csds 344 midterm 2

- The purpose of an automated scanner is to simulate attacks, quickly recognize vulnerabilities, and automate routine security checks.
- It is different from manual pen testing because with manual pen testing, it needs to be done by a human. Manual pen testing is a real attack, is slower, and is a deeper assessment.

A process of identifying, analyzing, and reporting security vulnerabilities in a program

Scoping, Recon, Discovery, Exploitation, Reporting

Gather information -- get info from websites about organization, look at job listing to understand technology used, visiting applications and company website, checking employees on LinkedIn

Use tools like nmap to discover hosts on a network, determine open ports and services, look at any vulnerabilities discovered through vulnerability scanning tool

Attempt to exploit any found vulnerabilities -- Could be authentication bypass, SQL injection, etc. DON'T DO IN PRODUCTION. DON'T DO WITHOUT PERMISSION.

Must document EXACTLY the vulnerability found and how you exploited it. Must describe how to fix the vulnerability either through a code change, patch, update of software, etc. -- Often the most ignored step, but MOST IMPORTANT. This is what the client essentially pays you to do.

System stability, time and resources, exploitation may not be legal

Yes

Authenticated scans- you scan from the inside

The cloud introduces challenges like
- misconfigurations
- limited visibility
- shared responsibility confusion
- rapid deployment risks
- multi-tenancy
- vendor lock-in
- regulatory compliance issues.

- The National Vulnerability Database (NVD) is a U.S. government repository of publicly known cybersecurity vulnerabilities.
- It provides detailed information, including:
-- severity scores (CVSS)
-- affected products
-- links to patches or mitigation steps.
- Maintained by NIST, it supports vulnerability management and security automation.

Network, Application, Physical, Social Engineering

Focus is on vulnerabilities within the network. Discover devices on the network.

Targeting specific applications, include static and dynamic.
Static- Perform a source code analysis (SCA) of code, detect vulnerabilities in code
Dynamic- Perform a penetration test of an actively running application

Static- Perform a source code analysis (SCA) of code, detect vulnerabilities in code
Dynamic- Perform a penetration test of an actively running application

Testing the physical security of a location, e.g. follow someone through a door

Phishing, leaving a USB drive, asking someone to do something

Pen tester has very little knowledge of system- Does not know server software, does not have credentials or access to source code

Has provided credentials, software versions. Might have source code and be able to run an analysis on it (SCA). Can confirm SCA finding with.

Somewhere between black box and white box

The people that are attempting to break into a network, exploit a vulnerability, etc.

The people attempting to defend a network, protect an application, etc.

- A buffer is read from or written to beyond the designated bounds.
- Modern languages protect against this, but C is a classic example where it is not.
- Can prevent by building security measures into code or using languages that have built-in protection.

Software that depends on timing or access to resources. Can prevent by avoiding shared states and ensuring that only one thread can access a resource at any given time.

- Modifying input where the attack is within the provided input.
- NEVER trust user input, NEVER use client side validation to establish trust.
- Validate inputs before storing them, but don't create your own method of validation.

Attacking the actual authentication mechanism. SQL Injection is one type of attack to bypass authentication. Others include attacking weak password policies, clear text passwords being stored, insecure password reset mechanisms, etc. Need to enforce best practices in cryptography. Implement password reset policies after several attempts, Implement user account being locked after several attempts, Email user when unrecognized device logs in or password failures, Implement a timeout or challenge on failed attempts.

- Attacker is attempting to bypass authorization mechanism.
- Access data that only users in certain roles should be able to access (RBAC).

- Bypass authorization check with direct URL.
- Bypass authorization check on the client side.

- Each time authorization is required, an authorization check should be done. Usually it is based on role, not on user.

- Developer does not implement cryptography correctly or implements their own cryptographic algorithm.
- Follow best practices for cryptography.

The client is the target. Cross Site Scripting (XSS), reflective and stored, and Cross Site Request Forgery (CSRF), submit a form on behalf of another user.

- The target is the actual server, but the attack can affect clients.
- common examples:
-- SQL Injection
-- Path Injection (accessing files that you should not have access to)
-- Accessing residual files
-- Arbitrary code execution (executing remote code on a system)
-- Privilege escalation (increasing your level of authorization)
--- SQL Injection can be used by bypassing authentication or authorization checks.

No, it is often insecure and has vulnerabilities.

True

False

True

- Not implementing access control correctly
- Directly referencing objects such as web pages or specific accounts.

- Best ways to prevent:
-- Perform authorization on each request
-- use a permit list and deny everyone else
-- log failures.

- Using weak algorithms such as MD5
- not using salt for hashing
- using insecure random number generators
- storing secrets in cleartext

Best ways to prevent:
- Keep up to date on best practices
- algorithms that are no longer secure
- don't roll your own encryption.

