Please enable JavaScript.

Coggle requires JavaScript to display documents.

CompTIA Security (Securing Individual Systems (Malwares :name_badge:…

- - - - Protocol Attack
        
        Application Attack
    - - Botnet
  - - - Phishing
    - - Spam
        
        From Messaging
    - - Audio Phishing
    - - URL
  - - - Ettercap
    - - Data
  - - - Elasticity
    - - Distributive Allocation
    - - Snapshots
      - Known State
  - - - Speed :check:
      - Integrity :red_cross:
    - - Speed :red_cross:
      - Integrity :check:
      - Even
        
        Nb Hard Drives
    - - Min
        
        3 Hard Drives
        
        1 Chunk
        
        1 Chunk
        
        Parity Computation
        
        Dedicated
    - - Min
        
        3 Hard Drives
        
        Distributed
        
        Parity Computation
      - Max 1 Drive
        
        Be Lost :check:
    - - Max 2 Drives
        
        Be Lost :check:
      - Min
        
        4 Hard Drives
      - 2 Parity Computations
    - - Speed :check:
      - Integrity :check:
      - Min
        
        4 Hard Drives
  - - - Std Network
      - File
    - - Dedicated
      - Block
      - FIber Channel
        
        iSCSI
  - - - Policy
    - - Execution
        
        Prevention
    - - Ports
        
        BIOS
  - - - Unecessary
        
        Services
    - - Default
        
        Passwords
    - - Unecessary
        
        Accounts
    - - Management
        
        Monitor
        
        Test
        
        Evaluate
        
        Deploy
        
        Document
    - - Host Firewalls
  - - - Speed
        
        HA
    - - Hard Drives
  - - - Trusted Platform Module
        
        Key
        
        Recovery
    - - TrueCrypt
        
        BitLocker
  - - - Drive
    - - Root
        
        Trust
  - - - Windows Server
      - Connections
    - - Appliance
      - Objects
    - - Linux
  - - - Blue Jacking
        
        Connexion
        
        Control
      - Blue Snarfing
        
        Data Stealing
      - Range
        
        33'
        
        Class 2
    - - Hidden Wifi
        
        Access Point
    - - Backdoors :door:
    - - Updates
  - - - Spyware
    - - Remote Access Trojan
    - - Admin
    - - Change Code
  - - - Network
    - - Passive
    - - Active
  - - - 1 and 0
        
        Useful
    - - Degauser
        
        Magnetic
        
        Not Usefeul
- - - - You Have
        
        You Are
    - - Somewhere You Are
  - - - Ressources
    - - Duties Separation
  - - - Mandatory Access Control
    - - Discretionnary
      - Owner
        
        Define
        
        Access
    - - Role-Based
        
        Groupes
        
        Rules
    - - Deny
  - - - Expiration
        
        History
  - - - Owner
        
        Group
        
        Everybody
    - - Read = 4
        
        Write = 2
        
        Execute = 1
    - - o / g / a
      - From 0 to 7
      - Permissions
    - - Ownership
        
        Change
  - - - Move A--A
        
        Keep NTFS permissions
  - - - Except Home
    - - Dedicated :check:
  - - - Authorization
        
        Accounting
    - - Server
        
        SQL DBA
        
        AD Domain
      - Client
        
        Gateway
      - Supplicant
      - Network Access
        
        No Authorization
      - TCP Ports
        
        1812 /1813 /1645 /1646
    - - Devices Management :check:
      - TCP Port 49
  - - - Password Authentication Protocol
    - - Challenge Handshake Authentication Protocol
      - Hash Challenges
    - - LAN Manager
      - 2 Windows
      - Double Hash Challenges
        
        Double CHAP
    - - KDC
        
        Key Distribution Center
        
        Authentication Service
        
        Ticket Granting Service
      - Session Key
        
        For Authorization
      - WIndows Domain
    - - Web Applications :check:
    - - TCP Port 389
      - Query
        
        Directories
  - - - Windows AD
        
        Federated Systems
        
        Windows Server
    - - Web Apps
      - Identity Provider
        
        Token
        
        Service Provider
- - - - Layer 2
        
        MAC
      - VLAN
        
        Split
        
        Domain
      - STP
        
        Prevent
        
        Loop Flood
    - - Layer 3
        
        IP
      - Gateway
        
        NAT
  - - - Multiple Switches
        
        One Domain
    - - 2 or More LANs
      - Routers
  - - - Between
        
        Router
        
        Gateway Router
    - - SSID
    - - Isolation
  - - - Transport Layer
      - Rudimentary
        
