Please enable JavaScript.
Coggle requires JavaScript to display documents.
Security Revision - Coggle Diagram
Security Revision
INTRODUCTION (1)
-
-
-
Non-Repudiation - The process of confirming a transaction that occurs between two individuals. Accountability enables non-repudiation as an individual cannot deny having committed an action
A vulnerability is a weakness or flaw in a system, software, or process that can be exploited to compromise security
A threat is a potential danger or event that could exploit a vulnerability to cause harm or unauthorized access
Risks are defined as the probability of a vulnerability being exploited, multiplied by the cost of the threat - any circumstance that could impact operations negatively
RISK MANAGEMENT (2)
ISO 3100 Process
Risk Identification - Describing the risk, finding the source of the trigger, and evaluating potential consequences
-
-
Risk Treatment - Treat, share, retain, and avoid potential risks
Risk Assessments
Qualitative Risk Assessments - Focus on descriptive evaluations of risk; preferred when risk assessors have limited experience, an insignificant amount of data, or a short timeframe
Quantitative Risk Assessments - Aim to calculate a numeric risk value and are more precise than qualitative risk assessments; performed by experts
Single Loss Expectancy - Asset value ($) x exposure factor (loss due to a successful threat exploit, given as a %)
-
Annualized Loss Expectancy - The single loss expectancy multiplied by the annualized rate of occurence
Valuation Methods
Tangible Asset Valuation - Calculated by the original cost of the asset - the depreciation of the asset
Intangible Asset Valuation - Difficult to determine; for approximation, the cost to create and replace the asset, capitalization of historic profits, or cost avoidance can be used
Security Policies
-
Functional, issue specific policies
-
Standards give a more technical perspective than policies as they define specific requirements instead of focusing on organizational needs
Baselines describe how to best implement security configurations or standards whilst procedures are step-by-step instructions on how to follow them
Guidelines are discretionary / optional recommendations for non-mandatory security policies, standards, or procedures
ACCESS CONTROL (3)
Access Control - The process of allowing only authorized users to observe, take possession, or modify resources in a computer system
-
-
-
Access Control Policies
Discretionary Access Control - The access controls are placed on the data by its owner, that determines who has access to data and their exact privileges
Mandatory Access Control - The access controls are placed on the data by the system and based on the organization's policy; preferred over DAC in highly sensitive environments
Non - Discretionary Access Control - Also based on the assignment of permissions, however unlike DAC it is done by the administrator of a system rather than the owner
Role-Based Access Control - Access is based on the roles of a user within an organization, allowing administrators to simplify control strategies
-
Limited RBAC - Users are mapped to roles within single applications, instead of through an organization-wide role structure
Hybrid RBAC - There is a clear role assignment to the user which is applied over multiple applications or systems
Full RBAC - Control is always based on roles defined by organizational policies, applied on an enterprise-wide basis
-
Identity Management - The set of technologies aiming to increase efficiency within technical environments, with the main responsibility being to centralize and streamline user identification, authentication and authorization
NETWORK SECURITY (4 & 5)
Security Architecture
-
TCP / IP Reference Model - A model very similar to OSI defined by the US dept. of Defense. The model contains only the application, transport, internet (network), and network access layers
Protocols & Services
DNS (domain name system) - One of the most prominent and visible network services to the user, supporting the resolution of email and www addresses. DNS is robust, flexible, and scaleable
DNS is a frequent target of attacks such as DNS spoofing, since this can divert, prevent, or intercept the vast majority of end user communications. However, if a DNS resolver goes offline, the integrity of the system is kept
HTTP (hypertext transfer protocol) - Supports the exchange of information in hypertext markup language. The standard port is 80 / TCP. It offers no quality of service, bidirectional communication, or encryption. HTTP proxying is done in three ways:
-
Open Proxy Servers - Used to allow unrestricted access to GET commands. Used for attacks or for obscuring the origin of illegitimate requests
-
HTTP Tunneling is applied to enhance functionality by bypassing user restrictions and allowing an application to function through a firewall
Usually, this is done by encapsulating outgoing traffic from an application in HTTP requests and incoming traffic in HTTP responses
Secure Shells - The secure alternative for users who wish to log on to a remote computer. Unlike TELNET, it allows users to secretly access resources using an encrypted tunnel, preventing session hijacking or other man-in-the-middle attacks
IP Security - A suite of protocols for communicating securely over IP, providing mechanisms for authentication and encryption. It is mandatory in IPv6 but also widely used in IPv4
