Please enable JavaScript.
Coggle requires JavaScript to display documents.
The Art of Protecting Secrets - Coggle Diagram
The Art of Protecting Secrets
Access Control
Types of Access Control
Logical Access Controls
Hardware and software solutions used to manage access to resources and systems. these technology-based solutions include tools and protocols that computer systems use for identification, authentication, authorization, and accountability
Access Control Lists (ACLs)
ACLs can define and control different types of traffic on a network device to meet specific security requirements.
An ACL is a sequential list of permit or deny statements that filter traffic based on certain criteria such as the source or destination IP address
Protocols
A set of rules that govern the exchange of data between devices
Biometrics
analyzes users' physical characteristics to verify their identity.
It is the most accurate method for identification verification, but it is also the most expensive method
Firewalls
Prevents undesirable traffic from entering an area within a network.
A firewall enforces an access control policy between networks.
Passwords
a protected string of characters used to authenticate a user.
Routers
Connect at least two networks
Smart Cards
have an embedded microchip that can communicate with the host computer or card reader
Intrusion Detection Systems
Monitor a network for suspicious activates
Encryption
The process of taking a message that is easily read by anyone and encoding it so that only authorized users can read it.
Operating systems offer encryption features to encrypt devices such as a hard drive.
Clipping Levels
certain allowed thresholds for errors before triggering a red flag
Administrative Access Controls
policies and procedures defined by organizations to implement and enforce all aspects of controlling unauthorized access. Administrative controls focus on personnel and business practices
Background checks are an employment screening that includes information of past employment verification, credit history and criminal history
Data classification categorizes data based on its sensitivity
Hiring practices involves the steps an organization takes to find qualified employees
Security training educates employees about the security policies at an organization
Procedures are the detailed steps required to perform an activity
Reviews evaluate an employee's job performance
Policies are statements of intent
Physical Access Controls
actual barriers deployed to prevent direct contact with systems.
The goal is to prevent unauthorized users from gaining physical access control determines who can enter (or exit), where they can enter (or exit), and when they can enter (or exit)
Fences to protect the perimeter
Motion detectors to detect moving objects
Guards to monitor the facility
Laptop locks safeguard portable equipment
Locked Doors prevent unauthorized access
Swipe Cards allow access to restricted areas
Guard dogs protect the facility
Video cameras monitor a facility by collecting a recording images
Mantraps allow access to the secured area after door 1 closes
Alarms detect intrusion
Access Control Strategies
Discretionary Access Control (DAC)
DAC grants or restricts object access determined by the object's owner.
As the name implies, controls are discretionary because an object owner with certain access permissions can pass on those permissions to another subject
Role-based Access Control (RBAC)
is based on the role of the subject.
Roles are job functions within an organization.
Specific roles require permissions to perform certain operations.
Users acquire permissions through their role.
RBAC can work in combination with DAC or MAC by enforcing the policies of either one
Need to Know
Object Properties
Group Membership
Subject Classificaton
Time of Day
Mandatory Access Control (MAC)
restricts the actions that a subject can perform on an object.
A subject can be a user or a process.
An object can be a file, a port, or an input/output device.
An authorization rule enforces whether or not a subject can access the object
Rule-based Access Control
Uses Access Control Lists (ACLs) to help determine whether to grant access.
A series of rules is contained in the ACL
The determination of whether to grant access depends on these rules. An example of such a rule is one that states that no employee may have access to the payroll file after hours or on weekends
Identification
Identification enforces the rules established by the authorization policy
Cybersec policies determine which identification controls should be used
The sensitivity of the information and information systems determine how stringent the controls
Every time the subject requests access to a resource, the access controls determine whether to grant or deny access
The increase in data breaches has forced many organizations to strengthen their identification controls
A subject requests access to a system resource
Authentication Methods
What You Know
Passwords, Passphrases, or PINs are all examples of something that the user knows. Passwords are the most popular method used for authentication
What You Are
Smart cards and security key fobs are both examples of something that users have in their possession
Who You Are
A unique physical characteristic, such as fingerprint, retina, or voice that identifies a specific user is called biometrics
Multi-factor Authentication
Uses at least two methods of verification.
