Please enable JavaScript.

Coggle requires JavaScript to display documents.

Protecting a Cybersecurity Domain - Coggle Diagram

- - - - the OS is vital in the operations of a system and is the target of many attacks
      - By changing the default config it hardens the OS making it more secure
      - This involves the removal of unneeded programs and services
      - Another critical requirement of hardening OS is the application of security patches and updates
      - Microsoft Baseline Security Analyzer (MBSA)
        
        Administrator Account
        
        Blank, Simple, Non-existent passwords
        
        Missing Security Updates
        
        Firewall Settings
        
        Security Misconfigurations
        
        Registry Settings
        
        Unnecessary Services
        
        Network Shares
        
        Security Event Auditing
        
        Guest Account Status
      - A baseline can enable an admin to identify potential vulnerabilities.
      - After hardening the OS, Policies and Procedures must be established to maintain security
    - - Malware includes viruses, worms, Trojan horses, keyloggers, spyware, and adware
        
        They all invade privacy, steal info, damage the system, or delete and corrupt data
      - It is important to protect computers and mobile devices using effective antimalware software
        
        Adware Protection -- looks for programs that display advertising on a computer
        
        Phishing protection -- blocks the IP address for known phishing sites and warns user about sus activity
        
        Spyware Protection -- Scans for keyloggers and other spyware
        
        Trusted / Untrusted sources -- Warns user about unsafe programs for unsafe sites before installing/viewing them
        
        Antivirus Protection -- monitors for viruses.
        When triggered the programs prompts the user to quarantine or delete the virus
    - - A firewall program that runs on a computer to allow/deny traffic between the pc and other devices.
      - The software firewall applies a set of rules to data transmissions through inspection and filtering of data packets
      - Provides the ability to control the type of data sent to and from the computer by opening or blocking chosen ports
      - Blocks incoming/outgoing traffic unless exceptions are defined
    - - A Host Intrusion Detection System (HIDS) is software that runs on a host pc that monitors suspicious activity
      - must be installed on the system device itself
      - HIDS stores all logs locally
      - Resource intensive, which can affect sys performance
    - - When connecting to the local network and sharing files, the comms between computers remains within that network.
      - To communicate and share resources over a network that is not secure, users employ a VPN
    - - Patches are code updates provided by the manufacturers to mitigate vulnerabilities from zero-day attacks
      - Manufacturers will combine patches and upgrades into a Service Pack
      - Some orgs test a patch before deploying it system-wide
      - benefits of automated patch updates
        
        Admins can force the updates of systems for a certain date n' time
        
        Admins can obtain reports on the update needed by each system
        
        Admins can approve or deny updates
        
        Each PC does not have to connect to the vendor's service for patches; a system gets the update from the local server
        
        Users cannot disable nor circumvent updates
  - - - an Improvement to wireless security was Wi-fi Protected Access (WPA) and WPA 2
      - WPA
        
        Most common WPA config is WPA-PSK (Pre-shared Key)
        
        WPA key size is 256-bit
        
        WPA provides several security improvements such as
        
        WPA could detect id an attacker had captured and altered data during transit between the AP and the Client
        
        Temporal Key Integrity Protocol (TKIP) standard provides the ability to better handle, protect and change encryption keys.
        
        AES has surpassed TKIP
        
        WPA was created in response to weaknesses in WEP
      - WPA 2
        
        WPA also has vulnerabilities so WPA 2 was created
    - - Aka two-way authen, is a process or technology in which both entities in a communication link authen to each other.
      - This enables clients to detect rouge APs before connecting to the unauthorized device, potentially mitigating MitM attacks
    - - the majority of network devices today are
        
        Tablets
        
        Smartphones
        
        Laptops
        
        and Other
      - WEP was a widely used wi-Fi sec standard.
        the WEP standard provides authen, and encrypt
      - One of the most important components of modern computing are mobile devices.
      - WEP is obsolete, but many devices support backwards compatibility
  - - - an org can lose data if cyber-crims yoink it, if equipment fails, or disaster occurs.
        For this reason, it is imperative to do data backup regularly
      - Backing up data is one of the most effective ways of protecting against data loss.
      - The org's security policy should include data backups.
      - Data backups are usually stored offsite to protect the backup media if anything happens to the main facility.
      - Things to consider for data backups
        
