CompTIA Security+

Willingness to tolerate risk within environment

- minimum frequency of scans
- Corporate policies

Limit frequency of scanning

Limit org from conducting resource intensive vulnerability scans during high business hours

Bandwidth consumed by scanner or number of scans

- Give Admin credentials to scanner to target server turns into config info
- Server config plus remote scan equals a better vulnerability scan

- Common config enumeration
- discuss system config issues

- Common Vulnerabilities and exposures
- standard sec related software flaws

- Common Vulnerability Scoring System
- severity of security software flaws

- Analyzes code w/o executing
- provides vulnerabilities
- remediation suggestions

Executes code as test, to get insight on interfaces the code exposes to user

- Static and dynamic
- Analyze source code while testers interact w/ apps through interfaces

Tools to examine security of web apps

Attack vector metric
How an attacker would exploit vulnerability

The attacker must physically touch device
Score: 0.20

Attacker must have physical or logical access to system
Score: 0.55

Attacker needs access to local network that system is connected to
Score: 0.62

Attacker can exploit remotely over network
Score: 0.85

Attack complexity metric
Diccifuclt of exploiting vulnerability

Exploiting requires “specialized” conditions that could be difficult to find
Score 0.44

Exploiting vulnerability needs no special cxonditions
Score: 0.77

Privileges require metric
Describes type of account access attacker needs to exploit

Attacker needs admin privileges to conduct attack
Score: 0.270(0.50 if scope changed)

Attacker needs basic user privileges to conduct attack
Score: 0.62 (or 0.68 if scope changed)

No privileges needed to exploit
Score: 0.85

User interaction metric
Whether attacker needs to involve another human

Does not require action by user
Score: 0.85

Exploitation requires access by user
Score: 0.62

Confidentiality metric
Type of info disclosure to occur if attacker succeeds

No confidentiality impact
Score: 0

Access to info possible, attacker does not have control over info compromised
Score: 0.22

All info compromised
Score: 0.56

Integrity metric
Type of info alteration to occur if successful

No integrity impact
Score: 0

Modification of info possible, no control over info
Score: 0.22

Integrity of system totally compromised, attacker can change info at will
Score: 0.56

Availability metric
Type of disruption

No impact
Score: 0

Performance degraded
Score: 0.22

System is completely shut down
Score: 0.56

Scope metric
Whether vulnerability can affect system components beyond scope of vulnerability

Exploited vulnerability can oonly affect resources managed by same security authority

Exploited vulnerability affects resources outside of security authority scope

Rating: None

Low rating

Medium rating

High rating

Critical rating

Identify and exploit vulnerabilities in orgs physical security controls

Sec professional act as attackers to simulate and test incident response
Defensive penetration testing
Evaluate orgs ability to defend against attacks
Assess effectiveness

Offensive and defensive
Comprehensive assessment

Gather info without engaging with target

Engage with target in intelligence gathering
Port scanning, footprinting, vulnerability scanning

Open source intelligence

Security content automation protocol

Identification, analysis, response and remediation, validation of remediation, and reporting

Scans, penetration tests, responsible disclosure, bug bounty, and audit results.

Describes steps of model for software development.
Planning, requirements, design, coding, testing, training and trantion, ongoin ops and maintenance, end of life decommissioning

Open worldwide application security project
Developers standards, guides, best practices, open source tools

Application programming interfaces

Reviewing source code of app, gives full visibility to users

Execution of code, provide it with input to test software
Usually automated due to volume

Malicious code is inserted into strings of code that are later passed to a SQL database server

Attacker sends input to web app to test if app interprets inject code before attempting attack

Lightweight directory acces protocol

Focuses on exploiting flaws to gain elevated permission or access

Cross-site scripting
Attacker embeds scripting commands on website to be executed by visitor.
Intent: trick user visiting site to execute malicious code

Valuable for apps that allow user input, data requires validation
Ex: allow lists
Prevents XSS and SQL injection attacks

Isolation tools to contain attackers within benign environment that they though they were attacking

Use more space than allocated to allow attacker to perform memory injection

User and resource provisioning
Guard rails
Security groups
Ticket creation
Escalation
enabling/disabling services and access
Continuous integration and testing
Integrations and APIs

Achieving efficiency and time saving
Enforcing security baselines
Standardizing infrastructure configs
Scaling in secure manner:
Retaining employees
Reducing reaction time
Serving as workforce multiplier

Complexity
Cost
Single point failure
Technical debt: outdated or inefficient
Ongoing supportability: maintain and update scripts

Practice of using cryptographic techniques to embed or conceal secret messages withing another file
Can be used to hide images, videos, text, audio

Use shared key available to all users of system

Use individual combinations of public and private keys for each user

Full Disk encryption
All data on hard drive automatically encrypted

Targets specific partition of drive
Allows for more flexibility when dealing with dual-boot systems
File-level encryption
Encrypt individual files
Easier to setup and manage but not as secure as FDE or partition

Encrypt set volume on drive, like several folders and files

Protect data at database level from access by unauthorized individuals.
Transparent database encryption (TDE): Encrypts entire database
Column-level encryption (CLE): specific columns in tables encrypted
Record level: individual records in database encrypted

Aka secret key cryptography, private key cryptography
Shared secret key
Sender uses secret to encrypt, receiver uses secret to decrypt
Pro: generated faster
Con: lack of nonrepudiation, key needs to be regenerated often

Aka public key algorithm
Public key encrypts message, private key decrypts message
e.g. Sender cannot decrypt a message once encrypted by receiver’s public key, only the receiver can decrypt since they are the only one who has access to their private key.
New users added require generation of only one new public-private pair.
Weakness: slow speed of operation

Secure distribution of secret keys needed to operate algorithms
Offline
Public key encryption: setup with public key, switch to private key session
Diffie-Hellman; choose integer, plug into same equation given same conditions

One way cryptographic function that take input and generates unique and repeatable output.
No two inputs should generate the same output, and hash should not be reversible.

used against secure comms, attempt to get user/system to shift to less secure cryptographic methods

using probability and logic to find two inputs that created the same hash output (collision)

Take long message and generate unique output, w/ value derived from original content (message digest)

Add randomly generated value to each password before hashing

Create Encryption keys from passwords made stronger

Apply encryption algorithm to entire message block

Operate on one character or bit of message at time.

Data encryption standard

Advanced encryption standard

Implements partial digital signatures
Guarantees integrity of message during transmission

Version, serial, algorithm identifier, issuer, validity period, common name, alternative name, public key

Assist CAs with burden of verifying users identities before issuing certs. Allow CAs to remotely validate users.

Contain serial numbers of certs that has been issued by CAS and revoked
Must be downloaded and cross-referenced periodically

Provides means for real-time certificate verification
Request sent to server, server checks, updates browser with status

Server staples timestamped response from OCSP to digital certificate
Saves time for user during next visit

Digital cert format

ASCII format of DER