SYO-601: CompTIA Security+
Study Guide with Practice Questions & Labs
Third Edition
www.ipspecialist.net
1
Document Control
Proposal Name
:
CompTIA Security+
Document Edition
:
Third Edition
Document Release Date
:
27th September 2021
Reference
:
SYO-601
Copyright © 2021 IPSpecialist LTD.
Registered in England and Wales
Company Registration No: 10883539
Registration Office at: Office 32, 19-21 Crawford Street, London W1H 1PJ, United Kingdom
www.ipspecialist.net
All rights reserved. No part of this book may be reproduced or transmitted in any form or by any
means, electronic or mechanical, including photocopying, recording, or by any information
storage and retrieval system, without the written permission from IPSpecialist LTD, except for the
inclusion of brief quotations in a review.
Feedback:
If you have any comments regarding the quality of this book, or otherwise alter it to better suit
your needs, you can contact us through email at info@ipspecialist.net
Please make sure to include the book’s title and ISBN in your message.
2
About IPSpecialist
IPSPECIALIST LTD. IS COMMITTED TO EXCELLENCE AND DEDICATED TO YOUR
SUCCESS.
Our philosophy is to treat our customers like family. We want you to succeed, and we are
willing to do everything possible to help you make it happen. We have the proof to back
up our claims. We strive to accelerate billions of careers with great courses, accessibility,
and affordability. We believe that continuous learning and knowledge evolution are the
most important things to keep re-skilling and up-skilling the world.
Planning and creating a specific goal is where IPSpecialist helps. We can create a career
track that suits your visions as well as develop the competencies you need to become a
professional Network Engineer. We can also assist you with the execution and evaluation
of your proficiency level, based on the career track you choose, as they are customized to
fit your specific goals.
We help you STAND OUT from the crowd through our detailed IP training content
packages.
Course Features:
 Self-Paced Learning
 Learn at your own pace and in your own time
 Covers Complete Exam Blueprint
 Prep-up for the exam with confidence
 Case Study Based Learning
 Relate the content with real-life scenarios
 Subscriptions that Suits You
 Get more and pay less with IPS subscriptions
 Career Advisory Services
 Let the industry experts plan your career journey
 Virtual Labs to test your skills
 With IPS vRacks, you can evaluate your exam preparations
 Practice Questions
 Practice questions to measure your preparation standards
 On Request Digital Certification
 On request digital certification from IPSpecialist LTD.
3
About the Authors:
This book has been compiled with the help of multiple professional engineers who
specialize in different fields, e.g., Networking, Security, Cloud, Big Data, IoT, etc. Each
engineer develops content in his/her own specialized field, which is then compiled to form
a comprehensive certification guide.
About the Technical Reviewers:
Nouman Ahmed Khan
AWS-Architect, CCDE, CCIEX5 (R&S, SP, Security, DC, Wireless), CISSP, CISA, CISM,
Nouman Ahmed Khan is a Solution Architect working with a major telecommunication
provider in Qatar. He works with enterprises, mega-projects, and service providers to help
them select the best-fit technology solutions. He also works as a consultant to understand
customer business processes and helps select an appropriate technology strategy to
support business goals. He has more than fourteen years of experience working in
Pakistan/Middle-East & the UK. He holds a Bachelor of Engineering Degree from NED
University, Pakistan, and an M.Sc. in Computer Networks from the UK.
Abubakar Saeed
Abubakar Saeed has more than twenty-five years of experience managing, consulting,
designing, and implementing large-scale technology projects, extensive experience
heading ISP operations, solutions integration, heading Product Development, Pre-sales,
and Solution Design. Emphasizing adhering to Project timelines and delivering as per
customer expectations, he always leads the project in the right direction with his
innovative ideas and excellent management skills.
Dr. Fahad Abdali
Dr. Fahad Abdali is a seasoned leader with extensive experience managing and growing
software development teams in high-growth start-ups. He is a business entrepreneur with
more than 18 years of experience in management and marketing. He holds a Bachelor's
Degree from NED University of Engineering and Technology and a Doctor of Philosophy
(Ph.D.) from the University of Karachi.
Mehwish Jawed
Mehwish Jawed is working as a Senior Research Analyst. She holds a Master's and
Bachelors of Engineering degree in Telecommunication Engineering from NED University
of Engineering and Technology. She also worked under the supervision of HEC Approved
supervisor. She has more than three published papers, including both conference and
4
journal papers. She has a great knowledge of TWDM Passive Optical Network (PON). She
also worked as a Project Engineer, Robotic Trainer in a private institute and has research
skills in the field of communication networks. She has both technical knowledge and
industry-sounding information, which she utilizes effectively when needed. She also has
expertise in cloud platforms, as in AWS, GCP, Oracle, and Microsoft Azure.
Ayesha Sheikh
Ayesha Sheikh is a professional technical content writer. She holds a Bachelor’s Degree in
Computer Engineering from Sir Syed University of Engineering & Technology. She has
hands-on experience on SDN (Software Defined Network), Java, .NET development,
machine learning, PHP, Artificial Intelligence, Python, and other programming and
development platforms as well as Database Management Systems like SQL, Oracle, and so
on. She is an excellent research analyst and is capable of performing all her tasks in a fast
and efficient way.
5
Free Resources:
For Free Resources: Please visit our website and register to access your desired Resources
Or contact us at: info@ipspecialist.net
Career Report: This report is a step-by-step guide for a novice who wants to develop
his/her career in the field of computer networks. It answers the following queries:






What are the current scenarios and future prospects?
Is this industry moving towards saturation, or are new opportunities knocking at the
door?
What will the monetary benefits be?
Why get certified?
How to plan, and when will I complete the certifications if I start today?
Is there any career track that I can follow to accomplish the specialization level?
Furthermore, this guide provides a comprehensive career path towards being a specialist
in networking and highlights the tracks needed to obtain certification.
IPS Personalized Technical Support for Customers: Good customer service means
helping customers efficiently, in a friendly manner. It is essential to be able to handle issues
for customers and do your best to ensure they are satisfied. Providing good service is one
of the most important things that can set our business apart from the others of its kind.
Excellent customer service will result in attracting more customers and attain maximum
customer retention.
IPS offers personalized TECH support to its customers to provide better value for money.
If you have any queries related to technology and labs, you can simply ask our technical
team for assistance via Live Chat or Email.
6
Our Products
Study Guides
IPSpecialist Study Guides are the ideal guides to developing the hands-on skills necessary
to pass the exam. Our Study Guides cover the official exam blueprint and explain the
technology with real-life case study-based labs. The content covered in each Study Guide
consists of individually focused technology topics presented in an easy-to-follow, goaloriented, step-by-step approach. Every scenario features detailed breakdowns and
thorough verifications to help you completely understand the task and associated
technology.
We extensively used mind maps in our Study Guides to visually explain the technology.
Our Study Guides have become a widely used tool to learn and remember information
effectively.
vRacks
Our highly scalable and innovative virtualized lab platforms let you practice the
IPSpecialist Study Guide at your own time and your own place as per your convenience.
Exam Cram
Our Exam Crams notes are a concise bundling of condensed notes of the complete exam
blueprint. It is an ideal and handy document to help you remember the most important
technology concepts related to the certification exam.
Practice Questions
IP Specialists' Practice Questions are dedicatedly designed from a certification exam
perspective. The collection of these questions from our Study Guides is prepared keeping
the exam blueprint in mind, covering not only important but necessary topics as well. It is
an ideal document to practice and revise your certification.
7
Content at a glance
Chapter 01: Threats, Attacks, and Vulnerabilities ............................ 29
Chapter 02: Architecture and Design ............................................... 147
Chapter 03: Implementation ............................................................. 252
Chapter 04: Operations and Incident Response ............................. 344
Chapter 05: Governance, Risk, and Compliance ............................. 446
Answers .............................................................................................. 522
Acronyms ...........................................................................................536
References ......................................................................................... 548
About Our Products.......................................................................... 560
8
Table of Contents
Chapter 01: Threats, Attacks, and Vulnerabilities ............................ 29
Technology Brief................................................................................................................ 29
An Overview of Social Engineering Techniques .............................................................. 29
Spam ................................................................................................................................30
Credential Harvesting .................................................................................................... 33
Mind Map........................................................................................................................ 35
Malware Concepts .............................................................................................................. 35
Ransomware....................................................................................................................36
Trojan ..............................................................................................................................36
Command and Control...................................................................................................38
Lab 1-01: HTTP RAT Trojan ........................................................................................... 42
Cryptography Attacks ....................................................................................................... 56
Mind Map........................................................................................................................58
Web Application Attacks ...............................................................................................58
Privilege Escalation.........................................................................................................58
Injections........................................................................................................................ 60
Structured Query Language (SQL) ............................................................................... 60
Session Replay Attack .................................................................................................... 66
Resource Exhaustion ..................................................................................................... 66
Pass the Hash ................................................................................................................. 67
Mind Map....................................................................................................................... 67
Network Attacks ................................................................................................................ 67
Wireless Network Concepts.............................................................................................. 68
Evil Twin ........................................................................................................................ 69
Layer 2 attacks .................................................................................................................... 73
Address Resolution Protocol (ARP) Poisoning ............................................................. 73
Media Access Control (MAC) Flooding ......................................................................... 73
9
Domain Name System (DNS) ........................................................................................74
Domain hijacking ...............................................................................................................74
Distributed Denial-of-Service (DDoS) .......................................................................... 75
How Distributed Denial-of-Service Attacks Work ...................................................... 76
Operational Technology (OT) .......................................................................................... 76
Malicious Code or script execution ............................................................................... 77
Macros and Visual Basic for Application (VBA) .............................................................. 78
Mind Map....................................................................................................................... 78
Threat Actors ..................................................................................................................... 79
Insider Threat ................................................................................................................. 81
Hacktivists ...................................................................................................................... 81
Script Kiddies ................................................................................................................. 82
Hacker ............................................................................................................................ 82
Threat Actor Attributes ......................................................................................................83
Internal/External ............................................................................................................83
Level of Sophistication .................................................................................................. 84
Resources/Funding ........................................................................................................ 84
Intent/Motivation .......................................................................................................... 84
Vectors ............................................................................................................................... 84
Wireless.............................................................................................................................. 84
Email ...................................................................................................................................85
Social Media ....................................................................................................................85
Mind Map....................................................................................................................... 92
Vulnerability Assessment .................................................................................................. 92
Weak Configurations..................................................................................................... 94
Improper or Weak Patch Management............................................................................ 96
Operating System (OS) ................................................................................................. 96
Data Exfiltration ............................................................................................................ 99
Mind Map...................................................................................................................... 100
Threat Hunting ................................................................................................................. 100
10
Vulnerability Scanning ...................................................................................................... 101
Lab 1-01: Installing and Using Vulnerability Assessment Tool ........................................ 101
Web 2.0 ......................................................................................................................... 128
Web App Threats .......................................................................................................... 128
SIEM (Security Information and Event Management) ............................................... 130
Review Reports .............................................................................................................. 131
User Behavior Analysis .................................................................................................. 131
Log Aggregation.............................................................................................................132
Mind Map....................................................................................................................... 133
Penetration Testing ....................................................................................................... 133
Rules of Engagement .................................................................................................... 136
Lateral Movement .........................................................................................................137
Privilege Escalation........................................................................................................137
Persistence .....................................................................................................................137
Cleanup ......................................................................................................................... 138
Pivoting ......................................................................................................................... 138
Exercise Types ............................................................................................................... 140
White Team ................................................................................................................... 141
Purple Team ................................................................................................................... 141
Mind Map...................................................................................................................... 142
Practice Question ............................................................................................................. 143
Chapter 02: Architecture and Design ............................................... 147
Technology Brief............................................................................................................... 147
The Significance of Security Ideas in a Business Setting ................................................ 148
Security Overview ......................................................................................................... 148
Configuration Management ......................................................................................... 148
Internet Protocol Schema ............................................................................................ 149
Data Sovereignty .............................................................................................................. 150
Data Protection ................................................................................................................ 150
Data Loss Prevention .................................................................................................... 150
11
Masking ......................................................................................................................... 150
Encryption..................................................................................................................... 150
At Rest ........................................................................................................................... 150
In Transit/Motion .......................................................................................................... 151
In Processing .................................................................................................................. 151
Tokenization .................................................................................................................. 151
Rights Management ...................................................................................................... 151
Hardware Security Module (HSM) ...................................................................................152
Geographical Considerations ............................................................................................153
Cloud Access Security Broker (CASB) ..............................................................................153
Response and Recovery Controls......................................................................................155
Secure Sockets Layer (SSL)/Transport Layer Security (TLS) inspection ....................... 156
Hashing ............................................................................................................................. 156
API Considerations ............................................................................................................157
Site Resiliency ................................................................................................................... 158
Hot Site ......................................................................................................................... 158
Cold Site ........................................................................................................................ 158
Warm site ...................................................................................................................... 158
Deception and Disruption ............................................................................................... 158
Honeypots ..................................................................................................................... 159
Honeyfiles ..................................................................................................................... 159
Honeynets ..................................................................................................................... 159
Lab 2-01: Configuring Honeypot on Windows Server 2016 ....................................... 159
DNS Sinkhole ................................................................................................................ 163
Mind Map...................................................................................................................... 164
Virtualization and Cloud Computing Concepts ............................................................. 164
What is Cloud Computing, and how does it work? .................................................... 164
Cloud Service Providers ............................................................................................... 170
On-Premises vs. Off-Premises ..................................................................................... 170
Fog Computing ............................................................................................................. 170
12
Edge Computing ........................................................................................................... 170
Thin Client ..................................................................................................................... 171
Containers ...................................................................................................................... 171
Microservices/API ........................................................................................................ 172
Infrastructure as Code .................................................................................................. 172
Serverless architecture ................................................................................................. 174
Services Integration ...................................................................................................... 174
Resource Policies ...........................................................................................................175
Transit Gateway .............................................................................................................175
Virtualization .................................................................................................................175
VM Escape Protection ...................................................................................................175
Mind Map...................................................................................................................... 176
Secure Application Development, Deployment, and Automation Concepts ............... 176
Environment ................................................................................................................. 176
Provisioning and De-Provisioning ............................................................................... 178
Integrity Measurement ................................................................................................. 179
Secure Coding Techniques ........................................................................................... 179
Open Web Application Security Project (OWASP).................................................... 180
Software Diversity.......................................................................................................... 181
Automation/Scripting ................................................................................................... 181
Elasticity ........................................................................................................................ 182
Scalability ...................................................................................................................... 182
Version Control ............................................................................................................ 182
Mind Map...................................................................................................................... 183
Summarize Authentication and Authorization Design Concepts ................................. 183
Authentication Methods .............................................................................................. 185
Technologies ................................................................................................................. 186
Authentication Applications ........................................................................................ 189
AAA (Authentication, Authorization, and Accounting) Framework ........................ 193
Multi-Factor Authentication ........................................................................................ 194
13
Gaining Access .................................................................................................................. 197
Cloud vs. On-Premises Requirements ......................................................................... 198
Mind Map...................................................................................................................... 199
Implementation of Cybersecurity Resilience .................................................................. 199
Redundancy .................................................................................................................. 199
Disk ............................................................................................................................... 199
Network......................................................................................................................... 201
Replication .................................................................................................................... 203
Backup Types ............................................................................................................... 204
Non-Persistence ............................................................................................................ 205
High Availability .......................................................................................................... 206
Restoration Order ........................................................................................................ 206
Diversity ....................................................................................................................... 206
Mind Map......................................................................................................................207
The Security Implications of Embedded and Specialized Systems ............................... 208
Embedded Systems ...................................................................................................... 208
Supervisory Control and Data Acquisition (SCADA)/Industrial Control System (ICS)
Facilities ....................................................................................................................... 208
Internet of Things (IoT) .............................................................................................. 208
IoT Communication Models ......................................................................................... 211
Specialized .................................................................................................................... 214
Voice over IP ..................................................................................................................215
Heating, Ventilation, Air Conditioning ........................................................................215
Drones/AVs ................................................................................................................... 216
Multifunction Printer ................................................................................................... 216
Real-Time Operating System ....................................................................................... 216
Surveillance Systems .................................................................................................... 216
System on Chip ............................................................................................................. 216
Communication Considerations .................................................................................. 217
Mind Map...................................................................................................................... 218
14
The Importance of Physical Security Controls ............................................................... 218
Bollards/Barricades....................................................................................................... 219
Mantraps ....................................................................................................................... 219
Badges ...........................................................................................................................220
Alarms ...........................................................................................................................220
Signage ..........................................................................................................................220
Cameras .........................................................................................................................220
Industrial Camouflage .................................................................................................. 221
Personnel ...................................................................................................................... 221
Locks ............................................................................................................................. 222
USB Data Blocker ......................................................................................................... 222
Lighting ......................................................................................................................... 222
Fencing .......................................................................................................................... 222
Fire Suppression ........................................................................................................... 222
Sensors .......................................................................................................................... 222
Visitor Logs ................................................................................................................... 223
Faraday Cages ............................................................................................................... 223
Air Gap .......................................................................................................................... 223
The Demilitarized Zone (DMZ) ................................................................................... 223
Protected Cable Distribution ....................................................................................... 224
Secure Areas .................................................................................................................. 224
Secure Data Destruction ..............................................................................................226
Mind Map...................................................................................................................... 227
The Basics of Cryptographic Concepts ............................................................................228
Cryptography ................................................................................................................228
Types of Cryptography .................................................................................................228
Digital Signatures .........................................................................................................229
Key Length .................................................................................................................... 230
Key Stretching............................................................................................................... 230
Salting............................................................................................................................ 230
15
Hashing ..........................................................................................................................231
Key Exchange ................................................................................................................ 232
Elliptic-Curve Cryptography ........................................................................................ 233
Perfect Forward Secrecy ............................................................................................... 234
Quantum ....................................................................................................................... 234
Blockchain..................................................................................................................... 234
Cipher Suites ................................................................................................................. 235
Symmetric vs. Asymmetric........................................................................................... 235
Lightweight Cryptography ........................................................................................... 239
Steganography .............................................................................................................. 239
Mind Map...................................................................................................................... 241
Homomorphic Encryption ........................................................................................... 247
Common Use Cases ...................................................................................................... 247
Limitations .................................................................................................................... 247
Mind Map..................................................................................................................... 248
Practice Question ............................................................................................................ 249
Chapter 03: Implementation ............................................................. 252
Implement Secure Protocols ............................................................................................ 252
Protocols ........................................................................................................................... 252
Secure Real-time Protocol (SRTP) ............................................................................... 252
NTP................................................................................................................................ 252
S/MIME ......................................................................................................................... 253
SSL/TLS ......................................................................................................................... 253
FTPS .............................................................................................................................. 253
LDAP ............................................................................................................................. 253
SSH ................................................................................................................................ 253
DHCP ............................................................................................................................ 253
Secure File Transfer Protocol (SFTP) .......................................................................... 254
Secure Post Office Protocol (POP)/ Internet Message Access Protocol (IMAP) ..... 266
Mind Map......................................................................................................................267
16
Implement Host or Application Security Solutions .......................................................267
Endpoint Protection .....................................................................................................267
Boot Integrity ............................................................................................................... 269
Application Security .....................................................................................................270
Hardening ..................................................................................................................... 271
Self-Encrypting Drive (SED)/ Full-Disk Encryption (FDE) ........................................ 273
Hardware Root of Trust ............................................................................................... 273
Trusted Platform Module (TPM) ................................................................................. 273
Sandboxing ................................................................................................................... 273
Mind Map...................................................................................................................... 274
Implement Secure Network Designs ............................................................................... 274
Load Balancing ............................................................................................................. 274
Network Segmentation ................................................................................................ 275
Network-based Intrusion Detection System (NIDS)/Network-based Intrusion
Prevention System (NIPS) ............................................................................................279
Firewall .......................................................................................................................... 283
Firewall Architecture ................................................................................................... 286
Types of Firewall .......................................................................................................... 290
Access control list (ACL) .............................................................................................. 293
Route security Quality of service (QoS) ...................................................................... 293
Implications of IPv6 ..................................................................................................... 293
Port Spanning/Port Mirroring .................................................................................... 294
Monitoring Services ..................................................................................................... 294
File Integrity Monitors ................................................................................................ 294
Mind Map......................................................................................................................295
Wireless Security Settings ................................................................................................295
Cryptographic Protocols ..............................................................................................295
Authentication Protocols ............................................................................................ 296
Methods ........................................................................................................................297
Installation Considerations ......................................................................................... 298
17
Mind Map..................................................................................................................... 299
Implement Secure Mobile Solutions .............................................................................. 299
Connection Methods and Receivers ........................................................................... 299
Mobile Device Management (MDM) .......................................................................... 301
Mobile Devices.............................................................................................................. 305
Enforcement and Monitoring ...................................................................................... 305
Deployment Models .....................................................................................................308
Mind Map..................................................................................................................... 309
Cybersecurity Solutions to the Cloud............................................................................. 309
Cloud Security Controls .............................................................................................. 309
Network..........................................................................................................................312
Compute........................................................................................................................ 314
Solutions ........................................................................................................................315
Cloud-native controls vs. third-party solutions .......................................................... 316
Mind Map...................................................................................................................... 318
Implement Identity and Account Management Controls .............................................. 318
Identity .......................................................................................................................... 318
Account Types .............................................................................................................. 319
Account Policies ........................................................................................................... 320
Mind Map...................................................................................................................... 322
Implement Authentication and Authorization Solutions .............................................. 322
Authentication Management ....................................................................................... 322
Authentication .............................................................................................................. 324
Access Control Schemes ............................................................................................... 328
Mind Map...................................................................................................................... 330
Implement Public Key Infrastructure.............................................................................. 330
Public Key Infrastructure (PKI) ................................................................................... 330
Types of certificates ...................................................................................................... 335
Certificate Formats ....................................................................................................... 337
Concepts........................................................................................................................ 338
18
Mind Map......................................................................................................................340
Practice Questions............................................................................................................ 341
Chapter 04: Operations and Incident Response ............................. 344
Introduction......................................................................................................................344
Appropriate Tools to Assess Organization Security .......................................................344
Network Reconnaissance and Discovery .....................................................................344
File Manipulation ......................................................................................................... 355
Shell and Script Environments .................................................................................... 357
Packet Capture and Replay .......................................................................................... 358
Lab 4-01: Introduction to Wireshark ........................................................................... 359
Forensics ....................................................................................................................... 362
Mind Map......................................................................................................................364
Importance of Policies, Processes, and Procedures for Incident Response .................. 365
Incident Response Plans .............................................................................................. 365
Incident Response Process ........................................................................................... 365
Exercises ........................................................................................................................ 367
Attack Frameworks.......................................................................................................368
Stakeholder Management ............................................................................................ 375
Communication Plan.................................................................................................... 375
Continuity of Operations Planning (COOP)............................................................... 375
Incident Response Team .............................................................................................. 376
Retention Policies ......................................................................................................... 376
Mind Map...................................................................................................................... 377
Appropriate Data Source to Support an Incident Investigation .................................... 377
Vulnerability Analysis .................................................................................................. 377
Lab 4-02: Installing and Using a Vulnerability Assessment Tool ..............................386
Lab 4-03: Vulnerability Scanning using the Nessus Vulnerability Scanning Tool ... 405
Analyze Vulnerability Scan Results ............................................................................. 417
Appropriate Solutions/Recommendations to Remediate the Discovered
Vulnerabilities............................................................................................................... 419
19
SIEM DashBoard .......................................................................................................... 420
Log Files ........................................................................................................................ 422
syslog/rsyslogs/syslog-ng ............................................................................................. 425
Journalctl ....................................................................................................................... 425
nxlog .............................................................................................................................. 425
Bandwidth monitors .................................................................................................... 426
Metadata ...................................................................................................................... 426
Netflow .......................................................................................................................... 427
Protocol Analyzer Output ........................................................................................... 428
Mind Map..................................................................................................................... 429
Use of Mitigation Techniques or Controls to Secure an Environment ........................ 429
Reconfigure Endpoint Security Solution .................................................................... 429
Configuration Changes.................................................................................................430
Isolation ........................................................................................................................ 431
Containment ................................................................................................................. 431
Segmentation ................................................................................................................ 432
SOAR ............................................................................................................................. 432
Mind Map...................................................................................................................... 433
The Key Aspect of Digital Forensics ................................................................................ 433
Documentation/Evidence ............................................................................................ 433
Acquisition .................................................................................................................... 435
On-Premises vs. Cloud .................................................................................................438
Integrity........................................................................................................................ 440
Preservation ................................................................................................................. 440
E-discovery ................................................................................................................... 440
Data recovery ................................................................................................................ 441
Non-repudiation ........................................................................................................... 441
Strategic Intelligence/ CounterIntelligence (CI) ........................................................ 441
Mind Map..................................................................................................................... 442
Practice Questions............................................................................................................443
20
Chapter 05: Governance, Risk, and Compliance ............................. 446
Introduction..................................................................................................................... 446
GRC Concepts .............................................................................................................. 446
Why GRC? .................................................................................................................... 446
Functions Supported by GRC...................................................................................... 447
Analyze Risks Associated with Cloud Infrastructure .................................................... 448
Risk Assessment/Analysis ........................................................................................... 448
Cloud Attack Vectors .................................................................................................. 448
Virtualization Rısks ..................................................................................................... 450
Counter-Measure Strategies........................................................................................ 450
Security Controls .............................................................................................................. 451
Physical and Environmental Protection ...................................................................... 451
System and Communication Protection ..................................................................... 452
Category of Security Control ........................................................................................ 452
Types of Security Control ............................................................................................. 453
Mind Map..................................................................................................................... 454
Importance of Applicable Regulations, Standards, or Frameworks that Impact
Organizational Security Posture. .................................................................................... 454
Regulations, Standards, and Legislation .................................................................... 454
Benchmarks/Secure Configuration Guides ................................................................ 466
Mind Map..................................................................................................................... 470
Importance of Policies to Organizational Security ........................................................ 470
Policies ......................................................................................................................... 470
Personnel Security ........................................................................................................ 471
Diversity of Training Techniques ............................................................................... 479
Third-Party Risk Management.................................................................................... 479
Data ...............................................................................................................................483
Credential Management System ................................................................................. 487
Credential Policies ....................................................................................................... 488
Organizational Policies ............................................................................................... 489
21
Mind Map......................................................................................................................493
Risk Management Processes and Concepts ....................................................................493
Threat Assessment....................................................................................................... 494
Risk Types .................................................................................................................... 494
Risk Management Strategies ....................................................................................... 495
Risk Monitoring ........................................................................................................... 496
Analyze Risks Associated with Cloud Infrastructure................................................. 496
Disaster ......................................................................................................................... 502
Business Impact Analysis ............................................................................................. 502
MindMap....................................................................................................................... 505
Privacy and Sensitive Data Concepts in Relation to Security ........................................ 505
Organizational consequences of privacy breaches ..................................................... 505
Notifications of Breaches ............................................................................................ 506
Data Types .................................................................................................................... 507
Privacy Enhancing Technologies ................................................................................ 508
Roles and Resposnibilities ............................................................................................. 511
Information Lifecycle ....................................................................................................512
Privacy Impact Assessment ...........................................................................................513
Terms of Agreement ......................................................................................................513
Privacy Notice/ Privacy Policy ......................................................................................513
Mind Map...................................................................................................................... 514
Data Security and Privacy Practices ................................................................................ 514
Data Destruction and Media Sanitization ................................................................... 514
Data Sensitivity Labelling and Handling ..................................................................... 516
Data Retention ...............................................................................................................517
Legal and Compliance ...................................................................................................517
Mind Map...................................................................................................................... 518
Practice Questions............................................................................................................ 519
Answers .............................................................................................. 522
Chapter 01: Threats, Attacks, and Vulnerabilities .......................................................... 522
22
Chapter 02: Architecture and Design .............................................................................. 525
Chapter 03: Implementation ............................................................................................ 528
Chapter 04: Operations and Incident Response ............................................................. 530
Chapter 05: Governance, Risk, and Compliance ............................................................. 533
Acronyms ...........................................................................................536
References ......................................................................................... 548
About Our Products.......................................................................... 560
23
CompTIA Certification: Security +
About this Certifications
This certification covers all the information you need to pass the CompTIA Security+ Exam
that is SY0-601. The workbook is designed to take a practical approach to learn with reallife examples and case studies.