        Frequency -- Backups can take a long time. Sometimes it is easier to make a full backup monthly or weekly, and then do frequent partial backups of any data that has changed since the last full backup.
        However, having many partial backups increases the amount of time needed to restore the data
        
        Storage -- For extra security, transport backups to an approved offsite storage location on a daily, weekly, monthly rotation, as required by the security policy
        
        Security -- Protect backups with passwords. The operator then enters the password before restoring the data on the backup media
        
        Validation -- Always validate backups to ensure the integrity of the data
    - - Perms are rules config-ed to restrict folder/file access for users or groups
      - Principle of Least Privilege
        
        while easier to provide users access to an entire drive, it is no way secure.
        Limiting access to only the resources they need to perform their job.
        
        Limiting access can also mitigate mal-programs from accessing those resources if that system becomes infected
      - Restricting User Perms
        
        if an admin denies perms to a net-share for a user/group, the denial overrides any other perm settings
        
        The Local sec policy must outline which resources and the type of access allowed for each user and group
        
        Perm Propagation
        
        When perms are changed on a folder, the user is prompted to apply the same perms to sub-folders
  - - - Content control software restricts the content that a user can access while using the web
      - Content Control can block sites that contain certain types of material such as porn, or controversial religious or political content
      - Content Filters Types
        
        Client-side filters installed on a specific computer
        
        Router-based content filters that block traffic from entering the network
        
        Email filters through a client- or server-based filter
        
        Appliance-based content filtering similar to router based
        
        Browser-based filters through a third-party browser extension
        
        Cloud-based content filtering
      - Search engine such as Google offer the option of turning on safety filter to exclude content
    - - Disk cloning copies the contents of the computer’s hard disk to an image file.
      - Uses for Cloned Images
        
        To deploy new computers within the org
        
        to provide a full system backup
        
        To automatically wipe a system and restore a clean master image
      - Deep Freeze “freezes” the hard drive partition.
      - When a user restarts the system, the system reverts to its frozen configuration.
        The system does not save any modifications, so any applications installed, or files saved are lost when the system restarts.
      - If changes need to be made, Deep freeze need to be disabled and the harddrive "thawed"
      - Deep freeze does not provide real-time protections
        Any machine infected with malware gets a fresh start after restart
  - - - Idle Timeout and Screen Lock
        
        it is best practice to config an idle timer that will automatically log the user out and lock the screen after a period of time
        
        It is a security risk to leave a system open and unattended
      - Login Times
        
        organization may want employees to log in during specific hours, such as 7 a.m. to 6 p.m.
        
        The system blocks logins during the hours that fall outside of the allowed login hours.
    - - Use cable locks with equipment
      - Keep telecom rooms locked
      - Use security cages around equipment
    - - GPS tracking can pinpoint a location within 100 meters
      - GPS to locate a cell phone without the user’s permission though is an invasion of privacy and it is illegal
    - - Radio frequency identification (RFID) uses radio waves to identify and track objects
      - The tags contain an integrated circuit that connects to an antenna.
      - RFID tags do not need a battery to store information to exchange with a reader
      - RFID systems operate within different frequencies
        
        Low frequencies have a shorter read range and slower data read rates, but are not as sensitive to radio wave interference
        
        Higher frequencies have a faster data transfer rate and longer read ranges, but are more sensitive to radio wave interference
- - - - Remote access refers to any combo of hardware and software that grants users to access a local internal network remotely.
      - technicians can use Remote Desktop and Remote Assistance to repair and upgrade computers
        
        Remote Desktop -- allows technicians to view and control a computer from a remote location
        
        Remote Assistance -- allows technicians to assist customers with problems from a remote location
        -- also allows the customer to view the repair or upgrade in real time on the screen.
        