A security key fob is a good example.
The two factors are something you know, such as a password, and something you have, such as a security key fob
Authorization
Authorization uses a set of attributes that describes the user's access to the network
The system compares these attributes to the information contained within the authentication database, determines a set of restrictions for that user, and delivers it to the local router where the user is connected
After a user proves their identity, the system checks to see what network resources the user can access and what the users can do with the resources
Defining authorization rules is the first step in controlling access. An authorization policy establishes these rules
Accountability
This allows an organization to trace actions, errors, and mistakes during an audit or investigation
Implementing accountability consists of technologies, policies, procedures, and education
The collected data might include the log in time for a user, whether the user log in was a success or failure, or what network resources the user accessed
Log files provide detailed information based on the parameters chosen
The organization can use this data for such purposes as auditing or billing
Types of Security Controls
Corrective Controls
Corrective counteracts something that is undesirable.
Orgs put corrective access controls in place after a system experiences a threat.
Corrective controls restore the system back to a state of confidentiality, integrity, and availability
They can also restore systems to normal after unauthorized activity occurs
Deterrent controls
A deterrent is the opposite of a reward.
A reward encourages individuals to do the right thing, while a deterrent discourages them from doing the wrong thing. Cybersec Pros and Orgs use deterrents to limit or mitigate an action or behavior.
Deterrents do not always stop these actions
Cameras
Intrusion Alarms
Mantraps
Separation of Duties
Guards
Awareness Training
Badges
Encryption
Fences
Auditing
Locks
Firewalls
Recovery Controls
Recovery is a return to a normal state.
Recovery access controls restore resources, functions, and capabilities after a violation of a secuirty policy.
Recovery controls have more advanced capabilities over corrective access controls
Server Clustering
Database Shadowing
Fault Tolerance Drive Systems
Antivirus Software
Backup/Restore Operations
Preventative Controls
Prevent means to keep something from happening.
Preventative access controls stop unwanted or unauthorized activity from happening
Compensative Controls
Compensate means to make up for something.
Compensative access controls provide options to other controls to bolster enforcement in support of a security policy.
A compensative control can also be a substitution used in place of a control that is not possible under the circumstances
Personnel Supervision
Monitoring
Security Policy
Work Task Procedures
Detective Controls
Detection is the act or process of noticing or discovering something.
Access control detection identify different types of unauthorized activity.
Detection systems can be very simple, such as a motion detector or secuirty guard.
They can also be more complex, such as an intrusion detection system
Obscuring Data
Data Masking
A technology that secures data by replacing sensitive information with a non-sensitive version.
The non-sensitive version looks and acts like the original.
This means that a business process can use non-sensitive data and there is no need to change the supporting applications or data storage facilities
In the most common use case, masking limits the propagation of sensitive data within IT systems by distributing surrogate data sets for testing and analysis
There are data masking techniques that can ensure that data remains meaningful but changed enough to protect it
Substitution
Replaces data with authentic looking values to apply anonymity to the data records.
Shuffling
Derives a substitution set from the dame column of data that a user wants to mask. This technique works well for financial information in a test database, for example
Steganography
Conceals data in another file such as a graphic, audio, or other tecxt file
the advantage of steganography over cryptography is that the secret message does not attract any special attention. No one would ever know that a picture actually contained a secret message by viewing the file either electronically or in hardcopy
there are several components involved in hiding data
Cover-text (or cover-image/-audio) hides the embedded data producing the stego-text(/image/audio)
A stego-key controls the hiding process
there is the embedded data, which is the secret message
Data Obfuscation
The use and practice of data masking and steganography techniques in the cybersecurity and cyber intelligence profession
Software watermarking protects software from unauthorized access or modification
Software watermarking inserts a secret message into the program as proof of ownership
A system may purposely scramble messages to prevent unauthorized access to sensitive information
The secret message is the software watermark. If someone tries to remove the watermark, the result is nonfuctional code
Obfuscation is the art of making the message confusing, ambiguous, or harder to understand.