- Broad category that includes SQL injection and now XSS.
- User input is not validated or sanitized.
- Possible damage: Login as someone else, leak information, modify information, information loss.
- Best ways to prevent: Use frameworks or APIs to perform queries, look at best practices for sanitation.

- User supplied data contains SQL that then executes something that was not intended.
- Common vulnerability: "select user_id from users where username = '\$username' and password ='\$password'.
- SQL Injection is fairly easy to protect against:
-- Always, always, bind parameters in SQL
-- Do not perform String concatenation.

A01 - Broken Access Control
A02 - Cryptographic Failures
A03 - Injection (SQL, XSS)
A04 - Insecure Design
A05 - Security Misconfiguration

A06 - Vulnerable and Outdated Components
Using vulnerable software, frameworks, libraries
A07 - Identification and Authentication Failures
Weak passwords, default accounts, session ID in URL, sessions not validated
A08 - Software and Data Integrity Failures
Using software without validating signature, libraries from untrusted repositories
A09 - Security Logging and Monitoring Failures
Log events!
A10 - Server-Side Request Forgery (SSRF)
Requesting data from a provided source without validating it

User supplied data contains JavaScript that then executes in a browser. 2 main forms, stored (persisted) and reflective. Reflective is not as much of an issue, most browsers provide some level of protection. Possible damage: User visits website, JavaScript executes in browser and redirects user to another page, ask the userfor their credentials, defaces a web page, etc. Main way to protect: Check best practices in a particular language.

- Fairly broad category
- Sharing information about a system or application (information disclosure).
- Not authenticating at each endpoint or performing authorization.
- Not applying principle of least privilege or defense in depth.
- Not performing input validation.

Possible damage: depends on which component was insecure.

- Default accounts were not changed
- Disclosing stack traces
- Not hardening applications or operating systems
- Services are running that are not needed.

Best ways to prevent:
- Log but don't disclose any information that an attacker could use
- Disable services and features that are not needed
- Apply principle of least privilege
- Disable default error reporting in applications.

Combine two factors of the three: Something you know, Something you are, Something you have.

- Entity authenticates client, but client also authenticates entity.
- For example, accessing a web application (client verifies certificate, app verifies user).
- What can happen if the client does not authenticate the server?:
-- Transmit data to server impersonating real server
-- Connect to Wi-Fi that is not the real Wi-Fi network

These scenarios are known as man-in-the-middle (MITM) attack.

Authentication determines if some entity is who they say they are. Authorization determines whether or not the entity can perform an action.

Perform authentication using a different channel. For example, receiving a phone call or text.
What would be the changes needed to do the following:
Require a password to be 15 characters in length minimum
Require 1 digit, 1 upper case letter, 1 lower case letter
Ensure that users do not repeat the same character twice consecutively

password requisite pam_pwquality.so retry=3 dcredit=-1 ucredit=-1 lcredit=-1 minlen=15 maxrepeat=1

- Role-Based: Determine access based on the group or role that a user is in, User can exist in multiple roles
- Rule-Based: Set of rules determine access (e.g. IP range)
- Attribute-Based: What attributes or properties does the entity contain
- Discretionary: Resource owner determines who has access and what type of access
- Mandatory: Separate group determines who has access to resource (Government organizations utilize this mechanism.)

We can apply access control to the operating system using Access Control Lists to determine what type of access entities have.

Fingerprint: IP, Browser Type, Cookies, Extensions, etc. Private browsing is not truly private, it just doesn't save history.

Install ad-blocker, limit use of clickbait websites, use a search engine other than Google

Mobile apps can determine your exact location, what's in your contacts, and what's in your photos.

Can result in fine or loss of business. PCI-DSS non-compliance can lead to not being able to process cards.

An information security policy is a formal document that outlines an organization's rules, procedures, and guidelines for protecting data and IT systems. Each organization needs to have well defined policies that are easy for employees to find. Each policy should address a certain area of compliance and should have the date it was created, updated, and by whom.

Implemented to stay in compliance. Technical controls, Administrative controls, Physical controls.

Firewalls, OS Hardening, ACLs, IDS, etc.

Processes and procedures that are defined and documented including change control systems, ticketing systems, etc.

Badge access to rooms, fences or barriers, cameras and security guards, etc.

(Health Insurance Portability and Accountability Act)
If your company deals with insurance or healthcare data, HIPAA applies. Protected health information has specific requirements for storage and safeguarding. Also includes requirements for protecting data integrity and availability.

(Payment Card Industry Data Security Standard)
Rules created by issues: Visa, Mastercard, American Express. Security rules and guidelines that protect cardholder data and prevent fraud.

(Family Education Rights and Privacy Act)
Parents do not have rights to access student records, unless student explicitly gives permission

(General Data Protection Regulation)
- Consent required before collecting personal data
- Right to be forgotten
- Allows users to remove collected data and access collected data

Key Controls- Vital controls, it stands alone to mitigate risk
Compensating Controls- Controls in place when you are not in compliance, might be a bridge to get you to compliance