        The Win. installation does not enable remote desktop by default
    - - Secure Shell (SSH) is a protocol that provides a secure (encrypted) management connection to a remote device
      - Telnet is an older protocol that uses unsecure plaintext transmission of both the login authen and the data transit between the communicating devices
        
        SSH should replace Telnet for management connections
      - Secure copy (SCP) securely transfers computer files between two remote systems
        
        SCP uses SSH for data transfer
  - - - Cyber-crims exploit the services running on a system because most devices are running more services or programs than they need.
      - look at every service to verify its necessity and evaluate its risk. Remove any unnecessary services.
      - A simple method to help secure the network from unauthorized access is to disable all unused ports on a switch
      - the process of enabling and disabling ports is time-consuming, but it enhances security and is well worth the effort.
    - - Cyber criminals exploit privileged accounts because they are the most powerful accounts in the Org.
      - Privileged accounts have the credentials to gain access to systems and they provide elevated, unrestricted access
      - Organization should adopt the following best practices for securing privileged accounts:
        
        Establish a process for revocation of rights when employees leave or change jobs
        
        Eliminate shared accounts with passwords that do not expire
        
        Enforce the principle of least privilege
        
        Secure password storage
        
        Identify and reduce the number of privileged accounts
        
        Eliminate shared credentials for multiple administrators
        
        Automatically change privileged account passwords every 30 or 60 days
        
        Record privileged sessions
        
        Implement a process to change embedded passwords for scripts and service accounts
        
        Log all user activity
        
        Generate alerts for unusual behavior
        
        Disable inactive privileged accounts
        
        Use multi-factor authentication for all administrative access
        
        implement a gateway between the end-user and sensitive assets to limit network exposure to malware
      - Securing these accounts needs to be a continuous process
    - - Windows computers are members of a domain.
        The administrator configures a Domain Security Policy that applies to all computers that join.
        Account policies are automatically set when a user logs in to Windows.
      - When not part of an Active Directory domain, the user configs policies through Windows Local Security Policy
        
        In all versions of Windows except Home edition
    - - Operating System Logs
        
        records events that occur because of operational actions performed by the operating system.
        
        Ex
        
        Client requests and server responses such as successful user authens
        
        Usage info that contains the number and size of transactions in a given period of time
      - Security Application Logs
        
        Orgs use network-based or system-based security software to detect malicious activity.
        This software generates a security log to provide computer security data.
        
        Logs are useful for auditing analysis and id-ing trends and long-term issues.
        
        also enable an org to provide documentation showing that it is following laws and regulatory requirements.
      - A log records all events as they occur.
      - Log entries make up a log file, and a log entry contains all of the information related to a specific event.
        Logs that relate to computer security have grown in importance.
  - - - Power Loss
        
        Blackout: complete loss of power
        
        Fault: momentary loss of power
      - Power Degradation
        
        Brownout: prolonged low voltage
        
        Inrush Current: initial surge of power
        
        Sag/dip: momentary low voltage
      - Power Excess
        
        Surge: prolonged high voltage
        
        Spike: momentary high voltage
    - - Here are some general rules in building effective electrical supply systems
        
        Power conditioning
        
        Backup power systems are often required
        
        Redundant power sources: two or more feeds coming from two or more electrical substations
        
        UPS should be available to gracefully shutdown systems
        
        Data centers should be on a different power supply from the rest of the building
    - - often found in large server farms to monitor the health of these systems and to minimize server and application downtime
      - Modern hardware monitoring systems use USB and network ports to transmit the condition of CPU temp, power supply status, fan speed and temp, memory status, disk space and NIC status
      - enable a technician to monitor hundreds or thousands of systems from a single termina
- - - - The Network Operation Center (NOC) is one or more locations houses the tools that provide admins with a detailed status of the org’s network
        
        The NOC is ground zero for
        --network troubleshooting
        --performance monitoring
        --software distribution and updates
        --communications management
        --device management
      - The Security Operation Center (SOC) a dedicated site that monitors, assesses, and defends the org’s info systems such as websites, applications, databases, data centers, networks, servers, and user systems
        
        A SOC is a team of security analysts who detect, analyze, respond to, report on, and prevent cybersecurity incidents
    - - Network devices ship with either no passwords or default passwords.
        Change the default passwords before connecting any device to the network
        Document the changes to network devices and log the changes.
        Lastly, examine all configuration logs
      - Switches
      - VLANs