Cybersecurity Fundamentals
Security Terms
Basic Concepts of
Network Security
Types of Security Controls
Administrative Access Control
Physical Access Controls
Technical Access Controls
Common Information Security Attacks
Directory Travesal
SQL Injection Attack
Cookies/Session Poisoning Attacks
What is a cookie?
Cookies/Session Poisoning Attacks
(Cont)
Cross-site Scripting (XSS) Attacks
• Cross-site scripting (‘XSS’ or ‘CSS’) attacks exploit vulnerabilities in dynamically
generated Web pages, which enables malicious attackers to inject client-site script into
web pages viewed by other users.
• It occurs when invalidated input data is included in dynamic content that is sent to a
user’s web browser for rendering.
• Attackers inject malicious JavaScript, VBScript, ActiveX, HTML, or Flash for execution on
a victim’s system by hiding it within legitimate requests.
• The malicious script can access any cookies, session tokens, or other sensitive
information retained by the browser and used with that site. These scripts can even
rewrite the content of the HTML page
Cross-site Scripting Attack Scenarior:
XSS Attack in Comment Field
XSS - Cross Site Scripting Explained
Cross-site Request Forgery (CSRF) Attack
• Cross-site Request Forgery (CSRF) attacks exploit web
page vulnerabilities that allow an attacker to force an
unsuspecting user's browser to send malicious requests
they did not intent.
• This victim user holds an active session with a trusted
site and simultaneously visits a malicious site, which
insject an HTTP request for the trusted site into the
victim user's session, compromising its integrity.
Cross-site Request Forgery (CSRF) Attack
(Cont)
Cross Site Request Forgery (CSRF or XSRF) Explained
Denial-Of-Service (DoS) Attack
Distributed
Denial-of-Service Attack (DDoS)
Social Engineering Attacks
Password Attacks
Network Sniffing
Man-in-the-Middle Attacks
Privilege Escalation
DNS Poisoning
DNS Cache Poisoning
ARP Poisoning
DHCP Starvation Attacks
DHCP Spoofing Attacks
MAC Spoofing/Duplicating
Malware
Writing a Simple Virus Program
Computer Worm
How Attackers Deploy a Trojan
How Attackers Using Trojans
Botnet Trojans
Remote Access Trojans
Proxy Server Trojans
Covert Channel Trojans
Data Hiding Trojans (Encrypted Trojans)
Buffer Overflow Attacks
Buffer Overflow Attacks
(Cont)
Security Policy Overview
Security Policy
Security Policy Audience
Security Policy Hierarchy
Governing Policy
A governing policy includes:
•
•
•
•
•
Statement of the issue that the policy addresses
How the policy applies in the environment
Roles and responsibilities of those affected by the policy
Actions, activities, and processes that are allowed (and not allowed)
Consequences of noncompliance
Technical Policies
Technical components:
•
•
•
•
•
•
General policies
Telephony policy
Email and communication policy
Remote access policy
Network policy
Application policy
End User Polices
Security Policy Documents
Policy, Standards, Procedures
Security Awareness Program
Thank you.