Cyber Security Test 1

the thing that should be protected

Anything that could exploit a vulnerability, which could affect the confidentiality, integrity or availability of your systems, data, people and more.

Hackers (black hat, gray hat?)
Have technical skills to exploit a vulnerability in the system
○ Black hat - unethical hackers with malicious intent; self-serving reasons (money, revenge, spread havoc, etc.)
○ White hat - use skills lawfully to help identify weaknesses in an organization's security (hired/have permission);
"ethical hackers" (help organization develop strong security)
○ Gray hat - look for vulnerabilities without the owner's permission. Usually reports findings to the owner, sometimes
requesting a fee. Don't cause harm. (curiosity, passion, desire to improve security, or financial gain)
● Script Kiddies ("skiddie")
○ Lacks programming knowledge and uses existing software (scripts) to hack systems
○ Often motivated by fun or financial gain
○ Can cause damage despite lack of experience.
● Hacktivist ('Hack' + 'Activism')
○ Motivation is to communicate a politically or socially motivated message
○ Similar skills to a hacker, but attacks bring attention to a cause rather than to damage
Different attackers have different motivations and skills.
Who is the Enemy (Threat Actors)?
● Nation States
○ Hacking through a corporation or government sponsorship (e.g., national governments)
○ Political or economic motivation; put the nation in a better position by causing damages to enemies.
○ Unlimited resources and sophisticated technologies
● Organized Crime
○ Professional criminals
○ Motivated by money
○ Extensive resources and sophisticated technologies
● Insiders
○ Legitimate users who purposefully or accidentally misuse their access to cause an incident.
● Competitors
○ Companies in the same industry that want to damage your company (many different intents)

a weakness that can be exploited by cybercriminals to gain unauthorized access to a computer system. these things enable a variety of attacks.

refers to any type of safeguard or countermeasure used to avoid, detect, counteract or minimize security risks to physical property, information, computer systems or other assets.

an attempt to steal data or cause harm to a computer, network or device.

the sum of vulnerabilities, pathways, or methods—sometimes called attack vectors—that hackers can use to gain unauthorized access to the network or sensitive data, or to carry out a cyberattack.

occurs when unauthorized individuals gain access to confidential information.

An effect of uncertainty on or within information and technology.

minimizing risk

confidentiality, integrity, avalibility

the avoidance of the unauthorized disclosure of information. That is, ____________ involves
the protection of data, providing access for those who are allowed to see it
while disallowing others from learning anything about its content.

threats/attacks
interception (c intercepts info between a and b)
threat of disclosure - unauthorized access to data
● Packet sniffing - monitor network traffic by examining streams of data
packets (Interception)
● Man-in-the-middle - attacker intercepts and distributes messages
between two participants who think they are interacting directly and
securely. (Interception, modification?)

security measures
Encryption: the transformation of information using a secret, called
an encryption key, so that the transformed information can only be
read using another secret, called the decryption key (which may, in
some cases, be the same as the encryption key). To be secure, an
encryption scheme should make it extremely difficult for someone to
determine the original information without use of the decryption key.


Access control: rules and policies that limit access to confidential
information to those people and/or systems with a “need to know.”
This need to know may be determined by identity, such as a person’s
name or a computer’s serial number, or by a role that a person has,
such as being a manager or a computer security specialist.


Authentication: the determination of the identity or role that some-
one has. This determination can be done in a number of different
ways, but it is usually based on a combination of something the
person has (like a smart card or a radio key fob storing secret keys),
something the person knows (like a password), and something the
person is (like a human with a fingerprint). The concept of authenti-
cation is schematically illustrated in Figure 2.


Authorization: the determination if a person or system is allowed
access to resources, based on an access control policy. Such authoriza-
tions should prevent an attacker from tricking the system into letting
him have access to protected resources.

the property that information has not be altered in an unauthorized way.

threats/attacks
● Fabrication/Modification
○ Threat of Deception - acceptance of false data (e.g., masquerading) (threatens integrity)
○ Threat of Usurpation - unauthorized control of resources (threatens integrity)
Code injection (SQL) - submitting malicious SQL statement via a fillable
field in a database query form (Fabrication)
Code injection (XXS) - inject malicious executable scripts into the code
of a trusted application or website. (Modification)
Man-in-the-middle - attacker intercepts and distributes messages
between two participants who think they are interacting directly and
securely. (Interception, modification?)

security measures
Backups: the periodic archiving of data. This archiving is done
so that data files can be restored should they ever be altered in an
unauthorized or unintended way.