Authentication Header (AH) - Ensures integrity through the proof of sender's identity and non tampered data by transmitting a hashed value of the packet's contents based on a shared secret
Encapsulating Security Payload (ESP) - Can encrypt IP packets and ensure their integrity through the following methods:
-
ESP Payload - Encrypted part of the packet (most of the times, symmetric encryption is used)
ESP Trailer - Padding, next header
-
Security Associations (SA) - Defines the mechanisms that an endpoint uses to communicate with its partner. These mechanisms include encryption and authentication algorithms; whether to use AH or ESP
Internet Key Exchange (IKE) - Used to provide the identity of each other, working in two principal phases:
Phase I: Authenticate using a shared secret, or public key encryption. Then IKE, establishes a temporary security association (SA) and secure tunnel to protect the rest of the key exchange
-
Transport Mode & Tunnel Mode - In transport mode, the IP payload is protected (usually used for end-to-end protection), whilst in tunnel mode, the IP header and it's payload are protected (used between networks such as firewall-to-firewall VPNs)
Network Attacks
Scanning Techniques
Port Scanning - Probing for TCP services on a machine, which identifies vulnerabilities in a target system
FIN Scanning - A stealth scanning method where a request to close a connection is sent to the target machine. If no application is listening to that port, a TCP, RST, or IMCP packet is sent, revealing an open port
NULL Scanning - Similar to FIN scanning, but no flags are set on the initiating TCP packet
XMAS Scanning - Similar to FIN scanning, but all flags are set on the initiating TCP packet
IP Fragmentation Attacks
Teardrop - IP packet fragments are constructed so that the target host calculates a negative fragment length when attempting to reconstruct the packet, resulting the host to crash
Overlapping Fragment Attack - Used to subvert packet filters that only inspect the first fragment of a fragmented packet. This is done through sending a harmless first fragment and overwriting it
Source Routing Exploitation - Allows the sender to specify the path of an IP packet instead of letting the router do it which allows for access to the internal network
Smurf Attack - The intruder broadcasts an ICMP echo request with a spoofed source address of the victim, overwhelming them with ICMP echo replies
Fraggle Attack - The intruder broadcasts UDP packets on port 7, also resulting in denial of service caused by the responses of the network
-
Spoofing Attacks
IP Address Spoofing - IP packets are sent with a bogus source address so that the victim will send a response to a different host. Spoofed addresses may be used to abuse the TCP handshake by leaving half-open connections.
E-Mail Spoofing - Can be done by sending a TELNET command on port 25 of a mail server, and used to obfuscate the sender's identity in spamming
-
DNS Poisoning - Injecting false information into a DNS server or cache, in order to redirect users to malicious websites
Pharming - Manipulating DNS records so that the victim is automatically taken to a malicious website, even when typing in the link for a trusted website correctly
Firewalls
Network Protocols - Insecure by default; more secure protocols such as IPSec exist however they are uncommon. This is why firewalls control what information can be transmitted on a network interface. They are implemented as a software with privileged access to the interface
Packet-Filtering Firewalls - Active by default, and behave based on a set of rules matching packets (IF, THEN / Action: ACCEPT, REJECT, DROP). However, they cannot block everything as it is possible to hide traffic as a different protocol or port
Proxy Firewalls - Forced intermediaries between two points A and B, operating on the application layer. The proxy crafts a request from point A, making a similar request to point B and vice versa. However, proxy firewalls are complex, may degrade performance, and must be trusted with sensitive data
-
Intrusion & Tunneling
Intrusion Detection - The process of monitoring and analyzing system events to identify / report attempts at accessing resources in an unauthorized manner
Network-Based IDS (NIDS) - Events that are derived from listeners at strategic points such as routers, gateways, or switches. Packet sniffing is used to observe in-transit patterns
Host-Based IDS (HIDS) - Events that are derived from kernel operations, application logs, filesystem changes, etc
Intrusion Prevention Systems - Take action in response to detected activity in order to stop or contain it
Signature-Based Event Analyses - Define malicious patterns and match events against signatures. Rules detect patterns that do not 'ping', warning about initial steps in an attack. This is both fast and accurate, however signatures still have to be updated by somebody, and signatures may be obfuscated
Anomaly-Based Event Analyses - Builds profiles of legitimate users and identifies deviations from them such as the number of failed login attempts, commands executed, or resources consumed
Tunneling is used to secure important data packets by encapsulating packets inside secure communication tunnels with trusted intermediaries. Tunneling can also be used to disguise requests originating from an intermediary network
Multi-Layer Packet Encapsulation - Achieved by placing a tunnel on top of a tunnel, so that no actor knows the complete communication path. This is also known as TOR (onion routing)
-