SEC_ Cyber Security.pdf

Skill Enhancement Course Cyber-Security Notes Table of Contents Skill Enhancement Course 1 Cybersecurity Awareness: Key S...

Skill Enhancement Course Cyber-Security Notes Table of Contents Skill Enhancement Course 1 Cybersecurity Awareness: Key Security Terms & Concepts 2 Cybersecurity Awareness: Exposure to Security Risk 11 Cybersecurity Awareness: Security Foundations 16 Cyber Security Foundations 17  Cybersecurity Awareness: Key Security Terms & Concepts Cyber-Security Terms and Concept needs to be understood to understand the criticality of the information, threat, attack etc. Handle the request and concerns of the clients and customers Terms Asset That has a value for an organisation. They bring in value to the organisation and must be protected. Can be in tangible form (servers), or in intangible form (data) Information - databases, files (transactional, information procedures), archive information Software assets - OS, MS Office. System and application software. Physical assets - Systems, buildings, furniture, equipment, devices Services - Computing of voice and data, value added services Risk It is a probability that may or may not materialise. It is the potential of losing something that is valuable that can be high or low depending on the asset and the situation. Internal or external to the organisation, depending on where it originated. Total risk can never be eliminated, but can be reduced by eliminating certain risks. Exposure Something that increase the likelihood of the risk. The asset being exploited by the threat agent. Threat Exploits weakness and when exploited affects the confidentiality, integrity, availability, which eventually causes the destruction or modification of the asset. Can be intentional or unintentional. Man-made - data theft, denial-of-service (DoS) attack Natural - hurricane, flood Can exploit vulnerabilities or bugs, Threat actor  Threats are originated by something that pushes a risk to a threat. This threat actor materialises the risk. He is the entity that is responsible for the threat. Also has a malicious intent, known as a malicious actor. Be a person or a group. They are not allowed or have access to the system, but do so through illegal means. Attacking the system through the vulnerability, deleting or doing harm to the system. Have a motive, steal information, unauthorized someone, disrupt the system, create a backdoor, delete the system. Outside, or insider of the organisation. Threat vector Can be a process, method, or tactic used by the threat actor to get access to the system Can be a malware, virus, downloaded by an insider, social engineering, phishing email, network vulnerability, vulnerability exploitation. Also known as attack vector Target The goal of the threat actor. Without a target, the security attack cannot exist. To gain valuable information or control. Can be an individual, application, server, or an organisation. Contains vulnerabilities, or security gaps that can be exploited. Vulnerability Flaw, error, weakness in a systems design that can be exploited by a threat actor. Can be exploited when discovered. The vulnerability leads to the exploitation of the system. Protected by security control or countermeasure, but they can also have vulnerability. 0-Day vulnerability is one that hasn’t been discovered before, but the security team must patch them and secure them immediately. Bug in protocol, SQL injection into an application Countermeasure Security measure. To protect valuable information. Threats can make the information vulnerable, and this is implemented to prevent a threat. They are not implemented alone. They are implemented in layers, known as defence-in-depth. Must implement multiple of them to circumvent a threat, when you cannot prevent a threat. Known as deterrents, rather than prevention, bc prevention is impossible due to multiple vulnerabilities. Threat Actors Advanced Persistent Threat (APT)  Most dangerous as they are difficult to detect and keep an extremely low profile. Equipped with the most sophisticated tools. The motive is to get to the data but do not cause disruption or destruction. Their main goal is to get to the sensitive information. Cyber-criminals They are after the data, money or information, and will sell it in the underground web or black market. Ransomware is their main tool is to extract money out of their target. Money is their main motive. Hacktivist People or individual who are after a social cause. They have an agenda or follow a certain philosophy. The main goal is to expose secrets, or to stop any political agenda, or organisation whose practices do not seem in favour of the public. Terrorist They are against governments, and are after sensitive information. Their main goal is complete their objective. Will cause severe damage to the information systems, and infrastructure. Called as cyber-terrorists. Insider threats They are internal to the organisation, and have access to a lot of assets and information, and network services. They are within the organisation and will always have an upper edge over the external entities. The main goal is to bypass the implementations because they have a specific reason. They are only after the organisation. Script Kiddies People who are very inclined to sort of get into the system, to prove they can hack and end up causing damage. Nation states Well funded, directed and usually sponsored by the nations. Can steal information, data and have sophisticated tools. To cause espionage or disruption of services. External threat Sit outside the network and breach into the network. Internal Threat They are within the network and have access to the resources and valuable data. Target Anybody who is there on the internet. A server with open acces to the internet, or focused target. Typically they are found through reconnaissance, selcted adn they attacked through vulnerabilities. Find the web server that is hosting the target, and exploit the vulnerabilities within its countermeasures or security to gain access to the target. Reconnaissance is required to see the possibility of attack, to see the existing infrastructure, and the possibility of exploiting the vulnerability. Motivations could be data theft, disruption of the entire web application. They usually have a structured plan beforehand. Since IT has reached to every industry in the world, they can attack any industry. They go after the data to make it public or sell it for money. Types of targets ○ Chemical, Electronic, Manufacturing, Aerospace, Automotive, Government, Energy, Telecommunications, Consumer, and Healthcare. Threat agent initiates the threat which exploits the vulnerability. The vulnerability generates a risk which can damage an asset. The asset is exposed and can be handled by a countermeasures. Security Threat Internal Can put in security measures. Employees, contractors, consultantas, vendors. External Can put in countermeasures Nation-state, Hackers, hacktivist, script kiddies Natural Not in your control Hurricane, earthquake Mobile Technology Mobiles in an organisation are allowed to carried information, valuable or quantity, by the employees. Mobiles are prone to vulnerability. The organisation has an app that can be used to hold all the information, yet they are vulnerabilities. Human are vulnerable to a range of threats, despite the best security measures.  Improper platform usage, insecure data storage, insecure communication, insecure authentication, insufficient cryptography, insecure authorisation, client code quality, code tampering, reverse engineering, and extraneous functionality. Mobile Malware Financial trojans have increased to a great extent, ransomware, and become a key threat. Distributed by poorly controlled app stores, repackaged existing apps, or SMS links. Largely designed to steal personal and financial information. Jailbroken iPhones and rooted Android phones are most vulnerable. Cloud Computing Backbone of the IT infrastructure, and most companies have moved their infrastructure in the cloud, or have partial infrastructure. The cloud is available on a subscription and metered basis. Another industries are also using, or completed switched. On-site infrastructure is difficult to scale and implement and assimilate. The cloud is infinitely scalable and assimilation. Cloud Threats ○ Management interface failure, virtual machine level (VM-level) attacks, malicious insider, service failure, weak authentication, inadequate infrastructure design, multi-tenancy, and misconfiguration. Cloud Application and Data threats ○ Social engineering, cross-site scripting (XSS), domain name system (DNS), SQL injection, sniffing, DoS or DDoS (Denial of service), OpenStack component, Man in the middle (MITM) attack, Advanced Persistent Threat (ATP) A threat that is well funded, highly skilled, establish their presence within the organisation, and difficult to trace. They will move deeper to find more valuable information. Advanced means that they use higher level of sophistication. Highly advanced methods of attack, expert skills and resources, use sophisticated and custom tools, all aimed at achieving their goals and purpose. Persistent means that they maintain an undetected presence, stay within the system for a long period of time, to obtain data without damage. Have specific goals and objectives until they are met, and intend to stay in the target zone long-term. Threat means motivated, skilled and persistent. Have coordinated human actions, capability, intent, and are resourceful and well-funded. Aimed at intellectual property, or government infrastructure.  