Checksums: the computation of a function that maps the contents of a
file to a numerical value. A checksum function depends on the entire
contents of a file and is designed in a way that even a small change
to the input file (such as flipping a single bit) is highly likely to result
in a different output value. Checksums are like trip-wires—they are
used to detect when a breach to data integrity has occurred.


Data correcting codes: methods for storing data in such a way that
small changes can be easily detected and automatically corrected.
These codes are typically applied to small units of storage (e.g., at the
byte level or memory word level), but there are also data-correcting
codes that can be applied to entire files as well.

the property that information is accessible and modifiable in a timely fashion by those authorized to do so.

threats/attacks
● Interruption
○ Threat of Disruption - interruption or prevention of correct operation (threatens availability)
● Ransomware - malware that encrypts your data/computer until you pay
for the key (Interruption)

security measures
Physical protections: infrastructure meant to keep information avail-
able even in the event of physical challenges. Such protections can
include buildings housing critical computer systems to be constructed
to withstand storms, earthquakes, and bomb blasts, and outfitted
with generators and other electronic equipment to be able to cope
with power outages and surges.


Computational redundancies: computers and storage devices that
serve as fallbacks in the case of failures. For example, redundant
arrays of inexpensive disks (RAID) use storage redundancies to keep
data available to their clients. Also, web servers are often organized
in multiples called “farms” so that the failure of any single computer
can be dealt with without degrading the availability of the web site.

unauthorized access to data (threatens confidentiality)

interruption or prevention of correct operation (threatens availability)

○ Threat of Deception - acceptance of false data (e.g., masquerading) (threatens integrity)
○ Threat of Usurpation - unauthorized control of resources (threatens integrity)

○ Threat of Deception - acceptance of false data (e.g., masquerading) (threatens integrity)
○ Threat of Usurpation - unauthorized control of resources (threatens integrity)

Have technical skills to exploit a vulnerability in the system
use skills lawfully to help identify weaknesses in an organization's security (hired/have permission);
"ethical hackers" (help organization develop strong security)

Have technical skills to exploit a vulnerability in the system
look for vulnerabilities without the owner's permission. Usually reports findings to the owner, sometimes
requesting a fee. Don't cause harm. (curiosity, passion, desire to improve security, or financial gain)

Have technical skills to exploit a vulnerability in the system
unethical hackers with malicious intent; self-serving reasons (money, revenge, spread havoc, etc.)

○ Lacks programming knowledge and uses existing software (scripts) to hack systems
○ Often motivated by fun or financial gain
○ Can cause damage despite lack of experience.

○ Motivation is to communicate a politically or socially motivated message
○ Similar skills to a hacker, but attacks bring attention to a cause rather than to damage

○ Hacking through a corporation or government sponsorship (e.g., national governments)
○ Political or economic motivation; put the nation in a better position by causing damages to enemies.
○ Unlimited resources and sophisticated technologies

○ Professional criminals
○ Motivated by money
○ Extensive resources and sophisticated technologies

○ Legitimate users who purposefully or accidentally misuse their access to cause an incident.

○ Companies in the same industry that want to damage your company (many different intents)

security principle
A simpler design is
easier to test and validate.
● Make it as simple as possible to get the
job done (K.I.S.S.)
● Likelihood of a vulnerabilities increases
with the complexity of the software,
architectural design, and code.

security principle
Failure is unavoidable and should be planned for. System should fail
securely.
● Access control - unless a subject is given explicit access to an object, access should
be denied (default: deny access)

security principle
Every access to an object
should be validated to ensure that it is allowed.
● Restricts caching of information - be careful
of techniques that save the results of
previous authorization checks, since
permissions can change over time.
● Ex. An online banking web site that requires
users to sign-in again after an elapsed time

security principle
The security of a mechanism should not
depend on the secrecy of its design or implementation.
● Opposite of security through obscurity (tries to
achieve security by keeping things secret/hiding)
● Allows a system to be analyzed by others for
vulnerabilities and bugs
● Ex. Cryptography
○ If the details of a secret algorithm leak, then it is a
catastrophic failure for all the users at once.
○ If the secrets are abstracted from a mechanism
(e.g., a key) then leakage of a key affects only one
user.

