Please enable JavaScript.

Coggle requires JavaScript to display documents.

Security Objective Manage & reduce risk across CIA triad, emails,…

- - - - Technical
        
        Encryption
        
        Smart cards
      - Physical
        
        Securing Laptops
        
        Securing magnetic media
        
        The protection of cable
        
        Locks
      - Administrative
        
        Background checks
        
        Policies & Procedures
- - - - NIST 800-53 Recomended sec control for FIS
      - NIST 800-37 RM framework to FIS
      - NIST 800-34 Contingency planning guide for FIS
      - NIST 800-115 Tec guide to Infosec testing & assessment
      - NIST SP800-18 Guide for dev sec plan for FIS - gives an ex of placing an control out of scope
- - - - Annualized rate of occurrence - ARO: Frequency of threat occurrence per year
      - Annualized loss of expectancy - ALE
      - Single loss expectancy - SLE
      - Total cost of ownership TCO
      - Return on Investment- ROI
      - SLE = Asset Value AV* Exposure factor EF
      - Asset Value AV
      - Exposure factor EF: % of AV at risk due to threat
      - ALE = SLE * ARO
  - - - Impact : Low, Medium, High
      - Likelihood: Low,Medium, Hgh
- - - - Actions that decrease the risk
      - Route that security professionals typically expect business to go
      - Not the only approach org can take, bellow are some other approaches
      - Obvious approach to excess risk is to attempt to reduce the risk to acceptable lvl
- - - - Stage of procurement to determine which provider will bid for proj & what their proposal look like- might include RFI/Q
      - Sec evaluation of proposal is imp
      - Addressing sec as early as possible is the key to affecting significant enterprise wide change
    - - RFI is to initially gather info about available providers of the item being procured
      - Which vendors will be included/excluded from RFP/RFQ
      - Procuring goods/services is common activity in org
      - Determines suppliers capabilities to allow for questions & tuning prior to the RFP
- - - - The gets() func doesn't enforce a 20 byte limit, Attacker may type 20,200,2000 etc characters.chars past at the end of buffer are written to the stack
      - BO may allow attacker to "smash the stack" and write arbitrary content to the memory
      - Occurs when progrmer failed to perform bounds checking ex: char user[20]; gets(user);
      - Read- Smashing the stack for fun & profit by aleph one
      - Many def tec have been dev to thwart these attacks, including DEP, ASLR ,canaries & many others
    - - setUID are prime targets for race condition attack
      - Normal user cannot edit passwd ,shadow file yet he can change both files using passwd command - how ? bcz passwd commnd is setuid root- means prog runs with root priv, even if running user is not root
      - aka TOC/TOU exploits the gap btwn time a sec check is applied, & code is executed
    - - Two type: Timing channel attack & storage channel attack
      - Is a req of B2 & higher classification of the TCSEC
      - Use of normal system resource to signal inf
    - - Hiding an true intent of an attack
      - Attack like smurf attack spoofed a victims IP addr
      - Modifying the source info to pretend to come from a diff location
    - - Replay Attack: simply sniffing traffic could allow for playing back recorded traffic at a later point in time
      - Spoofing: Impersonation of one endpoint to another is often an element of MITM
      - Attacks in which attacker inject himself in the middle of comm & sees all traffic going across the wire
      - Session hijackng: MITM attack could allow full session hijacking
    - - Ping of death- ICMP echo req with payload larger than the max IP packet size
      - LAND attack- spoofed pckt attack with source IP & source port matching the destination IP & port of the victim
      - crafted packts attacks Primary imapcts denial of service
      - Teardrop
      - Maliciously crafted pckt attacks exploit TCP/IP stack poor nw config to achieve DoS
    - - Able to force system to fail open
      - Common attack against switches is a CAM flood
      - Primarily an availability attack, attempting to consume finite resources such as mem , cpu,disk
    - - SMURF: spoof victims IP & send ICMP echo req(ping) to directed broadcast
      - Fraggle
      - SYN Flood: many TCP SYN pcktes sent with source IP spoofed to that of nonexistent host
    - - Specific resource exhaustion DoS attack
      - fork() means make a copy of prg & execute it - each copy will continue to spawn children for as long as possible
    - - Many sys potentially under the adversary's control served as a basis for distributed DoS suites
      - Evolved into functionality provided by botnets
      - Advanced & effective DoS began within reach of adversaries - their malware campaign were extremely successful at comprising sys
    - - Worm is malware that self propagates- infects 1 hosts,and then attempts to spread automatically
      - Trojan has 2 func- overt benign & covert malicious
      - Virus is a malware that req a carrier- carried from one computer to another via removable flash media
    - - arouse out of the older DDoS platforms - allows central control of many compromised systems simultaneously
      - Adversary wielding these systems referred to as bot herder
      - Another type of malware that should be understood is botnet
    - - SS attack is initiated by attacker against listening service
      - CS attack is reverse - Victim initiates traffic often by clicking link in email or on web
      - Why clientside attack ? Adversaries are pragmatic. They employ what works & often the simplest form of what works- Noneed to over engineer the attack is simple is successful
      - As a defender we achieved success with better patching,permiter fw & some basic segmentation of public from prvt sys. Our successful defensive posture req motivated attackers to change tactics to achieve success
    - - One of the most powerful tools in penetration testers/Blackhats arsenal
      - People are conditioned to help & trust each other- social eng preys on this trust
      - Uses human mind to bypass sec controls
      - Kevin Mitnick's famous book: Art of Deception
    - - Two primary goals of malicious email- Convince you to click the link or persuade you to open attachment
      - Spear phishing- implies more targeted attempts at social engg rather than generic techniques
      - Styling & content of emails matured
      - Whaling - targeted phishing attempts against executives / senior
      - Predominant delivery mechanism for attacks
      - Business Email Compromise (BEC) - CEO impersonation with goal of convincing employee to inappropriately make wire xfer
- - - - Trademark is a word,name,symbol or device that is used in trade with goods to indicate the source of goods & to distinguish them from the goods of others
      - Servicemark is same as TM it identifies the source of service rather than a product. The term trademark & mark are comonly used to refer to both trademarks & servicemarks
    - - Recorded thought on Paper,Vinly,Plastic,Magentic media or other
      - is a form of protection provided to author of original works of authorship
      - Form of expression
    - - Protect critical intellectual property that is not publicly available
      - Typically covered by an NDA & other contracts
    - - Protects invention for 20yrs from date of filing
      - Grants right to exclude others from making,using,offering for sale,selling or importing the invention
      - Patent for an invention is the grant of a property right to the inventor, issued by patent & trademark office
- - - - Reduction of sec issues - ex: phishing susceptibility
      - Increased notif of potential sec inci
      - Assist workforce in appreciating their role in org sec posture
      - Appreciation that attackers target user- users represent significant line of defense against attack