Please enable JavaScript.

Coggle requires JavaScript to display documents.

Security+ - Coggle Diagram

- - - - Different flooding attacks (Ping, UDP)
    - - SYN flood Attack
    - - Slow Loris Attack (Start and then stop conversation to apache server 1.1.0 to slow down server)
      - Amplification attack (Send ICMP packet into network, Attacker spoofs the web servers IP address)
    - - Usually follows the same principles except they use Botnets or zombies in some form
  - - - Email that asks for information of some kind, usually credentials
    - - Get enough authorization privilege to carry out malicious tasks
  - - - Ettercap is a great tool for this
    - - Domains aren't kept updated, people can jack them and change them to demand money from the original owner
    - - Replay attack
        
        Some type of secure communication is being used. The client sends out a username and a hash and if you have these they can be used later.
      - Downgrade attack
        
        Make a client connect to a web server over a less secure line
      - Session hijacking
        
        Two people are talking, the attacker gets in the middle of the session and injects information.
  - - - Snapshots and Backups for things in known states or at risk
  - - - RAID 0, minimum of 2 drives, files are clustered across these, If any drive is lost data is lost (No data integrity)
      - RAID 1, Even number of drives, Each file is mirrored onto each drive. Data integrity but not speed
      - RAID 2, Minimum of 3 drives, cluster between two drives and use third drive for a parity calculation. This is called a dedicated parity drive
      - RAID 5, distribute parity data over all drives, using same process of RAID 2, you can lose 1 drive and no more.
      - RAID 6, needs minimum of 4 drives, distribute clusters and parity's over two drives each.
      - Hybrid RAID
        
        RAID 0 + 1
        
        Need minimum of 4 drives, clustering that is then mirrored
        
        RAID 1 + 0
        
        minimum 4 drives, mirrored and then striped
      - Proprietary RAID
        
        Synology hybrid RAID
        
        Storage spaces (Windows Proprietary RAID)
  - - - File level sharing protocol
      - A box running different versions of RAID etc. Often tight operating systems like linux
      - Setup over specific sharing protocols
    - - They work at the block level, new drives available at the drive space in windows etc.
      - Run using HBA and FC (Fibre Channel)
      - ISCSI is a poor mans SAN, still works at block level
        
        a target is made with an extent and an iSCSI initiator is used to turn this into a small scale SAN
  - - - OS level is most elegant to deal with these. You can shut off optical media as well.
      - Use things like data execution prevention and optical media switches inside the OS for physical hardening
      - You can disable ports for the system at the BIOS level
  - - - Each device emits radiation. Each device can be isolated by giving it its own circuit
    - - All things have some form of electrostatic charge. Computers need to be protected from ESD, you can use wrist straps and grounding to stop this from happening
    - - Radiation in the radio range that will interfere with radio frequencies
  - - - Monitor patches, even for devices that don't necessarily do it automatically
      - Test in a sandbox environment
      - Evaluate the patch
      - Deploy the patch
      - Document the patch
    - - Train users
      - Procedures put in place for malware, including best practices
      - Monitor the logs and network
      - IDs deployment
      - Utilize third party tools
    - - Usually only as good as the operator. These work at an application level.
      - Often configured with a whitelist that allows only programs on the whitelist to run
  - - - Availability ion storage s very easy using RAID
      - For other components of a system RAID will not work, this will require clustering.
        
        Create multiple systems that share the data between them. Great when systems commonly go down. Problem is they need to update each other all the time
      - Load Balancing
        
        Distributing data between servers with primary and backup for redundancy
        
        You can also virtualize the servers
    - - Encrypts all data on the mass storage
      - Can slow down your system
      - Good for Desktop systems that need security and mobile devices as well
      - TPM (Trusted Platform Module)
        
        Inside a TPM chip is a private/public key set. Stops disconnected drives from being used. Often needs to be activated.
      - Password encryption
      - Services - PGP/Truecrypt/Bitlocker/FileVault
    - - FDE (Full Disk Encryption)
        
        Using Bit locker we can take advantage of TPM. Make sure to securely save the recovery key in the event that the motherboard was destroyed.
      - SED (Self-encrypting Devices)
        
        Password is given to the drive that is used whenever the storage is used
      - Secure Boot
        
        Included by TPM 2.0. Every time the system boots the system runs checks on the quality of all of the hardware
        
        A Hardware Root Trust is setup so that anyone without the right certificate cannot inject malicious software or instructions
        
        Great for embedded systems
      - HSM (Hardware Security Module)
        
        Can use a card that is snapped into a computer that handles security on the host
- - - - Between C and I falls auditing ands accountability.
    - - Between C and A is non-repudiation. It ensures that a user cannot deny having made some form of communication.
  - - - Any part of an infrastructure that the organization is worried about being harmed.
    - - A weakness to an asset leaving it open to damage
    - - An action (Negative) that exploits a vulnerability, these are carried out by a threat agent
    - - The level of certainty that a specific threat will occur. Is separated into quantitative and qualitative types of likelihood. Quantitative can be concretely measured. Qualitative is more speculative measurements
    - - The magnitude of damage caused by the eventuation of a threat