Security+

Something will eventually happen, we cant expect 100% uptime. There are different modes and strategies for deciding what to do with data when something breaks.

-Fail-closed mode
-Fail-open mode
-Active Device
-Passive Device

When system fails, data does not flow (All traffic, legitimate and illegitimate stops) Security Guard (IPS) is gone and door is closed

When system fails, data continues to flow (All traffic) Securirty guard ( IPS) is gone but door is open

A monitoring device placed INLINE , it analyzes traffic in real time and can immediately block,drop or reject it ( Example: IPS, Firewalls, Web Firewalls)

A monitoring device placed OUT OF BAND. The real traffic does not pass through and it receives a copy instead to analyze and create alerts. It cannot directly stop the pakcet.

A device that sits INLINE of the network meaning all traffic must go through it. Usually implemented for IPS to PREVENT any threats

A device that does NOT sit inline instead it sits OUT OF BAND and it simply monitors the traffic flowing through the network and analyzes it as it continues to pass by receivign a copy thanks to a TAP implemented in IDS to DETECT any threats

A protocol that allows a monitoring system to collect statistics about a network device by creating a poll

Instead of the SNMP requesting information ( a poll ) the monitored device can send an ALERT on its own. In this case the monitor devices are sending SNMP TRAPS over udp/162

Polling occurs when a request is made for a network device to send its statistics. These are done over UDP/161

EAP is a framework to design an authentication process of a wireless network, it can be done it done in many different ways.

An authentication server following a AAA framework ( Authentication, Authorization, Accounting ) RADIUS is what verifies an authentication attempt via for example Active Directory or via itself. It verifies the authentication

LDAP is what creates queries to something like Active Directory, it can read the AD as well as write to it a Radius Server would make use of LDPA to verify an Authentication by using AD

A wireless security standard to protect authentifcation and encrypt wireless data. It provides to versions WPA3 Personal where it uses a pre shared key (typical wifi setup) and WPA3 Enterprise where everyone logs in with their own credentials ( company login portal ).

A firewall installed in the client itself, it is able to inspeact all incoming and outgoing traffic on a per application basis

Sits inline of the network but it is on in the client. It mainly just reads IPs, Protocols and Ports through its packets

Technique that can help enforce compliance with security standards and policies on a system or network by using a list of approved applciations that are allowed to run and blocking all other applications

A specialized group dedicated to perfom an expert analysis and recommendations on a specific thing. It can temporal

These are the big guys, focused and dedicated to making the financial and strategic decisions.

A group of people with some specific knowledge that they can advise with for decisions

These are the ones in the day to day operations implementing any decisions being made, the IT managers

An electronic sygnature that uses a form of encryption ( Private key & Public Key) to verify the source of data and also verify it was not changed

When you run a hash over and over from a single password so that it takes multiple time and power and verifying

Hashing is when you simply turn a password into a fixed string of text , it cannot be reversed

Tricking people into malicious links via SMS texts

Tricking people into malicious links via email

Tricking people into malicious links via voice calls or voice messages

This is just giving wrong information to confuse or trick. Lying

This is an all-in-one security network device it will have everything, antivirus, spam filtering, vpn, ids/ips, firewall etc.

An IPS sits on the network and actively monitors all traffic it is able to prevent any threats from continuing in traffic and block them.

An IDS sits out of band of the network and monitors the traffic passively. It is able to detect any threats but not block them

A VPN Gateway allows for all data to be encrypted when being in traffic so that it is private as well as traveling through through a secure channel

A traditional firewall is able to monitor and prevent traiffc based on the protocol and the port its coming from or coming out of.

A next generation firewall has the same abilities as a regular firewall but has much more extened capabilities like having an IPS, a VPN and others

They decide what to do with the data and how to do it. How or Why will it be collected stored or shared

Acts in behalf of the controller, they process the data as in storing, it calculating it, transmistting it

Accountable for the data, they decide how important it is, its classification its access requiements etc.

They work directly with the data they implement its protections, privacy and access rights

Breaking one large application into several smaller independent services. If one fails it wont affect the others

How easy is to get something started up, if there are a lot of steps and they are all manual it can be really slow and even prone to errors. Better to implement automation, orchestration and containers to simplify the process

How fast we can recover after a disruption, There are many ways to do things but its better to do what works the quickest, reinstalling an entire OS could be really slow as opposed to just doing an imaging.

An attack where you are redirected from a legit webiste to a fake one to steal your info.

Listing all the components of an asset ( A computer: CPU, RAM, Storage Type, Size, OS, etc)

A process to modify or thoroughly remove data so that is is irrecoverable

Associating an asset with a person/location/department etc

It outlines what responsibilities each party has

Gathering information without directly interacting with the target

Gathering information by directly interacting with the target

Blockchain is a distributed ledger where transactions are recorded in cryptographically linked blocks and replicated across multiple participants.

An electronic signature that uses a type of encryption to ensure authencity and integry of a digital message or document

A network tool that provides visibility into network traffic and helps identify security threats

An attacker spoofs their IP address to make it seem like it came from the victim's IP and performs a request to a third party server and the response gets sent to the victim due to the spoofing

this refers to when an attacker makes a small request to a server that it then causes a much larger response. If that large response is redirected to the victim through reflection for example then it can overwhelm the bandwidth or resources

An attack on wi-fi or radio communication, it can be different techniques deauthentication: sending forged management frames that repeatedly disconnect users from a wireless accesspoint. RF jamming. Interfering radio signals so legitimate wireless devices cannot communicate

Unathorized copying or transfer of data out of an organization's system

Access is granted or denied after considering multiple attributes/factors such as location, time, device, department etc. It is a more flexible access control.