Characteristics Use social engineering as a key tool. Work with clear and defined objectives against a target. Well-funded by sponsors. Well-organised in the form of hierarchy. Low profile attacks. Extremely stealthy and remain undetected. Do not cause damage to avoid downtime to avoid detection. Do not follow the hit-and-run method. APT actors Nation state actors, organised crime groups, hacktivist groups, corporate espionage actors, cyberterrorists. Life cycle Reconnaissance. Initial intrusion to the network or system. Installing the backdoor. Obtaining user credentials. Installing tools for control. Performing privilege escalation. Performing lateral movement. Maintaining persistence. Equation Group One of the most well-known APT, well-funded and sophisticated, and operating since 2001. Targets only one victim at one time, and uses various malware platforms, such as EquationDrug, and GrayFish to steal information from the target. Uses a command and control centre to monitor the malware and receive information. Uses a malware to alter hard drive, fanny worm, to attack air-gapped (isolated) networks, replace CD-ROM with infected versions, shared its exploits with Stuxnet and Flame group. Key tools used ○ EquationDrug, DoublePulsar backdoor, Double Fantasy, FuzzBunch framework, EternalBlue, Eternal Synergy, EternalRomance, GrayFish Strengthen the APT Defences Assume that you are already compromised Dig deeper into errors and accidents Monitor the known and its related elements Broaden the scope Use next-gen security solutions Automate the investigation and validation process Insider Threats An internal person in the organisation, or any other entity within or related the organisation or system.  Has legitimate access to the network and information. Can have overprivileged access. Can have access to privileged and confidential information. They are difficult to detect because they are invisible due to trust of employees. They bypass the exterior defence to being inside the organisation. They always have an edge over the exterior entities, due to knowledge of network, and legitimate accounts, and can access information in an unauthorised manner. Types of insider threats ○ Pure insider Fully embedded in the system and can wreck disruption due to access and privileges ○ Insider associate With limited access to the security network or system, like a contractor and security guard. ○ Insider affiliate They are related to someone who is within the system ○ Outside affiliate They are not related to anyone in the system, but will find ways into the organisation’s network. US - Computer Emergency Response Team (US - CERT) ○ Insider IT sabotage - misuses authorised level of access ○ Insider theft - used the IT systems to steal intellectual property ○ Insider fraud - uses IT to commit an identity fraud Reasons ○ Personal - anger, frustration, ideology, divided loyalty, ego, compulsive behaviour, adventure, or family problems. ○ Organisational - availability of confidentiality information, no classification of information, ease of access to network resources, no security policies in existence, no security trained employees, unwanted access, or odd shift working. FBI’s Behavioural Indicators of Insider threats. If the employees show one or more of these behaviours, they must be suspected. ○ Unwanted access, out of scope, copy of material, remote access at odd times, disregard of company policies, and odd working hours. Malware Stands for Malicious software, that disrupts the normal functioning of a system or network. Could also cripple the internet, or organisation.  They can be designed to delete data, steal data, bypass access control, encrypt data, or cause performance degradation. Can be used as a weapon to launch attacks against a system or network. The entry point of the system is usually opened with the malware. It can be delivered through a phishing email, website, pirated software, open software to the system. Can work as an independent entity, or can be controlled by a command and control (C&C) server. Method of Malware ○ Perform reconnaissance, trick the user, infect the user’s device, and cause damage. Types of Malware ○ Trojan It pretends to be a legitimate software, and is often a carrier for other malware, such as a worm. Requires the user’s intervention in most cases. Can be delivered though download r email. Virus Attaches itself to other files. Can also attack itself to applications installers and media Triggers when an infected file is opened and executed. Designed to disrupt the system’s functionality by deleting data or corrupting applications and operating systems. Worm Replicate itself over the network. Can be delivered over the network or email. Scans for vulnerability, self-replicating and does not require user intervention. Can cause network performance issues after infecting the network’s systems. Ransomware Can encrypt the user’s data, and demands a ransom to decrypt the data. The data may not be decrypted after paying the ransom. Uses social engineering to trick the user. Halts the systems and displays a ransom message. Spyware Designed to collect information from the user’s system without their consent. Intends to collect and send the information to the threat actor. Intends to stay in the user’s system without being caught. Rootkit Designed to remotely provide access to a malicious entity. Used to execute remote commands to control the system of device. Designed to subvert the security controls. Difficult to remove.  Adware Designed to display advertisements on a device’s screen. Can be triggered on a web browser or a program. Least harmful malware, but can be bundled with a spyware to track user's activities. Security Attack Conducted by a threat actor using a threat vector. Targeted at an individual or organisation. Can vary depending on the objective. Can be conducted by an insider or outsider. Usually done by exploiting a vulnerability or weakness in a system or network. Steps in an attack ○ Method 1 - Reconnaissance, scanning, access and escalation, exfiltration, sustainment, assault, and obfuscation. ○ Method 2 - Reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and exfiltration. Used by botnet to launch a DDoS, or DoS Uncertainty in an Attack Phases ○ Prior security risk management ○ Real-time intrusion detection ○ Posterior forensic analysis Handling Uncertainty ○ Logical approach When there is not much data available, and you need to use logic to solve it. ○ Statistical approach Data is available to be gathered, and analysis can be performed to find the best approach based on the results.  Cyber Security Foundations Cyber attacks 2016 Bangladeshi Bank Heist 2016 Indian debit card breach 2015 Ukraine Power grid attack 2014 Sony pictures hack After a cyber attack Organization name hits headlines! Loss in business: loss of customers, reputation/brand damage, trade secrets, strategies, plans leaked Legal penalties: lawsuits filed by customers for privacy breach. Regular functioning crippled: email systems down, automated payroll processing down, network outage etc. Defamation: Confidential emails leaked; etc. Information that needs protection Customer data, source code, design documents, financial reports , employee records, intellectual property, etc. Information systems: Computers, networks, other devices, cables etc. Category of attacks and security objectives violated Security objectives are also known as security goals, characteristics of information (and information systems). Often multiple objectives are compromised in a cyber-attack. In the case of sophisticated attacks multiple security objectives of multiple information systems are compromised. Information disclosure No secrecy on communication. Violates confidentiality Tampering Unauthorised alteration of message. Violates integrity Denial of service Website becomes unavailable for legitimate users. Violates availability Spoofing Attacker pretends to be an authentic user. Violates authenticity  Elevation of privilege User does an action woithout sufficient priviledge. Violates authorisation Repudiation Falsely denying an action. Violates non-repudiation Information Security Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide: ○ Integrity which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity; ○ Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and ○ Availability, which means ensuring timely and reliable access to and use of information. CIA/DAD Triad ○ The Confidentiality, Integrity and Availability are together called as the CIA triad. ○ Sometimes the alternate way of referring is a DAD triad. DAD triad is a negative form the CIA. DAD stands for Disclosure, Alteration & Denial. These are opposites to Confidentiality, integrity & availability. ○ The objectives of confidentiality, integrity & availability is the foundation of information security. All protection mechanisms aim to protect one or more of these objectives. AAA services ○ Authentication is verifying an identity. ○ Authorization is deciding whether a particular user is allowed to access a particular resource or function. ○ Accounting includes two other components - auditing & non-repudiation. Auditing is recording a log of activities of a user in a system. Accounting refers to reviewing the log file to check for violations and hold users answerable to their actions. It includes non-repudiation. AAA services are used to realize the CIA principles. For example, if you want a document to be confidential, within your team. You will assign 'read' permissions only for your team members. So you use authorization to enforce this requirement.  Simply put, authentication & authorization are used to control access to a resource. Accounting is done to verify access if has not been violated Technical Terminology Asset Threat Threat agent Vulnerability A flaw or weakness in the system’s design, implementation or operation could be used exploited to compromise objectives Technical Impact Impact on the information or the functioning of the information or system Business impact Harm done to the business Attack vector Ways in which an attack can come Security Controls Protection mechanisms to prevent, block or to detect attacks. Multiple security controls are often implemented for better security. Fixing each vulnerability requires resources (money, time, effort). Since such resources are limited it is important to know which vulnerabilities are very important to fix or need not be fixed. Without this knowledge, you might end up spending too much in protecting against an attack that will never happen. There is a need to prioritize vulnerabilities. Two factors influences this priority: ○ Likelihood of an attack ○ Impact due to the attack A combined estimate of both these factors is called risk. Estimating risk is called risk analysis. Information security is stated as a "well informed sense of assurance that the risks and controls are in balance". Cryptography The practice and study of secure communication in the presence of adversaries is called cryptography.  