used in FDE, they use a hardware root of trust for key storage. It verifies that the keys match before the secure boot process takes place Trusted platform module (TPM) and Hardware Security Module (HSM) are both implementations of HRoT TOOLS Key Management System (KMS) E.G. Azure Key Vault, AWS KMS, GCP Cloud KMS Vault CSPs offer a cloud service for centralized secure storage and access for application secrets called a vault. A secret is anything that you want to control access to, such as API keys, passwords, certificates, tokens, or cryptographic keys. Service will typically offer programmatic access via API to support DevOps and continuous integration/continuous deployment (CI/CD) Access control at vault instance-level and to secrets stored within. Secrets and keys can generally be protected either by software or by FIPS 140-2 Level 2 validated HSMs. TOOLS provides a secure and isolated area within a system or application for processing sensitive data. Secure uses hardware-based security mechanisms to create an isolated trusted execution environment Enclave allows sensitive data to be processed and stored securely, even in a potentially insecure computing environment. Also called “Trusted Execution Environment” obfuscation Privacy enhancing technologies a computer file, message, image, or video is concealed within another file, message, Steganography image, or video. an attacker may hide info in this way to exfiltrate sensitive company data. obfuscation where meaningful data is replaced with a Tokenization token that is generated randomly, and the Stateless, stronger than original data is held in a vault. encryption, keys not local de-identification procedure in which Pseudo- personally identifiable information (PII) fields nymization within a data record are replaced by one or more artificial identifiers, or pseudonyms. Reversal requires access to another data source obfuscation process of removing all relevant data Anonymization so that it is impossible to identify original subject or person. Only effective if you do NOT need the identity data!  OBFUSCATION Data minimization only necessary data required to fulfill the specific purpose should be collected Collect “the minimum amount” to meet the stated purpose and manage retention to meet regulations  OBFUSCATION Data masking when only partial data is left in a data field. for example, a credit card may be shown as **** **** **** 1234 Commonly implemented within the database tier, but also possible in code of frontend applications hashing vs encryption How is hashing different from encryption? Encryption Encryption is a two-way function; what is encrypted can be decrypted with the proper key. Hashing no way to reverse if properly designed a one-way function that scrambles plain text to produce a unique message digest. Common uses of hashing Verification of digital signatures Generation of pseudo-random numbers Integrity services (data integrity and authenticity) File integrity monitoring , validation of data transfer common uses of algorithms How are different algorithm types used? Symmetric Example: AES256 Typically used for bulk encryption / encrypting large amounts of data. Asymmetric Example: RSA, DH, ECC Distribution of symmetric bulk encryption keys (shared key) Identity authentication via digital signatures and certificates Non-repudiation services and key agreement Hash functions Verification of digital signatures Generation of pseudo-random numbers Integrity services (data integrity and authenticity) HASH FUNCTION REQUIREMENTS Good hash functions have five requirements: 1. They must allow input of any length. 2. Provide fixed-length output. 3. Make it relatively easy to compute the hash function for any input. 4. Provide one-way functionality. 5. Must be collision free. differences between algorithm types Feature / Algorithm HASH SYMMETRIC ASYMMETRIC NUMBER OF KEYS 0 1 2+ RECOMMENDED KEY 128 bits (more for some 256 bits 2048 bits LENGTH (NIST) sensitive data types) COMMON EXAMPLE SHA AES RSA SPEED Fast Fast Relatively Slow COMPLEXITY Medium Medium High EFFECT OF KEY Loss of both Loss for owner of the N/A COMPROMISE sender & receiver asymmetric key only KEY MANAGEMENT N/A Challenging Easy & Secure & SHARING SHA-224, SHA-256, AES, Blowfish, Twofish, RSA, DSA, ECC, Diffie- EXAMPLES SHA-384, SHA-512 3DES, RC4 Helman Always evolving, and eventually affected by quantum computing salting Attackers may use rainbow tables, which contain precomputed values of cryptographic hash functions to identify commonly used passwords SALTS A salt is random data that is used as an additional input to a one-way function that hashes data, a Cryptographic password or passphrase. Adding salts to the passwords before hashing them reduces the effectiveness of rainbow table attacks.  CRYPTOGRAPHIC CONCEPTS Digital Signatures Digital signatures are similar in concept to handwritten signatures on printed documents that identify individuals, but they provide more security benefits. is an encrypted hash of a message, encrypted with the sender’s private key. in a signed email scenario, it provides three key benefits: Authentication. This positively identifies the sender of the email. ownership of a digital signature secret key is bound to a specific user Non-repudiation. The sender cannot later deny sending the message. This is sometimes required with online transactions Integrity. provides assurances that the message has not been modified or corrupted. Recipients know that the message was not altered in transit These are the basics important for the Security+ exam Digital Signature Standard The Digital Signature Standard uses the SHA-2, and SHA-3 message digest functions… DSS Works in conjunction with one of three asymmetric encryption algorithms: Digital Signature