Section 2.1-2.3: Security Measures and Malware

- all doors normally unlocked: opening one door causes others to lock
- all doors normally locked: unlocking one door prevents others from being unlocked
- one door open and other locked: when one is open, the other cannot be unlocked
- one at a time, controlled groups: managed control through an area

- magnetic swipe, RFID, or NFC: many different identification methods
- different applications: time clocks, security guard patrols, door access

- CCTV(closed circuit television), can replace physical guards
- camera features are important: object detection can identify a license plate or person's face
- often many different cameras networked together and recorded over time
- motion detection: radio reflection or passive infrared, useful in areas not often in use

- circuit-based: circuit is opened or closed, door, window, fence, useful on the perimeter
- motion detection: identify motion without a camera
- duress: triggered by a person, big red button

- conventional: lock and key
- deadbolt: physical bolt
- electronic: keyless, PIN
- token-based: RFID badge, magnetic swipe, or key fob
- biometric: hand, fingers or retina
- multi-factor: smart card and PIN

- data center hardware is usually managed by different groups, responsibility lies with the owner
- racks can be installed together side by side
- enclosed cabinets with locks: ventilation on front, back, top, and bottom

- security guard: physical protection at the reception, validates ID of existing employees, provides guest access
- ID badge: picture, name, other details, must be worn at all times
- access list: physical list of names, enforced by security guard
- maintains a visitor log

- prevent access: there are limits to the prevention
- channel people thorugh a specific access point and keep out other things, allow people, prevent cars and trucks
- identify safety concerns and prevent injuries
- can be used to an extreme: concrete barriers or bollards, moats

- build a perimeter: usually very obvious and may not be the security what you're looking for
- transparent or opaque: may be able to see through the fence or not
- robust: difficult to cut the fence
- prevent climbing: razor wire, built high

- small RFID key, add to physical keychain
- replaces a physical key: commonly used for door locks, proximity operation and contactless

- certificate-based authentication, something you have, usually requires additional factors
- integrated card reader: built into the laptop

- some doors may not have an electronic lock: rarely used, standalone locks, used for safe, storage bin, cabinet
- use a key cabinet: formal check in and check out, well-defined storage location, allows for auditing and timestamps

- biometric authentication: usually stores a mathematical representation of your biometric, your actual fingerprint isn't usually saved
- difficult to change: you can change your password but you can't change your finger print
- used in very specific situations: not foolproof

- retina scanner: unique capillary structure in the back of the eye
- fingerprint scanner: phones, laptops, door access
- palmprint scanner: shape of the hand and fingers

- more light means more security: attackers avoid the light, easier to see when lit, non IR cameras can see better
- specialized design: consider overall light levels, lighting angles may be important with facial recognition, avoid shadows and glare

- metal detector, passive scanning: detect metal objects
- not useful for non-metal objectives: won't identify ceramic or plastic

- Mobile Device Management: manage company-owned and user-owned mobile devices
- BYOD: Bring Your Own Device
- centralized management of the mobile devices: specialized functionality
- set policies on apps, data, camera, etc: control the remote device, the entire device or a "partition"
- manage acceses control: force screen locks and PINs on these single user devices

- rights and permissions should be set to the bare minimum: you only get exactly what's needed to complete your objective
- all user accounts must be limited: applications should run with minimal privileges
- don't allow users to run with administrative privileges: limits the scope of malicious behavior

- Access Control Lists: used to allow or deny traffic, aslso used for NAT, QoS, etc, commonly used on the ingress or egress of a router interface
- ACLs evaluate on certain criteria: source IP, destination IP, TCP port numbers, UDP port numbers, ICMP
- deny or permit: what happens when an ACL matches the traffic
- also used in OSes: allow or deny access to the filesystem

- more than one factor: something you are, you have, you know, you do, or something you are
- can be expensive: separate hardware tokens, specialized scanning equipment

- authenticator application: pseudo-random number generator, can't guess it, changes constantly/
- saves money: free smartphone applications, no separate device to lose

- short message service: text messaging, includes more than text these days
- login factor can be sent via SMS to a predefined phone number: provide username and password, phone receieves an SMS, input SMS code into login form
- security issues exist: phone number can be reassigned to a different phone, SMS messages can be intercepted, SMS spoofing

- phone call provides the token: computer is talking to you, "your code is ------"
- similar disadvantages to SMS: phone call can be intercepted or forwarded, phone number can be added to another phone

- unsolicited email: stop it at the gateway before it reaches the user, on-site or cloud-based
- scan and block malicious software: executables, known vulnerabilities, phishing attempts, other unwanted content

- a database of everything on the network: computers, user accounts, file shares, printers, groups, and more
- manage authentication: users login using their AD credentials
- centralized access control: determine which users can access resources
- commonly used by the help desk: reset passwords, add and remove accounts