Covers complete CompTIA Security+ SY0-601 blueprint
Summarized content
Case Study based approach
Downloadable vRacks
Practice Questions
100% pass guarantee
Mind maps
CompTIA Certifications
CompTIA certification helps to establish and build your IT career. It benefits you in various
ways, either seeking certification to have a job in IT or want to upgrade your IT career with
a leading certification, that is, CompTIA certification.
Figure 1. CompTIA Certifications Pathway
24
CompTIA Certification: Security +
About Security+ Certification
The purpose of this certification is to make you a better IT Security Tech. All the essential
principles for network security are covered in this Security+ certification.
The skills or techniques you will learn when you obtain the Security+ certificate:






Configuring a secure network for protection against threats, malware, etc.
Identification of vulnerabilities in a network and provision of proper mitigation
techniques.
Knowledge of the latest threats that harm your system intelligently.
Implementation of secure protocols and appropriate security checks and the
establishment of end-to-end host security.
Implementation of access and identity management controls to have your data in
legal hands.
Ability to use encryption, configuring wireless security for information safety
purposes.
Figure 2. CompTIA Security Certifications Pathway
About the CompTIA Security+ Exam





Exam Number: SY0-601 CompTIA Security+
Duration: 90 minutes
Number of Questions: Maximum 90
Types of Questions: Multiple choice & performance-based
Passing Marks: 750
The CompTIA Security+ Exam (SY0-601) is a 90-minute qualifying exam with a maximum
of 90 questions for the CompTIA certification. The CompTIA Security+ Exam certifies the
25
CompTIA Certification: Security +
successful applicants with the awareness and skills needed to configure and install the
systems to secure the networks, devices, & applications.
This exam measures your ability to accomplish the following technical tasks:





Attacks, Threats, and Vulnerabilities (24%)
Architecture and Design (21%)
Implementation (25%)
Operation and Incident Response (16%)
Governance, Risk, and Compliance (14%)
How to become Security+ certified?
Step 1: Choose a certification: Explore what is available and choose an IT certification
that will benefit you in accomplishing your career target.
To study various IT career tracks and to choose the best certification for yourself, you can
use the “CompTIA Career Roadmap.”
CompTIA has four core IT certifications: IT Fundamental, A+, Network+, and Security+
that examine your knowledge from entry to the expert level.
If you have the skills to secure a network & deter hackers and want to become a highly
efficient IT Security Tech, CompTIA Security+ is the right type of certification.
Step 2: Learning & Training: Exam preparation can be done through self-study with
textbooks, practice exams, and online classroom programs. However, this course provides
you with all the information and offers complete assessments in one place to help you pass
the CompTIA Security+ Exam.
IPSpecialist provides full support to the candidates in order for them to pass the exam.
Step 3: Familiarization with Exam: A great suggestion is to first understand what you
are training for. For that, we are providing you not only the exam objectives but practice
questions too, in order to give you a thorough idea about your final exam of certification.
Step 4: Register & Take Exam for Certification: After all the learning process, the next
step is to take your test. Certification exams are offered at different locations all over the
world. To register for an exam, contact the authorized test delivery partner of CompTIA,
contact Pearson VUE.
The following are the steps for registration and scheduling an exam:
1. Buy the exam voucher from here, “Buy a certification exam voucher.”
2. Find and visit a testing center, “testing center.”
3. Create a Pearson VUE account & Schedule your exam. Here is a link for that “Create
a Pearson VUE testing account and schedule your exam.”
26
CompTIA Certification: Security +
4. You will receive a confirmation email having testing information after the
registration process.
5. You are ready for the test.
Step 5: Results: After you complete an exam at an authorized testing center, you will get
immediate, online notification of your pass or fail status. If you have passed the exam, a
congratulatory email will be forwarded to you with guidelines to access your record.
Make sure to keep a record of the email address you used for the registration and score
report with an exam registration number. This information is required to log in to your
certification account.
The CompTIA Security+ certification exam will verify the successful candidate has the
knowledge and skills required to:




Assess the security posture of an enterprise environment and recommend and
implement appropriate security solutions
Monitor and secure hybrid environments, including cloud, mobile, and IoT
Operate with an awareness of applicable laws and policies, including principles of
governance, risk, and compliance
Identify, analyze, and respond to security events and incidents
This is equivalent to two years of hands-on experience working in a security/systems
administrator job role.
Recommended Knowledge















Compare and contrast different types of social engineering techniques.
Analyze potential indicators to determine the type of attack.
Analyze potential indicators, associated with application attacks.
Analyze potential indicators, associated with network attacks.
Explain different threat actors, vectors, and intelligence sources.
The security concerns associated with various types of vulnerabilities.
Summarize the techniques used in security assessments.
The techniques used in penetration testing.
The importance of security concepts in an enterprise environment.
Summarize virtualization and cloud computing concepts.
Summarize secure application development, deployment, and automation concepts.
Summarize authentication and authorization design concepts.
Implement cybersecurity resilience.
The security implications of embedded and specialized systems.
The importance of physical security controls.
27
CompTIA Certification: Security +




















The basics of cryptographic concepts.
Implement secure protocols.
Implement host or application security solutions.
Implement secure network designs.
Install and configure wireless security settings.
Implement secure mobile solutions.
Apply cybersecurity solutions to the cloud.
Implement identity and account management controls
Implement authentication and authorization solutions.
Implement public key infrastructure.
Use the appropriate tool to assess organizational security.
The importance of policies, processes, and procedures for incident response.
Given an incident, utilize appropriate data sources to support an investigation.
Given an incident, apply mitigation techniques or controls to secure an environment.
Explain the key aspects of digital forensics.
Compare and contrast various types of controls.
The importance of applicable regulations, standards, or frameworks that impact
organizational security posture.
The importance of policies to organizational security.
Summarize risk management processes and concepts.
Explain privacy and sensitive data concepts in relation to security.
All the required information is included in this course.
Domain
Percentage
Domain 1
Attacks, Threats, and Vulnerabilities
24%
Domain 2
Architecture and Design
21%
Domain 3
Implementation
25%
Domain 4
Operation and Incident Response
16%
Domain 5
Governance, Risk, and Compliance
14%
28
Chapter 01: Threats, Attacks, and Vulnerabilities
Chapter 01: Threats, Attacks, and Vulnerabilities
Technology Brief
In this chapter, we will discuss the basic concepts of social engineering and how it
works. This technique is different from other information-stealing techniques that have
been discussed. All the tools and techniques used for hacking a system looked at so far
are technical and require a deep understanding of Networking, Operating Systems, and
other domains. Social Engineering is a non-technical technique for obtaining
information. It is one of the best common techniques because it is easy to use. This is
because humans are very careless and are prone to making mistakes.
There are several components to security, but humans are the most important
component. All security measures depend upon the human being. If a user is careless
about securing his/her login credentials, all security architectures will fail. Spreading
awareness, training, and briefing users about social engineering, social engineering
attacks, and the impact of their carelessness will help to strengthen security from
endpoints.
This chapter will provide an overview of social engineering concepts and types of social
engineering attacks. Here, you will learn how different social engineering techniques
work, what insider threats are, how an attacker impersonates someone on social
networking sites, and how all of these threats can be mitigated. Let's start with social
engineering concepts. This chapter will discuss the concept of wireless networks,
threats and vulnerabilities, attacks on wireless technologies, and some defense
techniques.
An Overview of Social Engineering Techniques
Social Engineering is the art of extracting sensitive information from people. Social
Engineers play with human psychology and trick people into sharing their valuable
information. In Information Security, footprinting through social engineering is done
for gathering information such as:







Credit card information
Usernames and passwords
Security devices and technology information
Operating System information
Software information
Network information
IP address and name server’s information
29
Chapter 01: Threats, Attacks, and Vulnerabilities
There are different ways to perform social engineering. The different types of social
engineering techniques are as follows:
Phishing
In the process of Phishing, emails sent to a targeted group contain messages that look
legitimate. The recipient clicks the link as provided in the email, assuming that it is a
legitimate link. Once the reader clicks the link, it redirects the user to a fake webpage
that looks like an official website. For example, the recipient may be redirected to a fake
bank webpage that then asks for sensitive information. Similarly, clicking on the link
may download a malicious script onto the recipient’s system to fetch information.
Smishing
Smishing is an alternative type of phishing attack that tricks unsuspecting victims into
handing over sensitive data via fraudulent SMS messages. This form of phishing is less
common in the corporate world than spear phishing and vishing but could become
more of a threat as we see an increase in the use of bring-your-own-device (BYOD) in
work environments.
Vishing
Vishing is an attack-type related to phishing since it attempts to trick and persuade
victims to reveal sensitive data over a social engineering attack. A victim may receive a
pre-recorded message on their phone which specifies that there has been suspicious
activity on their credit card, financial account, or other bank accounts. The victim is
told to call a definite telephone number, where he must key in identification
information. The identification information is commonly the connected PIN, account
number, or/and password value. The victim thinks this information is being sent to a
trusted source, as in their bank. However, it is being recorded by an attacker who
intends to use it for fraudulent purposes. When calls are made using VoIP, authorities
find it difficult to track because packets might pass through many different switches
around the world instead of the circuit switching employed by traditional telephone
lines.
Spam
Spamming is usually against the law, so the spammers do not want the traffic to appear
as if it came from their equipment. They will look for mail servers on the Internet or
within enterprise DMZs that have loosely configured relaying systems and utilize them
to deliver spam. If a mail server's relays are set to "wide open," the mail server can receive
any message and send it to any intended recipient. Antispam features, which are
complete layer features, must be activated on mail servers. A company's mail server
should only receive mail intended for its domain and should not forward
communications to other dubious mail servers or domains.
30
Chapter 01: Threats, Attacks, and Vulnerabilities
Spam over Internet Messaging (SPIM)
Instant messaging spam (SPIM) or Spam over Internet Messaging is a type of spamming
that practices instant messengers for this malicious action. Though this kind of
spamming is not as common as e-mail spamming, it is certainly increasing over time.
The fact that firewalls are incapable of blocking SPIM has made it more attractive for
spammers. One technique to prevent SPIM is to enable the option of receiving
immediate messages only from a known list of users.
Spear Phishing
A spear-phishing attack is a phishing attack that is crafted to trick a specific target and
not a large generic group of people. Spear phishing targets individuals. If somebody
distinguishes your particular likes, political motives, shopping habits, etc., the attacker
can craft an attack directed only at you. If an attacker sends a spoofed e-mail that seems
to have come from the mother with the subject line of “Emily’s Birthday Pictures” and
an e-mail attachment, that will most likely think it came from the mother and open the
file which will then infect the system. These generalized attacks take more time for the
hacker to craft as unique information has to be assembled about the target, but they are
more successful because they are more convincing.
Dumpster Diving
The process of looking for treasure in the trash is known as Dumpster Diving. This
technique is old but quite effective. It consists of accessing the target's trash such as
trash, printer, user desk, company trash to find phone bills, contact information,
financial information, source codes, and other helpful material.
Shoulder Surfing
In Shoulder Surfing, information is collected by standing behind a target when he is
dealing with sensitive information. Using this technique, passwords, account numbers,
or other secret information can be gathered, depending upon the carelessness of the
target.
Pharming
It is a form of cyber-attack in which a user is forwarded to a malicious website created
by the attacker. Usually, this type of redirection happens without users’ acceptance or
knowledge.
31
Chapter 01: Threats, Attacks, and Vulnerabilities
Figure 1-01: Software Pharming Has Become Increasingly Popular in Recent Years
Tailgating
Tailgating is a technique in which an unauthorized person gains access to a restricted
area by following the authorized person. Tailgating is easy when using Fake IDs and
following the target closely while crossing checkpoints
Whaling
In a whaling attack, an attacker selects some "big fish" in a company (CEO, CFO, COO,
CSO) and targets them because they have access to some of the firm's most sensitive
data. The attack has been fine-tuned to maximize the chances of success.
Identity Fraud
Stealing information about the identity of another person is known as Identity fraud.
Anyone with malicious intent may steal your identity by gathering documents such as
utility bills and personal and other significant information and creating a new ID card
to impersonate someone. This information may also be used to confirm the fake identity
and then take advantage of it.
32
Chapter 01: Threats, Attacks, and Vulnerabilities
Figure 1-02: Processes of Identity Theft
Credential Harvesting
Credential Harvesting is also known as password harvesting. The attacker sends the
victim a captivating message, typically an email containing a tenable subject and a
hyperlink or maybe an attachment, leading to a sign-in page associated with a legitimate
service that the victim is known to use. The most common are Google Drive, Office 365,
and Dropbox. Once the victim logs in, their credentials are hijacked. The attacker uses
those credentials to access another system aligned with their objectives.
Reconnaissance
Reconnaissance is a primary preparation phase for the attacker to prepare for an attack
by gathering data or information about the target before launching an attack by using
33
Chapter 01: Threats, Attacks, and Vulnerabilities
different techniques and tools. Gathering information about the target creates it easier
for an attacker. It helps to identify the target range for large-scale attacks.
In passive Reconnaissance, a hacker obtains information about the target without
directly interacting with the target. An example of passive reconnaissance includes
searching social media to obtain the target’s information.
Active Reconnaissance is obtaining knowledge by connecting directly with the target.
Interacting with the target via emails, calls, the help desk, or technical departments are
examples of active reconnaissance.
Hoax
This type of threat is where an organization is warned of a particular problem and then
asked for money to solve or remove it. These types of threats can be sent through email,
through Facebook posts, or tweets; the aim is to make money by fooling others.
Impersonation
Impersonation is a social engineering approach that uses people. Impersonation is the
act of impersonating someone or something. Impersonation, here, implies pretending
to be a legitimate user or pretending to be an authorized person. This impersonation
may be either face-to-face or through a communication channel such as email or
telephone communication, etc.
Personal impersonation is identity theft carried out by an attacker when he/she has
enough personal information about an authorized person. An attacker impersonates a
legitimate user by providing the legitimate user’s personal information (either collected
or stolen). Impersonating a technical support agent and asking for credentials is another
method of impersonation for gathering information.
34
Chapter 01: Threats, Attacks, and Vulnerabilities
Mind Map
Figure 1-03: Mind Map of Social Engineering Techniques
Malware Concepts
The term malware is an umbrella term that describes a wide variety of potentially risky
software. This malicious software is particularly designed to gain access to target
machines, steal information, and harm the target system. Any software designed with
the malicious intention that allows damaging, disabling, or limiting the control of the
authorized owner and passing control of a target system to a malware developer or
attacker, or allows any other malicious intent, can be considered malware. Viruses,
Worms, Keyloggers, Spywares, Trojans, Ransomware, and other harmful software are
among the many varieties of malware. Malware is now the most hazardous threat on
the planet. Typical viruses and worms use outdated methodologies, whereas modern
malware is designed to attack cutting-edge equipment, making it more deadly.
How can Malware enter into your system?
Malware takes advantage of the weaknesses and vulnerabilities in the operating system
or the vulnerabilities introduced by accidentally clicking on the malicious links. A
malware program starts running before the malware deploys itself on the system.
How to keep malware away?