ex. Facebook Privacy Policy
Cryptography
Types of Cryptography
Stream Ciphers
Can be much faster than Block ciphers and generally do not increase the message size, because they can encrypt an arbitrary number of bits
Transformation of smaller plaintext units varies, depending on when they are encountered during the encryption process
Encrypt plaintext one byte or one bit at a time
Block Ciphers
usually output data that is larger than the input, bc the ciphertext must be in a multiple of the block size
transforms a fixed-length block of plaintext into a common block of ciphertext of 64 or 128 bits.
block size is the amount of data encrypted at any one time.
Symmetrical vs Asymmetrical Encryption
Key Management
Two Terms used to describe keys
Keyspace, this is the number of possibilities that a specific key length can generate
Key Length, aka key size, this is the measure in bits
Key management is the most difficult of designing a cryptosystem
In practice, most attacks on cryptographic systems target the key management level, rather than the cryptographic algorithm itself
Key Management Considerations
Key Exchange
Key management procedures should provide a secure key exchange mechanism that allows secure agreement on the keying material with the other party, probably over an untrusted medium
Key Revocation and Destruction
Revocation notifies all interested parties that a certain key has been compromised and should no longer be used.
Destruction erases old keys in a manner that prevents malicious attackers from recovering them
Key Generation
In a modern cryptographic system, key generation is usually automated and not left to the end user.
The use of good random number generators is needed to ensure that all keys are equally generated so that the attacker cannot predict which keys are more likely to be used
Key Lifetime
Using short key lifetimes improves the security of legacy ciphers that are used on high-speed connections. In IPsec a 24-hour lifetime is typical.
However, changing the lifetime to 30 minutes improves the security of the algorithms
Key Verification
Some keys are better than others.
Almost all cryptographic algorithms have some weak keys that should not be used.
With the help of key verification procedures, weak keys can be identified and regenerated to provide a more secure encryption
Key Storage
On a modern multi-user operating system that uses cryptography, a key can be stored in memory.
This presents a possible problem when that memory is swapped to the disk, because a Trojan horse program installed on the PC of a user could then have access to the private keys of that user
Applications
A VPN is a private network that uses a public network, usually the internet, to create a secure communication channel.
If criminals compromise data in use, they will have access to data at rest and data in motion
VPNs use IPsec. IPsec is a suite of protocols developed to achieve secure services over networks
System Memory holds data in use and it can contain sensitive data such as the encryption key
IPsec services allow for authentication, integrity, access control, and confidentiality
Data in use is a growing concern to many organizations.
When in use, data no longer has any protection because the user needs to open and change the data
With IPsec, remote sites can exchange encrypted and verified information
Four Protocols use asymmetric key algorithms
Pretty Good Privacy PGP) which is a computer program that provides cryptographic privacy and authentication to increase the security of email communications
Secure Shell (SSH), which is a protocol that provides a secure remote access connection to network devices
Secure Socket Layer (SSL), which is a means of implementing cryptography into a web browser
Internet Key Exchange (IKE), which is a fundamental component of IPsec Virtual Private Networks (VPNs)
There are many applications for both symmetric and asymmetric algorithms.
A one-time password-generating token is a hardware device that uses cryptography to generate a one-time password.
A one-time password is an automatically generated numeric or alphanumeric string of characters that authenticates a user for one transaction of one session only.
The number changes every 30 seconds or so. The session password appears on a display and the user enters the password.