- the name associated with this related group of users, computers and resources: each domain has a name
- domain controllers store this central domain database: active directory is the service that manages this directory
- often referenced when troubleshooting: is this computer on the domain, can you reset the domain password

- Organizational Units: keeps the very large database organized whether its users and or computers
- create your own hierarchy: countries, states, buildings, departments, etc
- apply policies to an OU: can be very large for domain users or can be for a specific group like Marketing, North America, Pegasus galaxy

- automate a series of tasks during login: assign a script to a specific user, group, or OU
- associate the script with a Group Policy: User Configuration >> Policies >> Windows Settings >> Scripts
- create a different login scripts for different OUs: customize based on your needs

- manage the computers or userse with group policies: local and domain policies, group policy management editor
- a central console: login scripts, network configurations (QoS), security parameters
- update a client with the "gpupdate" utility: "> gpupdate /force"

- assign a user home folder to a network folder: manage and backup files from the network, avoid storing files on the local computer
- when added to the user profile, the directories are automatically created and proper permissions are assigned
- requires some training: encourage users to store files on the network home folder

- some users and applications use the Windows library folders: desktop, downloads, music, documents, etc
- redirect the folders to a network share: User Configuration >> Policies >> Windows Settings >> Folder Redirection
- this is often paired with the Offline Files feature as you're not always connected

- create a group: assign permissions to the group
- set the rights and permissions to the group: add users to the group
- some built-in groups: users, guests, remote management users, Event Log Readers
- save time: avoid confusion and mistakes

- an organizations wireless network can contain confidential info: not everyone is allowed access
- authenticate the users before granting access: who gets access to the wireless network
- need username, password, multi-factor authentication
- ensure that all communication is confidential: encrypt the wireless data
- verify the integrity of all communication: the received data should be identical to original sent data, a message integrity check(MIC)

- all wireless computers are radio transmitters and receivers: anyone can listen in
- solution: encrypt the data, everyone has an encryption key
- only people with the right key can transmit and listen: WPA2 and WPA3

- Wi-Fi Protected Access II: WPA2 certification began in 2004
- CCMP block cipher mode: Counter Mode and Cipher Block Chaining Message Authentication Code Protocol, or Counter/CBC-MAC Protocol
- CCMP security services: data confidentiality with AES encryption, MIC with CBC-MAC

- Wi-Fi Protected Access 3: introduced in 2018
- GCMP block cipher mode: Galois/Counter Mode Protocol, stronger encryption than WPA2
- GCMP security services: data confidentiality with AES, MIC with Galois Message Authentication Code(GMAC)

- WPA2 has a pre-shared key(PSK) brute-force problem: listen to the four-way handshake, some methods can derive the PSK hash without the handshake, capture the hash
- with the hash, attackers can brute force the PSK
- this has become easier as technology improves: a weak PSK is easier to brute force, GPU processing speeds, cloud-based password cracking
- once you have the PSK, you have everyone's wireless key: there's no forward secrecy

- Simultaneous Authentication of Equals: Diffie-Hellman derived key exchange with an authentication component, everyone uses a different session key, even with the same PSK, an IEEE standard: dragonfly handshake
- WPA3 changes the PSK authentication process: includes mutual authentication, creates a shared session key without sending that key across the network meaning no more four-way handshakes, no hashes, and no brute force attacks

- configure the authentication on your wireless access point or wireless router
- open system: no authentication password is required
- WPA/2/3-Personal and WPA/2/3-PSK: WPA2 or WPA3 with a pre-shared key, everyone uses the same 256-bit key
- WPA/2/3-Enterprise and WPA/2/3-802.1X: authenticates users individually with an authentication server(i.e., RADIUS)

- client >> internet >> Firewall/VPN concentrator/Access Point >> authenticate user with authentication server and if credentials approved >> Internal File Server

- Remote Authentication Dial-in User Service: one of the more common AAA protocols, supported on a wide variety of platforms and devices, not just for dial-in
- Centralize authentication for users: routers, switches, firewalls, server authentication, remote VPN access, 802.1X network access
- RADIUS services available on almost any server OS

- Terminal Access Controller Access-Control System: remote authentication protocol, created to control access to dial-up lines to ARPANET
- TACACS+: latest version of TACACS, more authentication requests and response codes, released as an open standard in 1993
- common for this to be associated with a CISCO device

- network authentication protocol: authenticate once, trusted by the system, no need to re-authenticate to everything, mutual authentication for the client and the server, protect against on-path or replay attacks
- standard since the 1980s: developed by MIT
- Microsoft started using Kerberos in Windows 2000: based on Kerberos 5.0 open standard, compatible with other OSes and devices

- Single Sign On
- Authenticate one time: lots of backend ticketing, cryptographic tickets
- no constant username and password input: save time
- only works with Kerberos: not everything is Kerberos-friendly
- there are many other SSO methods: smart-cards, SAML, etc