security principle
● Reliance on Multiple Factor in a Security Decision
- A system should grant access permission based
on more than one condition being satisfied.
○ Ex. Two factor authentication - use multiple
factors, such as a password and fingerprint
scan
○ Ex. Dual keys used for crypto key controls or
safety deposit boxes
● Compartmentalization - separate the components
of a system in order to minimize the amount of
damage that can be caused by a breach

security principle
Every program and user
should operate with as few privileges as
possible.
● Subjects should be given only those
privileges necessary to complete their
tasks (Need-to-Know principle).
Additional rights given as needed and
removed after use.
● Limits damage in case of exploited
vulnerability
● Ex. running as administrator or root

security principle
Mechanisms allowing
resources to be shared should be minimized
(multi-user environment).
● Information can flow along shared channels and
unintentionally compromise security
● Ex. same login page for employees and
customers to login to company portal.
● Ex. covert channels might arise when separate
processes share CPU, RAM, or I/O resources
● Ex. Be careful with shared code (e.g., libraries)

security principle
User interfaces
should be easy to use, so that users apply the
protection mechanisms correctly.
● If software security is difficult or inconvenient to
use, non-malicious user may disableypass the
mechanism or setup the software in an insecure
manner (intentional or unintentional)
● Ex. Users don't read dialog boxes (don't offer
complex choices; make default secure)

security principle (not part of OG 8)
Compare the cost of circumventing
the mechanism with the resources of a potential
attacker; make cost to perpetrator sufficiently high to
deter most intruders

surface web (small % of the internet), deep web (most of the internet), dark web
(Tor browser)

asserting who a person (or subject) is
○ State your identity
○ Generally public (username, process ID, smart card).
○ Easy for someone to say they are you.

proving the asserted identity
○ Prove "who you are"
○ Private. Must be reliable to prove who you say you are (how?).

process of determining access rights/privileges to resources for the authenticated
user (often what's referred to as "access control").
○ Once authenticated, determining "what you can do".
○ Permissions given based on policies/models.
○ Permissions stored in the system for authorization.

principles of least privilege - A subject should be given only those privileges needed to complete its task.

fail-safe defaults - Unless a subject is given explicit access to an object, access should be denied (default: deny access); system should fail securely.

complete mediation - Every access to an object should be checked to ensure that it is allowed.

separation of privilege - Reliance on multiple factors in a security decision - A system should grant access based on more thanone condition being satisfied.

psychological acceptability - Accessibility to resources should not be inhibited by security mechanisms

work factor - Compare the cost of circumventing the mechanism with the resources of a potential attacker; make cost to perpetrator sufficiently high to deter most intruders

○ Something you know (knowledge)
○ Something you are (biometrics)
○ Something you have (ownership)

● Advantages
○ Ideal binding between subject and identity (nonrepudiation)
○ Always have it (can't be forgotten/lost)
○ More difficult to counterfeiteplicate
● Disadvantage
○ Replacement of biometric features difficult once compromised (not revocable)
○ Require integration and/or additional hardware (can be costly)
○ Environmentsage can affect measurements - not 100% accurate (false positives/false negatives)
○ Worrisome privacy concerns

biological properties that are based on unique physical or
behavioral characteristics of the human body.

● False positive (false accept) - incorrectly confirming an identity (reading is
accepted when it should be rejected)
● False negative (false reject) - incorrectly denying an identity (reading is
rejected when it should be accepted)

false negative would be better. better to be safe than sorry (fail-safe default)

Enrollment (populating the
database) - subject's features
are scanned, analyzed, and
stored in a coded form on a
secure database.
Verification (comparing a test
image to stored data) -
subject's features are scanned,
analyzed, coded, and compared
to what's stored in the database
to determine if access is
granted.
Features are stored rather than original biometric. Not an exact match - threshold.

● Universal - almost every person should have this characteristic
○ Good example: fingerprints
○ Bad example: a birthmark
● Unique/Distinctive - each person should have noticeable differences in
the characteristic
○ Good example: Retinal images
○ Bad example: Presence/absence of tonsils
● Permanent - characteristic should not change significantly over time
○ Good example: DNA
○ Bad example: Hair color
● Collectable (measurable) - characteristic should have the ability to be
effectively determined and quantified

■ Presentation attacks (attack the sensor) - Fake biometric sample presented to sensor (e.g., fake face masks, silicon fingerprint, etc).
Spoofing - situation in which a person/program successfully identifies as another by falsifying data
countermeasure:
liveness detection - recognizing signs of life inherent to the biometric property (passsive)
challenge-response - system issues a challenge, and user must respond appropriately. Used to confirm the presence of a person by getting some form of direct response from the individual. (active)
■ Replay attack - Biometric data captured by device is intercepted and replayed
countermeasure:
challenge-response, encryption
■ Template tampering attack - The templates stored in the database can be replaced, stolen, or altered.
(same problems as other databases)

● Passwords not stored as plaintext (or
shouldn't be)
● One-way hash of password is stored
● Hash of password query must match stored
hash exactly.
● Biometric-based authentication system relies
on the similarity between two biometric
samples (query will not exactly match the
stored template - "close" is good enough). →
traditional cryptographic one-way hash won't
work.