        Authentication
        
        PAP
        
        Password
        
        MSCHAP
        
        Hash
    - - Extensible
        
        Authentication
        
        Protocol
      - Framework
        
        On Top of
        
        PPP
      - MD5
        
        MSCHAP
      - PSK
        
        Pre-Shared Key :old_key:
        
        WPA / WPA 2 Like
        
        Symmetric
      - TLS
        
        Certificates
        
        Client
        
        Server
      - TTLS
        
        Certificate
        
        Server
    - - EAP
        
        Password
        
        TLS Tunnel
  - - - Stateful
        
        Decision Based
        
        Behavior
        
        No ACL
      - Stateless
        
        ACL Based
        
        IP
        
        Ports
        
        URL
  - - - Features
        
        Content
        
        Filtering
        
        Caching
        
        Block
        
        URL
      - Application
        
        Specific
      - Client
        
        Aware
        
        Hidden
    - - Server :computer:
        
        Hidden
      - Behind
        
        Firewall :fire:
      - Features
        
        Protect :shield:
        
        Server :computer:
        
        Load Balancing
        
        Caching
        
        Encryption
  - - - Logging
  - - - Tunnel
    - - Split
        
        Internet
        
        Not in VPN
    - - PPTP
        
        Old
      - L2TP
        
        UDP 500 / 4500
      - SSL/TLS
        
        TCP Port 443
        
        Web Browser
      - OpenVPN
        
        Unique Tunnel :bridge_at_night:
        
        SSL/TLS :key:
        
        TCP Port 1194
    - - Remote Access
        
        Site To Site
  - - - Integrity
        
        HMAC
    - - Encryption
        
        Integrity
    - - New IP Address + ESP
    - - Security Association (SA)
        
        2 Hosts
  - - - Behavior
        
        Signature
        
        Rules
      - In-Band
    - - Passive
        
        Out Of Band
    - - Correlation Engines :fire_engine:
  - - - Information
        
        Event
        
        Management
    - - Time Synchronization
        
        Event Duplication
        
        Normalization
        
        Logs
    - - Alerts
        
        Triggering
    - - ArcSight
        
        ELK
- - - - DES
        
        Block
        
        64-Bits
        
        Key
        
        56 Bits
        
        16 Rounds
      - Blowfish
        
        Key
        
        32-448 Bits
        
        16 Rounds
        
        Block
        
        64 Bits
      - 3DES
        
        Key
        
        3 X 56 Bits
        
        16 Rounds
        
        Block
        
        64 Bits
      - AES
        
        Bloc
        
        128 Bits
        
        Key
        
        128
        
        192
        
        256
        
        Rounds
        
        10-12-14
      - Cons
        
        Patterns
        
        Obfuscation
        
        Chains
        
        CBC
        
        Initialization Vector
        
        CFB
        
        IV Encrypted
        
        Output Feedback
        
        Same IV
        
        CTR
        
        Nonce + Counter
        
        Avoid ECB
    - - RC4
        
        Block
        
        1 Bit
      - Round
        
        1
      - Key
        
        From 40 to 2048 Bits
  - - - Keys
        
        Public
        
        Private
        
        Large
        
        Primes
    - - Session Key
      - Key Exchange Protocol
      - ECC Possible
    - - Smaller Keys
        
        Same RSA Performance
      - Keys
        
        Private-Public
  - - - Random Key
    - - Private Key
    - - Open PGP
    - - Full encryption
  - - - Deterministic
    - - MD5
        
        1992
        
        128 Bits
      - SHA
        
        SHA-1
        
        128 Bits
        
        SHA-2
      - R1PEMD
        
        Open Std
    - - Message Authentication
      - Key Use
      - Standard Hash
  - - - Within
        
        Other Data
  - - - Hash
        
        Encrypted Data
        
        Private Key
    - - 3rd Party
  - - - Root Certificate
      - Intermediare Certificates
        
        Distributed
    - - Standard
      - 7
        
        Certificates
        
        Storage
      - 12
        
        Certificate + Private Key
    - - Revocation
    - - Real Time
        
        CRL
  - - - Passwords
        
        Cain & Abel
    - - Dictionnary
        
        Rainbow
    - - SALT
- - - - Dead :red_cross:
    - - Access Point
        
        MAC Address
        
        SSID
        
        Service Set Identifier
        
        Extended
        
        Multiple WAPs
        
        Basic
        
        1 WAP
    - - Wired
        
        Equivalent
        
        Privacy
      - Basic Authent
        
        Encryption
      - RC4 Streaming
    - - Wireless
        
        Protected
        
        Access
      - WPA2
        
        TKIP
        
        Instead of
        
        AES
    - - 802.1X Authentication
      - AES Encryption
        
        WPA2
    - - Session Cookie :cookie:
        