People only have access to information that has a security label that matches their clearance level. It is strictly enforced. Someone from a different level may not be able to access information with another security label

A trusted entity that issues and manage security credentials for public keys and message encryption

They process the request for digital certificates through an aunthetication of the users but they do not hand out the actual certificates

A source that can always be trusted, the foundation of a cryptographic system, it can be a piece of hardware or software

This is an old WIFI standard which had the goal of having the same amount of privacy as a private wired network, however it used a flawed encryption algorithm that made it vulnerable

This is the newer WIFI standard implementation after WEP it utilized TKIP but because of this it was still very flawed and vulnerable making it obsolote.

This is an encryption algorithm that used temporal keys as well. It is implemented in WPA but it still relies on RC4 encryption which continues to make it vulnerable

this is the newest encryption method that has been implemented in the newest WIFI standards such as WPA2 and WPA3 this method is the current most secure as it uses modern encryption method

This is a vulnerability in which a process may not properly be releasing RAM and instead keeps consuming and consuing memory.

This refers to when an attacker puts malicious code in memory that is being run from an active legitmitiate process

A race condition vulnerability refers to when to when two proccess change the same thing nearly at the same time which can lead to some errors and incorrect values

A time of use vulnerability refers to when the attacker has opportunity to attack/manipulate before the resource is used again by an application

A policy that is a set of list of approved email domains to receive from, helps avoid spoofing.

This handles creating a digital signature for all emails being sent and verifying any received.

This is what decides what to do after an email has been rejected either to make a report, send it to spam or block it.

This is the email sever that handles all the traffic

A model distributed into layers that demonstrates how data is transferred in the network between two devices. It has seven layers

This layer handles how data is transmitted physically into devices, through ethernet cables, radio frequency, fiber optics, repeaters, etc.

This handles the communication with devices in the network, it manages MAC Addresses VLANS, switches, frames.

This layer handles IP Addresses and routing it to determine where to send the packets

This layer handles the way data is transported, wether via UDP or TCP through which ports etc. It gives commnuication between applications

This establishes mantains and ends a communication session with other systems

This handles how the data is presented so both systems can be able to understand it wether is decrypting an ecrypted data, or decompressing from compression, character ecoding, data formats etc.

This handles the network service that the appications are using. HTTP/HTTPS Websites, DNS - Domain names into IPs, SMTP, sending emails, FTP/SFTP Transfering files, SNMP monitor network devices.

Refers to the average period of time between any failures

Refers to the maximum amount of data tolerated to be lost and it is measured in time. This helps determine how recent a backup must be to recover to it with data that we are comfortable with going back to instead of loosing more than we wanted.

This refers to the time target the company has to be able to get back up and running and avoid any undesired downtime

A packet filtering firewall looks at each header from a incoming or outgoing packet against a set of rules set by the network administrator. The roles usually revolve around source/destination, IP Addresses, port numbers, protocols

They monitor and mantain the context of active connections to make decisions about which packets to allow through

A network security device that acts as an intermediary between internal users and external networs, filtering and inspecting traffic at the application layer. Instead of the user connecting to the server they connect to the proxy and the proxy communicates with the server

A centralized system to manage all access rules and policies, Active Directory for example.

Access is depending on the roles, this also means everyone in onoe role get the same amount of access. For example everyone in the accounting department get the same type of access

One organization trusts another organization to authenticate the user. A federation often provides single sign-on where once you log in you can access company B's application

Allowing someone or an application to perform specific actions on the behalf of another user. They do not receive a password or full account access

A protocol that serves as a framework and allows to be highly flexible and customizable to authenthicate

A software controls the communication between different WAN devices and makes the decision of sending the traffic through the best paths available

This is a layer 3 protocol to send diagnostics and statuts about network devices

Sets the rules and guidelines of appropiate use of organization's IT resources

The acceptable level of risk exposure to tolerate for a company

The amount of loss if a vulnerability is exploited.

The attitude a company has to tolerating risk, either theyre more conservative ( as in more protective ) or more neutral ( as in they can be a bit more chill ) is just a way to describe it

Patching (putting a band-aid) on something may push the issue down the road for later, but it can be worse later, how much debt can you tolerate

A person who hacks to push their phylosophy, political ideas, beliefs, revenges, etc.

Hackers motivated by money, Very organized attacks usually, large too not just one person.

A person with internal access who may harm the organization through intentional, negligent, or compromised actions.

Using IT systems within an organization without approval or knowledoe of the IT department.

Ethical hackers, who attempt to hack to exploit vulnerabilities and help the organization detect them and fix them

Attackers who work for national govenment and intend to attack other governments and steal information or disrupt or anything.

Overwriting data in a manner that ensures it is permanently removed and unrecoverable.

Completely blind no information about the target

Complete information about everything in the enviroment

Partial information about the enviroment

A statement of work defines all the work, tasks, timeline and costs of everything that has been to be completed in a project.

Outlines an agreement and understanding of collaboration between parties doesn't outline any tasks

A SLA define the level of service that is expected from the vendor.

A comprehensive contract that sets forth the general terms and conditions that will governm multiple future engagements between the parties.

Captures of the state of a system at a particular instant without copying the entire data, enabling quick recovery points

A symmetric encryption method that processes data bit by bit or byte by byte making it ideal for real-time communication.

A widely used encryption algorithm that secures data by converting into an unreadable format without the proper key. 256 stands for the key lenght of bits

Symmetric encryption algorithm that processes fixed-size blocks of plaintext into cipher text blocks of the same size using a secret key. Security depends on key length block size affects efficiency and resistance