Cryptography provides confidentiality and assurance of integrity, authenticity and non-repudiation. However cryptography is equally applicable to information at rest (information in hard disk). Confidentiality of data in transit and at rest can be done using shared key cryptography and public key cryptography. Integrity can be maintained by hashing. Authenticity and Non-Repudiation can be maintained by Digital signature. Cryptography can make use of encryption algorithms. Encryption algorithms turn messages and information into gibberish using a cypher, and a decryption algorithm with the same key can decode the cypher. A key is a very large integer, and the same key can be used for encryption and decryption. Tis method is called Shared key encryption or symmetric key encryption. Popular encryption algorithms are Advanced Encryption Standard (AES), Triple Data Encryption Standard (3DES), Blowfish, Twofish, Skipjack. Disadvantages of Shared and Symmetric Key Encryption ○ Secure key distribution is problematic Both the computers need to know the key. Through the network in plaintext form, the key can be shared. Then the key can be ‘sniffed’ by an attacker and further encrypted communication can be decrypted by the attacker. There is a need for a secure way for sharing the key. The keys can be shared through ‘out of band’ channel like a phone call, if humans intervene. But such techniques are tedious and often not possible, especially if the communicating parties are strangers or special devices like routers. ○ Not scalable Given a symmetric key system with n users, each pairwise communication requires a unique key. When a computer joins the group as the nth user, there needs to be (n-1) keys created for communication with a new computer. In total there will n*(n-1)/2 keys in a system of n users. The problem is as the number of users become large, the number of keys become extremely large (increases quadratically, O(n2)). It is very difficult to manage very large number of keys. Thus shared key cryptosystems are not scalable. Public Key Cryptography ○ Each user has a pair of key - a public and a private key. A private key is only known to the user, and a public key is known to everyone. A message encrypted with the public key can only be decrypted with the private key and vice versa. ○ Also known as asymmetric key cryptography. RSA and ELGammal are softwares that do this.  ○ It is scalable, A user should know the receiver’s public key. The public keys are available to everyone in a key server. When a new computer joins, a new entry is created in the key server for their public key. The computer will have their private key with them. So there are only 2*n keys required (n users * [1 public key + 1 private key]). When the number of users increases linearly, the number of keys also increases linearly (O(n)). ○ Asymmetric key cryptography has a limitation – it is very slow. It is about 1000 times slower than symmetric key encryption. ○ Often, both these techniques are used together to combine their advantages. One of the problems with symmetric key cryptography was the need for a secure & efficient way of sharing the secret key. This problem is solved by using public key cryptography to share the secret key. Once the key is shared, all communication between sender & receiver will use symmetric-key cryptography. (Speed advantage). Hashing Compare this hash value and the hash value published on the web site of Kali Linux. If they both match, the OS file is unaltered (i.e. it is integral). If the values do not match it means the file has been corrupt (accidentally) or tampered (by an attacker). You will not want to install a corrupt file, because, the installation could fail, fully or partially. Or a corrupt unstable OS will be installed. You might not get the OS file from Kali Linux website. You might receive it from a friend or download it from some other file hosting site. The problem is malicious person could have tampered the OS file to insert ‘malware’ and before hosting the file. A hash function or algorithm is a cryptographic technique. It takes an arbitrarily long input and produces a fixed length hash value as its output. This hash value is also known as message digest. Input can be of any length. Output hash will be fixed length. One way function: Computationally easy to convert from message to hash. But it is computationally infeasible to get the actual message from hash. Collision free: It is very unlikely to find two different messages that will have the same hash value. Hashing is not just used for files (data at rest), it is applicable to messages transferred between computers (data in transit) also. To ensure integrity: ○ Whenever you install an important software in your device, you will not want a corrupt, tampered, malware laden or unstable file to be installed. To prevent this, it is  important to check the integrity of the downloaded file before installing it. Hashing is widely used for performing such integrity checks. To ensure secure storage of passwords: ○ Typically password stores hold the passwords in the hashed form. Even if a hacker gets access to the store, the actual passwords cannot be retrieved. When a genuine user needs access, the password entered by the user will be hashed and matched with the passwords stored. Hash value match would result in user being successfully verified, and a mismatch indicates an invalid user. Digital Signature One person may deny that they have sent the message, or the message may have originated from an attacker or outside entity. Digital signature solves both of this. You know that the signer will use the private key to sign the document. The receiver will use the public key to verify the document. But you must have a pair of public-private keys to begin. Generate a digital ID. A digital ID is a password protected file that contains the following: ○ Private key ○ Public key ○ Identity information Identity information is information about the holder of the private key (in this example you). Name, email address, organization and country. The public key and the identify information are combined in a format called a public key certificate. The signature value in PDF implementation includes the following: ○ Digital signature (signed message digest) ○ Timestamp (time of signing) ○ Signer’s public key certificate Generation Algorithm ○ The message to be sent is hashed to get a hash 'h'. Hash 'h', is then encrypted using the sender’s private key (PriA) to generate signature 'S'. Sender sends the message along with it’s signature to receiver. The signature generated in above step is unique for a combination of a message and a private key. So, the signature will be different for different messages sent by the same user.  ○ Verification Algorithm ○ The received message is hashed to generate hash 'hr'. The received signature is decrypted using sender’s public key (PubA), to generate another hash h’. If hr is found equal to h’, it means the signature is valid. Therefore, the message is authentic and sender cannot repudiate. ○ If the received message or signature is tampered during transit, then hr will not be equal to h’ (signature invalid). So digital signature also provides data integrity. In fact for a message to be authentic, it should be integral in the first place. ○ Application of Cryptography Cryptographic mechanisms such as encryption, hashing, digital signatures require computational resources such as CPU time and memory. Thus, they can impact performance. The choice of a cryptographic algorithm from all available options must be done by evaluating both the performance of each algorithm and the security levels they provide. Tradeoffs between performance and security will often be required. HTTP Secure (HTTPS) protocol is used to protect web transactions by encrypting the communication between browser and the web server. The technology used for encyrption is Transport Layer Security (TLS). (Earlier it was SSL). It relies on both symmetric and asymmetric cryptography. The following steps describe its working. ○ When a user visits a website, the website supplies the browser its public key. ○ The browser creates a random symmetric key (called session key), encrypts it using the website's public key and sends it the website. ○ The website then decrypts the session key using its private key.  ○ The browser and the website use the session key for all further communication. SSL leverages the advanced functionality of asymmetric cryptography while encrypting & decrypting the vast majority of the data exchanged using the faster symmetric algorithm. Devices such as laptops and smart phones often contain highly sensitive information, if lost or stolen, could cause serious harm to an organization and its customers, employees, and affiliates. Encryption to protect the data on these devices in the event of theft of these devices. For example, Microsoft Windows operating system uses BitLocker and Encrypting File System (EFS) technologies for the purpose of encryption. Other common applications include, encrypting email, Digital Rights Management (DRM), wifi encryption. Breaking the Cryptography System In a 256 bit key system, there are 2256 possible keys. The decryption key is one among these possible keys. By trying out all of these 2256 possible keys in a trial and error manner, the cipher text can be decrypted. The larger the key size, the more time for a brute force attack and hence the more secure is the encryption system. Almost all cryptographic systems have a limited life span. Moore's law, a commonly cited trend in the advancement of computing power, states that the processing capabilities of a state-of-the-art microprocessor will double approximately every two years. This means that eventually processors will reach the amount of strength required to quickly find the encryption keys used for a communication. Network Security Network security refers to any activity taken to protect the availability of networks and confidentiality and integrity of data in the network. The Internet is an untrusted place. Anything coming from it could be potentially harmful. The organization’s network is a trusted zone. Data entering the intranet (trusted zone) from the Internet (untrusted zone) must be carefully scrutinized. There should be mechanisms to prevent certain data from entering the network. Firewall and Intrusion Detection System (IDS) work as security against attacks like DoS, etc DDoS Attacks A large number of malware infected computers send a huge volume of requests to the target host (victim), resulting in the victim’s loss of availability.  