Current research area for securing biometric templates
○ Original biometric not stored → transformed using a one way function (several one-way
functions are available)
○ Compromised biometric can be re-enrolled using another transformation (provides revocability)
○ Computationally difficult to recover the original biometric from a transformed one → preserve
privacy.
○ Does not degrade the accuracy of a matching algorithm as the statistical characteristics of
features are approximately maintained after transformation

Advantages
● Cloning and replication usually difficult
● Easily handled
● Easily replaced
Disadvantages
● Lost and theft of device problematic - could
result in unauthorized access
● Often need for special hardware

● Subject confirms identity by ownership
● Examples: key, access card, badge, token
(one time password that expires quickly)

○ Attacks often dependent on the type of token
■ Ex. Sim Card
To connect to a network, phone must verify itself as a paid subscriber by authenticating itself with the network's database.
1. IMSI from SIM card relayed to the network ("request for access").
2. Network looks in database for IMSI's authentication key.
3. Network generates a random number, RAND, and signs it with the authentication key to create a new number,
SRES. Expects SIM card to create same number (the challenge)
4, 5. SIM receives RAND from the network, and signs it with its own authentication key to create its own SREStest
. This
number is relayed back to the network. (the response)
6. If network's SRES matches the SIM card's SREStes, the SIM card is declared legitimate and access is granted.
Secure communication continues with the session key, Kc.
SIM Card Swapping
● Trickery and human engineering rather than technical vulnerabilities (social engineering).
● Attacker calls your phone provider pretending to be you and asks to transfer account to a
new SIM card in attacker's possession (e.g., upgrading to a new device; lost phone).
○ Recent data breaches expose customer information that could make this attack easier
● Provider moves account info to new SIM (still your phone number).
○ Your real SIM card will be deactivated and stop working.
○ Impact? Consider MFA with SMS messaging (text messages)
Try to use non-SMS multi-factor
authentication (why?) someone could hack your messages and authenticate whatever they want with your phone #


■ Ex. Web tokens
● Token based authentication is used extensively on the web
Authentication without tokens (session-based with cookies):
● Applications remember a user by storing the user's logged-in information on the server.
● Two of the problems:
○ Sessions: Every time user is
authenticated, server
creates/stores a record (typically in
memory) → with many users,
server overhead increases
○ Scalability: Unable to add more
servers to handle application load
since the user is logged into a
specific location

Advantages:
● Easy to create and administer
● Potentially strong
● Inexpensive
● Easy to use
Disadvantages:
● Human Deficiencies:
○ Weak passwords
○ Password reuse
○ May tell others
● Password guessing (online) or cracking (offline)
○ Dictionary and brute force attacks
● Password snooping
○ Eavesdropping on network traffic
○ Retrieval of passwords from hosts (e.g., malware)

many security questions can be determined fairly easily
○ Ex. Mother's maiden name, your high school, what city you were born in, first car,
etc.
trace patterns- Easy to steal via shoulder surfing (easier than a pin)

Hashing is almost always preferable to encryption when storing passwords inside databases because in the event of a compromise attackers won’t get access to the plaintext passwords and there’s no reason for the website to ever know the user’s plaintext password.

the same input always produces the same output

should be very difficult ("impossible") to regenerate the original
message from its hash value (one-way)
○ Output does not reveal information about the input. Even minor changes to input should
produce significant changes in output (Avalanche Effect)

should be very unlikely that two inputs produce the same hash (i.e.,
each message has its own hash).
though the number of possible passwords that can be hashed is infinite. What this means is that infinitely many different passwords have the same hash.
a collision happens when different data inputs result in the same hash after being processed by a hashing mechanism.
frequent collision can degrade performance

Bcrypt, blowfish, pbkdf2, Argon2

On a computing system, guessing passwords takes time, and herein lies the advantage of a slow (i.e. computationally more complex) hash function. The longer a hash function takes to calculate, the more time it will take to successfully guess (crack) a password.

SHA512 and SHA 3 are fast

● Hashed passwords subject to brute force types of attacks.
● Add salt to slow down or thwart these attacks.
○ Salting: add random data to the input of a hash function → guarantees unique hash
● Example: $hashed_pw = hash($salt + $password)