Make sure to keep Operating Systems up to date.
Update all the Applications.
Avoid clicking unnecessary or malicious links.
35
Chapter 01: Threats, Attacks, and Vulnerabilities

Use Anti-Virus / Anti-Malware software.
Ransomware
Ransomware is a malware program that restricts access to system files and folders by
encrypting them. Some types of ransomware may lock the system as well. Once the
system is encrypted, it requires a decryption key to unlock it and its files. An attacker
then demands a ransom payment before providing the decryption key to remove
restrictions. Online payments using digital currencies that are difficult to trace, like
Ukash and Bitcoin, are used for ransoms. Ransomware is usually deployed by using
Trojans. One of the finest examples of ransomware is the WannaCry Ransomware
attack.
Following are the most common and widely known types of ransomware:





Cryptobit Ransomware
CryptoLocker Ransomware
CryptoDefense Ransomware
CryptoWall Ransomware
Police-themed Ransomware
Examples of Ransomware:

Crypto-Locker
Trojan
Any Malicious Program misleading the user about its actual intention is classified as a
Trojan. Social Engineering normally spreads Trojans. The determination or most
common use of Trojan programs are:









Creating a Backdoor
Gaining Unauthorized Access
Stealing Information
Infecting Connected Devices
Ransomware Attacks
Using Victims for Spamming
Using Victims as Botnet
Downloading other Malicious Software
Disabling Firewalls
Trojans Types

Command Shell Trojans
Command Shell Trojans are proficient as long as remote control of the command shell
of a victim. The trojan server of command shell Trojan such as Netcat is installed on the
target machine. The trojan server will open the port for command shell connection to
36
Chapter 01: Threats, Attacks, and Vulnerabilities
its client application, installed on the attacker's machine. This Client-Server based
Trojan delivers access to the Command line.

Defacement Trojans
An attacker can access, change, and extract information from any Windows program
using the Defacement Trojan. To leave their imprint, the attacker frequently replaces
the string, graphics, and logos using this information. The attacker defaces applications
using User-Styled Custom Application (UCA). Website defacement is very popularly
known; it is similar to the concept of applications running on the target machine.

HTTP/HTTPS Trojans
HTTP and HTTPS Trojans get across the firewall and execute on the target computer.
After execution, they construct an HTTP/ HTTPS tunnel to interact with the attacker
from the victim's PC.

Botnet Trojans
The amount of hacked systems is referred to as a botnet (zombies). These infected
systems are not restricted to a single LAN; they could be found all around the world.
The Command and Control Center is in charge of these botnets. These botnets are used
to carry out attacks like Denial of Service (DoS), spamming, and so on.

Proxy Server Trojans
Trojan-Proxy Server is a stand-alone virus program that can transform your computer
into a proxy server. The Proxy Server Trojan allows the attacker to utilize the victim's
computer as a proxy by enabling the proxy server on the victim's PC. This method is
used to launch further attacks while keeping the true source of the attack hidden.

Remote Access Trojans (RAT)
RAT (Remote Access Trojan) permits the attacker to get remote desktop access to a
victim's machine by permitting a Port that allows the GUI access to the remote system.
RAT consist of a back door for maintaining administrative access and control over the
victim. Using RAT, an attacker can monitor a user's activity, access confidential data
and information, take screenshots, record audio and video by a webcam, alter files and
format drives, etc.
How to prevent this malware?



You must examine the software before installing it. Install only what is trusted.
You must have a backup of your data.
You must update the antivirus software and operating system.
Trojan Construction Kit
Trojan Construction Kit permits attackers to create their specific Trojans. These
customized Trojans can be more dangerous for the target and the attacker if it backfires
37
Chapter 01: Threats, Attacks, and Vulnerabilities
or is not executed appropriately. These modified Trojans created by using construction
kits can avoid detection from viruses and Trojan scanning software.
Some Trojan Construction Kits are:

Dark Horse Trojan Virus Maker

Senna Spy Generator

Trojan Horse Construction Kit

Pyrogenic mail Trojan Construction Kit

Pandora's Box
Worms
Different Viruses, Worms are capable of replicating themselves. This ability of worms
makes them spread on a resident system very rapidly. Worms are propagating in many
different forms since the 1980s. Some kinds of evolving worms are very destructive and
responsible for devastating DoS attacks. It can move without human action or
interference inside the computer or network. They spread and take over the system
speedily. A well-known virus can be filtered over a next-generation intrusion prevention
system or firewall.
Example of worm:




Sobig worm of 2003
SQL Slammer worm of 2003
2001 attacks of Code Red and Nimba
2005 Zotob worm
Command and Control
The adversary establishes a two-way communication or command channel with its C2
server during the Command and Control (C2) phase. The adversary owns and manages
this C2 server, which is used to relay commands to compromised machines. Adversaries
can change the victim's searches and commands from afar. C2 channels have the
following characteristics:



Victim opens two-way communication channel towards C2
Mostly, the C2 channel is on the web, DNS, or email
C2 queries encoded commands
Security defenders have one last chance in this kill chain to detect and stop the assault
by blocking the C2 channel. An adversary cannot issue orders to the victim if the C2
channel is immediately disabled. Some strategies for security teams to guard against C2
communication are as follows:


Collect and block C2 IoC via Threat Intelligence or Malware analysis
Need proxies for all types of traffic (HTTP, DNS)
38
Chapter 01: Threats, Attacks, and Vulnerabilities


DNS Sink Holing and Name Server Poisoning
Monitoring network sessions
Bots
A bot is a piece of software that allows you to control a target remotely and perform
predetermined activities. It has the ability to run automatic scripts via the internet. Bots
are sometimes known as Web Robots or Internet Bots. Chatterbots and live chats are
examples of bots that can be used for social purposes. Furthermore, they can also be
used for malicious purposes in the form of malware. Hackers use malware bots to gain
complete authority over a computer.
Logic Bomb
A Logic Bomb virus is aimed to persist in a sleep mode or waiting for the state until the
end of a pre-determined period, or an event or action occurs. When the condition is
met, it triggers the virus to exploit and perform the intentional task. These logic bombs
are difficult to detect, as they cannot be detected in sleep mode, and once they are
detected, it is too late.
Spyware
Spyware is software designed for gathering information about a user’s interaction by a
system, such as login credentials, email address, and other details, without informing
the user of the target system. Mostly, spyware is used for tracking a user’s internet
interactions. The information obtained is sent to a remote destination. Spyware hides
its processes and files to avoid detection. The most common types of spyware are:
 Adware
 System Monitors
 Tracking Cookies
 Trojans
Features of Spyware
There are several spyware tools available on the internet providing several advanced
features such as:









Tracking users such as keylogging
Monitoring user’s activity such as websites visited
Recording conversations
Blocking applications and services
Remote delivery of logs
Tracking email communication
Recording removable media communication like USB
Voice recording
Video recording
39
Chapter 01: Threats, Attacks, and Vulnerabilities


Tracking location (GPS)
Mobile tracking
Keyloggers
Keystroke logging, keylogging, or keyboard capturing is monitoring or recording actions
performed by any user. For example, consider a PC with a keylogger for any purpose,
such as monitoring a user. Each key pressed by the user will be logged by this tool.
Keyloggers can be either hardware or software. The major purpose of using keyloggers
is monitoring: copying data to the clipboard, capturing screenshots by the user, and
screen logging by capturing a screenshot at every action.
Figure 1-04: Different Types of Keyloggers
Types of Keystroke Loggers
 Software Keyloggers
Software-based Keyloggers perform their function by logging actions to steal
information from the target machine. Software-based keyloggers are either remotely
installed or sent by an attacker to a user, and the user may then accidentally execute
the application. Software keyloggers include:




Application Keyloggers
Kernel Keyloggers
Hypervisor-based Keyloggers
Form Grabbing-based Keyloggers
 Hardware Keyloggers
Hardware-based Keyloggers are physical hardware or keyloggers that are installed
on hardware by physically accessing the device. Firmware-based keyloggers require
physical access to the machine to load the software into BIOS or keyboard hardware
40
Chapter 01: Threats, Attacks, and Vulnerabilities
such as a key grabber. A USB is a physical device that needs to be installed in line
with the keyboard. Hardware keyloggers are further classified into the following
types:



PC/BIOS Embedded Keyloggers
Keyloggers Keyboard
External Keyloggers
Hardware Keyloggers
Hardware Keyloggers
Website
KeyGrabber USB
http://www.keydemon.com/
KeyGrabber PS/2
http://www.keydemon.com/
VideoGhost
http://www.keydemon.com/
KeyGrabber Nano Wi-Fi
http://www.keydemon.com/
KeyGrabber Wi-Fi Premium
http://www.keydemon.com/
KeyGrabber TimeKeeper
http://www.keydemon.com/
KeyGrabber Module
http://www.keydemon.com/
KeyGhost USB Keylogger
http://www.keyghost.com/
KeyCobra Hardware Keylogger (USB and http://www.keycobra.com/
PS2)
Table 1-01: Keylogging Hardware Devices
Anti-Keyloggers
Anti-Keyloggers are application software that guarantees protection against keylogging.
This software excludes the threat of keylogging by providing SSL protection, keylogging
protection, clipboard logging protection, and screen logging protection. Some AntiKeylogger software is listed below:



Zemana Anti-Keylogger ( https://www.zemana.com )
Spyshelter Anti-Keylogger ( https://www.spyshelter.com )
Anti-Keylogger ( http://anti-keyloggers.com )
How to prevent this malware?



Update anti-virus software
Use the exfiltration process
Set up firewall rules for the file transfer from a system
41
Chapter 01: Threats, Attacks, and Vulnerabilities

Use keylogger scanner
Remote access Trojans (RATs)
Remote Access Trojans (RATs) are malicious programs running on systems and allowing
intruders to remotely access and use a system. They mimic legitimate remote control
programs used for remote administration but are used for sinister purposes instead of
helpful activities. Several RAT programs are available to the hacker (Back Orifice,
SubSeven, Netbus, and others). Once the RAT is loaded on the victim’s system, the
attacker can download or upload files, send commands, monitor user behaviors, install
zombie software, activate the webcam, take screenshots, alter files, and use the
compromised system as he pleases.
Lab 1-01: HTTP RAT Trojan
Case Study: Using HTTP RAT Trojan, create an HTTP Remote Access Trojan (RAT)
server on a Windows 7 machine (10.10.50.202). When a Trojan file is executed on the
remote machine (in our case, Windows Server 2016 with the IP address 10.10.50.211), it
will create remote access to Windows Server 2016 on Windows 7.
Configuration and Procedure:
Go to a Windows 7 machine and run the HTTP RAT Trojan.
1. Uncheck “send a notification with IP address to mail.”
2. Configure Port.
3. Click “Create.”
42
Chapter 01: Threats, Attacks, and Vulnerabilities
In the default directory where the application is installed, see a new executable file.
Forward this file to the victim’s machine.
4. Log in to the victim’s machine (in our case, Windows Server 2016) and run the file.
5. Check the task manager for a running process; you will see an HTTP Server task is
in process.
43
Chapter 01: Threats, Attacks, and Vulnerabilities
6. Go back to Windows 7.
7. Open a Web browser.
8. Go to the IP address of the victim’s machine; in our case, 10.10.50.211.
The HTTP connection is open from the victim’s machine. You can check running
processes and browse drives. You can also check the computer information of the victim
by using this tool.
9. Click “Running Processes.”
44
Chapter 01: Threats, Attacks, and Vulnerabilities
In the above output, the “running process” of the victim’s machine is shown.
10. Click “Browse.”
The output shows drives.
11. Click “Drive C.”
45
Chapter 01: Threats, Attacks, and Vulnerabilities
Output showing C drive.
12. Click “Computer Information.”
The output shows computer information.
13. To terminate the connection, click “Stop_httpRat.”
46
Chapter 01: Threats, Attacks, and Vulnerabilities
14. Refresh the browser.
The connection is successfully terminated.
15. Go to Windows Server 2016 and check the running processes.
47
Chapter 01: Threats, Attacks, and Vulnerabilities
The HTTP server process is terminated.
Rootkits
A collection of software designed to distribute privileged access to a remote user over
the targeted system is referred to as RootKits. Typically, rootkits are the group of
malicious software deployed after an attack. Once an attacker has administrative access
to the target system and can maintain privileged access for the future, it creates a
backdoor for the attacker. Rootkits frequently mask the existence of its software that
helps to avoid detection.
Rootkits Types

Application Level Rootkits
48
Chapter 01: Threats, Attacks, and Vulnerabilities
Application Level of Rootkits accomplishes manipulation of standard application
files and change of the behavior of the current application with an injection of
codes.

Kernel-Level Rootkits

The kernel is the core of an OS. Kernel-Level Rootkits are created by adding
additional codes (malicious) or replacing the original Operating System kernel
sections.
Hardware/Firmware Level Rootkits
Hardware/Firmware Level Rootkits are the type of rootkits that hide in hardware
such as the hard drive, network interface card, system BIOS that are not
inspected for integrity. These rootkits are built into chipsets and are used to
recover stolen computers, delete data, or render them useless. Furthermore,
rootkits raise privacy and security concerns due to undetectable spying.

Hypervisor Level Rootkits

Hypervisor Level Rootkits exploit hardware features like AMD-V (Hardwareassisted virtualization technologies) or Intel VT, which hosts the target OS as a
virtual machine.
Boot Loader Level Rootkits
Bootloader Level Rootkits (Bootkits) replace a legitimate boot loader with a
malicious one, enabling the Bootkits to activate before an OS run. Rootkits are a
serious threat to system security as they can infect startup codes such as the
Master Boot Record (MBR), Volume Boot Record (VBR), or boot sector. They can
be used to attack full disk encryption systems and hack encryption keys and
passwords.
Rootkit Tools




Avatar
Necurs
Azazel
ZeroAccess
Backdoor
It involves deploying a Backdoor on an organization’s computer to gain unauthorized
access to the private network.
Some other types of IoT attacks include:


Eavesdropping
Sybil Attack
49
Chapter 01: Threats, Attacks, and Vulnerabilities






Exploit Kits
Man-in-the-Middle Attack
Replay Attack
Forged Malicious Devices
Side-Channel Attack
Ransomware Attack
Password attacks
Passwords should never be sent or stored in plaintext. Most operating systems and
applications run passwords through hashing algorithms, which generate hash values,
also known as message digest values. The following practices should be followed to
properly protect an environment against password attacks:
• Passwords should not be sent in cleartext.
• Encryption algorithms or hashing functions should be used to encrypt the passwords.
• One-time password tokens should be used.
• Difficult-to-guess passwords should be used.
• Change passwords regularly.
• An Intrusion Detection System (IDS) to detect suspicious behavior should be used.
• Dictionary-cracking tools should be used to find weak passwords that users have
chosen.
• Make use of special characters, numbers, and upper- and lowercase letters.
Password Attacks Types
Password attacks are classified as one of three types:
1.
2.
3.
4.
Spraying
Dictionary
Brute force
Rainbow tables
5. Plaintext/unencrypted
Dictionary Attack
In a Dictionary Attack, a password-cracking application is used along with a dictionary
file. This dictionary file contains the entire dictionary or a list of known and common
words that can be used to try to recover a password. It is the most basic type of password
cracking, and systems that use strong, unique, and alphanumeric passwords are usually
not vulnerable to dictionary attacks.
50
Chapter 01: Threats, Attacks, and Vulnerabilities
Exam Tip:
L0phtCrack is a password recovery and auditing application. It is used to test the
strength of passwords and, on occasion, to recover lost Microsoft Windows passwords
using a dictionary, brute-force, hybrid attacks, and rainbow tables.
Brute Force Attack
A Brute Force Attack attempts to recover a password by trying every possible
combination of characters. Each combination pattern is tried until the password is
accepted. Brute forcing is the most common and basic technique for uncovering
passwords.
Online:
The usage of proxy servers to provide internet anonymity has grown in popularity over
time. Some people use it to keep their surfing habits hidden from others, allowing them
to have more personal freedom and privacy. The same functionality is used by attackers
to ensure that their activities cannot be traced back to their local computers.
The following are some of the most popular online services:





Google Earth
Google Map
Bing Map
Wikimapia
Yahoo Map
Offline:
It is common for hackers to first determine whether an intrusion detection system (IDS)
is present on the network they intend to attack. If one exists, the attacker may use a
denial-of-service attack to bring it down. These activities aim to either disable the IDS
or distract network and security personnel so that they are busy chasing the wrong
packets while the real attack occurs.
Rainbow Table
The Rainbow Table is a table that contains every possible password and has performed
all of the calculations. It is also known as a "pre-built set of hashes." The password can
be determined in a few seconds by matching up the hashes, but it does not work with
salted hashes.
Using a rainbow table to compare passwords is an example of an offline attack. Every
possibility To generate a rainbow table, every possible combination of characters is
computed for the hash. The attacker captures the target's password hash and compares
it to the rainbow table when a rainbow table contains all possible precomputed hashes.
51
Chapter 01: Threats, Attacks, and Vulnerabilities
The Rainbow table has the advantage of having all hashes precomputed. As a result, it
only takes a few moments to compare and reveal the password. A rainbow table's
limitation is that it takes a long time to generate a rainbow table by computing all
hashes.
The utilities you can use to generate rainbow tables are winrtgen, GUI-based generator,
rtgen, and command-line tool. The following hashing formats are supported:

MD2

MD4

MD5

SHA1

SHA-256

SHA-384

SHA-512 and more hashing types
Exercise
Open Winrtgen application, Click Add table button
table.
to add a new Rainbow
As needed, choose Hash, Minimum length, Maximum length, and another property.
52
Chapter 01: Threats, Attacks, and Vulnerabilities
Choose a Charset value; possibilities include Alphabets, Alphanumeric, and various
character combinations, as indicated in the diagram below.
Click Benchmark Button
to Estimate Hash Speed, Step Speed, Table PreComputation time, and other parameters.
Click Ok
to proceed.
53
Chapter 01: Threats, Attacks, and Vulnerabilities
Click Start to Compute.
Compiling all hashes will take a long time.
54
Chapter 01: Threats, Attacks, and Vulnerabilities
Once completed, the Window Table can be found in the directory.
Plaintext/Unencrypted
The attacker has encrypted data as well as plain text in this type of attack. The plain text
assists an attacker in breaking the cryptography, and it is referred to as a "crib."
Physical attacks
Physical attacks involve breaching the physical security that protects information
systems. It can be as simple as walking into a building and sitting down at a computer
system in a facility with low physical security or public access. Here is a list of some of
the different types of physical assaults:





Malicious universal
Serial Bus (USB) cable
Malicious flash drive
Card cloning
Skimming
55
Chapter 01: Threats, Attacks, and Vulnerabilities
Supply Chain Attacks
A supply chain attack is a cyber-attack that seeks to harm an organization by focusing
on less secure supply chain elements. Supply chain testing is typically directed at
companies and organizations that the client organization wishes to examine to
determine whether suppliers have adequate security controls in place. It is common
practice to request audit and assessment documentation from suppliers.
Cloud-based vs. On-premises Attacks
Cloud-based
Cloud-based DLP is used by many organizations, which is between the users and the
internet. Every bit that goes through the DLP tool means it watches every bit of network
traffic. Everything takes place in the cloud, and no hardware or software is required for
this purpose.
Cloud-based systems Cloud Computing is an advancement in architecture where
computing devices are outsourced to a third party. By renting a virtual machine hosted
by a trusted third party, cloud computing eliminates the need for on-premises devices.
This type of remote computing improves efficiency, performance, scalability, and
security. There are three types of cloud computing models. Cloud Computing Service
Types The three types of cloud computing services are as follows:
● Infrastructure-as-a-Service (IaaS)
● Platform-as-a-Service (PaaS)
● Software-as-a-Service (SaaS)
On-premises
It is a type of model that uses the same legacy IT infrastructure and runs cloud resources
within its own data center. It is also called the private cloud to provide dedicated
resources while maintaining total control and ownership of the environment.
Cryptography Attacks
Cryptography attacks are intended to recover an encryption key. Once an attacker
obtains the encryption key, they can decrypt all messages. Weak encryption algorithms
are vulnerable to cryptographic attacks. Cryptanalysis is the process of identifying flaws
in a code, encryption algorithm, or key management scheme. It can be used to either
strengthen or decrypt a cryptographic algorithm.
Birthday
A type of cryptographic attack that takes its function and exploits it through the
birthday problem in probability theory states that there is a 50% chance that two people
56
Chapter 01: Threats, Attacks, and Vulnerabilities
share the same birthday in a class of 23 students. The following equation can be used in
mathematics:
1.25
k
1/2
k = the size of the set of possible values
Collisions
Collision refers to the hash collision that means two different plaintexts have the same
hash value. This is a rare condition that should not exist in a hash algorithm. The
hashing process accepts an infinite number of inputs and produces a finite number of
outputs. Consider the following scenario: an attacker discovers a hash collision between
a legitimate and an altered document. The attacker can now easily fool the target while
remaining undetected.
Figure 1-05: Hash Collision
Downgrade
The use of some weak cryptographic algorithm instead of a strong algorithm may result
in a downgrade attack. For example, a downgrade attack was used in 1995 with web
servers.
57
Chapter 01: Threats, Attacks, and Vulnerabilities
Mind Map
Figure 1-06: Mind Map of Potential Indicators
Web Application Attacks
Other web application related attacks include:







Cookie Tampering
DoS Attack
SQL Injection
Session Hijacking
Cross-Site Request Forgery (CSRF) Attack
Cross-Site Scripting (XSS) Attack
Buffer Overflow
Privilege Escalation
This network intrusion assault takes use of programming faults or design defects to give
the attacker enhanced access to the network and its data and applications. A design
flaw, bug, or configuration oversight in a software application or operating system is
exploited with privilege escalation to access applications or user-protected resources.
An unauthorized user will not always be provided full access to a targeted system. The
privilege escalation is essential in these circumstances. The privilege escalation is of two
types: vertical and horizontal.
Privilege Escalation is further more classified into two types:
1.
Horizontal Privileges Escalation
58
Chapter 01: Threats, Attacks, and Vulnerabilities
2.
Vertical Privileges Escalation
Horizontal Privileges Escalation
In Horizontal Privileges Escalation, an attacker tries to take command of the privileges
of another user with the same set of privileges on their account. Horizontal privileges
escalation occurs when attackers attempt to access the same set of resources allowed
for a particular user.
Consider an example of horizontal privileges escalation where you have an Operating
System with multiple users, including an Administrator having full privileges, User A
and User B, and so on, with limited privileges for running applications only (so not
allowed to install or uninstall any application). Each user is given the same level of
access. User A gains access to User B by exploiting any weakness or vulnerability. User
A can now control and access User B's account.
Escalation of Vertical Privileges
In order to escalate privileges to a higher level, an attacker must first get access to the
system in Vertical Privileges Escalation. Vertical privilege escalation occurs when an
attacker tries to gain access, most commonly to the administrator account. Higher
privileges grant the attacker access to sensitive information and install, modify, and
delete files and programs such as viruses and Trojans.
Privilege Escalation Using DLL Hijacking
Applications need Dynamic Link Libraries (DLL) to run executable files. Most
applications search for DLL in directories in the Windows Operating System rather than
using a fully qualified path. Taking advantage of this legitimate DLL replaces malicious
DLL. Malicious DLLs are renamed legitimate DLLs. These malicious DLLs replace
legitimate DLLs in the directory; the executable file will load malicious DLL from the
application directory instead of the real DLL.
59
Chapter 01: Threats, Attacks, and Vulnerabilities
Figure 1-07: Vertical Privilege Escalation
Cross-site Scripting
The acronym for Cross-site scripting is XSS. A cross-site scripting attacker conducts a
scripting attack by sending a crafted link containing a malicious script. The script will
be executed when the user clicks on this malicious link. This script could be
programmed to extract Session IDs and send them to the attacker. An attacker performs
a Cross-site Scripting Attack by sending a crafted link with a malicious script. When the
user clicks the malicious link, the script is executed. This script might be coded to
extract and send the session IDs to the attacker.
Cross-site Request Forgery Attack
A Cross-site Request Forgery (CSRF) attack is the process of obtaining a legitimate user’s
session ID and exploiting the active session with the trusted website to perform
malicious activities.
Injections
In an Injection Attack, the system accepts data from a user without any validation.
Untrusted input is supplied to a program. An interpreter processes it as part of a
command that alters the execution of the program.
Injection attacks are of four types:




Structured Query Language (SQL)
Dynamic-Link Library (DLL)
Lightweight Directory Access Protocol (LDAP)
Extensible Markup Language (XML)
Structured Query Language (SQL)
SQL Injection Attacks use SQL websites or web applications. They rely on the strategic
injection of malicious code or script into existing queries. This malicious code is drafted
to reveal or manipulate data stored in the tables within the database. It is a powerful
and dangerous attack that finds vulnerabilities in a website or application. The concept
of SQL injection is to inject commands to reveal sensitive information from the
database, which results in a high-profile attack. It is used to add, modify, and delete
data in the database.
Dynamic Link Library (DDL)
DLL (Dynamic Link Library) injection is the process of inserting a library into a program
that contains a specific vulnerability. DLL injection also provides a point of entry for
60
Chapter 01: Threats, Attacks, and Vulnerabilities
threat actors. Applications need Dynamic Link Libraries (DLL) to run executable files.
Most applications search for DLL in directories in the Windows Operating System
rather than using a fully qualified path. Taking advantage of this legitimate DLL replaces
malicious DLL. Malicious DLLs are renamed legitimate DLLs. These malicious DLLs
replace legitimate DLLs in the directory; the executable file will load malicious DLL
from the application directory instead of the real DLL.
Figure 1-08: Dynamic-Link Library Injection
Lightweight Directory Access Protocol (LDAP)
The Lightweight Directory Access Protocol (LDAP) acronym for Lightweight Directory
Access Protocol LDAP is a free and open internet protocol. The LDAP is a protocol for
accessing and maintaining hierarchical and logical distributed directory information
services. A directory service is useful because it allows users, systems, networks, and
service information to be shared across the network. LDAP provides a centralized
location for storing usernames and passwords. To validate users, applications and
services connect to the LDAP server. THE CLIENT STARTED an LDAP session sending
an operation request to the Directory System Agent (DSA) via TCP port 389. The
communication between client and server uses Basic Encoding Rules (BER). Directory
services using LDAP include:





Active Directory
Open Directory
Oracle iPlanet
Novell eDirectory
OpenLDAP
Pointer/Object Dereference
Dereferencing a pointer is the process of inquiring about the value stored in the memory
addressable by the pointer. The program may dereference a null pointer, resulting in a
61
Chapter 01: Threats, Attacks, and Vulnerabilities
Null Pointer Exception. Null pointer errors are typically caused by a breach of one or
more programmer assumptions. The attacker may use the resulting exception to
circumvent security logic or cause the application to reveal debugging information
useful in planning future attacks.
Directory Traversal
Directory Traversal Attack is a type of attack in which an attacker attempts using a trial
and error method to access restricted directories by applying dots and slash sequences.
Through accessing the directories outside the root directory, the attacker can reveal
sensitive information about the system. Access to web content should be controlled
properly for running a secure web server. Directory traversal is an HTTP attack in which
restricted directories are allowed, and the commands are executed outside the root
directory of the web server’s commands.
This vulnerability can also exist in the web application code or the web server software
itself.
A directory traversal attack is simple to carry out if you know where to look for any
default files and folders on the system and have access to a web browser.
The main levels of security mechanisms for web servers are:


Access Control Lists (ACLs)
Root directory
Access Control Lists
These are used in the authorization process. A web server’s administrator uses this list
of users or groups authorized to access, execute, or modify particular files on the server
and other access rights.
Root Directory
It is a directory on the server file system to which users are confined: they can access
nothing above this root.
For example, if the default root directory were C:\Inetpub\wwwroot, access
to C:\Windows is not possible, but access to any other directories under the root
directory is possible. Users are prevented from accessing any files on the server through
the root directory. The prevented file may include the /etc/passwdfile on Linux/UNIX
platforms and C:\WINDOWS/system32/win.ini on Windows platforms.
Opening an Opportunity to an Attacker
This vulnerability allows stepping out of the root directory. Also, other parts of the file
system can be accessed. The attacker can view the restricted files, which could help
provide more information to further compromise the system.
62
Chapter 01: Threats, Attacks, and Vulnerabilities
An attacker can use a system vulnerable to directory traversal to exit the root directory
and access other parts of the file system. It may allow the attacker to view restricted
files, which may provide him/her with additional information to further compromise
the system. Access depends on what the user has been permitted to access in the system.
Directory Traversal Vulnerabilities Check
A Web Vulnerability Scanner is used to check whether a website and web applications
are vulnerable to directory traversal attacks. In this scan, the entire website is
automatically checked for directory traversal vulnerabilities. Further, a report on
existing vulnerabilities and how to fix them is generated. As well as directory traversal
vulnerabilities, SQL injection, cross-site scripting, and other web vulnerabilities are also
checked.
Preventing Directory Traversal Attacks
The first step is to ensure that the latest version of your web server software is installed
and all patches have been applied.
Secondly, user input is filtered effectively, which includes the data that is known to the
user. Only the data entered in the field will be submitted to the server.
Buffer Overflow
One of the most common types of operating system attacks is a buffer overflow. It has
something to do with software exploitation attacks. A buffer overflow occurs when a
program or application lacks well-defined boundaries, such as restrictions or predefined functional areas regarding the amount of data it can handle or the type of data
inputted. It causes Denial-of-Service (DoS) problems, rebooting, gaining unrestricted
access, and freezing.
What causes it to happen?



Owing to an overabundance of data in the buffer memory
When a program or process attempts to write more data to a fixed-length block
of memory (a buffer)
Coding errors
The impact of buffer overflow is that it provides an entry point for threat actors as well
as causing the system to crash or abort the program.
How to prevent it?
Open Web Application Security Project (OWASP) defines some general techniques to
prevent buffer overflows include:
63
Chapter 01: Threats, Attacks, and Vulnerabilities





Code auditing (manual or automated) Developer training – bounds checking, use
of unsafe functions, and group standards
Non-executable stacks – many operating systems support this in some way
Compiler tools – StackShield, StackGuard, and Libsafe, among others
Safe functions -Use strncat instead of strcat, strncpy instead of strcpy, and so on.
Patches – Keep your web and application servers fully patched, and keep an eye
out for bug reports relating to applications on which your code depends.
Scan your application regularly with one or more widely available scanners that
look for buffer overflow flaws in your server products and custom web
applications.
Race Conditions
When a computing system is forced to perform two or more operations simultaneously,
the condition is called a race condition. The system was designed to handle tasks in a
specific sequence. A time gap between the moment a service is initiated and the
moment a security control takes effect is beneficial for the technique.
The race condition comes either with untrusted processes causing interference or a
trusted process causing interference; the attack depends on multithreaded applications.
In a race condition, different processes can interfere with each other without having
proper control. This vulnerability is also referred to as Time of Check/Time of Use or
TOC/TOU attacks.
How a Race Condition Attack Takes Place
Race condition attack shows the vulnerability when dealing with web applications,
networking environments, and file systems. Its target list includes an access control list,
financial ledger, payroll or human resources database, transactional system, or another
data repository. In this attack, there is a very small window of opportunity available for
attackers to exploit. This attack offers some unintended consequences, but still, they
are difficult to be detected.
Anatomy of a Race Condition Flaw
An application or database updating, i.e., numbers, names, and the most current state
of information, may result in a race condition attack because, during the update process,
the database is not completely rewritten. The update then results in a gap that can last
less than a second or up to a few minutes and makes the system unprotected. This gap
period allows an attacker to send queries for compromising the system, and a race
condition attack result.
64
Chapter 01: Threats, Attacks, and Vulnerabilities
Impact of a Race Condition Attack
After compromising the system with a race condition attack, it becomes possible to steal
data, alter, manipulate, and insert malicious code, make changes to privileges, and
deactivate security controls.
Error Handling
Encountering errors and exceptions in an application is common and needs to be
handled securely. One attack methodology forces an error to move applications from
normal to exceptional handling. If the exception handling is incorrect, it can lead to a
wide range of disclosures. For example, SQL errors disclose data elements and
structures. RPC (Remote Procedure Call) errors can disclose sensitive information such
as server, filename, path, and programmatic errors, such as stack element or line
number on which an exception occurred.
Lack of Error Handling
The error message includes sensitive information about its users, environment, and
associated data. The error information provided by the server may be used to launch a
more focused attack. For example, a path traversal weakness exploitation in any
application produces the complete pathname of the installed application, which may
provide a way to find the proper number of and sequences to navigate to the targeted
file. The query logic and even passwords or other sensitive information used within the
query are revealed with an error message, which may be used for a later attack or private
information stored in the server. The implementation of an architectural security tactic
causes this weakness.
Example of Error Handling
The function “Get User Bank Account” retrieves a bank account object from a database
using the specified username and account number to query the database. An error
message is generated and written to a log file when a SQL Exception occurs while
querying the database. Sensitive information about the database query is included in
the error message that exposes the table name and column names used in the database.
This information simplifies other attacks, such as SQL injection, to access the database
directly.
Error Handling Implementation
Ensure that error messages only contain information relevant to the intended audience
and no one else. The messages must strike a balance between being too cryptic and
being insufficiently cryptic. They are not required to reveal the methods used to
determine the error. Such detailed information can be used to improve the original
attack's chances of success.
65
Chapter 01: Threats, Attacks, and Vulnerabilities
If errors must be tracked in some detail, capture them in log messages, but consider
what might happen if attackers can view them. Passwords, for example, should never be
recorded in any form. Avoid inconsistent messaging that could accidentally reveal
internal states to an attacker, such as whether a username is valid or not.
Exceptions should be handled internally, and errors containing potentially sensitive
information should not be displayed to the user.
Overly Verbose Error Handling
The risk may also be presented with overly verbose error handling routines. The detailed
explanation of the inner workings of code invites an attacker to exploit the code. For
example, an error message appearing on a website may contain details of the SQL query
by which the table structure is determined and assist in carrying out an attack.
Improper Input Handling
As we move toward web-based applications, errors have shifted from buffer overflow to
input handling issues. Improper Input Handling is the primary cause of an injection
attack, memory overflow, or structure error. Allowing invalid inputs can be disastrous.
When handling input, trust no one and handle all of it properly. The impact of improper
input handling is the increase of the attacker’s privilege level.
Replay Attack
In a Replay Attack, an attacker captures packets using a packet sniffer tool. After
capturing packets, relevant information such as passwords is extracted. An attacker
gains access to the system by generating replay traffic with the injection of extracted
information.
Session Replay Attack
Another technique for session hijacking is the Session Replay Attack. Attackers steal the
authentication token intended for the server from users and use it to replay the request
to the server, resulting in unauthorized access to the server.
Resource Exhaustion
When the system lacks all of the resources required for the function to function, this is
referred to as resource exhaustion. A system failure is the result of this type of
vulnerability.
Memory Leak
When memory is allocated during program execution and never unassigned after use,
it eventually consumes all available memory, causing the system or application to crash.
66
Chapter 01: Threats, Attacks, and Vulnerabilities
Secure sockets layer (SSL) stripping
Secure Sockets Layer (SSL) is a newer VPN technology that operates at a higher layer in
the OSI model than the VPN protocols previously discussed. It protects HTTP traffic by
working at the transport and session layers of the network stack. Because most online
browsers already have SSL capability, deployment and compatibility difficulties are low.
• Works at the transport layer and protects mainly web-based traffic
• Granular access control and configuration are available
• Easy deployment since SSL is already embedded into web browsers
• Can only protect a small number of protocol types, thus is not an infrastructure-level
VPN solution
Pass the Hash
A Pass the Hash (PtH) attack is an exploit in which an attacker captures a hashed
username and password or other credentials and uses the hash directly without cracking
it. This attack bypasses the standard authentication layers that require a clear text
password and directly enters the portion of authentication that uses the hash password.
Mind Map
Figure 1-09: Mind Map of Application Attacks
Network Attacks
The Cisco NGIPS Solution offers comprehensive network visibility, automation, security
intelligence, and next-generation protection. To detect emerging sophisticated network
67
Chapter 01: Threats, Attacks, and Vulnerabilities
attacks, it employs the most advanced and effective intrusion prevention capabilities. It
continuously collects network information, such as operating system information, file,
and application information, device and user information. This data assists NGIPS in
determining network maps and host profiles, providing context for making better
decisions about intrusive events.
A replay attack is a type of network attack in which legitimate data transmission is
maliciously or fraudulently repeated to gain unauthorized access.
Wireless
Wireless networks are a very common and popular technology. Because of the ease and
mobility of the wireless network, it has been replacing the installation of wired
networks. Using wireless networks increases not only mobility but also flexibility for
end-users. One more advantage of wireless technology is that it helps connect remote
areas where wired technology is difficult to implement. In the early days of wireless
technology, the network was not secure enough to protect information. However, many
encryption techniques are used nowadays to secure wireless communication channels.
Wireless Network Concepts
A wireless network is a type of computer network that can send and receive data over a
wireless medium such as radio waves. The primary benefit of this type of network is the
lower cost of wires and devices and the ease of installation compared to the complexity
of wired networks. Wireless communication is typically based on radio communication.
Depending on the requirements, different frequency ranges are used for various types
of wireless technology. Cell phone networks, satellite communications, microwave
communications, and other wireless networks are the most common examples.
Personal, Local, and Wide Area Networks are common applications for these wireless
networks.
The most common types of Wireless networks are:
 Evil Twin
 Rogue Access Point
 Bluesnarfing
 Bluejacking
 Disassociation
 Jamming
 Radio Frequency Identifier (RFID)
 Near-Field Communication (NFC)
 An Initialization Vector (IV)
68
Chapter 01: Threats, Attacks, and Vulnerabilities
Evil Twin
In an Evil Twin attack, an attacker facilitates a fraudulent Wi-Fi access point or any
other radio device that appears legitimate but is set up to compromise wireless
communication. An evil twin attack may be used to steal passwords and other
credentials without user knowledge. An attacker creates an evil twin with internet
devices and smartphones or some open source software by creating an easy access
hotspot and placing the device near the target with a strong signal.
Rogue Access Point
A Rogue Access Point Attack is a technique whereby a legitimate wireless network is
replaced with a rogue access point, usually with the same SSID. The user assumes the
rogue access point as the legitimate access point and connects to it. Once a user is
connected to the rogue access point, all traffic will direct through it, and the attacker
can sniff the packet to monitor activity.
Bluesnarfing
Bluesnarfing is another technique in which attackers steal information from Bluetoothenabled devices. In Bluesnarfing, attackers exploit the security vulnerabilities of
Bluetooth software, access Bluetooth-enabled devices, and steal information such as
contact lists, text messages, email, etc.
Bluejacking
In a Bluejacking attack, someone sends an unsolicited message to a Bluetooth-enabled
device. Bluejackers search for a receiving device (phone, PDA, tablet PC, or laptop) and
then send data to the ISP. Often, the Bluejacker attempts to send someone else their
business card, which will be added to the victim's address book contact list. Someone
sends an unsolicited message to a Bluetooth-enabled device in a Bluejacking attack.
Bluejackers look for a receiving device (PDA phone, tablet PC, or laptop) before sending
data to the ISP. Often, the Bluejacker will try to send their business card to someone
else, which will be added to the victim's address book contact list.
Note:
Bluesnarfing is unauthorized access from a wireless device through a Bluetooth
connection. It permits access to a calendar, contact list, e-mails, and text messages, and
on some phones, users can copy pictures and private videos.
Jamming
A Jamming Attack uses signals to prevent devices from communicating with each other
as well as with the server.
69
Chapter 01: Threats, Attacks, and Vulnerabilities
Radio Frequency Identifier (RFID)
Radio-Frequency Identification (RFID) uses the electromagnetic field and refers to a
technology whereby a reader reads digital data encoded in labels or tags via radio waves.
It is used to automatically classify and track tags attached to objects or to gain access to
a secured area.
Radio-Frequency Identification (RFID) is a data communication technology that uses
radio waves. An electronic tag is embedded in an object and can be identified and
communicated using a reader. The tag includes an integrated circuit for storing and
processing data, modulating and demodulating an RF signal, and performing other
specialized functions. The reader includes an antenna for receiving and transmitting
signals. For access control purposes, this technology can be integrated into smart cards
or other mobile transport mechanisms. Theft is a common RFID security issue.
RFID (Radio Frequency Identification) attacks include a variety of techniques such as:




Data Capture
Spoof the Reader
Denial of Service
Decryption of Communication
Near Field Communication (NFC)



It is commonly used when the communication is between the mobile device and
a device that is nearby.
They are commonly used in the payment system.
Also used to help with other wireless technologies like, it is used to help the
pairing process for Bluetooth, also used as an identity system where one can
identify themselves using the phone.
Some of the security concerns with NFC are as follows:




It is a wireless network (although short-range), but someone with an antenna
can capture and listen to the conversation.
Someone could jam the frequency and attack through denial of service.
There is also a concern about replay attacks.
If an NFC device is lost, it could be a major security issue because the person who
stole the device will use that NFC instead of the legitimate user.
Initialization Vectors (IV)
Vectors of Initiation Initialization vectors (IVs) are random values used with algorithms
to prevent patterns from forming during the encryption process. They are used in
70
Chapter 01: Threats, Attacks, and Vulnerabilities
conjunction with keys and do not need to be encrypted before being sent to their
destination. If no IVs are used, two identical plaintext values encrypted with the same
key will produce the same ciphertext. Giving attackers these types of patterns can make
it easier for them to break the encryption method and discover the key. For example, if
we have the plaintext value “See Spot run” twice in our message, we must ensure that,
despite the presence of a pattern in the plaintext message, no pattern is created in the
resulting ciphertext. As a result, the algorithm employs both the IV and the key to
increase the randomness of the encryption process. In the below figure, as shown, the
sender and receiver must have the same key to generate the same keystream.
Figure 1-10: Initialization Vectors (IV)
Note: Fig: The sender and receiver must have the same key to generate the same
keystream.
Man-in-the-Middle Attack
A Man-in-the-Middle Attack is the form of attack in which an attacker involves
himself in the communication between other nodes. A MITM attack is defined
as an attacker inserting himself/herself into a conversation between a user and
another user or server by sniffing packets and generating MITM or Replay traffic.
Some utilities for attempting Man-in-the-Middle (MITM) attacks are as follows:



SSL Strip
Burp Suite
Browser Exploitation Framework (BeEF)
71
Chapter 01: Threats, Attacks, and Vulnerabilities
Figure 1-11: MITM Attack
Man-in-the-Browser
In Man-in-the-Browser, the attacker first infects the victim's machine using a Trojan.
The Trojan installs malicious code on the victim’s machine in an extension that modifies
the browser's configuration upon boot. Once a user logs in to a website, the URL is
checked against a known list of the targeted websites. The event handler registers the
event upon detection. Using a DOM interface, an attacker can extract and modify the
values when the user clicks the button. The browser will send the form to the webserver
with the modified entries. Because the browser displays the original transaction details,
the user is unable to identify any interception.
Figure 1-12: Man-in-the-Browser
72
Chapter 01: Threats, Attacks, and Vulnerabilities
Layer 2 attacks
Layer 2 uses the concept of VLANs or Private VLANs (PVLAN) to separate the traffic of
two or more networks. The common layer 2 addresses Resolution Protocol (ARP)
poisoning, Media Access Control (MAC) Flooding, MAC cloning, and so on.
Address Resolution Protocol (ARP) Poisoning
ARP is a stateless protocol that ensures communication within a broadcast domain by
resolving the IP address to MAC address mapping. It is in charge of mapping L3 to L2
addresses. The ARP protocol ensures that IP addresses and MAC addresses are bound
together. The switch can study the associated MAC address information from the reply
of the specific host by broadcasting the ARP request with an IP address. If there is no
map or the map is unknown, the source will be broadcast to all nodes. Only the node
with a coordinating MAC address for that IP will respond to the demand with the MAC
address mapping packet. The switch will feed the MAC address and its connection port
information into its fixed length CAM table.
Figure 1-13: Address Resolution Protocol (ARP) Poisoning Operation
As shown in Figure 1-13, the source generates an ARP query by broadcasting the ARP
packet. A node with the MAC address that the query is destined for will reply only to
the packet. If CAM table entries are full, the frame is flooded out of all ports (other than
the port on which the frame was received). This also occurs when the frame's
destination MAC address is the broadcast address. The MAC flooding technique is used
to turn a switch into a hub, in which the switch starts broadcasting every packet. In this
scenario, each user can catch the packets, even those not intended.
Media Access Control (MAC) Flooding
73
Chapter 01: Threats, Attacks, and Vulnerabilities
MAC flooding is a technique in which an attacker sends random MAC addresses
mapped with random IP to overflow the storage capacity of a CAM table. A switch then
acts as a hub because a CAM table has a fixed length. It will now broadcast the packet
on all ports, which helps an attacker sniff the packet with ease. A Unix/Linux utility,
known as “macof,” offers MAC flooding. Using macof, a random source MAC and IP
can be sent to an interface.
Domain Name System (DNS)
Domain Name System (DNS) includes DNS Poisoning, Cybersquatting, Domain
Hijacking, and Domain Snipping. An attacker may try to spoof by poisoning the DNS
server or cache. The credentials of internal users.
The common Domain Name System (DNS) attack includes:
 Domain hijacking
 DNS poisoning
 Universal resource locator (URL) redirection
 Domain reputation
Domain hijacking
Theft of a cloud service domain name is referred to as domain hijacking. Similarly,
Phishing scams can redirect users to a bogus website. DNS hijacking is a type of attack
in which the threat actor gains access to the Domain registration and controls the traffic
flow.
Poisoning by DNS
DNS poisoning is also referred to as DNS spoofing. In a DNS Poisoning attack, the threat
actor modifies the DNS server so that when a user visits a website, it directs them to the
incorrect site (a malicious site) that they did not intend to visit (or to the site, they were
not going). DNS poisoning is accomplished by replacing the DNS configuration from a
target's web browser. All web queries are directed to a malicious proxy server controlled
by the attacker, redirecting traffic to malicious sites.
There is a distinction to be made between Hijacking and Poisoning. Spoofing involves
poisoning the DNS server's cache, whereas Hijacking involves hacking the router's DNS
settings or planting malware.
A DNS server updates its database if it receives a false entry. DNS servers maintain a
cache in which this entry is updated to provide quick query resolution to improve
performance. This poisonous false entry in DNS translation continues until the cache
expires. Attackers use DNS poisoning to direct traffic to servers and computers owned
or controlled by the attackers.
74
Chapter 01: Threats, Attacks, and Vulnerabilities
How to prevent it?