A infected computer is called a bot. An IoT device in this example, was the bot. A group of bots that receive instructions from an attacker (on whom to target and when to target) is called a botnet. The OVH DDoS attack is a connection-flooding DDoS attack: Server's normal operation: for each request from a host, a server will allot some memory. When a deluge of requests is received the server’s memory is exhausted. So the server will stop accepting new requests. Firewall A firewall is a special computer that is placed between an organization’s intranet and the Internet. In general a firewall is a a special computer or software running on a general purpose computer or router. It controls what data (network packets) enters or leaves the network. A traditional packet filter firewall, and more sophisticated firewalls like proxy firewalls, web application firewalls. All communication between the Internet and the intranet flow through this firewall. A firewall has an access control list. Each entry is called a rule. The firewall inspects every packet's headers – source and destination IP addresses and ports etc. It compares the header information with each rule in the access control list, in an if-else if-else way. If a packet matches a particular rule, then, the action specified under that rule is applied. The action could be allowed a packet or deny entry/exit for a packet. Host based Firewalls The firewalls are placed between two networks and hence are called network firewalls. A firewall that is placed between a computer and a network is called a host based firewall. It controls traffic between the applications in the computer and the rest of the network. Windows firewall is an example. Apart from controlling access to internal sites, a firewall is used to block several types of attacks like DDoS or to enforce an organization’s network policy (eg: Employees not allowed to access Internet websites). Demilitarised Zone Here the public server is between two firewalls (A & B). This area where public sites are hosted is called a demilitarized zone (DMZ). Firewall ‘A’ will be configured to block incoming port 80 packets (like before). Firewall ‘B’ will allow incoming port 80 packets but might have other rules that protects the DMZ itself.  Thus public sites could be accessed from Internet, but not the internal sites. Public facing severs are more likely to be ‘hacked’. An attacker after hacking a host will attempt to ‘move horizontally’ by hacking other hosts in the same network. In the case of DMZ it much more difficult to do this horizontal movement across the two firewalls. Intrusion Detection System An unauthorized user logs on to a machine. An authorized user disables logging functionality in a router. A worm (a type of malware) spreads to all the hosts in the network. An authorized user (say an employee) downloads all employee directory records to his computer. An unusually high number of login attempts in a host. All the above examples involve an user (or computer process) trespassing or attempting to trespass into a network (or host). Such trespasses are as intrusions. A firewall cannot be useful in detecting or stopping such intrusions. An Intrusion Detection System (IDS) is used to detect such intrusions. An IDS is a dedicated computer or a software running on a general purpose computer. It is positioned at certain points in the network. The IDS sniffs all the packets at that point. It analyses the contents of network packets (headers and application data) and the sequence of packets. If the analysis result indicates an intrusion, an alert message is sent to the administrator. An IDS can also use different log files (generated by hosts) as input for detecting intrusions. There are two kinds of IDS based on how packets are analysed. ○ Signature based IDS Each type of intrusion have a characteristic pattern: Certain sequence of events. Certain format of data etc. Information that describes this pattern is called a signature or a rule. A signature based IDS contains a large database of attack signatures. The IDS inspects the packets (or log files) and compares them to each signature in the database. If any of them matched, then an alert is issued to the administrator. Disadvantage: Signature based IDS cannot prevent unknown attacks (because signatures are not available). Most IDSs are signature based IDS ○ Anomoly based IDS Can detect previously unknown intrusions. Such an IDS will observe the normal traffic in a network and creates a ‘traffic profile’. It then looks for network traffic that is statistically unusual and issues an alert. Anomoly based IDS can also observe the normal behaviour of users to create a 'behaviour profile'. If it sees a deviation from the normal behaviour, it issues an alert.  An IDS can generate false positives. If a safe packet is determined as suspicious, then it is called as false positive. Many false positives could be detected if the signatures (aka rule) are too restrictive. An IPS (Intrusion Prevention System) not only issues an alert but also attempts to block an intrusion. However blocking may not always be possible. Hence detection is the next solution. The purpose of detection is to respond to an intrusion as soon as possible to minimize the damage. The threats to network security is not limited to Denial of Service attacks. There are numerous other threats such as - port scans, network mapping, OS vulnerability scanning, worms, viruses, email spam. The firewall and IDS can prevent or detect such threats. But they should be configured properly in the first place. Similarly, all devices attached to a network should be configured properly. Application Security Though it is easy to fix the SQL injection vulnerability, these attacks are common and have resulted in huge losses. Neither cryptography nor network security can prevent the SQL injection attacks. The attack will happen irrespective of the use of encryption (HTTPS) or not. Also, for the network security devices, the communication (containing the SQL injection attack input) from client to web application looks safe. Security defects in applications are introduced in the implementation (coding) phase or in the design phase. Defects introduced in the implementation phase are security bugs. Defects introduced in the design phase are security flaws. Failing to do server side input validation is an example of a security design flaw. An improperly implemented input validation logic is a security bug. Developing secure applications involves preventing these security bugs and flaws. It is achieved by, following established, ○ secure coding practices ○ secure design principles Secure coding is a practice to avoid introducing security bugs in the software. Security professionals have analyzed previous attacks targeting applications and have discovered that most vulnerabilities have arisen from common coding errors: ○ OWASP Top 10 Application Security Risks ○ SANS Top 25 Dangerous Software Errors  As a developer/tester/code reviewer your objective is to ensure your applications don't have these common security bugs. These guides provide secure alternatives for each of the errors (for developers) and tips on how to detect these errors (for testers, code reviewers). Security design flaws can be avoided by following established secure design principles: ○ OWASP Security by design principles ○ IEEE Avoiding the Top 10 Software Security Design Flaws ○ SANS Top 25 Dangerous Software Errors Principle of least privilege ○ Users should have no more privileges than required for carrying out their normal functions. ○ Applications, have user accounts in the database so that they can the access database. If the web application's functionality is just to retrieve records from the database, then it is sufficient to have a read privilege. ○ In fact, permissions should be tuned so that the application user account will not be able to read tables of other applications. We say 'mitigating' because it does not eliminate the vulnerability, but instead significantly reduces the severity of the vulnerability. For example, the number of records exposed due to an SQL injection vulnerability will be reduced if the least privilege principle is followed. Principle of defence in depth ○ Use of multiple security controls to mitigate a vulnerability. So that even if one fails, we can hope that other controls can prevent an attack. ○ Defence in depth is having multiple obstacles before an attacker to make it very difficult for the attacker. Application security is not limited to following secure coding practices and design principles. A crucial component of application security is security testing. Security testing provides an assurance that the application is secure. Most of the common security bugs (like SQL injection) can be detected by automated security testing tools. Moreover, in this section we saw SQL injection attack. But there are a lot of other severe attacks like cross site scripting attacks, buffer overflow exploits, cross site request forgery attacks, session hijacking etc. Threat Modelling When an application is deployed, many threat agents predominantly from the Internet, try to attack that application. A single security loophole in the application can cause severe damage to  it. Hence, every organization wants their applications to be secure and protected against such damages. This demands for designing and developing secure applications without loopholes. Threat modelling is one important activity carried out in the design phase of the software development life-cycle that helps in identifying and addressing security loopholes. This activity enables organizations to develop highly secure applications. Threat modelling is a process where the design of the application is analysed to find potential security problems. Following are the steps involved in threat modelling process: ○ The design of the application, usually represented as a Data Flow Diagram (DFD) will be taken for analysis. ○ A threat modelling team comprising software designers/developers and software security analysts will analyse the DFD and brainstorm to identify potential security problems (threats) that can endanger the security of the application. ○ The identified set of threats to the applications are collectively called as a threat model. ○ Threat modelling team will identify vulnerabilities that might be exploited by the identified threats and will identify suitable counter-measures to address all the threats in the threat model. Need for Threat Modelling Software designers and developers approach software security in two ways - "Security as Afterthought" (not a good practice) and "Security Early in the SDLC" (best practice). ○ Helps in building a very robust application that is secure by design, by identifying security defects even before the code is written. ○ Drastically reducing the effort in redesigning and rewriting the software (as in the case of Security as Afterthought approach). Software Development Life Cycle (SDLC) is a process implemented by software developers to design and test their software. It helps in improving the quality of the software and looks after the overall development of the software. It is divided into many phases where each phase has its own significance.  