- 1. Service Request: ticket granting ticket >> service ticket
- 2. Presents Service Ticket: Service ticket >> application server
- 3. Mutual Authentication(Optional): application server >> principal
- 4. Data Transfer: between application server and principal

- many different ways to communicate to an authentication server: more than a simple login process
- often determined by what is at hand: VPN concentrator can talk to a RADIUS server, we have a RADIUS server
- TACACS+: probably a Cisco device
- Kerberos: probably a Microsoft network

- malicious software: these can be very bad
- gather information: keystrokes
- participate in a group: controlled over the 'net'
- show you advertising: big money
- viruses and worms: encrypt your data, ruin your day

- trojan horse, rootkit, viruses, spyware, ransomeware, keylogger, boot sector virus, cryptominers

- these all work together: malicious software takes advantage of a vulnerability, installs malware that includes a remote access backdoor, bot may be installed later
- your computer must run a program: email link - don't click links, web page pop-up, drive-by download, worm
- your computer is vulnerable: keep OS and applications updated, check with publisher for latest version on apps

- used by the Greeks to capture Troy from the Trojans: digital wooden horse
- software that pretends to be something else so it can conquer your computer, doesn't really care much about replicating
- circumvents your existing security: anti-virus may catch it when it runs, the better trojans are built to avoid and disable AV
- once it's inside it has free reign and it may open the gates for other programs

- originally a Unix technique: the "root" in rootkit is the superuser on the system in Unix and Linux
- modifies core system files: part of the kernel
- can be invisible to the OS: won't see it in task manager
- also invisible to traditional AV utilities: if you can't see it, you cant stop it

- look for the unusual: anti-malware scans
- use a remover specific to the rootkit: usually built after the rootkit is discovered
- secure boot with UEFI: security in the BIOS

- malware that can reproduce itself: it needs you to execute a program
- reproduces through file systems or the network: just running a program can spread a virus
- may or may not cause problems: some viruses are invisible, some are annoying
- AV is very common: thousands of new viruses every week, is your signature file updated

- most viruses run after the OS is loaded: like most applications
- some boot loaders can be modified to run malware: runs every time you start your computer
- modern UEFI BIOS includes secure boot: prevent unsigned software from running during the boot process

- malware that spies on you: advertising, identity theft, affliate fraud
- can trick you into installing: peer to peer, fake security software
- browser monitoring: capture surfing habits
- keyloggers: capture every keystroke, send it back to the mother ship

- your keystrokes contain valuable info: website login URLs, passwords, email messages
- save all of your input: send it to the bad guys
- circumvents encryption protections: your keystrokes are in the clear
- other data logging: clipboard logging, screen logging, instant messaging, search engine queries

- nasty malware: your data is unavailable until you provide cash
- malware encrypts your data files: pictures, documents, music, movies, etc, your OS remains available, they want you running but not working
- you must pay the bad guys to obtain the decryption key: untraceable payment system, an unfortunate use of public-key cryptography

- some cryptocurrency mining requires "proof of work": usually consists of a difficult math problem, answer the problem and earn some currency
- this requires extensive CPU processing: one CPU isn't enough, attackers want to use your CPU
- may appear in different ways: visit a website and CPU utilization spikes, malware is installed and mining is always occuring
- only way to resolve is to remove cryptomining software

- very powerful
- very dangerous: last resort
- complete control: fix your problems before system starts, remove malicious software
- requires additional info: use, copy, rename, or replace OS files and folders, enable or disable service or device startup, repair the file system boot sector or the master boot record(MBR)

- all Windows versions: hold shift key while clicking restart or boot from installation media
- Windows 10: Settings >> Update and Security >> Recovery >> Advanced Startup
- Windows 11: Settings >> Recovery >> Advanced Startup >> restart now
- after rebooting: Troubleshoot >> Advanced Options >> Command Prompt

- need both: often included together
- real-time options: not just an on-demand scan
- modern anti-malware recognizes malicious activity: doesn't require a specific set of signatures

- monitor the local computer: alert on unknown or unauthorized network communication
- prevent malware communication: downloads after infection, botnet communication
- use Microsoft Defender Firewall: at a minimum
- runs by default: constantly monitoring, any network connection

- no single technology can stop social engineering: don't give away private info, the user is the best anti-phishing
- extensive training: avoid becoming a victim
- test the users: send a phishing email, find out who clicks and gives up information
- train again

- one on one: personal training
- posters and signs: high visibility
- message board posting: the real kind
- login message: these become invisible
- intranet page: always available

- only one way to guarantee malware removal: delete everything, install from scratch
- restore from backup(fast): as long as the backup is not also infected
- manual installation(slowest): backup data files, install Windows from installation media
- image the system(fastest): user's data files are on a network share, recover from a prebuilt image