Digital Signature Algorithm (DSA) Standard Rivest, Shamir, Adleman (RSA) algorithm Elliptic Curve DSA (ECDSA) algorithm. DSS is documented in FIPS 186-4 from NIST at https://csrc.nist.gov/publications/detail/fips/186/4/final KEY STRETCHING some cipher suites are easier to crack than others. Key larger keys tend to be more secure, because there Length are more possible key combinations processes used to take a key that may be weak and Key make it stronger, by making it longer and more random Stretching a longer key has more combinations a brute force attack has to go through to crack Quantum computing will impact this recommendation Since 2015, NIST recommends a minimum of 2048-bit keys for RSA. This will change over time as computing power advances. blockchain Blockchain was originally the technology that powered Bitcoin but has broader uses. A distributed, public ledger that can be used to store financial, medical, or other transactions. Anyone is free to join and participate does not use intermediaries such as banks and financial institutions. data is “chained together” with a block of data holding both the hash for that block and the hash of the preceding block. To create a new block on the chain: the computer that wishes to add the block solves a cryptographic puzzle and sends the solution to the other computers participating in that blockchain. This is known as “proof of work”  BLOCKCHAIN vs OPEN PUBLIC LEDGER? What is the difference between blockchain and an open public ledger? Decentralization. blockchain is decentralized - it is distributed across a peer-to- peer network with no central authority. An open public ledger can be centralized and maintained by a single entity. Immutability. blockchain data is immutable and cryptographically secured. Once data is added to the blockchain, it is extremely difficult to alter it. Data on a public ledger can be changed more easily. Validation. blockchain uses consensus mechanisms like proof-of-work or proof- of-stake to validate new data added to the chain. Public ledgers rely more on the integrity of the central authority. Transparency. blockchain transactions can be pseudonymous for privacy. Public ledger transactions are typically fully transparent.  1. 4 : CRYPTOGRAPHIC CONCEPTS Common use cases Common scenarios for specific cryptographic choices. Low power devices. devices often use ECC for encryption, as it uses a small key. IoT devices do not have the processing power for conventional encryption. Low latency. Means “encryption and decryption should not take a long time”. Specialized encryption hardware is a common answer in this scenario. a VPN concentrator or encryption accelerator cards can improve efficiency High resiliency. Use the most secure encryption algorithm practical to prevent the encryption key from being cracked by attackers. Device, application, or service compatibility may influence decisions Supporting confidentiality. Encryption should be implemented for exchange of any sensitive data, and in a way that ensures only authorized parties can view. For example, connecting remote offices via IPSec VPN  1. 4 : CRYPTOGRAPHIC CONCEPTS Common use cases Common scenarios for specific cryptographic choices. Supporting integrity. two important scenarios for ensuring integrity: ensuring file data has not been tampered with, and communications are not altered in transit. File hash to check file integrity, digital signature for email. Supporting obfuscation. obfuscation is commonly used in source code or with data to ensure it cannot be read by anyone who steals it. Steganography, tokenization, masking can be used to obscure data. Supporting authentication. a single-factor username and password are not considered secure as theft of the password leads to compromise. MFA for user authentication, certificate-based auth for devices Supporting non-repudiation. When you digitally sign an email with your private key, you cannot deny that it was you, as there is only one private key. Non-repudiation is important in any legally binding transaction  1. 4 : CRYPTOGRAPHIC CONCEPTS Limitations Common scenarios for specific cryptographic choices. Speed. Application and hardware must be able to keep pace with the selected encryption. Size. If encrypting 16 bytes of data with a block cipher, the encrypted information is also 16 bytes. This overhead must be considered in resource planning Need enough memory, storage, and network to support the result Weak keys. Larger keys are generally stronger and thus more difficult to break. Find balance between security, compatibility, and capacity Time. encryption and hashing take time. Larger amounts of data and asymmetric encryption take more time than small data and symmetric encryption. Selections need to match time constraints in transactions Longevity. consider how long encryption algorithms selected can be used. Older algorithms will generally be retired sooner  1. 4 : CRYPTOGRAPHIC CONCEPTS Limitations Common scenarios for specific cryptographic choices. Predictability. cryptography relies on randomization. Random number generation that can’t be easily predicted is crucial for any type of cryptography. Reuse. using the same key is commonly seen in a number of encryption mechanisms. If an attacker gains access to the key, they can decrypt data encrypted with it. some IoT devices may not allow a key change Entropy. a measure of the randomness or diversity of a data-generating function. Data with full entropy is completely random with no meaningful patterns. Resource vs security constraints. the more secure the encryption used and higher the key length, the more processing power and memory the server will need. requires balance between algorithms and hardware selections INSIDE CLOUD THANKS F O R W A T C H I N G!