        Replay Attack
        
        SSL Stripping Aka
      - Secured Protocols
        
        HTTPS
        
        VPN
    - - Rogue
        
        Access Points
        
        Accidental
      - Evil Twin
        
        Intentional
      - 802.11 jammer
        
        DoS
      - Deauthentication Attack
        
        Replace the WAP
  - - - IV Attack
        
        aircrack-ng
    - - Dictionnary Attack
        
        During
        
        4-Way Handhake
      - aircrack-ng
      - Long
        
        Complex
        
        Passwords
    - - Pre-Shared Keys
        
        8 digits
        
        2^4 + 2^3
        
        Too low
        
        Buttons
        
        Both Devices
      - Reaver
    - - Installation
        
        Survey Tools
        
        HeatMap
      - Maintenance
        
        Documentation
        
        SSID Broadcast :red_cross:
        
        MAC Filtering
        
        AP Isolation
        
        Scanning
        
        WIDS
  - - - Configuration
    - - Controller
        
        All at Once
    - - Signal Strength :hammer:
    - - Types
        
        Omni
        
        Dipole
        
        Directionnal
        
        Patch Graphic
        
        Walls
    - - Selection
        
        2.4GHZ
        
        802.11 Old
        
        5GHZ
        
        802.11ac
      - Width
  - - - Virtual Machine Monitor
      - Type 2
        
        Runs
        
        Top of
        
        OS
        
        VirtualBox
      - Type 1
        
        Runs
        
        Hardware
        
        VMWare ESXI
      - Cloud Type
    - - Network
        
        Separation
      - Snapshots
        
        Backups
      - VM Sprawl
        
        Mutliple Types
      - Hardening
        
        Data
        
        Removal
        
        Good
        
        Policies
        
        Patch
        
        User
        
        Preferences
        
        Cloud Access Security Broker
    - - Isolation
    - - Heroku
      - From
        
        Code
        
        To
        
        Web App
    - - AWS
    - - Office365
  - - - On-Premise
      - Hosted Application
      - Cloud
        