The electronic payment industry uses 3DES
Most encrypting file systems, such as NTFS, use AES
Operating Systems use DES to protect user files and system data with passwords
Comparing Encryption Types
Asymmetric cryptography is more efficient at protecting the confidentiality of small amounts of data, and its size and speed make it more secure for tasks such as electronic key exchange which is a small amount of data rather than encrypting large blocks of data
Examples include RSA, ElGamal, Elliptic Curves and DH
Algorithms are relatively slow because they are based on difficult computational algorithms
A sender and receiver do not share a secret key
The usual key length is 512 to 4,096 bits
Best known as public key algorithms
Symmetric encryption systems are more efficient and can handle more data. However, key management with symmetric encryption systems is more problematic and harder to manage
the usual key length is 80 to 256 bits
Examples include DES, 3DES, AES, IDEA, RC2/4/5/6, and Blowfish
Algorithms are usually quite fast (wire speed) because they are based on simple mathematical operations
A sender and receiver must share a secret key
Best known as shared-secret key algorithms
Public-Key Encryption
Asymmetrical Encryption Process
Elliptic Curve Cryptography (ECC)
In the U.S., the National Security Agency uses ECC for digital signature generation and key exchange
uses elliptic curves as part of the algorithm.
ElGamal
uses the U.S. government standard for digital signatures. This algorithm is free to use because no one holds the patent
Diffie-Hellman
Secure protocols, such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH), and Internet Protocol Security (IPsec), use Diffie-Hellman
Provides an electronic exchange method to share the secret key.
RSA (Rivest_Shamir-Adleman)
Browsers use RSA to establish a secure connection
Uses the product of two very large prime numbers with an equal length of between 100 and 200 digits.
Asymmetric Encryption, AKA Public-key encryption, uses one key for encryption that is different from the key used for decryption.
A Criminal cannot calculate the decryption key based on knowledge of encryption key, and vice versa, in any reasonable amount of time.
Private-Key Encryption
Symmetrical Encryption Process
Common Symmetric Encryption Standards
AES
The US government uses SEA to protect classified information
The National Institute of Standards and Technology (NIST) approved the AES algorithm in December 2001
the Advanced Encryption Standard (AES) has a fixed block size of 128-bits with a key size of 128, 192, or 256 bits
IDEA
IDEA was the replacement for DES, and now PGP (Pretty Good Privacy) uses it.
IDEA performs eight rounds of transformation on each of the 16 blocks that result from dividing each 64-bit block.
the International Data Encryption Algorithm (IDEA) uses 64-bitblocks and 128-bit keys.
3DES (Triple DES)
Triple DES encrypts data three times and uses a different key for at least one of the three passes, giving it a total key size of 112-168 bits
Digital Encryption Standard (DES) is a symmetric block cipher w/ 64-bit block size that uses a 56-bit key.
Symmetric Algorithms use pre-shared key to encrypt and decrypt data, a method also known as private-key encryption.
Numerous encryption systems use symmetric encryption
Overview
Two Types of Encryption
Asymmetric Algorithms
Asymmetric algorithms are more complex.
These algorithms are resource intensive and slower to execute.
One key is public and the other is private. In a public-key encryption, any person can encrypt a message using the public key of the receiver, and the receiver is the only one that can decrypt it using their private key.
Symmetric Algorithms
uses identical pre-shared key, aka secret key pair, to encrypt and decrypt data. bot parties have the key before transmission
Key Management is the most difficult part of designing a cryptosystems
the security of encryption lies in the secrecy of the keys, not the algorithm
Methods of Creating Cipher Text
One-Time Pad
Plaintext combined with a secrets key creates a new character, which then combines with a plaintext to produce ciphertext
Substitution
Letters are replaced
Transposition
Letters are rearranged
All Ciphers use a key to encrypt or decrypt a message
Cryptography is a way to store and transmit data so only the intended recipient can read or process it.
Encryption is the process of scrambling data so that an unauthorized party cannot easily read it
Cryptology is the science of making and breaking secret codes.