Earlier, software development practice treated security as an “afterthought” i.e. security will become a focus only during the testing phase of the SDLC after the software has been designed and implemented. During security testing, many security defects might be identified in the application which will require redesign of the software or rewriting some code of the software to correct the defect. This redesign and rewriting code is a significant source of wasteful effort. This rising and significant wasteful effort forced software designers/developers to adopt the new approach - Security Early in the SDLC. Current software development practice has shifted from the approach of “security as afterthought” to “thinking about security early in the SDLC – in the design phase”. This approach is also known as “shift left (in the SDLC)”. One of the key activities in this approach is threat modelling. ○ Design related security defects are identified by analysing the design documents and the design will be corrected. ○ Potential implementation (or code) related security defects will be anticipated by analysing the design documents, and necessary precautions will be taken to avoid such defects before even beginning the implementation phase. In the SDLC model, the cost to resolve an issue increases in the later phases of development. Thus, it is important to run a thorough assessment on the application to know the current status of the security level and resolve the potential threats as early as possible. That is why, threat modelling is introduced in the design phase. Following are some the benefits of implementing Threat Modeling: ○ Allows architects and designers to evaluate the design of the application for vulnerabilities in the design phase. ○ Helps in future release of a software to evaluate whether new security controls need to be put in place or existing controls are sufficient. ○ Helps in cost reduction by mitigating threats in early SDLC. ○ Reduces cost by removing maximum security defects before development. ○ Provides a clear "line of sight" across a project and cut down errors and efforts. Threat Modelling involves the following steps: ○ Step 1: Identify security objectives - Enumerate the security objectives of the application, i.e. the security requirements that must be fulfilled by the application. ○ Step 2: Create an Application Overview - Identify important characteristics and elements (such as relational database servers, business logic, application server, client-side application) of the systems and external actors (users, administrators or  other systems/applications) that affect the application. All these functionalities should be understood before implementing other steps. A fine understanding of all the functionalities of the application helps in defining the scope of the application. An overview of a particular application will help in getting details of all the possible vulnerabilities present in the application. This step helps you to identify relevant threats during step 4. ○ Step 3: Decompose your application - Draw a model of the application that details the interaction (data flow) between various elements in the application. ○ Step 4: Identify threats - Analyse the model of the application to identify threats relevant to your application and context. ○ Step 5: Identify vulnerabilities - Analyse the application to identify vulnerabilities in various elements that can be exploited by various threats. After threats and vulnerabilities are identified, security controls or countermeasures for these threats/vulnerabilities must be identified. All this information will be documented. Assets of an application are one of the main reasons behind any cyber-attack. Weak measures taken to protect the assets can aid hackers in exploiting the application. Assets can be broadly classified into: ○ Data: Any sensitive data like Customer Information, User ID, Passwords, Credit card information ○ Resources: Resources can again be classified into software and hardware resources Software: Application, application database, third party software and any software that needs to be secured Hardware: Application, web and database servers All these assets need to be documented in order to protect them from the atrocities of potential hackers. An application grants some set of access rights specifically defined for its users. These access rights are the trust levels implied by an application. These trust levels need to be documented in order to monitor the access rights at every entry point and required to engage with the asset of an application. Also, data flow diagrams can be developed with privilege boundaries using the information about the trust levels. A high-level visualization of the working of an application can be provided by Data Flow Diagrams (DFDs). DFDs help in understanding how the data is designed to flow within the system. All the documented components play a major role while drafting a DFD. The below  DFD is drawn using a tool (we will see more on this later). It is also common to use a whiteboard and marker to draw the DFD. The DFD is a model of the application, and the process of drawing this DFD is simply called as modelling the application. Vulnerabilities are divided into different categories: - ○ Authentication and Authorization vulnerabilities ○ Input/Data validation vulnerabilities ○ Configuration management vulnerabilities ○ Sensitive data vulnerabilities ○ Session management vulnerabilities ○ Cryptography vulnerabilities ○ Parameter manipulation vulnerabilities ○ Exception management vulnerabilities ○ Auditing and logging vulnerabilities Microsoft’s DREAD Microsoft’s DREAD Threat-Risk ranking model can be used to determine the ranking of a threat. In order to determine the threat, basic questions to be answered for each factor of risk, for example: ○ For Damage: How big would the damage be if the attack succeeded? ○ For Reproducibility: How easy is it to reproduce an attack to work? ○ For Exploitability: How much time, effort, and expertise is needed to exploit the threat? ○ For Affected Users: If a threat were exploited, what percentage of users would be affected? ○ For Discoverability: How easy is it for an attacker to discover this threat? Each risk component is assigned a value between 0 (low) and 9 (high) so that a quantifiable score can be created for potential threats. It helps in prioritizing the security responses according to the rank of the individual threats. One can define the rating as low (L), medium (M) and high (H) on the following basis of the value received by calculating the average of the DREAD components of a particular threat i.e. (D+R+E+A+D)/5 The techniques and controls that are used to mitigate the exploitation that can be caused by a potential threat through known or unknown vulnerabilities are called as countermeasures.  Documenting the identified threats, vulnerabilities, countermeasures and other details are important. If this information was not documented, it is very likely that some threats are not addressed even though they were identified during the threat modeling process. Threat modeling is a manually intensive task that relies solely on the specification documents, data flow diagrams and the knowledge of an individual which is abstract in nature. There are chances of threats being missed mainly because one particular data flow has not been analysed or because of insufficient knowledge of the person about emerging threats. Since manual threat modeling is time-consuming, most threat models are drawn holistically at a software architecture/design level and not at individual use case level. Because of this, threats related to a specific use case may be missed out. A threat modeling tool can help in alleviating these difficulties. Benefits of using a threat modeling tool: ○ Make use of rich knowledge of threat repository (library) for a given component. ○ Draw Data Flow Diagrams (DFD) easily. ○ Automate the identification of threats and vulnerabilities. ○ Automatically come up with required countermeasures. ○ Generate documents. External Entities This is an external interactor that is outside your area of control. It could be a user that is calling your API or web application, or it could be another component that calls your API. Example-People, Other Systems, Microsoft.com, etc. Process It is a collection of code or web methods or components that performs some computations on the data. It is basically a group of functions that performs some actions. Example- DLLs, EXEs, COM object, Services, Assemblies, etc. Data Flow It basically represents the communication links used for data transfer between entities or components within the system. Example-Function call, Network traffic, Remote Procedure Call (RPC), etc. Data Store A unit that holds the data. That is, Data repository. Example-Database, Registry, Queue/Stack, etc. Trust Boundary Occurs when one component doesn’t trust the other component outside its boundary without sufficient authorization. Example-Process boundary, File system, etc.  