        Private
        
        Community
        
        Public
        
        Hybrid
      - VDE
        
        Remote
        
        Desktop
        
        HW
      - VDI
        
        Remote
        
        Desktop
        
        virtualized
  - - - SCADA
        
        Data
        
        Acquisition
      - Securing
        
        Default
        
        Passwords
        
        Disable
        
        Ports
        
        Useless
        
        Network
        
        Segmentation
  - - - SATCOM
        
        Bluetooth
        
        NFC
        
        ANT/ANT+
        
        Infrared
        
        USB
      - Wifi
        
        Direct
        
        WPS
        
        Tethering
    - - COBO
        
        Corporate Only
      - COPE
        
        Personal Possible
      - CYOD
        
        Choose
        
        Own Device
      - BYOD
        
        Bring
        
        Own
        
        Device
    - - Side loading
        
        Rooting
      - Firmware OTA
        
        Camera Use
        
        SMS/MMS
        
        External Media
        
        GPS Tagging
        
        Payment Methods
    - - Application Management
        
        Databases
        
        Documents
        
        Geolocation
        
        Geofencing
      - Password
        
        Recovery
      - Biometry
      - Remote
        
        Wipe
      - Context
        
        Authentication
  - - - Preventative
        
        Detective
        
        Compensative
- - - - Confidentiality
        
        Integrity
        
        Availability
    - - Auditing
        
        Non Repudiation
  - - - Attributes
        
        Internal / External
        
        Sophistication
        
        Funding
        
        Motivation
        
        Open Source
        
        Intelligence
      - Types
        
        Script Kiddies
        
        Pre-made tools
        
        No Evil
        
        Hacktivist
        
        Motivation
        
        Organized Crime
        
        Money
        
        Nation States
        
        Intelligence
        
        Sophistication
        
        Advanced
        
        Persistent
        
        State
        
        APT
        
        Insiders
        
        Competitors
  - - - X Exposure Factor
        
        = Single Loss Expectancy
    - - Exploit
        
        Vulnerabilities
      - Types
        
        Adversarial
        
        Accidental
        
        Structural
        
        Environmental
    - - Probability
        
        Bad
        
        Happen
        
        ARO
        
        Annualized Rate of Occurence
    - - Harm
        
        Generated
      - MTTR
        
        Mean Time To Repair
      - MTTF
        
        Mean Time To Failure
      - MTBF
        
        Between Failure
    - - Starting Place
        
        For Risk Management
    - - Common
        
        Vulnerabilities
        
        Exposures
      - More
        
        Details
        
        Vs NIST SP800
      - Pen Testing
        
        Still required
    - - Vulnerability
        
        Assessment
    - - Acceptance
        
        Avoidance
        
        Transferrance
        
        Response
    - - ISACA
        
        NIST SP800-S37
        
        ISO27000
      - Process
        
        Categorize
        
        Select Security Control
        
        Implement
        
        Assess
        
        Auhorize IS
        
        1 more item...
  - - - Remediate
        
        Problems
      - Protect
        
        Infrastructure
    - - Administrative
        
        Policies
        
        Guides
      - Technical
        
        Firewall
        
        Password
      - Physical
        
        Mantrap
        
        Guards
    - - Deterrent
      - Preventive
      - Detective
      - Corrective
      - Compensative
    - - Mandatory Vacation
        
        Job Rotation
        
        Multi Person Control
      - Separation of duties
        
        Least Privilege
  - - - Diversity
  - - - Laws & Regulation
        
        HIPAA
      - Standards
        
        NIST
        
        ISO
        
        PCI DSS
      - Common Sense
        
        Best Practices
    - - Broad
        
        Directive
        
        Roles & Responsabilities
      - Acceptable Use
      - Data Sensitivity
        
        & Classification
      - Access Control
      - Password
      - Care & Use
        
        Equipments
      - Privacy
      - Personnel
    - - Standards
        
        More detailed
    - - Step by Step
    - - Optional
  - - - Owner
        
        Accountable
      - Steward
        
        Accuracy
        
        Integrity
      - Privacy Officer
    - - Users
      - Privileged Users
      - Executive Users
      - Sys. Admin
- - - - Putty
      - Port 22
      - Key Exchanges
        
        Cipher
    - - TLS
      - Port 80
    - - Port 443
    - - FTP
        
        Ports 20-21
        
        Not secured
        
        FTP/SSH
        
        Port 22
        
        FTPS
        
        TLS
      - SFTP
        
        Port 22
    - - SMTP
        
        Port 25
      - iMAP
        
        Port 143
      - Pop
        
        Port 110
    - - Port 389
    - - Port 53
      - DNSSec
        
        Authentication
  - - - Physical
        
        Datalink
        
        Network
      - Transport
        
        Session
        
        Presentation
      - Application
    - - Network Interface
        
        Internet
      - Transport
        
        Application
  - - - IPv4
        
        Private address
        
        10.X
        
        172.16 to 172.31
        
        192.168.XXX.XXX
        
        32 Bits
      - IPv6
        
        128 Bits
    - - 3-Way Handshake
    - - No acknowledgment
    - - 1 packet
  - - - Vs Runtime
    - - Handling
    - - Validation
    - - Procedures
- - - - DNS Working
    - - Session Running
      - netsat -n
        
        All connexions
      - netsat -a
        
        Opening ports
    - - tracert URL
        
        Different Routes
        
        To URL
        
        Know
        
        Infrastructure
    - - ARP -a
      - IP address
        
        MAC address
      - ARP Poisoner
        
        Intrusion
    - - ipconfig -all
        
        MAC address
    - - My DNS
      - Linux
        
        Digg
    - - Linux
      - Open
        
        Listen
        
        Ports
  - - - Network inventory
      - Rogue Detection
      - Open Ports Detection
    - - Target
      - Visual
  - - - Sniffer
      - Analyzer
    - - ARP Poisoner
    - - Sniffer
        
        More Efficient
  - - - Network
        
        Management
        
        Protocol
    - - Management
        
        Agent
        
        UDP 161
        
        TLS 10161
    - - Trap
        
        Walk
    - - 2
        
        Encryption
      - 3
        
        TLS
  - - - Network
        
        OS
        
        Remote logon
        
        Application
        
        Firewall
      - Non Network
        
        OS
        
        Start
        
        Shutdown
        
        Reboot
        
        Applications
        
        Start
        
        Security
        
        Logon
- - - - Advanced IP Scanner
      - Nmap
    - - Basline
        
        Security
        
        Analyzer
    - - Nexpose
        
        OpenVAS
  - - - Cross-Site
        
        Scripting
      - XML
        
        Injection
  - - - Injection
        
        Code
        
        Command
        
        SQL
        
        LDAP
        
        X500
      - Buffer
        
        Overflow
      - Integer
        
        Overflow
  - - - White Box
      - Black Box
      - Gray Box