Using these components, one can draw a model (precisely the data flow diagram) of the application. But the model so formed can be an incorrect one. This is a complete threat model because the source of data is present in this diagram. Here, the customer is the external entity that sends data to the SQL database through the web application. Also, there is proper data flow between SQL Database and Web Server and between Customer and Web Server. Tthe rules that need to be followed while drawing the model of the application are: ○ Data stores should have a sink - When you mention a database or a data store, remember to include the entity that will be using that store. ○ Data doesn’t flow magically - Don’t connect two entities without an intermediate process. ○ Data doesn’t appear magically - A Web Server needs an interface (such as an API) to connect to a data store. ○ There should not be any required component missing - Skipping any component in the diagram will make it incomplete. ○ Right flow of data - The flow of data should be in appropriate direction. The arrows should be drawn such that it correctly shows that the data is flowing from which component to which component. Access Management Subject A subject is an entity, usually a user, device, or process, that requests access to resources or services in a system. The subject is often authenticated and authorized before access is granted.  Object An object is a resource or entity within a system that a subject wants to access. Objects can be files, databases, services, or any data that subjects need to interact with. Identity Identity refers to the distinct attributes or characteristics that uniquely define a subject within a system. It is what distinguishes one user or entity from another and is often verified through authentication processes. Attributes An identity store is a repository that holds identity information such as usernames, passwords, roles, and attributes. It is where authentication and authorization decisions draw information from. Examples include Active Directory, LDAP, or custom databases. Identity store An identity store is a repository that holds identity information such as usernames, passwords, roles, and attributes. It is where authentication and authorization decisions draw information from. Examples include Active Directory, LDAP, or custom databases. Access Access refers to the ability of a subject to interact with an object in a system. It can be read, write, execute, or any form of interaction allowed by the system's policies. Authentication Authentication is the process of verifying the identity of a subject. This typically involves confirming that a subject is who they claim to be, often through passwords, biometrics, tokens, or other verification methods. Authorization Authorization is the process of determining what actions a subject is allowed to perform on an object. Once a subject is authenticated, authorization policies define what resources or services they can access and what actions they can take. Accountability Accountability ensures that all actions and access to resources by subjects are logged, tracked, and can be audited. This ensures that any unauthorized or malicious actions can be traced back to the responsible party, promoting transparency and security. Single Sign On SSO is an authentication process that allows a user to access multiple applications or systems with a single set of login credentials. Instead of requiring separate usernames and passwords for each application, SSO enables users to authenticate once and gain access to all authorized systems without having to log in again for each one.  How SSO Works: 1. User Authentication: When a user tries to access an application or service, they are redirected to the SSO authentication service. The user provides their login credentials (username and password, for example) to the SSO service. 2. Token Generation: Once authenticated, the SSO service generates a security token or session that contains the user's identity and access information. This token is encrypted and passed back to the application or system the user is trying to access. 3. Access to Applications: The application verifies the token with the SSO service. If the token is valid, the application grants the user access without requiring them to log in again. 4. Token Reuse: As the user navigates to other applications within the same SSO environment, the existing token can be reused. The user does not need to re-enter their credentials, as long as the token is still valid. Benefits of SSO: ○ User Convenience: Users only need to remember one set of credentials, reducing the hassle of multiple logins. ○ Improved Security: SSO can enhance security by centralizing authentication and allowing for stronger, more consistent security policies (e.g., multi-factor authentication). ○ Reduced IT Burden: IT departments spend less time managing multiple passwords and can focus on securing a single authentication point. ○ Streamlined User Experience: Users can easily switch between applications without repeated logins, improving productivity. Risks and Considerations: ○ Single Point of Failure: If the SSO system is compromised, an attacker could potentially gain access to all connected applications. ○ Session Management: Managing token expiration and ensuring users are logged out securely across all applications can be challenging. ○ Compatibility: Not all applications may support SSO, requiring careful integration planning. Examples of SSO: ○ Enterprise SSO: Common in corporate environments where employees access multiple internal systems (e.g., HR systems, email, file storage).  ○ Web SSO: Used for accessing various web applications like Google services (Gmail, Google Drive, YouTube) with one Google account. ○ Federated SSO: Allows users to authenticate across multiple organizations or domains (e.g., using your Google credentials to log into third-party websites). SSO simplifies the user experience while maintaining security, making it a popular choice for both enterprises and service providers. Password Management With SSO enabled IAM systems in organisation, single credentials are sufficient to access all the internal applications. Although, this makes it easy for the uses to access, it also makes it easy for a hacker to gain control of all the linked application at once on hacking this single password. Hence, it is also necessary to build strong access mechanisms to avoid any such violation of access rights by having set strong password and by managing it. Password management refers to the practices, tools, and strategies used to create, store, manage, and secure passwords. Effective password management is crucial in maintaining strong cybersecurity, as passwords are often the first line of defense against unauthorized access to systems, applications, and data. Key Aspects of Password Management: Password Creation: ○ Strong Passwords: Passwords should be complex, using a combination of uppercase and lowercase letters, numbers, and special characters. They should also be sufficiently long (e.g., at least 12-16 characters) to resist brute-force attacks. ○ Avoid Common Passwords: Users should avoid easily guessable passwords such as "password123," "qwerty," or any personal information like birthdays. Password Storage: ○ Secure Storage: Passwords should never be stored in plain text. Instead, they should be stored using cryptographic hashing algorithms, which convert passwords into a secure format that cannot be easily reversed. ○ Password Managers: These are software tools that securely store and organize passwords. They can generate strong, random passwords and store them in an encrypted vault, accessible only with a master password or through multi-factor authentication. Password Policies: ○ Regular Updates: Organizations often enforce policies that require users to change passwords regularly (e.g., every 60-90 days). However, it's important not to make this too frequent, as it may lead to weaker password practices.  ○ Password Reuse: Users should be discouraged from reusing passwords across different accounts. A compromise on one account could lead to vulnerabilities in others if the same password is used. Multi-Factor Authentication (MFA): ○ Additional Layer: Password management can be greatly enhanced by implementing MFA, which requires users to provide two or more verification factors (e.g., a password and a fingerprint, or a password and a code sent to a mobile device). ○ Reduced Risk: Even if a password is compromised, the additional factor makes unauthorized access much more difficult. Password Recovery: ○ Secure Recovery Processes: Password recovery mechanisms (e.g., security questions, email resets) should be secure and not easily exploitable. Recovery processes should involve multi-factor authentication whenever possible. ○ User Education: Users should be educated about the risks of phishing and social engineering attacks, which often target password recovery processes. Monitoring and Alerts: ○ Breach Detection: Some password managers and security tools monitor for data breaches and notify users if their credentials have been exposed, prompting them to change passwords immediately. ○ Login Alerts: Users can enable alerts that notify them when a login attempt is made from an unrecognized device or location. Password Sharing: ○ Avoid Sharing: Passwords should not be shared. If sharing is necessary, it should be done through secure means (e.g., using a password manager’s sharing feature that keeps passwords encrypted). ○ Role-Based Access Control: Instead of sharing passwords, organizations should implement role-based access control (RBAC) where each user has access to the resources they need without sharing accounts. User Training and Awareness: ○ Phishing Awareness: Educate users about phishing attacks that attempt to steal passwords through deceptive emails or websites. ○ Password Hygiene: Promote good password hygiene practices, such as not writing down passwords in insecure places, and being cautious of where passwords are entered. Benefits of Good Password Management: ○ Enhanced Security: Strong and well-managed passwords reduce the likelihood of unauthorized access and data breaches.  ○ Simplified Management: Password managers simplify the process of handling multiple strong passwords, reducing the burden on users. ○ Compliance: Many regulatory frameworks (e.g., GDPR, HIPAA) require organizations to implement strong password management practices to protect sensitive information. Challenges in Password Management: ○ User Resistance: Users might resist adopting strong passwords or password managers due to perceived complexity or inconvenience. ○ Password Fatigue: Managing numerous passwords without proper tools can lead to fatigue, where users start using weaker passwords or reusing them across platforms. Tools and Best Practices: ○ Password Managers: Tools like LastPass, 1Password, and Dashlane help manage and securely store passwords. ○ Password Generation: Use password managers to generate strong, unique passwords for each account. ○ Regular Audits: Organizations should conduct regular audits of password practices and update policies as needed. Effective password management is critical for both individuals and organizations to protect against unauthorized access and maintain the integrity of sensitive information. Identity Federation Federated Identity Management (FIM) is managing a single identity information among multiple enterprises to let users use the same identity information to gain access across inter and intra enterprise networks. Identity federation is a system that allows users to authenticate across multiple systems, organizations, or domains using a single identity credential. It facilitates secure and seamless access to resources across different security domains without the need for multiple separate login credentials. Identity federation is commonly used in environments where users need to access resources from different organizations or services, such as in business partnerships or when using cloud services. Federated Identity: ○ A federated identity is a single digital identity that is trusted across multiple systems or organizations. Users can use this identity to access various services without needing to create separate accounts for each one. Identity Provider (IdP):  ○ The Identity Provider is the entity that authenticates the user and issues a token or credential asserting the user’s identity. Examples of IdPs include organizations, social media platforms (like Google or Facebook), or dedicated services like Microsoft Azure AD. Service Provider (SP): ○ The Service Provider is the entity or system that the user wants to access. The SP relies on the IdP to authenticate the user and then grants access based on the identity and attributes provided by the IdP. Trust Relationships: ○ Identity federation relies on trust relationships between the Identity Provider and the Service Provider. These relationships are often established through digital certificates or shared cryptographic keys, ensuring that tokens or credentials from the IdP are accepted by the SP. Single Sign-On (SSO): ○ Identity federation often incorporates SSO, allowing users to log in once and access multiple services without needing to re-authenticate. SSO within a federated identity context works across different domains or organizations. Standards and Protocols: ○ SAML (Security Assertion Markup Language): A widely-used XML-based standard for exchanging authentication and authorization data between IdPs and SPs. ○ OAuth: A protocol that allows third-party services to exchange tokens for resource access, often used for delegated access. ○ OpenID Connect: An identity layer built on top of OAuth 2.0, providing an easy-to-use protocol for federated authentication. How Identity Federation Works: ○ User Authentication: A user attempts to access a service provided by an SP. The SP redirects the user to the IdP for authentication, often through a web-based interface. ○ Token Generation: The IdP authenticates the user (e.g., using username and password, multi-factor authentication). Upon successful authentication, the IdP generates a token or assertion containing the user’s identity information and attributes. ○ Token Exchange: The user is redirected back to the SP with the token provided by the IdP. The SP verifies the token with the IdP and, if valid, grants the user access to the requested service.  ○ Access Granted: The user can now access the service without needing a separate login for that specific SP. Benefits of Identity Federation: ○ User Convenience: Users can access multiple services across different organizations or domains with a single set of credentials, reducing password fatigue and the need to remember multiple logins. ○ Security: Identity federation centralizes authentication, allowing organizations to enforce consistent security policies, such as strong password requirements and multi-factor authentication. ○ Scalability: Organizations can easily integrate with partners, vendors, and cloud services without managing separate user accounts for each service. ○ Streamlined IT Management: IT departments can manage identities centrally, reducing the administrative overhead associated with managing multiple user accounts and credentials. Use Cases of Identity Federation: ○ Enterprise Collaboration: Companies in a partnership might use identity federation to allow employees from one organization to access resources from another without requiring new accounts. ○ Cloud Services: Users can log into cloud services (e.g., Microsoft 365, Salesforce) using their corporate credentials, thanks to federation between the enterprise's IdP and the cloud provider. ○ Education: Universities often use federated identity to allow students to access resources across different campuses or partner institutions. Challenges and Considerations: ○ Trust Management: Establishing and maintaining trust relationships between IdPs and SPs can be complex, especially when multiple organizations are involved. ○ Interoperability: Ensuring that different systems and protocols (e.g., SAML, OAuth) work together seamlessly can be challenging, especially in heterogeneous environments. ○ Security Risks: If the IdP is compromised, it could lead to unauthorized access across multiple systems, making the security of the IdP critical. Examples of Identity Federation: ○ Shibboleth: A widely used open-source identity federation system, particularly in the education sector. ○ SAML Federation: Often used in enterprise environments for federated access to cloud services.  ○ OAuth with OpenID Connect: Commonly used for social logins, where users can log in to third-party websites using credentials from services like Google or Facebook. Identity federation simplifies and secures access across multiple systems, making it a powerful tool in modern cybersecurity and identity management strategies. Authorisation Secure access management is carried out with the aid of Authentication, Authorisation and Accountability (AAA) services. As seen earlier, authentication was carried out to provide access to legitimate subjects on the right set of objects. Besides authentication, it is imperative to manage access permission on objects for different category of subjects. This next level of Access Management is carried out by Authorisation. Authorisation is a process of granting access permissions to subjects on various objects based on the subject's nature of work and job role. This will significantly cut down the undesirable access gained by the subjects. Authorisation also helps in keeping a tab on number of access violations. Authorization is the process of determining what actions a user or system is allowed to perform on a resource after they have been authenticated. It controls access to data, services, and functionalities based on the user’s identity, role, or other attributes, ensuring that only authorized users can perform specific actions within a system. Authentication vs. Authorization: ○ Authentication verifies the identity of a user (e.g., confirming they are who they claim to be). ○ Authorization determines what the authenticated user is allowed to do (e.g., what files they can access or what operations they can perform). Permissions: ○ Permissions define specific rights or privileges assigned to a user, group, or role. For example, permissions might include reading a file, writing to a database, or executing a command. Roles: ○ Roles group users with similar responsibilities and assign them a common set of permissions. Role-Based Access Control (RBAC) is a common method where roles like "admin," "user," or "guest" determine what a user can do within a system. Access Control Models: ○ Discretionary Access Control (DAC): Access is granted based on the identity of the user and the discretion of the resource owner. The owner can assign permissions to others.  ○ Mandatory Access Control (MAC): Access is based on fixed policies established by a central authority, often involving classifications and labels (e.g., classified, secret). ○ Role-Based Access Control (RBAC): Access is determined based on roles assigned to users, and permissions are granted based on those roles. ○ Attribute-Based Access Control (ABAC): Access decisions are based on attributes of users, objects, and the environment, such as time of day, location, or the sensitivity of the data. Access Control Lists (ACLs): ○ ACLs are lists that specify which users or systems are allowed or denied access to specific resources. An ACL might list specific users and their permissions, such as "read," "write," or "execute." Policy Enforcement Point (PEP) and Policy Decision Point (PDP): ○ PEP: The component that enforces access control decisions by allowing or denying access based on the authorization policy. ○ PDP: The component that makes the decision on whether to allow or deny access, based on the policies in place. Least Privilege Principle: ○ This principle dictates that users should be granted the minimum level of access—or permissions—necessary to perform their job functions. It helps reduce the risk of unauthorized access or misuse of privileges. Auditing and Logging: ○ Authorization processes should include logging and auditing mechanisms to track who accessed what resources and when. This helps in detecting unauthorized access attempts and ensuring compliance with policies. How Authorization Works: ○ User Authentication: The process begins with the user being authenticated, usually by providing credentials (e.g., username and password). ○ Policy Evaluation: Once authenticated, the system evaluates authorization policies to determine what resources the user can access. This might involve checking roles, permissions, and other attributes. ○ Decision Making: The system's PDP makes a decision based on the evaluation. If the user's attributes and permissions align with the policy, access is granted; otherwise, it is denied.  ○ Access Enforcement: The system's PEP enforces the decision by either allowing or denying the user access to the resource. The action is logged for auditing purposes. Types of Authorization: ○ Role-Based Authorization: Users are assigned roles, and permissions are granted based on these roles. For example, an "Admin" role might have full access, while a "User" role has limited access. ○ Attribute-Based Authorization: Access decisions are made based on attributes such as user location, time of access, or the sensitivity of the data. This allows for more granular and context-aware access control. ○ Policy-Based Authorization: Authorization is based on predefined policies that specify the conditions under which access is granted or denied. Policies can be simple (e.g., "Admins can access all resources") or complex (e.g., "Access is granted if the user is in the office and it's during business hours"). Common Use Cases: ○ Enterprise Systems: Employees might have different levels of access to corporate resources based on their role in the organization (e.g., HR staff can access employee records, while IT staff can access system configurations). ○ Cloud Services: Users are granted or denied access to cloud resources based on their identity, roles, and policies defined by the cloud provider. ○ Web Applications: Users are authorized to perform actions (e.g., view, edit, delete) based on their role within the application, such as "admin" or "regular user." Challenges in Authorization: ○ Complexity: As systems grow and evolve, managing and maintaining authorization rules and policies can become complex, leading to potential security gaps. ○ Dynamic Environments: In dynamic environments like cloud computing, where resources and users frequently change, keeping authorization policies up to date is challenging. ○ Consistency: Ensuring that authorization policies are consistently applied across all systems and resources can be difficult, especially in large, distributed environments. Best Practices: ○ Implement the Principle of Least Privilege: Always assign the minimum necessary permissions to users.  ○ Regularly Review Permissions: Periodically review and update permissions to ensure they align with current user roles and responsibilities. ○ Use Role-Based Access Control (RBAC): Group users by roles to simplify the management of permissions. ○ Audit and Monitor Access: Regularly audit and monitor access logs to detect and respond to unauthorized access attempts. ○ Automate Policy Management: Use tools and systems that allow for automated management and enforcement of authorization policies, especially in large or complex environments. Authorization is a critical aspect of cybersecurity, ensuring that only authorized users can access and interact with specific resources, thus protecting sensitive data and maintaining system integrity. Accountability Despite the controlled access management through authentication and authorization there are chances of attacks by internal threat agents to compromise the enterprise Information System (IS). This necessitates logging of day-to-day activities of the subject w.r.t usage of enterprise IS. Hence, it is advisable to enable auditing and logging features at organizational end. This is taken care by Accountability. Accountability is to establish responsibility for one's actions/events performed on system back in time by tracing, logging and auditing. This will ensure to keep up the security objective of Non-Repudiation. Audit Trails: ○ An audit trail is a chronological record of activities and events that occur within a system. These records include details such as who performed an action, what action was performed, when it was performed, and from where it was performed. ○ Audit trails are crucial for post-incident analysis, allowing organizations to trace back actions to specific users or processes and understand the sequence of events leading to a security incident. Logging and Monitoring: ○ Logging involves recording events and activities within a system, such as logins, file access, and changes to configurations. Monitoring refers to the continuous observation of these logs to detect anomalies, unauthorized access, or other suspicious activities. ○ Effective logging and monitoring provide real-time insights and historical data that help maintain accountability. Non-Repudiation:  ○ Non-repudiation ensures that a user or entity cannot deny the authenticity of their actions or communications. This is often achieved through digital signatures, cryptographic hashing, and secure logging. ○ Non-repudiation is critical in legal and compliance contexts, where it’s necessary to prove that certain actions were performed by specific individuals. User Identification and Authentication: ○ Accountability relies on strong user identification and authentication mechanisms to ensure that actions are attributed to the correct individual or entity. Without reliable authentication, it’s difficult to hold users accountable for their actions. ○ Multi-factor authentication (MFA) and biometrics are examples of methods that enhance the reliability of user identification. Access Control and Permissions: ○ Proper access control mechanisms ensure that users can only perform actions for which they are authorized. By restricting access based on roles, permissions, and policies, organizations can limit the scope of actions a user can take, making it easier to hold them accountable for their activities. ○ Role-based access control (RBAC) and attribute-based access control (ABAC) are common methods used to manage permissions and maintain accountability. Policy Enforcement: ○ Organizations define policies that dictate acceptable behavior, security practices, and compliance requirements. Accountability is enforced by ensuring that users and systems adhere to these policies. ○ Violations of policies are logged and monitored, and users are held accountable for non-compliance. Incident Response: ○ Accountability plays a critical role in incident response. When a security incident occurs, accountability ensures that the actions leading up to and following the incident are well-documented and can be reviewed to identify the responsible parties. ○ Effective incident response depends on the ability to trace actions, understand the cause of the incident, and take corrective measures. Compliance and Legal Requirements: ○ Many regulations and standards (e.g., GDPR, HIPAA, ISO 27001) require organizations to maintain accountability by tracking and auditing user activities. Failure to do so can result in legal consequences and fines. ○ Accountability ensures that organizations can demonstrate compliance with these regulations by providing detailed records of activities and access.  How Accountability Works: ○ User Actions: Users interact with the system by performing actions such as logging in, accessing files, or executing commands. Each of these actions is logged by the system. ○ Logging and Auditing: The system logs the details of these actions, including the user’s identity, the action taken, the time and date, and the outcome. This log data is stored securely for future reference. Auditing tools analyze these logs to ensure compliance with policies and detect any unauthorized or suspicious activities. ○ Monitoring and Alerts: Monitoring systems continuously observe logs and user activities in real time. If an anomaly or policy violation is detected, the system may generate an alert for further investigation. Alerts can be configured to notify administrators immediately, allowing for a quick response to potential security threats. ○ Review and Analysis: In the event of a security incident, the audit trail is reviewed to determine what actions were taken, who was responsible, and how the incident occurred. This information is crucial for responding to the incident and preventing future occurrences. Accountability measures ensure that all steps are documented, and corrective actions are taken. Importance of Accountability: ○ Security: Accountability deters malicious or negligent behavior by ensuring that all actions are tracked and can be traced back to an individual or system. This makes it easier to identify and address security breaches. ○ Transparency: It promotes transparency within an organization, as users know their actions are being monitored and recorded. This encourages adherence to policies and ethical behavior. ○ Trust: Accountability builds trust between users and the organization, as it ensures that everyone is responsible for their actions and that any misconduct will be addressed. ○ Compliance: Many industry regulations require organizations to maintain accountability for user actions. Failing to do so can lead to legal penalties, loss of reputation, and financial losses. ○ Incident Resolution: Accountability facilitates faster and more effective incident resolution by providing a clear and detailed record of events, helping to identify the root cause and responsible parties. Challenges in Accountability:  ○ Data Volume: In large organizations, the volume of log data can be overwhelming, making it challenging to analyze and maintain effectively. ○ Privacy Concerns: While accountability requires monitoring and logging, it must be balanced with privacy concerns to avoid overreach or misuse of user data. ○ Complex Environments: In complex, distributed environments, maintaining a clear and consistent audit trail across multiple systems and platforms can be difficult. ○ False Positives: Monitoring systems may generate false positives, leading to unnecessary alerts or investigations that can drain resources. Best Practices for Maintaining Accountability: ○ Implement Strong Authentication: Ensure that all users are properly authenticated using strong methods such as MFA, so actions can be reliably attributed. ○ Regularly Review and Update Policies: Keep security and access control policies up to date and ensure they reflect current organizational needs and compliance requirements. ○ Automate Monitoring and Alerts: Use automated tools to monitor logs and generate alerts, reducing the likelihood of human error and improving response times. ○ Conduct Regular Audits: Regularly audit logs and access records to ensure compliance with policies and identify any unauthorized activities. ○ Educate Users: Make sure that all users are aware of the accountability measures in place and understand their responsibilities within the system. Accountability is a cornerstone of cybersecurity, ensuring that all actions within a system are tracked, traceable, and auditable, thereby protecting the organization from unauthorized access, data breaches, and non-compliance.