Do not go to every website you come across.
Create a password that is as strong as possible.
Make use of anti-malware software.
Being proactive can also keep you safe from cyber-attacks.
Universal Resource Locator (URL) redirection
Redirects are the exploitable vulnerabilities to steal user sessions. Destination URLs are
passed by the web applications and then redirected at the end of their operation.
Distributed Denial-of-Service (DDoS)
DDoS is similar to Denial-of-Service in that an attacker generates fake traffic. In a
Distributed DoS attack, multiple compromised systems attack a target to cause a denial
of service. Botnets are used for carrying out a DDoS attack.
A Denial-of-Service (DoS) attack on a system or network results in either denial of
service or services, a reduction in functions and operation of that system, prevention of
legitimate users accessing the resources. In short, a DoS attack on a service or network
makes it unavailable for legitimate users. The DoS attack technique is to generates huge
traffic to the target system requesting a specific service. This unexpected amount of
traffic overloads the system’s capacity and either result in a system crash or
unavailability.
Figure 1-14: Denial-of-Service Attack
75
Chapter 01: Threats, Attacks, and Vulnerabilities
Common symptoms of DoS attacks are as follows:
•
•
•
•
•
Slow performance
Increase in spam emails
Unavailability of a resource
Loss of access to a website
Disconnection of a wireless or wired internet connection
How Distributed Denial-of-Service Attacks Work
Usually, establishing a connection consists of a few steps in which a user sends a request
to a server to authenticate it. The server returns with authentication approval, and the
user acknowledges that approval. Then, the connection is established and allowed onto
the server.
During a denial-of-service attack process, an attacker sends several authentication
requests to the server. These requests have fake return addresses, meaning the server
cannot find a user to send authentication approval. The server usually waits more than
a minute before closing the session. By continuously sending requests, the attacker
causes many open connections on the server, resulting in the denial of service.
Application
A Distributed-Denial-of-Service Attack, as defined earlier, is intended to make the
target’s services unavailable. Using a Distributed-DOS attack, all IoT devices, IoT
gateways, and application servers can be targeted, and flooding requests toward them
can result in a denial of service.
Operational Technology (OT)
Operational Technology is a broad term that covers the operational network of an
organization, usually based on Industrial Control Systems (ICS). ICS refers to a control
system based on devices, systems, and controls used for the operation or function of an
automated industrial process. Different nature of industries utilizes different types of
industrial controls having different functions with different protocols. ICS is used in
almost every industrial sector, such as manufacturing, transportation, energy, aviation,
and many more. The most common ICSs are Supervisory Control and Data Acquisition
(SCADA) systems and Distributed Control Systems (DCS).
Operational technology is defined by the National Institute of Standards and
Technology as "programmable systems" or “devices that interact with the physical
environment." These systems/devices detect or cause a direct change through
monitoring and/or controlling equipment, processes, and events. Industrial control
76
Chapter 01: Threats, Attacks, and Vulnerabilities
systems, building management systems, fire control systems, and physical access
control mechanisms are examples of such systems.
Figure 1-15: Overview of OT Environment
Malicious Code or script execution
Malicious Code is the most common attack in which a file containing malicious code
stored in a USB runs when the user clicks on it. It then activates and installs some viruses
such as a logic bomb or downloads other malware from the internet.
The common Malicious Code or script execution are as follows:





PowerShell
Python
Bash
Macros
Virtual Basic for Applications (VBA)
PowerShell
PowerShell is a command-line shell and related scripting language that gives adversaries
access to almost everything in Windows.
Python
Python is cross-platform, meaning it is run on Linux/Windows as long as it is installed
on the operating system. It is an easily readable scripting language that uses .py file
extensions. It uses block identification (tabs or white spaces) for group statements, and
its second and third version is not backward compatible.
bash
A bash script is created as, place #! /bin/bash at the top of the file. From the current
directory, execute the script as, /script name, and any parameters of anyone’s choice
77
Chapter 01: Threats, Attacks, and Vulnerabilities
could be passed. The #! /path/to/interpreter is found while the shell is executing a
script.
Macros and Visual Basic for Application (VBA)
Macros are programs that are typically used with Microsoft Office products and are
written in Word Basic, Visual Basic, or VBScript. Macros help users automate actions
that they would otherwise have to do manually. Instead of performing each action
separately, users can create a series of activities and common tasks to perform when a
button is clicked. A macro virus is a platform-independent virus built in one of these
macro languages. They infect and proliferate in documents and templates. Macro
viruses are common because they are simple to create, and widely used software such
as Microsoft Office makes heavy use of macros.
A Macro Virus is a kind of virus specially designed for Microsoft Word, Excel, and other
applications using Visual Basic for Application (VBA). Macro languages help automate
and create a new process used abusively by running on a victim's system.
Mind Map
Figure 1-16: Mind Map of Potential Indicators in Network Attacks
78
Chapter 01: Threats, Attacks, and Vulnerabilities
Threat Actors
One of the roles of information security professionals is to proactively define their
organization’s systems and data. It, like any defensive strategy, necessitates knowledge
of the adversary's tactics and motivations. CompTIA's Security+ Exam is intended to
assess candidates' knowledge of the various types of threat actors and their
characteristics.
Adversary Tier
When a company performs a black-box penetration test, one of the first questions it
asks is, "Who would attack us and why?" Answering that question can assist
management in making decisions about how a penetration test will be conducted, what
techniques will be considered in the engagement, the scope of the test, and who will
conduct
it.
Threat actors are frequently rated based on their capabilities. For example, script kiddies
and casual hackers use pre-built tools to conduct their attacks, and most organizations
consider their attacks to be nuisance-level threats. However, as you continue down the
threat actors' adversary tiers as shown below Figure. The likelihood of a successful
attack and compromise increases as professional hackers organized crime. The nationstate–level attackers such as Advanced Persistent Threats (APTs) enter your threat
radar, which means that you should prepare for a breach and plan consequently.
Each of these potential adversaries is likely to have a different goal in mind: hacktivists
may want to make a political or social statement, whereas black hats and organized
crime are more likely to be profit-driven. APT actors are typically focused on the goals
of a nation-state, with other attacks motivated by different objectives.
Figure 1-17: Adversary Tier
79
Chapter 01: Threats, Attacks, and Vulnerabilities
Advance Persistent Threats (APT)
Advance Persistent Threats are the most sophisticated threats for an organization.
These threats require significant expertise and resources along with the combination of
multiple attack vectors. They further require extended foothold and adoption of security
controls placed in the target organization to evade and continually exfiltrate the
information or achieve motives. Moreover, these threats pursue their objective over an
extended period.
Figure 1-18: Advance Persistent Threats
NIST defines advanced persistent threat characteristics as:
Consisting of Multi-Attack-Stage
APT tactics, including pre-requisites and post-conditions
Pursuing its objectives repeatedly over an extended period of time
Stealth between the individual attack steps
Adapting to defenders’ efforts to resist it
Grouped set of adversarial behaviors and resources with common properties
believed to be orchestrated by a single threat actor
7. Determined to maintain the level of interaction desirable to execute its objectives
8. Concerned with what data are exfiltrated and how
1.
2.
3.
4.
5.
6.
A successful APT attack can be extremely beneficial for threat actors because of its
sophistication and targeted nature. There could be extreme political objectives targeting
80
Chapter 01: Threats, Attacks, and Vulnerabilities
military, defense, and other sensitive government bodies if state-sponsored. In smaller
scope, APTs can be significant for competitive outcomes.
Insider Threat
One of the greatest dangers that associations face is insider threats. These incorporate
the accidental loss of information of on-screen characters who take data or bargain
frameworks. In a large number of these cases, the loss of information could have been
relieved or anticipated with powerful penetration testing. However, very few
associations know about the advantages of penetration testing and are making
themselves open to ruptures.
An insider can also misuse a system within a corporate network. Users are termed
“Insiders” and have different privileges and authorization power to access and grant the
network resources.
Figure 1-19: Insider Threat
Hacktivists
Hacktivists draw attention to the target to deliver a message or promoting an agenda.
The expression hacktivism, which joins hack and activism, refers to the utilization of
PCs and some other IT framework or system to discuss and continue a political issue,
advance free speech, and support human rights. Hacktivism is fundamentally
deciphered by society as the transposition of a challenge and the common noncompliance into the internet. Hacktivism is the utilization of innovation to express
dispute. From a security point of view, there are two schools of thought: One considers
hacktivists cybercriminals to be arraigned; the other, despite being aware of the hazard
81
Chapter 01: Threats, Attacks, and Vulnerabilities
they speak up for, is a voice to listen to. It has definite effects on society with web clients'
propensities, business security, and government strategies.
Script Kiddies
A Script Kiddie, or "skiddie," is somebody who needs to have software understanding
and uses existing programs to dispatch an attacker. They are most likely to only use prebuilt attack tools and techniques. More advanced attackers will customize existing tools
or even build new tools and techniques to compromise a target. Frequently, a script
kiddie will utilize these projects without knowing how they work or what they do. For
instance, imagine a youngster getting their first PC. The kid watches a motion picture
about hacking and, after that, downloads a duplicate of Kali Linux. They start playing
with different projects while hunting down online instructional exercises. They might
think of it as just a web troll because of their absence of experience.
Note: Script kids lack the necessary skills to carry out specific attacks without their tools
on the Internet and through friends. Because these people do not necessarily
understand how the attacks are carried out, they are likely unaware of the extent of
damage they can cause.
Criminal Syndicates
A Criminal investigation deals with an allegation of criminal misconduct and violation
of federal, state, or local criminal codes. A criminal investigation occurs when a crime
has been committed, and you work with a law enforcement agency to convict the alleged
committer. It is common to gather evidence for a court of law and share the defense
evidence in such a case. As strong evidence is a key feature of this type of investigation,
using this method to gather information is useful for presenting in a court of law.
Hacker
A hacker can steal information or data such as financial information, business data,
personal data, credit card information, username, and password from a system to which
they do not have authorized access. An attacker gains access by gaining unauthorized
control of the system through various techniques and tools. They have exceptional skills
and abilities in developing software and the exploration of both software and hardware.
Hacking can be done for various reasons, the most common of which are for fun, money,
thrills, or a personal vendetta.
82
Chapter 01: Threats, Attacks, and Vulnerabilities
Figure 1-20: Different Types of Hackers
Google Play Hack
Ibrahim Balic, a Turkish hacker, hacked Google Play twice. He accepted responsibility
for the Google Play attack and claimed to be the mastermind behind the Apple
Developer site attack. He discovered a flaw in the Android operating system while
testing vulnerabilities in Google's Developer Console. He tested the flaw twice to ensure
that it truly existed and then used the results of his vulnerability testing to create an
Android application that exploited the flaw. Users were unable to download
applications, and developers could not upload their applications when the developer's
console crashed.
Competitors
The competitors in the organization are significant threat actors. They may attack with
multiple goals in mind, such as corrupting or stealing data or bringing someone's system
down. Competitive intelligence gathering is a method of gathering information,
analyzing it, and compiling statistics on competitors. The process of gathering
competitive intelligence is non-interfering because it gathers information through
resources such as the internet, the target organization's website, advertisements, press
releases, Annual Reports, Product Catalogues, analyst reports, and agents and
distributors.
Threat Actor Attributes
Internal/External
83
Chapter 01: Threats, Attacks, and Vulnerabilities
Internal threat actors have a significant advantage over external threat actors. They have
a limited approach to the system compared to the user, but this gives them the strength
to continue their attack. On the other hand, external threat actors must go through an
additional step to first gain access to the targeted system.
Level of Sophistication
The higher a threat actor's skill level, the better he or she will lead and plan attacks.
Strong skills result in using the simplest methods, which is directly related to the level
of sophistication.
Resources/Funding
A criminal organization has a large team and budget to continue operations for an
extended period. Advanced Persistence Threats necessitate significant resources to
engage in these types of actions, so long-term resources that large organizations or
states can manage are desired.
Intent/Motivation
The motivation or intention behind any attack can be simple or complex. For example,
the threat actor may simply wish to carry out a technique or steal something valuable.
Vectors
Vectors can be categorized as follows:







Direct access
Wireless
Email
Supply chain
Social media
Removable media
Cloud
Wireless
Wireless networks are a very common and popular technology. Because of the ease and
mobility of the wireless network, it has been replacing the installation of wired
networks. Using wireless networks increases not only mobility but also flexibility for
end-users. One more advantage of wireless technology is that it helps connect remote
areas where wired technology is difficult to implement. In the early days of wireless
technology, the network was not secure enough to protect information. However, many
encryption techniques are used nowadays to secure wireless communication channels.
84
Chapter 01: Threats, Attacks, and Vulnerabilities
Email
A major risk factor is the email system. Therefore, the DLP appliance is used by many
organizations that monitor, track and filter all the inbound and outbound emails.
Supply Chain
In September 2015, the researchers found that many Cisco routers are infected by a
malicious firmware called “SYNful Knock.” This malicious firmware allows the threat
actor to gain backdoor access to the infrastructure devices, creating trust issues. End
users realized that they require vendors in the supply chain who they can rely on to
know where this hardware is coming from. They must also ensure that these critical
devices are not connected to the Internet before security is implemented. It is always
useful to verify in some way that the hardware and the firmware inside of that hardware
are secure.
Social Media
Social media is indeed a blessing, but it easily applies some questions to the system
regarding security. Valuable information must be kept secure from the public sphere as
much as possible. Every company should have some secure boundaries for the
marketing strategies they follow.
Removable Media
In a high-security organization, users should minimize or eliminate the use of
removable media, including any removable storage devices that rely on USB or other
connection methods. It can minimize malicious files coming into the network from the
outside and data leaving the company on tiny storage mechanisms.
Cloud
Cloud-based DLP (Data Loss Prevention) is used by many organizations between users
and the internet. Every bit that goes through the DLP tool means it watches every bit of
network traffic. Everything takes place in the cloud, and no hardware or software is
required for this purpose.
Real-World Scenario
Background
Scams involving executive impersonation are on the rise, costing firms billions of dollars
each year. These crimes can target and victimize organizations of all sizes.
Challenge
A company’s email is compromised or spoofed by using social engineering to assume
the identity of the CEO, company attorney, executive, or a trusted vendor or customer.
85
Chapter 01: Threats, Attacks, and Vulnerabilities
Criminals greatly understand the victim’s normal business practices as a part of their
homework.
The executive impersonation scams are categorized as variations of the FBI's Business
Email Compromise (BEC) scam. BEC is defined to be a sophisticated scam targeting
businesses that work with foreign suppliers and/or businesses that regularly perform
wire transfer payments. The legitimate business email accounts are compromised to
carry out the scam. The unauthorized funds are transferred through social engineering
or computer intrusion techniques. This being said, what are the challenges we face, and
how to resolve the issue?
To resolve this issue, we may consider two scenarios:
Scenario #01
Data Theft:
One or more of the victim company’s executives’ email addresses are compromised in a
data theft scenario. An associate employee responsible for handling payroll or another
company employee’s Personal Identifiable Information (PII) is connected using the
executive’s email address.
Employees in Human Resources, Finance, Payroll, or Audit are the targeted individuals.
The executive’s request often expresses an urgent need for payroll or other PII data. The
crime has recently ramped up due to tax season and the associated urgency to get tax
returns completed.
Scenario #02
Executive EFT and Wire Transfer Request
What appears to be the executive as the initiator of the request is involved in this
scenario. A hacked or spoofed email address is involved in requesting if the executive's
email account is compromised. In many of the cases that took place, the criminals
hacked into the email system, and the normal business process for EFT transfer is
determined. The criminals then send the fraudulent executive email to the company’s
employees. The respective employee is responsible for handling the EFT process and
requests that the EFT be made to a customer, vendor, or financial institution.
The executive is targeted with an email in a variation of the executive wire transfer scam
that appears to be from a trusted party; vendor, customer, or foreign supplier. The prior
successful EFTs that have been completed in the past are matched with the email. Also,
86
Chapter 01: Threats, Attacks, and Vulnerabilities
the faxes or phone calls corresponding to past legitimate requests are involved in many
cases.
Figure 1-21: Typical Scenarios in Executive Impersonation Scams
Solution
How to Protect a Company?
The security awareness training, called the Executive Impersonation Fraud, is a crime
that can help to reduce risk. A fundamental part of security awareness training is
awareness of new crimes and scams in the news. The likelihood that your company will
be victimized is greatly reduced by ensuring that the employees know about this scam.
Following are some key points that are used to head off these types of scams:
* Strong internal prevention processes and procedures should be required for every
company while dealing with all EFT requests. These crimes could be prevented from
occurring by a simple, direct confirmation phone call
* All EFT requests should be held with strict external verification procedures for some
time
* Any request for sensitive data or EFT transfers involving secrecy or quick action should
be viewed as suspect.
* On the suspect’s email messages, use the “Forward” option instead of “Reply” or “Reply
All.” The likelihood of using the legitimate email address from the address book is
increased by forwarding the message to the sender. A spoofed address from the original
email is not used in this case
* Information posted on the company’s websites and social media’s sites should be
restricted and reviewed, and the details of individuals’ job duties and the organizational
structure of the company should be provided
87
Chapter 01: Threats, Attacks, and Vulnerabilities
*Always be aware of the account changes for suppliers while establishing the
relationship. A backup authentication method should be arranged that is separate from
email to avoid interception by the hacker
* An alternative backup method is utilized to authenticate and verify a request before
sending funds or data
*Ongoing security awareness training should be provided for employees to keep them
updated on the latest security scams
Mail services are configured with SPF and DMARC.3 to block spoofed emails from being
allowed into an organization
Conclusion:
The growth of innovative technology and its evolving threats needs to be monitored as
impersonation scams are increasing. The banking Trojan targets need to be analyzed.
The possibility for an organization to be a victim can be reduced by understanding how
these crimes are committed and the various variations and vectors of attacks.
Threat Intelligence sources
Open-source intelligence can also be referred to as open-source threat intelligence. The
term "OPSIT" refers to intelligence data gathered from open or public sources and is
primarily used in law enforcement, national security, and business intelligence.
One of the most important decisions is where to apply one's resources in the complex
environment of cybersecurity defenses. Threat intelligence collects information from
multiple sources that allows a system to focus on its defenses against potential threat
actors.
Open Source Intelligence (OSINT)
Open Source Intelligence (OSINT) uses open-source tools to gather statistics from
widely accessible sources and then analyze them to decide or take some action. OSINT
may be damaging when hackers use it to get knowledge about an organization. Data
from sources that are publicly available are included in OSINT. Information outside a
technology-centric organization is also included in it.
Closed/Proprietary
‘Proprietary’ is something that is owned and controlled by an individual or organization.
Therefore, proprietary data is something that is confined to a business for competitive
use.
Proprietary labeled data can be shared with a group of users other than a competitor.
The label of proprietary alerts the group not to further share that proprietary data. For
protecting proprietary data, the laws of secrecy, copyright, patent are used.
88
Chapter 01: Threats, Attacks, and Vulnerabilities
Vulnerability databases
The U.S. National Vulnerability Database (NVD) was launched by the National Institute
of Standards and Technology (NIST). The CVE entities are input to the NVD, which
automates vulnerability management, security, and compliance management using
CVE entries to provide enhanced information for each entity, for example, fixing
information, severity scores, and impact ratings. Apart from its enhanced information,
the NVD also provides advanced search features such as using an Operating System,
vendor’s name, product name, version number, and vulnerability type, severity, related
exploit range, and impact.
Dark web
Cyber attackers sell credit and debit card details on the Dark Web – their motive is clear
profit. Financial motivations are among the greatest reasons for targeting individuals
and organizations. It is no surprise that, according to Juniper Networks, cybercrime is
estimated to become $2.1 trillion by 2019.
Indicators of compromise
IOCs known as Indicators of compromise are “pieces of forensic data, such as data or
information found in system log entries or files, that identify potentially malicious
activity on a system or network.” Compromise indicators assist information security,
and IT professionals detect data breaches, malware infections, and other threat actors.
Organizations can detect attacks and act rapidly to prevent breaches or limit the
damage by stopping attacks in the early stages by monitoring for indicators of
compromise.
Automated Indicator Sharing (AIS)
The Automated Indicator Sharing (AIS) capability of the Cybersecurity and
Infrastructure Security Agency (CISA) enables the real-time exchange of machinereadable cyber threat indicators and defensive measures to help protect AIS community
members and, ultimately, reduce the prevalence of cyberattacks.
Trusted Automated eXchange of Indicator Information (STIX)/Structured Threat
Information eXpression (STIX) (TAXII)
TAXII (Trusted Automated eXchange of Indicator Information) is the core transport
mechanism for cyber threat information represented in STIX. Through TAXII services,
organizations can share cyber threat information in a secure and automated manner.
The STIX and TAXII communities work closely to ensure that they continue to provide
a full stack for sharing threat intelligence.
89
Chapter 01: Threats, Attacks, and Vulnerabilities
Predictive Analysis
Predictive analytics software applications employ variables that can be measured and
analyzed to forecast the likely behavior of people, machines, and other entities.
Predictive analytics has a wide range of applications. For example, when pricing and
issuing auto insurance policies, an insurance company is likely to consider potential
driving safety variables such as age, gender, location, type of vehicle, and driving record.
Threat Maps
Threat Mapping is another term for Vulnerability Mapping. It entails identifying
weaknesses in an environment, design flaws, and other security concerns that can
misuse an operating system, application, or website. Misconfigurations, default
configurations, buffer overflows, operating system flaws, open services, and so on are
examples of vulnerabilities. To scan a network for vulnerabilities, network
administrators and pen testers can use a variety of tools. Vulnerabilities are classified
into three categories based on their threat level: low, medium, and high. Furthermore,
they can be classified as either local or remote exploit ranges.
File/Code Repositories
Code repositories serve primarily as a central storage location for developers' source
code. Code repositories such as GitHub, Bitbucket, and SourceForge also provide
version control, bug tracking, web hosting, release management, and communications
functions that support software development. Code repositories are wonderful
collaborative tools that facilitate software development, but they also have security risks
of their own. To overcome this, developers must carefully design access controls only to
allow read and/or write access to authorized users.
Research Sources
The Research phase includes collecting information about a target organization. It may
be collected through dumpster diving, scanning an organization’s website, finding
information on the internet, gathering information from employees, etc.
Vendor Websites
Third-party users, such as vendors, consultants, and contractors, require access to
information and related systems in order to perform their job functions. Information
security begins with screening, confidentiality, and non-disclosure agreements.
Academic Journals
The term "vulnerability" is commonly used in the social sciences and policy-making,
health and social care services, and social work to refer to a wide range of groups or
individuals, but it has rarely been ideally defined or analyzed. The aim is to analyze and
clarify the concept for social work research critically. It is also important to recognize
the temporal, situational, relational, and structural nature of vulnerability.
90
Chapter 01: Threats, Attacks, and Vulnerabilities
Vulnerability Feed
Vulnerability management solutions, like any technology product, require care and
feeding. Regular maintenance of the vulnerability scanner should be conducted to
ensure the vulnerability feeds and the scanning software remain up to date.
Request for Comments (RFC)
A Request for Comments (RFC) is a formal document drafted by the Internet
Engineering Task Force (IETF) that describes the specifications for a particular
technology. Once an RFC is ratified, it becomes a formal standards document.
Conferences
To maximize the effectiveness of disaster recovery procedures, a training and awareness
campaign is beneficial. Occasionally, technical teams will gain disaster recovery
knowledge while attending training classes or conferences on the technology. But it is
also essential to train in disaster recovery procedures and policies for the organization.
Adversary Tactics, Techniques, and Procedures (TTP)
Tactics, Techniques, and Procedures (TTP) describe a method of analyzing an APT's
operation or can be used to profile a specific threat actor. Tactics refer to how an
adversary chooses to carry out his attack from start to finish. Finally, the organizational
approach of the attack is defined by the threat actor's procedures. To understand and
fight the enemy, one must first understand the attacker's Tactics, Techniques, and
Procedures (TTP). Knowing an adversary's tactics can help predict upcoming attacks
and detect those in the early stages. Understanding the Techniques used during the
campaign allows the organization to identify its blind spots and implement
countermeasures ahead of time. Finally, analyzing the adversary's procedures can help
to understand what the adversary is looking for within the target's infrastructure.
TTP described within this research is meant to show the complexity of the life-cycle
rather than provide an exhaustive list. Furthermore, it is demonstrated that attackers
can use readily available tools to carry out certain stages of the attack, allowing them to
focus on the tactical aspect rather than developing tools.
91
Chapter 01: Threats, Attacks, and Vulnerabilities
Mind Map
Figure 1-22: Mind Map of Threat actors
Vulnerability Assessment
Vulnerability is a weak point or loophole in any system or network that attackers can
exploit to gain access to the system. Any vulnerability can be used as an entry point to
their target.
Vulnerability assessment is the process of examining, identifying, and analyzing a
system's or application's ability to withstand any threat, including security processes
running on the system. Vulnerability assessment allows you to identify system flaws,
prioritize vulnerabilities, and estimate the need for and effectiveness of any additional
security layer.
Types of Vulnerability Assessment
Following are the types of vulnerability assessment:
92
Chapter 01: Threats, Attacks, and Vulnerabilities
1.
2.
3.
4.
5.
6.
7.
8.
Active Assessment
Passive Assessment
Host-based Assessment
Internal Assessment
External Assessment
Network Assessment
Wireless Network Assessment
Application Assessment Network
Vulnerability Assessment Methodology
A network vulnerability assessment examines the potential for an attack and
vulnerabilities in a network. The phases of a Network Vulnerability Assessment are as
follows:
Figure 1-23: Network Vulnerability Assessment Methodology
Acquisition
The Acquisition phase compares and reviews previously identified laws, vulnerabilities,
and procedures related to network vulnerability assessment.
Identification
Interaction with customers, employees, administration, or other people involved in
network architecture design during the Identification phase to gather technical
information.
93
Chapter 01: Threats, Attacks, and Vulnerabilities
Analysis
The information gathered is reviewed in the Analysis phase. It entails the following
steps:
• Reviewing information
• Analyzing the results of earlier recognized vulnerabilities
• Risk assessment
• Vulnerability and risk analysis
• Evaluating the effectiveness of existing security policies
Evaluation
The Evaluation phase includes:
• Inspection of identified vulnerabilities
• Identification of flaws, gaps in an existing network, and required security
considerations in a network design
• Determination of security controls required to resolve issues and vulnerabilities
• Identification of the required modification and upgrades
Generating Reports
Reports are written during the Reporting phase to document the security event and to
present to higher authorities such as a security manager, board of directors, or others.
This documentation will also come in handy for future inspections. These previously
gathered reports are also required for auditing and penetration testing. When changes
to the security mechanism are required, these reports aid in designing the security
infrastructure. These reports are typically stored in central databases. Reports include
the following information:
•
•
•
•
•
Tasks completed by each member of the team
Methods and tools used
Findings
Recommendations
Gathered information
Zero-day Attacks
There are flaws in many operating systems and applications. People are working hard
to find those flaws before the hacker does. In a zero-day attack, the attacker discovers
previously unknown vulnerabilities and exploits them before security patches are
available. It means that a zero-day attack takes advantage of vulnerabilities that are
unknown to everyone except the attacker.
Weak Configurations
94
Chapter 01: Threats, Attacks, and Vulnerabilities
Weak configuration is a vulnerability that prevents the system from meeting all of its
security objectives. The type of vulnerability allows attackers to gain access and raises
their privilege level.
Unsecure protocols
Examples of insecure protocols are Telnet and the early versions of SNMP (v1 and
v2c). Insecure protocols allow attackers and hackers to easily have access to your data
and even to remote controls.
Open permissions
Another most common mistake over the internet is the permission issue; it happens
when a file is shared over the internet, and it is not protected with the righteous
permissions, and anyone can access that file and use it in a way that is not protected
supported. Therefore, permission and permission logs should be audited actively for
such behavior in order to keep the network secure.
Error
Error and Exception encounter in an application is common, and it needs to be handled
in a secure manner. One of the attack methodologies forces an error to move
applications from normal to exceptional handling. If the exception handling is
improper, it can lead to a wide range of disclosure. For example, SQL errors disclose
data elements and data structure. Sensitive information like server, filename, and path
can be disclosed by RPC (Remote Procedure Call) error, and programmatic error can
disclose information like stack element or line number on which exception occurred.
Weak encryptions
Weak encryptions may be used during the data transmission between the server and
other systems. It can be either weak encryption or no encryption at all.
Default Setting
As no security against default settings can make the system vulnerable, default settings
must be secured from the start. This type of vulnerability, like weak configuration,
allows attackers to enter and advance their privilege level.
Open Ports and Services
The Metasploit Framework allows you to automate the discovery and exploitation
process while also providing you with the tools you need to perform the manual testing
phase of a penetration test. Metasploit Pro can be used to scan for open ports and
services, exploit vulnerabilities, pivot deeper into a network, collect evidence, and
generate test results reports. A honeypot, for example, is a computer set up on the
network as a sacrificial lamb. The system is not locked down, and all ports and services
are open. This is done to divert a potential attacker to this computer rather than
95
Chapter 01: Threats, Attacks, and Vulnerabilities
attacking legitimate production systems on a network. Because the honeypot contains
no real company information, it will not be compromised if and when it is attacked.
Improper or Weak Patch Management
Patch management is the process of software and application patch up-gradation,
including installing patches, acquiring, and testing. All Operating Systems require an
update and have different methods for the users to keep their systems up to date.
“The process of discovering, purchasing, installing, and verifying fixes for systems and
products is known as patch management. Patches are used to resolve bugs in software
and firmware that affect security and functionality.”
Firmware
Software instructions are stored in Read-Only Memory (ROM) or a Programmable
Read-Only Memory (PROM) chip.
Operating System (OS)
An Operating System is an interface (system software) to make hardware functional. It
is an intermediary between applications and computer hardware. Windows, macOS,
ChromeOS, BlackBerry, Linux are the common and popular operating systems.
Figure 1-24: Working of an Operating System
Types of Operating System
Some types of Operating systems are discussed below:

Network Operating System:
96
Chapter 01: Threats, Attacks, and Vulnerabilities
The network components use the network Operating System to provide computation and
configuration portions for networking. Every networking equipment vendor has its own
operating system like Cisco has IOS, Juniper has Junos, etc.

Server Operating System:
The “Server Operating System bridges the gap between a running application on the
server and server hardware.” Windows Operating system and Linux Operating System
are two examples of Server operating systems. Windows Operating System has a
commanding lead in the market due to its Active Directory Technology and built-in
Hyper-V capability.

Workstation Operating System:
The Workstation Operating System provides functional working space and the
graphical interface for a user to interact with the system and its different applications.
Windows are commonly seen in the role of Workstation Operating System due to the
reason of a high level of user interaction with the workstations.

Appliance Operating System:
Special-purpose appliances typically have their own operating systems. These are the
special-purpose operating systems for usual vendor-specific appliances designed to
perform specific functions only considering economics portability and functionality.

Kiosk:
Kiosks are machines that are usually set up with auto-login in a browser. The OS in
Kiosk is locked down to minimal functionality to prevent users from making any
configuration changes.

Mobile Operating System:
A type of Operating system that is optimized for mobile hardware. The Mobile
Operating System is categorized into two main types; Google’s Android OS and Apple’s
iOS. These Operating Systems are optimized to both Device capability and Desired
functionality.
Application
Application management is a challenge. Not all applications are secure, and some are
malicious, which is a rapidly growing security concern is.
How do Web Applications Work?
A web application functions in two steps;
- front-end
- back-end.
97
Chapter 01: Threats, Attacks, and Vulnerabilities
Users’ requests are handled by the front-end, where the user interacts with the web
pages. Services are communicated to the user from the server through buttons and other
controls on the web page. All processing is controlled and processed on the back-end.
Server-side languages include:






Ruby on Rails
PHP
C#
Java
Python
JavaScript
Client-side languages include:



CSS
JavaScript
HTML
Web applications work on the following layers:



Presentation Layer: This is responsible for displaying and presenting information
to the user on the client end.
Logic Layer: This is used to transform, query, edit, and otherwise manipulate
information to and from forms.
Data Layer: This is responsible for holding data and information for the
application as a whole.
Legacy Platforms
Virtual machines do a good job of serving legacy applications. A legacy application may
simply be incompatible with newer hardware and/or operating systems. Even if it does,
it may underutilize the server, so consolidating several applications makes sense.
Without virtualization, this may be difficult because such applications are not typically
written to coexist within a single execution environment.
Impacts
When an incident or risk occurs, it creates an impact on an organization. The impact
can be a financial gain or instability, reputational rise and fall, Data loss, data breaches,
Data exfiltration, Identity theft, Availability loss, and much more.
Data Loss
One of the most common potential threats that makes cloud security vulnerable is data
loss. Data loss can occur through either intentional or unintentional means. Massive
data loss, whether on a large or small scale, is disastrous and costly.
Breach of Data
98
Chapter 01: Threats, Attacks, and Vulnerabilities
Data Breaches are the most common threats to every platform. Improper encryption or
loss of encryption keys may result in data modification, erasing, theft, or misuse.
Data Exfiltration
It is the process when data from a network is taken in an unauthorized way and used
against the law. It is a security threat when someone can easily copy or retrieve data
from inside of a network and take it outside as their own.
Identity Theft
Personal impersonation is identity theft when an attacker has enough personal
information about an authorized person. An attacker impersonates a legitimate user by
providing the legitimate user’s personal information (either collected or stolen).
Impersonating a technical support agent and asking for credentials is another way to
impersonate and gather information.
Financial
The final arbiter of all work is ‘Finance' that helps us to manage a score. The gain can be
measured by profit and loss through unmitigated threats. When impacts overreach the
predicted costs linked with the planned residual risks, it turns into an issue and impacts
profit.
Reputation
One of the essential values in marketing is Reputation. Junky history or shoddy record
ruins the company’s reputation and costs the company in client base and revenue. For
example, nobody wants to give up personal information or contract with a bank with a
junky history
Availability Loss
Availability loss includes flooding and denial-of-service attacks that prevent legitimate
users from connecting or accessing the wireless network. Availability loss can be carried
out by authentication flooding, ARP poisoning, de-authentication attacks,
disassociation attack, etc.
99
Chapter 01: Threats, Attacks, and Vulnerabilities
Mind Map
Figure 1-25: Mind Map of Types of Vulnerabilities
Threat Hunting
Threat hunting is closely interconnected to penetration testing but serves a different
and distinct purpose. Threat hunters, like penetration testers, try to put themselves in
the attacker's shoes and imagine how hackers might try to circumvent an organization's
security controls. What these two disciplines do with this information differs.
While penetration testers try to evaluate an organization's security controls by testing
them in the same way that an attacker would, threat hunters use the attacker mindset
to search the organization's technology infrastructure for artifacts of a successful attack.
They consider what a hacker might do and what type of evidence they might leave
behind before going in search of that evidence.
Threat hunting is based on the “presumption of compromise,” a cybersecurity
philosophy. This approach assumes that attackers have already successfully breached
an organization and searched for evidence of successful attacks. When threat hunters
identify a potential compromise, they enter incident-handling mode, attempting to
contain, eliminate, and recover from the compromise. In order to correct deficiencies,
they also conduct a post-mortem analysis of the factors that contributed to the
100
Chapter 01: Threats, Attacks, and Vulnerabilities
compromise. Another similarity between penetration testing and threat hunting is postevent remediation: organizations use the output of both processes in similar ways.
Intelligence Fusion
Threat actors are very clever and intelligent; they stalk their targets and use various
methods of identity theft such as email phishing and eavesdropping. Once they have
obtained the identity, they attempt to gain access to the system or network in order to
do whatever they want.
Threat Feeds
Thread management solutions, like any technology product, require care and feeding.
Regular maintenance of the vulnerability scanner should be conducted in order to
ensure the vulnerability feeds and the scanning software remain up to date.
Vulnerability Scanning
Various tools have made finding vulnerabilities in an existing environment very easy in
this age of modern technology and advancement. Different tools, automated as well as
manual, are available to help find vulnerabilities. Vulnerability Scanners are automated
utilities specially developed to detect vulnerabilities, weaknesses, problems, and
loopholes in operating systems, networks, software, and applications. These scanning
tools thoroughly inspect scripts, open ports, banners, running services, configuration
errors, and other areas.
These vulnerability scanning tools include:






Nessus
OpenVAS
Nexpose
Retina
GFI LanGuard
Qualys FreeScan, etc.
These tools are used by security experts to inspect running software and applications to
find risks and vulnerabilities and by attackers to find out loopholes in an organization's
operating environment.
Lab 1-01: Installing and Using Vulnerability Assessment Tool
Main Objective: In this lab, you will learn how to set up and operate a vulnerability
assessment tool. Vulnerability scanning can be done with a variety of tools. The one I
am going to install and use is “Nessus.”
101
Chapter 01: Threats, Attacks, and Vulnerabilities
Go to the browser and type ‘Nessus Home.’ Click on the Nessus home link that has been
marked below.
This is going to take you to the Nessus registration page. You need to register in order
to get the activation code, which you are going to need to activate Nessus.
102
Chapter 01: Threats, Attacks, and Vulnerabilities
For registration, you need to put in your first name, last name, email address. Check the
checkbox and click on register.
Now to download Nessus, click on the download link.
103
Chapter 01: Threats, Attacks, and Vulnerabilities
Select the Operating system on which you are going to install Nessus. Here, we will be
installing it on Windows 8 machine (64 bit). Therefore, we will download the first link,
which is for the 64-bit version of Windows.
Now read the agreement and click on “I Agree.” Save the file to a computer.
104
Chapter 01: Threats, Attacks, and Vulnerabilities
Download and install the software.
105
Chapter 01: Threats, Attacks, and Vulnerabilities
Click "Next" after selecting "I agree."
Now, if you want to change the file destination, you can change it by clicking on the
‘change’ button or else just click “Next.”
106
Chapter 01: Threats, Attacks, and Vulnerabilities
Now, click on the “Install” button.
107
Chapter 01: Threats, Attacks, and Vulnerabilities
Once you click ‘install,’ the installation process will start.
108
Chapter 01: Threats, Attacks, and Vulnerabilities
The installation is complete. Click ‘Finish.’
109
Chapter 01: Threats, Attacks, and Vulnerabilities
It is installed now, and you are going to see this window. Just click on ‘Connect via SSL.’
110
Chapter 01: Threats, Attacks, and Vulnerabilities
Click on the ‘Advanced’ option.
111
Chapter 01: Threats, Attacks, and Vulnerabilities
Now, click on ‘Proceed to localhost.’
112
Chapter 01: Threats, Attacks, and Vulnerabilities
You now have to create an account for the Nessus server. Here, you are going to choose
a login name and password and make sure you remember it because this is what you
are going to use to log in to Nessus from now on. After inserting the username and
password, click on the ‘Continue’ button.
113
Chapter 01: Threats, Attacks, and Vulnerabilities
Now choose the scanner type that you want. Here, we have selected the first one, which
is ‘Home, professional or manager.’
114
Chapter 01: Threats, Attacks, and Vulnerabilities
Now, go to the email, copy the activation code that was forwarded to you and paste it
here. Click ‘Continue.’
After that, you are going to see this ‘Initializing’ window. It is basically fetching all the
plugins for Nessus, and this can take about 15 to 20 minutes.
Once all the plugins are installed, this Window will appear, and this is what Nessus
looks like. The first thing you have to do now is to create a policy. So, click on ‘Policies.’
115
Chapter 01: Threats, Attacks, and Vulnerabilities
Then, click on ‘Create new policy.’
You have a variety of scanner options here. We are going to perform a 'Basic Network
Scan.' To do so, select Basic network scan from the drop-down menu.
This window will now be visible to you. You must name the policy here. You can call it
whatever you like; for example, we can call it 'Basic Scan.'
116
Chapter 01: Threats, Attacks, and Vulnerabilities
In the basic setting, you have another setting option that is the ‘Permission’ setting.
Here, you have two options, one is ‘No Access,’ and the other is ‘Can Use.’ Leave it as
default and click on the ‘Discovery’ option.
Here, you have to choose the Scan Type. Either you want to scan common ports, all
ports, or you want to customize it. After selecting your desired option, click on
‘Assessment.’
117
Chapter 01: Threats, Attacks, and Vulnerabilities
Here, you are going to see three scanning options; choose whatever you want and then
click on ‘Report.’
118
Chapter 01: Threats, Attacks, and Vulnerabilities
In this window, you have multiple options, and you can see that some of them are
marked as ‘checked’ by default. For now, you can leave it as default, but if you want to
change some settings, you can change it according to your need.
In the ‘advanced’ setting option, you have three options to choose from. Select any of
them and click on the ‘Credentials’ button.
Here, we are going to choose ‘Windows' if using Windows or ‘SSH’ if using Mac or Linux.
119
Chapter 01: Threats, Attacks, and Vulnerabilities
Go ahead and insert your credentials and authentication method. If you have a domain,
you can insert that; in this case, we do not, so we are going to leave it blank. Check the
below boxes and click on the ‘Save’ button at the bottom.
And that is it. The policy has been created. Now in order to scan, you have to click on
the ‘Scan’ button up on top.
Click on the ‘Create a new scan’ option.
Go to the ‘User Defined’ option. Click on ‘Basic Scan.’
120
Chapter 01: Threats, Attacks, and Vulnerabilities
To name this Scan, we are going to label it as ‘Basic Scan,’ the same as the policy name.
You can also add a description if you want.
Select the folder where you want to save a scan and, at last, insert the IP address of the
target.
You can insert the target in different ways. Example: 192.168.1.1, 192.168.1.1/24, & test.com
121
Chapter 01: Threats, Attacks, and Vulnerabilities
You can also schedule your scan. For this, click on ‘Enabled,’ select the frequency, start
time, and time zone.
122
Chapter 01: Threats, Attacks, and Vulnerabilities
If you want to get a notification, you can add your email address. After doing all the
settings, click on the ‘Save’ button.
Here, you can see that the scanning process has started. Once the process is completed,
you can see the result by clicking on the section that is marked below.
Here is the scan result. The result is shown in multiple colors. The red represents Critical
Vulnerability. The Orange one is for High, Yellow is for Medium, Green is for Low, and
Blue is for Info.
123
Chapter 01: Threats, Attacks, and Vulnerabilities
Now, click on ‘Vulnerability’ next to the ‘Host’ option. And here, you are going to see
the vulnerabilities that have been found. Click any of that.
You can see the description of a particular vulnerability as well as a solution for it.
124
Chapter 01: Threats, Attacks, and Vulnerabilities
Here are some other vulnerabilities that were found.
125
Chapter 01: Threats, Attacks, and Vulnerabilities
False Positives
In vulnerability scanning, False Positives occur when the scanner can access only a
subset of the required information, preventing it from accurately determining whether
a vulnerability exists. False positives use more than one type of scan and cross-reference.
The most common false positives occur on static web pages.
A false positive is when the system incorrectly receives a biometric sample as being a
match. Biometric sensors can sometimes make mistakes for several reasons. The
identification process looks for a match by comparing a biometric, such as a fingerprint
or iris scan, that is presented to the system to all entries in a database. This is known as
a one-to-many search. Live biometrics change as a result of climate, age, or a possible
finger injury. These threshold settings are known as False Acceptance Rates (FARs) and
False Rejection Rates (FRRs) by vendors (FRRs).
False Negatives
False negatives tend to be produced by security systems that rely exclusively on a
negative security model. Under this approach, the system allows all traffic access unless
the traffic matches a threat signature or is otherwise identified as hostile. This means
that attackers can be successful if they can conduct their attacks to not match common
threat patterns or signatures.
Log Review
Logging is an important approach to keeping everything tracked. Typically, logs are
maintained on special devices known as Log Servers. Necessary logging should be
enabled on every device to ensure every critical activity such as logging in, changes,
modifications, and deletions are recorded. Security analysts examine these logs of all
126
Chapter 01: Threats, Attacks, and Vulnerabilities
infrastructure devices and critical server systems for signs of attempted access, both
successful and unsuccessful. The last thing before leaving the system after a compromise
is clear log entries to wipe the evidence.
Credentialed vs. Non-Credentialed
Two kinds of vulnerability assessments are offered in most vulnerability management
solutions. These assessments are credentialed and non-credentialed, also known as
authenticated and unauthenticated scans.
Non-credentialed scanning tools provide a quick view of vulnerabilities by looking at
network services only. The host exposes these services. A deeper understanding of the
application is not provided in these scans, and the network is not exposed by operating
system vulnerabilities or the vulnerabilities potentially covered up by a firewall that sits
between the host and the scanner. The false hope of the system to be safe is provided,
although attackers frequently target vulnerabilities in reality. The attackers have gained
credentialed access, and the security risk is not accurately indicated. In credential
scanning, an administrator provides the scanner with credentials. The target server is
then allowed to be connected for scanning. The existence of vulnerability is then
determined with this information, and the accuracy over non-credentialed alternatives
is improved. For example, a potential issue can be corrected by an operating system
service pack, which was detected by a vulnerability scan. Before reporting a
vulnerability, the service pack installed on the system is checked by the credentialed
scan.
Intrusive vs. Non-Intrusive
A vulnerability scanner can perform an intrusive or non-intrusive test. An intrusive test
attempts to exploit a vulnerability that can cause the remote target to crash or change.
A non-intrusive test attempts to avoid causing any harm to the target. The test typically
consists of verifying the remote service version or determining whether the vulnerable
options are enabled. Intrusive tests are usually much more accurate, but they cannot be
done in a production environment. A non-intrusive test cannot determine whether or
not a service installed is vulnerable; it can only determine whether or not it is
vulnerable.
Web Applications
Observe the functionality and other parameters of Web Applications in order to identify
vulnerabilities, entry points, and server technologies that can be exploited. These
parameters are diagnosed using HTTP requests and HTTP fingerprinting techniques.
A web application works on the following layers:

Presentation Layer: The Presentation Layer is responsible for displaying and
presenting information to the user on the client end
127
Chapter 01: Threats, Attacks, and Vulnerabilities

Logic Layer: The Logic Layer is used to transform, query, edit, and otherwise
manipulate information to and from the forms

Data Layer: The Data Layer is responsible for holding data and information for
the application as a whole
Web 2.0
Web 2.0 is the World Wide Web website generation that provides dynamic and flexible
user interaction. It provides ease of use and interoperability between other products,
systems, and devices. Web 2.0 allows users to interact and collaborate with social
platforms such as social media and social networking sites. The previous generation,
i.e., web 1.0, was limited to the passive viewing of static content. Web 2.0 offers almost
all users the same freedom to contribute. The characteristics of Web 2.0 are rich in user
experience and participation, dynamic content, metadata, web standards, and
scalability.
Web App Threats
Threats to Web Application include:
















Cookie Poisoning
Insecure Storage
Information Leakage
Directory Traversal
Parameter/Form Tampering
DOS Attack
Buffer Overflow
Log Tampering
SQL Injection
Cross-Site (XSS)
Cross-Site Request Forgery
Security Misconfiguration
Broken Session Management
DMZ Attacks
Session Hijacking
Network Access Attacks
Network
A network security assessment is, basically, an audit. It is a review of your network’s
security measures meant to find vulnerabilities in your system.
128
Chapter 01: Threats, Attacks, and Vulnerabilities
Common Vulnerabilities and Exposures (CVE) A standard nomenclature for
describing security-related software flaws is provided in this standard. It is another
platform where you can find information about vulnerabilities. CVE maintains a list of
known vulnerabilities, including an identification number and description of
cybersecurity vulnerabilities.
The U.S. National Vulnerability Database (NVD) was launched by the National Institute
of Standards and Technology (NIST). The CVE entities are input to the NVD, which
automates vulnerability management, security, and compliance management using
CVE entries to provide enhanced information for each entity, for example, fixing
information, severity scores, and impact ratings. Apart from its enhanced information,
the NVD also provides advanced search features such as using an Operating System,
vendor’s name, product name, version number, and vulnerability type, severity, related
exploit range, and impact.
Figure 1-26: Common Vulnerability and Exposures (CVE)
To learn more about CVE, go to the website http://cve.mitre.org.
Common Vulnerability Scoring System (CVSS) A standardized approach for
measuring and describing the severity of flaws related to software security is provided
in this standard. The Common Vulnerability Scoring System (CVSS) assists in
identifying the key characteristics of a vulnerability and assigns a numerical score to
reflect its severity. The numerical score is then converted into a qualitative
129
Chapter 01: Threats, Attacks, and Vulnerabilities
representation (low, medium, high, and critical) to properly assess and prioritize their
vulnerability management processes.
Security
Base Score Rating
None
0.0
Low
0. 1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 10.0
Table 1-02: CVSSv3 Scoring
To learn more about CVSS-SIG, go to the website https://www.first.org.
Review of the Configuration
The review's goal is to ensure that the system is in good working order and that its
security configuration and rule sets are effective. The evaluation will be carried out with
a number of factors in mind, including corporate policies, industry best practices, and
regulatory obligations.
SIEM (Security Information and Event Management)
Security Information and Event Management (SIEM) is an industry-standard term used
to monitor and manage networks. SIEM combines two related technologies; Security
Event Management (SEM) and Security Information Management (SIM).
SEM deals with real-time monitoring and notifying the security events such as
authentication failures and intrusion events generated by the security systems. At the
same time, SIM is responsible for collecting and managing security-related log data
from firewalls, antivirus software, network routers, DNS servers, databases, and other
origins. Therefore, SIEM is referred to as System Information and Event Management,
which strengthens the effect on the whole system, particularly on security.
Some popular SIEM options include:

ArcSight Express

McAfee ESM (Enterprise Security Manager)

IBM Security QRadar

Splunk Enterprise Software or Virtual Machines
130
Chapter 01: Threats, Attacks, and Vulnerabilities

LogRhythm's appliance, Software, and Virtual Machines
Data Inputs
SIEM gathers data from antivirus events, firewall logs, and other locations; it sorts it
into categories such as malware activity and failed and successful logins. Some common
features offered by SIEM are:
Logging Device
SIEM is a centralized logging device.
Common Database
Collects data from all the devices and brings it to a single database.
Security Alerts
It can also provide security alerts as the user is getting real-time information.
Storage
The storage of SIEM is long-term.
Data Correlation
SIEM also includes additional features of data correlation.
How SIEM works
SIEM provides reports on security-related events and incidents like failed and successful
logins, malicious activities, etc. It sends alerts if analysis shows any activity runs against
predetermined rule sets and thus indicates a potential security issue.
Review Reports
SIEM is a useful tool for collecting and evaluating compliance data across an
organization's complete infrastructure. SIEM solutions may create real-time compliance
reports for PCI-DSS, GDPR, HIPPA, SOX, and other compliance requirements, easing
security management and detecting any violations early. Many of the SIEM solutions
come with pre-built, out-of-the-box add-ons that can generate automated reports
designed to meet compliance requirements.
User Behavior Analysis
User Behavior Analytics (UBA) is where the sources are variable often logs feature, but
the analysis is focused on users, user accounts, user identities, and not on, say, IP
addresses or hosts. Some forms of SIEM and DLP post-processing where the primary
source data is SIEM or DLP outputs and enhanced user identity data and algorithms
characterize these tools. So, these tools may collect logs and context data themselves or
from a SIEM and utilize various analytic algorithms to create new insight from that data.
Security Monitoring
131
Chapter 01: Threats, Attacks, and Vulnerabilities
SIEM enables centralized management of on-premise and cloud-based infrastructure.
Solutions can identify all entities of the IT environment. This enables SIEM technology
to monitor for security incidents across all connected users, devices, and applications
and classify abnormal behavior as it is detected in the network. Using customizable,
predefined correlation rules, administrators can immediately notify and take
appropriate action to mitigate the threat before it manifests into more serious security
issues.
Log Aggregation
Log management collects data from a variety of sources, including applications,
databases, networks, security, and servers, and allows you to consolidate monitored
data to avoid missing important events.
Log Collectors
In SIEMs, Log Collectors are good for application log investigations. A collector
contains a log file containing records of events that occurred in an operating system,
application, server, or from various other sources. Security analysts benefit greatly from
log files because they give a documented trail of all communications to and from each
source. When a cyber-attack happens, log files can be used to investigate and assess the
source of the assault as well as its impact on the IT infrastructure.
Security Orchestration, Automation, and Response (SOAR)
132
Chapter 01: Threats, Attacks, and Vulnerabilities
Figure 1-27: Security Orchestration, Automation, and Response (SOAR)
SOAR (Security Orchestration, Automation, and Response) is a set of software solutions
and tools that help businesses optimize security operations in three important areas:

Threat and vulnerability management

Incident response

Security operations automation
SOAR technologies enable organizations to collect inputs that are monitored by the
security operations team. Alerts from the SIEM system and other security technologies,
for example, where incident analysis and triage can be performed by combining human
and machine power, can help define, prioritize, and drive standardized incident
response activities. SOAR tools enable businesses to define incident analysis and
response procedures in a digital workflow format.
Mind Map
Figure 1-28: Mind Map of Security Assessments
Penetration Testing
Penetration testing is the process of hacking a system with the owner's permission to
assess security, Hack Value, Target of Evaluation (TOE), attacks, exploits, zero-day
133
Chapter 01: Threats, Attacks, and Vulnerabilities
vulnerabilities, and other components, including threats, vulnerabilities, and daisychaining. A pentester is an individual authorized by an owner to hack into a system to
perform penetration testing in the context of Ethical Hacking.
The Importance of Penetration testing
In today's fast-paced technological environment, the most common cybercrimes are
denial-of-service, identity theft, service theft, and information theft. System penetration
is used to protect a system from malicious threats by identifying vulnerabilities in the
system. Other significant benefits of penetration testing include:
Identifying and exploiting vulnerabilities in systems and security controls in the same
way that an attacker searches for and exploits vulnerabilities to circumvent security.








Recognizing threats and vulnerabilities in an organization's assets
Conducting a thorough assessment of policies, procedures, design, and architecture;
and
Implementing corrective actions before a hacker identifies and breaches security.
Determining what an attacker can gain access to in order to steal
Determining the value of information
Testing and validating security controls, as well as determining the need for any
additional protection layer
Modifying and upgrading currently deployed security architecture
Reducing IT security costs by improving Return on Security Investment (ROSI)
VAPT is essential because it protects us from damage, keeps our confidential data
private, and keeps our information hidden from prying eyes. To overcome their flaws,
every business management or network administrator must be aware of their own. We
all know networks are vulnerable, but we do not all know where or how; this is where
vulnerability assessment comes in.
It is a comprehensive study of computer and network hardware vulnerabilities. It
evaluates potential hazards and threats and develops mitigation plans for any exposure.
“Prevention is better than cure.”
Another reason for VAPT is to prevent cyber-attacks. We are well aware of hacks that
result in the loss of:
•
•
•
•
Sensitive data
Account numbers
Email addresses
Personal information
These security incidents occur on a daily basis in the world of computer networking.
This is why you should examine your network from the outside, as an attacker would.
Discover its strengths and weaknesses, and then fill the gaps. Your infrastructure may
134
Chapter 01: Threats, Attacks, and Vulnerabilities
be secure, and your servers may have strong firewall policies in place, but what about
the default configuration of peripheral devices like printers, scanners, fax machines, and
so on? They adorn your network, and their vulnerability is frequently overlooked. A
vulnerability assessment and penetration testing would reveal any issues in a matter of
seconds. Any network with users is not as secure as you may believe. Your network's
security should be your top priority. In summary, the following are the reasons for
performing VAPT:
•
•
•
•
•
To protect the network from attacks
To identify its strengths and weaknesses
To protect information from theft
To comply with data security standards
To improve the reliability and value of services
Security Audits
•Security audits are the
evaluation of security
controls. It makes sure
that controls are being
enforced and followed
properly throughout the
organization, without
any concern about the
threats and
vulnerabilities
Vulnerability
Assessments
Penetration
Testing
•Vulnerability
Assessment process is
to identify
vulnerabilities and
threats, which may
exploit and impact an
organization financially
or reputationally
•Penetration is the
process of security
assessment, which
includes security audits
and vulnerability
assessment.
Furthermore, it
demonstrates the
attack, its solution and
required remedial
actions
Figure 1-29: Mi Comparison Chart
Types of Penetration Testing
As a penetration tester may be asked to perform any of the three types of Penetration
Testing, it is critical to understand their distinctions.
The Black Box penetration test is one in which the pentester does blind or double-blind
testing. This indicates that the pentester has no prior knowledge of the system or of the
target.
Gray Box is a type of penetration testing in which the pentester has only a rudimentary
understanding of the organization's network. For example, information about the
operating system or network may be scarce.
135
Chapter 01: Threats, Attacks, and Vulnerabilities
White Box is a type of penetration testing in which the pentester knows everything
there is to know about the system and the target. Internal security teams or security
audit teams perform this type of penetration testing in order to carry out an audit.
Penetration Testing Phases
Penetration testing is a three-step procedure that includes the following steps:
1. Pre-Attack Phase
2. Attack Phase
3. Post-Attack Phase
Figure 1-30: Penetration Testing Phases
Security Testing Methodology
There are some methodological approaches to be adopted for security or penetration
testing. Industry-leading Penetration Testing Methodologies are:




Open Web Application Security Project (OWASP)
Open Source Security Testing Methodology Manual (OSSTMM)
Information Systems Security Assessment Framework (ISAF)
EC-Council Licensed Penetration Tester (LPT) Methodology
Rules of Engagement
Rules of Engagement (RoE) is an archive that documents the rules and regulations
under which a penetration tester is to engage with a client. An RoE document explains
the manner in which the pentest will be conducted. Being a professional pentester, it is
136
Chapter 01: Threats, Attacks, and Vulnerabilities
the primary task before starting any test to spell out the RoE clearly. Before you begin
the penetration test, follow the basic considerations as defined by PCI Security
Standards Council, which are:








The time window to perform and complete the testing process
The preferred method of communicating about scope and issues
The action to take if any sensitive information is disclosed during the test
Ensuring the pentesting equipment and tools do not pose a threat to the
environment
What steps would you take if you detected a previous or active compromise to
the systems being tested?
How would you deal with a legacy system with known issues with automated
scanning?
Who is permitted to engage the pentest team?
What should legal concerns be addressed?
Lateral Movement
Cyber attackers use a technique to move through a network searching for the key data
called a Lateral Movement. Many attacks happen when data is moved laterally over the
network from system to system.
Privilege Escalation
This attack-type of network intrusion takes advantage of programming errors or design
flaws to grant the attacker elevated access to the network and its associated data and
applications. A bug, design flaw, or configuration oversight in a software application or
operating system is exploited with privilege escalation to access applications or userprotected resources.
An unauthorized user will not always be provided full access to a targeted system. The
privilege escalation is essential in these circumstances. The privilege escalation is of two
types: vertical and horizontal.
Vertical Privilege Escalation
In vertical privilege escalation, higher privileges are granted to the attacker. The kernellevel operations typically assist in achieving vertical privilege escalation in which
unauthorized codes are allowed to run.
Horizontal Privilege Escalation
The attackers use the same level of privileges that have been granted.
For example, horizontal privilege escalation will be constituted when anyone’s online
banking account has gained access by some unauthorized person.
Persistence
137
Chapter 01: Threats, Attacks, and Vulnerabilities
The system needs to be continually accessed to gather data and conduct further attacks
that have been more critical to most penetration attacks. Thus, a critical part of a
penetration tester’s efforts is persistence.
Cleanup
Penetration testers use various tools and techniques as they work their way through a
client network. During the engagement, testers should document any changes they
make to the systems, and they should revisit that documentation after the test to ensure
that they have completely removed all traces of their work.
There are three major post-engagement clean-up activities:



Removing shells installed on systems
Removing all backdoors, services, daemons, rootkits, and tester-created accounts
installed during the rest
Removing any tools installed during the penetration test
These three activities serve as a jumping-off point. The basic principle that testers
should follow when performing post-engagement clean-up is to return the system to its
pre-test state.
Bug Bounty
Bug bounty programs allow testing web platforms by simulating attacks to detect and
fix vulnerabilities. It relies on independent hackers paid per vulnerability.
Pivoting
Pivot is a method that allows an attacker or penetration tester to move or flow across a
network. The first step in pivoting is gaining access to a machine, moving tools to that
machine, and remotely control them. The penetration tester then examines the system
or network using the remote machine's IP address.
Active and Passive Reconnaissance
Reconnaissance is the first step in an attacker's preparation for an assault. It involves
obtaining information about the target before launching an attack using various tools
and tactics. An attacker's task is made easier by gathering information about the target.
It aids in determining the target range for large-scale attacks.
In Passive Reconnaissance, a hacker gathers information about a target without directly
interacting with it. Searching social media for the target's information is an example of
passive reconnaissance.
Active Reconnaissance gains information by interacting with the target directly. Active
reconnaissance includes interacting with the target via calls, emails, help desks, or
technical departments.
138
Chapter 01: Threats, Attacks, and Vulnerabilities
War Driving
Kismet is a sniffer, wardriving tool, and wireless intrusion detector. WIDS is the
framework used as a wireless network and device detector.
It operates using Bluetooth interfaces, Wi-Fi interfaces, some Software Defined Radio,
and RTL-SDR (a USB Dongle) hardware.
Footprinting
The collecting of all conceivable information about the target and the targeted network
is known as fingerprinting.
Performing WHOIS Footprinting
1. Go to the URL https://www.whois.com/
Figure 1-31: WHOIS Footprinting Engine
2. A search of Target Domain
139
Chapter 01: Threats, Attacks, and Vulnerabilities
Figure 1-32: WHOIS Footprinting
Exam Tip: Standards Testing Resources
Footprinting and reconnaissance techniques and principles are usually included in
penetration testing standards.
http://csrc.nist.gov/publications/nistpubs/800-115/SP800-115.pdf;
PenetrationTestingExecutionStandard:http://csrc.nist.gov/publications/nistpubs/800115/SP800-115.pdf;
PenetrationTestingExecutionStandard:http://csrc.nist
The
Penetration Testing Execution Standard includes a list of OSINT targets that might
assist you in compiling a list of possible OSINT targets.
Exercise Types
Security analysts must practice responding to them to respond to security events in the
most organized and efficient manner. There are some tried-and-true approaches to this.
This section will look at how team analysts, both employees, and third-party
contractors, can be organized and some well-known names for these teams.
Security posture is assessed by war game exercises in which one group attacks the
network while another attempts to defend the network. Three teams are involved in
most cybersecurity war games: red, blue, and white teams.
140
Chapter 01: Threats, Attacks, and Vulnerabilities
Red Team
The red team plays the role of attacking the force and uses reconnaissance and
exploitation tools to gain access to the protected network. The red team’s work is similar
to that of the testers during a penetration test.
Blue Team
The blue team takes on the position of Network defense, and the red team's attempted
attack puts the blue team's ability to respond to the attack to the test. Gaining access to
log data, using a SIEM, gathering information, and doing traffic and data flow analysis
are all part of this process.
White Team
The white team is a group of technicians who coordinate the exercise and act as referees,
resolving disagreements between the red and blue teams. Enforcing the rules of
engagement could be one of the white team's responsibilities, along with monitoring
the blue team's responses to the attack and noting specific approaches used by the red
team.
Purple Team
Purple refers to a philosophy in which attackers and defenders work together on the
same team. As a result, rather than a dedicated team, it should be viewed as a function.
Purple teams should not be needed in organizations where the red team / blue team
interaction is healthy and functioning effectively because the primary objective of a red
team is to develop ways to improve the blue team.
Figure 1-33: Exercise Type
141
Chapter 01: Threats, Attacks, and Vulnerabilitie
Mind Map
Figure 1-34: Mind Map of Penetration Testing
142
Chapter 01: Threats, Attacks, and Vulnerabilities
Practice Question
1. An Ethical Hacker needs which of the following to break into a system?
A.
B.
C.
D.
Training
Permission
Planning
Nothing
2. What is Gray Box Pentesting, and how does it work?
A.
B.
C.
D.
Pentesting with no knowledge
Pentesting with partial knowledge
Pentesting with complete knowledge
Pentesting with permission
3. What kind of hacker are you if you have been employed to launch an attack on a
target system in order to uncover and exploit vulnerabilities?
A. Gray Hat
B. Black Hat
C. White Hat
D. Red Hat
4. Which of the following best describes an assailant who seeks out a target in order
to attract attention to a cause?
A. Terrorist
B. Criminal
C. Hacktivist
D. Script Kiddie
5. What is the level of knowledge of a Script Kiddie?
A. Low
B. Average
C. High
D. Advanced
6. What is required for a White Box Test?
A. No knowledge
B. Some knowledge
C. Complete knowledge
D. Permission
143
Chapter 01: Threats, Attacks, and Vulnerabilities
7. Which of the following best describes a hacker who does not care if they are
caught or punished?
A.
B.
C.
D.
Hacktivist
Terrorist
Criminal
Suicide Hacker
8. Which of the following reasons necessitates a penetration test? (Select 2)
A.
B.
C.
D.
Troubleshooting network issues
Finding vulnerabilities
To perform an audit
To monitor performance
9. Hacker using their skills for both benign and malicious goals at different times are
______________.
A. White Hat
B. Gray Hat
C. Black Hat
D. Suicide Hacker
10. Vulnerability analysis is basically ____________.
A. Monitoring for threats
B. Disclosure, scope, & prioritization of vulnerabilities
C. Defending techniques from vulnerabilities
D. Security application
11. What is Black Box Testing?
A. Pentesting with no knowledge
B. Pentesting with complete knowledge
C. Pentesting with partial knowledge
D. Pentesting performed by Black Hat
12. The term “Vulnerability” refers to _______________.
A. A Virus
B. A Malware
C. An Attack
D. A Weakness
13. Using dots and slash sequences, an attacker is attempting a trial and error strategy
to get access to restricted directories. Which form of web server attack is this?
144
Chapter 01: Threats, Attacks, and Vulnerabilities
A.
B.
C.
D.
LDAP Attack
AD Attack
Directory Traversal Attack
SQL Injection
14. An attacker sends a request, allowing him to add a header response; now, he
redirects the user to a malicious website. Which type of attack is this?
A. Web Cache Poisoning
B. HTTP Response Splitting Attack
C. Session Hijacking
D. SQL Injection
15. What are the most common methods for performing Footprinting?
A. Active & Passive Footprinting
B. Pseudonymous & Passive Footprinting
C. Social & Internet Footprinting
D. Active & Social Footprinting
16. Which one of the following is the best meaning of Footprinting?
A. Collection of information about a target
B. Monitoring target
C. Tracing a target
D. Scanning a target
17. What is the purpose of Social Engineering?
A. Reveal information from human beings
B. Extract information from compromised social networking sites
C. Reveal information about social networking sites
D. Compromising social accounts
18. Cracking password with pre-computed hashes is called ___________.
A. Rainbow Table Attack
B. Brute Force Attack
C. Dictionary Attack
D. Password Guessing
19. Which of the following is used for Backdoor installation?
A. Meterpreter
B. Zero-day Exploit
145
Chapter 01: Threats, Attacks, and Vulnerabilities
C. Exploit Kits
D. Persistence
20. How can you mitigate a rainbow table attack?
A. Changing Default Password
B. Configuring Unpredictable Password
C. Password Salting
D. Password Hashing
21. Which of the following assertions is the most accurate description of the term
"malware"?
A.
B.
C.
D.
Malware is Viruses
Malware is Malicious Software
Malware is Trojans
Malware is Infected Files
146
Chapter 02: Architecture and Design
Chapter 02: Architecture and Design
Technology Brief
This chapter describes the concepts of security related to operating in an enterprise
environment. It delves into enterprise security issues such as change and configuration
management, data sovereignty, protection, and loss prevention. You will become
acquainted with hardware security modules, geographical considerations, and cloud
access security brokers.
After that, we will discuss response and recovery controls, SSL/TLS inspection, and site
resiliency. Finally, we will learn how to use honeypots, honey files, honeynets, fake
telemetry, and DNS sinkholes for deception and disruption.
We will discuss the following topics in detail in this chapter:










Define change and configuration management concepts such as diagrams,
baseline configurations, standard naming conventions, and IP schema
documentation
Describe data sovereignty, data conversion and storage in binary digital form,
and how data is governed by the country's laws where it is stored.
Describe data security issues such as data loss prevention, masking, and
encryption
Learn how hardware security modules (HSMs) play a significant role in
delivering hardened, tamper-resistant devices for generating keys, encrypting
and decrypting data, and issuing and verifying digital signatures.
Recognize geographical factors such as jurisdictions, privacy laws, import-export
restrictions, and cryptographic regulations describe the on-premises or cloudbased CASB security policy enforcement points that are established between
cloud service providers and their customers
Contrast response and recovery control as they relate to enterprise business
continuity and disaster recovery.
Describe how next-generation firewalls, WAF solutions, and other cloud-based
techniques perform SSL/TLS inspection
Explain hashing and application programming interfaces, as well as the
significance of digitally signing all API calls
Describe the various types of site resiliency, such as hot site, cold site, and warm
site solutions
Define deception and disruption techniques that use honeypots, honey tokens,
honey files, honeynets, phony telemetry, and DNS sinkholes.
147
Chapter 02: Architecture and Design
The Significance of Security Ideas in a Business Setting
Security Overview
The methods and procedures for preventing unauthorized access, disclosure, use, or
modification of data and information systems are system security. Data security ensures
that information is kept private, secure, and accessible. An organization's confidential
information and data will not be protected if it lacks security policies and suitable
security standards, placing the organization in danger. Security policies and welldefined procedures can help secure an organization's assets from unauthorized access
and disclosure.
Thanks to cutting-edge technology and platforms, millions of individuals communicate
with one another every minute in today's world. Due to various old and new threats that
exist around the world, these sixty seconds can be tremendously vulnerable and costly
to private and public businesses. The public internet is the most common and fastest
way for risks to spread over the planet. Viruses, spam, malware, and malicious routines
and scripts are all waiting to be accessed at any time. This is why security threats to a
network or system can never be entirely eliminated. It is a never-ending challenge to
design a security policy that's effective and efficient rather than a jumble of ineffective
security implementations that waste resources and expose vulnerabilities to attacks.
Configuration Management
When changes occur to a software product during its development life cycle, a
configuration management system can be put into place that allows for change control
processes to occur through automation. Software Configuration Management (SCM) is
a feature of a product that recognizes software attributes at various points in time and
performs methodical change control to maintain software integrity and traceability
throughout the software development life cycle. It establishes the need to keep track of
changes and ensures that the final delivered software contains all of the approved
changes that are supposed to be included in the release.
148
Chapter 02: Architecture and Design
Figure 2-01: Software Configuration Management
Baseline Configuration
A baseline is an agreed-upon description of a product's attributes at a specific point in
time used to define configuration management changes. A baseline is typically a single
work output or a series of work products that may be used as a reasonable comparison
point.
Standard Naming Conventions
Software configuration management is a set of processes, regulations, and technologies
that aid in the organization of developers' work. It preserves the existing state of the
software (referred to as the "baseline") while allowing developers to work on new
versions for new features or adjustments.
Internet Protocol Schema
149
Chapter 02: Architecture and Design
The IP address of the server is one of the most crucial parts of establishing a business IT
system. This data must be kept private, but it must also be accessible to others, such as
compliance officers performing audits. It is difficult to decide which stakeholders or
personnel have access to and can edit CM data.
Data Sovereignty
Data sovereignty is the perception that information has been converted and stored in
binary digital form. It is the idea that data are subject to the laws and governance
structures within the nation it is collected. The conception of data sovereignty is closely
linked with data security, cloud computing, and technological sovereignty.
Data Protection
Throughout its lifecycle, data security refers to the process of securing data from illegal
access and data corruption. Data encryption, hashing, tokenization, and key
management are all data security strategies that safeguard data across all applications
and platforms.
Data Loss Prevention
Data Loss Prevention (DLP) is a term that refers to the prevention of data loss. It
basically puts a stop to data transmission before it reaches the risk actor. The endpoint
DLP program on the computer monitors the data and prevents unauthorized access.
The DLP device monitors any confidential information, such as credit card numbers,
that should not be in clear text across the network connection. The data is monitored
by the server's DLP system, which ensures that it does not come into the hands of the
threat actor.
Masking
Data masking safeguards confidential data such as credit card numbers, Social Security
numbers, names, addresses, and phone numbers from unintended exposure, reducing
the risk of data breaches. Masking of data helps enterprises raise the level of security
and privacy assurance.
Encryption
In order for an application to be secure and usable, it must include encryption. It is
necessary to adopt and utilize a proven algorithm and codebase. For example, we can
make sure that only the sender and receiver can read clear text data using encryption.
At Rest
150
Chapter 02: Architecture and Design
Data at rest is information that is not actively traveling from one device to another or
from one network to another, such as information saved on a hard drive, laptop, flash
drive, or archived/stored in another fashion. The goal of data security at rest is to protect
idle data on any device or network. While data at rest is sometimes thought to be less
vulnerable than data in motion, attackers often regard data at rest as a more desirable
target. The security mechanisms in place to secure data in transit or at rest determine
the risk profile for data in either condition.
In Transit/Motion
Data in transit, also known as data in motion, refers to information that is actively
traveling from one area to another, such as across the internet or a private network.
Data protection in transit refers to the security of data while it is being transported from
one network to another or from a local storage device to a cloud storage device. Effective
data protection solutions for in-transit data are crucial anywhere data is moving, as data
is frequently regarded as less safe while in transit.
Modern businesses must protect sensitive data both in transit and at rest, as hackers
continue to develop new ways to breach networks and steal data.
In Processing
Data security is a set of procedures and policies designed to protect your critical
Information Technology (IT) infrastructure. All types of files, databases, accounts and
networks are examined. Effective data security relies on a combination of controls,
applications, and methods to assess the value of various datasets and implement the
most effective security policies.
Data security that is effective considers the sensitivity of diverse datasets as well as
regulatory compliance needs.
Tokenization
Tokenization is the process of transforming valuable data, such as an account number,
into a useless string of characters called a token. Tokens can be used to refer back to the
source data but not to estimate values.
Rights Management
Right Management assists in the protection of sensitive information or data by
maintaining and enforcing access and usage rights to information throughout its
lifecycle, regardless of where it is distributed.
151
Chapter 02: Architecture and Design
Hardware Security Module (HSM)
A hardware security module is a physical computing device that secures and manages
digital keys while also encrypting and decrypting data for digital signatures, strong
authentication, and other cryptographic operations. Traditionally, these modules take
the form of a plug-in card or an external device that connects directly to a computer or
network server.
Any application that uses digital keys can benefit from the use of a hardware security
module. The keys are usually extremely valuable, implying that the owner would suffer
a significant financial loss if they were compromised.
An HSM performs the following functions:
1.
2.
3.
4.
Secure cryptographic key generation on-board
Secure cryptographic key storage onboard, at least for master keys, which are the
highest level and most sensitive keys
Key management
Using cryptographic and sensitive data material to offload application servers for
comprehensive asymmetric and symmetric cryptography, such as executing
encryption or digital signature operations
HSMs manage transparent data encryption keys for databases, as well as keys for storage
devices like disks and tapes.
Figure 2-02: Hardware Security Modules
152
Chapter 02: Architecture and Design
Geographical Considerations
Prior to cloud computing's broad acceptance, defining the boundary was relatively
simple; it consisted of the computing assets on-premises to the organization and/or at
a colocation datacenter; with the seemingly ubiquitous adoption of cloud services, the
enterprise cybersecurity boundary required to be extended to include leveraged cloud
services rather than geographic locations. For example, a company may have
information assets on-premises at their corporate location but also use AWS or Azure
for additional compute and storage resources. We have heard about AWS S3 buckets
being publicly exposed on the internet, resulting in a data breach for organizations.
Cloud Access Security Broker (CASB)
When users access cloud-based resources, a cloud access security broker sits between
them and the cloud service, enforcing security regulations.
To better understand what CASB is, it is important to note that this is not the same as
the firewalls that businesses employ to monitor and filter their networks. CASBs can
shed light on strange or unusual user activity and provide cloud access control to the
company. They, unlike firewalls, provide deep visibility into cloud environments and
granular control over cloud usage.
CASBs are increasingly being used to mitigate cloud security risks, ensure compliance
with data privacy regulations, and enforce corporate security policies. They are
becoming increasingly important to organizations as employees use personal,
unmanaged devices to access corporate networks from new, dispersed locations, posing
additional cloud security risks. The concept of CASB emerged in response to the
growing need for more consistent security across multiple cloud environments, which
was exacerbated by the rise of cloud computing. CASBs enabled organizations to gain
greater visibility into what was happening in their cloud and Software-as-a-Service
(SaaS) deployments and protect all user and sensitive corporate data in these
environments.
Organizations require solutions that make protecting their data and users easier, given
blended attacks, various exploits, and obfuscation technologies that make detection
more difficult. CASBs are becoming increasingly important in protecting against
malware and phishing attacks, securing access to cloud services, and ensuring the
security of cloud applications.
153
Chapter 02: Architecture and Design
Figure 2-03: Pillars of CASBs
CASB solutions are divided into four pillars or functions that ensure the security of an
organization's cloud services:
Visibility
Organizations need to be able to see what their users are doing across all of their cloud
applications, including sanctioned and unsanctioned applications, also known as
shadow IT. A specific risk of cloud usage is an activity that occurs outside of IT controls
because the organization's data is no longer protected by its compliance, governance,
and risk policies. As a result, CASBs are critical for detecting high-risk behavior that IT
teams may miss.
A CASB solution provides comprehensive visibility of cloud application usage, including
device and location data, to assist organizations in protecting data, intellectual
property, and users. It also offers cloud discovery analysis, which allows businesses to
assess the risk of cloud services and determine whether or not to give users access to
applications.
Compliance
Organizations now have a plethora of cloud supplier options and will almost certainly
use multiple vendors for various solutions. Regardless of whether they outsource or
154
Chapter 02: Architecture and Design
manage services in-house themselves, organizations are still responsible for ensuring
regulatory compliance regarding the privacy and security of their data.
CASBs assist organizations in meeting the increasingly stringent and ever-changing
requirements of data and privacy regulations such as privacy legislation, including the
California Consumer Privacy Act (CCPA), the European Union's General Data
Protection Regulation (GDPR), and the Health Insurance Portability and Accountability
Act (HIPAA). CASBs are also necessary for meeting the security requirements of ISO
27001 and the Payment Card Industry Data Security Standard (PCI DSS).
Data Security
Organizations must ensure that sensitive data is protected even as cloud usage grows
and data loss prevention (DLP) tools are implemented. On-premises DLP solutions are
effective at protecting data, but they cannot protect cloud services.
Threat Protection
Organizations are increasingly vulnerable to outside hackers using stolen credentials
and insider attacks. As a result, businesses must be able to detect and prevent suspicious
behavior, even from authorized users.
Response and Recovery Controls
Figure 2-04: Response and Recovery Control
Response and Recovery services include:
155
Chapter 02: Architecture and Design
1.
2.
Backup and Restore
Incident Response
These services aid in the definition of procedures to be followed in the event of an
incident, including detection, reaction, and recovery activities.
The consequences of a cyber-security event can be mitigated by detecting an incident
early and responding appropriately. Honeywell's Response and Recovery services assist
users in resuming operations following an incident. The services also include backup
solution implementation and consulting to assist users in developing a formal incident
response plan.
Users can use Response and Recovery services to document incident details for future
reference and improve their ability to recover and respond quickly to future attacks.
Furthermore, these services teach employees how to report cyber security incidents.
Secure Sockets Layer (SSL)/Transport Layer Security (TLS) inspection
The process of intercepting SSL/TLS encrypted internet communication between the
client and server is known as SSL/TLS inspection or HTTPS interception. Malicious
content could be hidden in encrypted traffic alongside your legitimate data.
The next version of the Internet Engineering Task Force (IETF) protocol standardized
it and renamed it Transport Layer Security, or TLS, after it was launched in
1999. According to the TLS specification, the differences between this protocol and SSL
3.0 are not dramatic. As a result, it is not really a question of TLS vs. SSL; rather, the two
form a constantly updated series of protocols that are often referred to as SSL/TLS.
The TLS protocol encrypts all internet traffic. Web traffic is the most prevalent if the
URL in your address begins with "HTTPS," and there is a padlock icon suggesting the
connection is secure. TLS, on the other hand, can be utilized by other programs such as
e-mail and Usenet. ad will expire in 27.
Hashing
Hashing is a mathematical process that uses a special cryptographic function to
transform one set of data into another of fixed length. The process entails using a hash
table to map data of any size to a fixed length and then storing the output data in the
digest. It is a method for converting a set of key values into a set of array indexes. To get
a range of key values, we will use the modulo operator. Consider a hash table of size 20
with the following items to be stored. Items are formatted as “(key, value).”
156
Chapter 02: Architecture and Design
Figure 2-05: Encryption and Hashing
API Considerations
API security is the safeguarding of the integrity of APIs, both those you own and those
you use. Like systems and apps, APIs are one of the most common ways for
microservices and containers to communicate. APIs are becoming increasingly
important as integration and interconnectivity become more important.
Figure 2-06: API Process
157
Chapter 02: Architecture and Design
Site Resiliency
Resilience is defined as the ability to withstand and recover from deliberate attacks,
accidents, or naturally occurring dangers or incidents. As with security, organizations
implement physical- and cyber-resilience strategies, such as having a backup power
generator.
Hot Site
A hot site is a near-instant backup of your production site, complete with personnel,
network systems, power grids, and data backups. When switching from the host site to
the backup site, there is almost no downtime. While the idea of having real-time
synchronization is appealing, it is also quite costly. You must first weigh the benefits
and decide whether they are worth the cost.
Cold Site
A chilly site is similar to keeping a spare, run-down automobile in your garage at home.
You must call a buddy to bring your other automobile to you if your car breaks down.
You and your friend may need to work out the details of getting extra keys for the car.
No matter what, it will take a long time for your new ride to arrive, so be prepared to
wait. When a disaster strikes, this translates to a site with little or no hardware set up.
Because the equipment is not set up and running, you are saving a lot of money.
However, getting your site back up and running will take a long time.
Warm site
When you visit a warm site, it is like traveling down the road with your second
automobile following closely behind. However, the car could have stopped at a few
signals and be several miles behind you; As a result, catching up to you may take some
time. Your spare car would not be as fancy as your current one (no heated seats or
satellite radio), but it has gas in the tank, and the engine works, which is all you really
need until you can get your current car repaired and running again. Similarly, a warm
site recovery implies that you have established hardware and network connections from
one site to another, but they are not the same. While you are restoring your data from
a remote backup location, your recovery will still be delayed.
Deception and Disruption
Deception technology is a type of cybersecurity defense practice that aims to deceive
attackers by disseminating a set of traps and decoys throughout a system's
infrastructure to imitate genuine assets. In contrast, disruption is a dangerous threat
caused by intentional or unintentional incidents that result in a security breach, damage
to digital devices and networks, or a network outage.
158
Chapter 02: Architecture and Design
Honeypots
Honeypots are devices or systems deployed to trap attackers attempting to gain
unauthorized access to a system or network. They are placed in a controlled setting and
are constantly watched. Honeypots are often deployed in the DMZ and configured in
the same way as servers. Any type of probe, malware, or infection will be immediately
detected as the honeypot appears to be a legitimate part of the network.
Honeyfiles
Honeyfiles are a deception-based intrusion detection mechanism. A honey file is a bait
file that is designed for hackers to open; when the file is accessed, an alert is set off. A
honey file could be a file called passwords.txt on a workstation, for example. The file's
name will attract hackers who get illegal access to the workstation, and when they open
it, an alarm will go out.
Honeynets
A honeynet is a virtual system that is basically designed to attract threat actors or
attackers and trap them. It is a group or collection of honeypots designed to look like a
real corporate network that, in reality, is fake.
Lab 2-01: Configuring Honeypot on Windows Server 2016
Machines:
--Windows Server 20 16 (VM)
--Windows 7 (VM)
Software used:
--honeypot (https://www.atomicsoftwaresolutions.com)
Procedure:
1.
2.
Open the HoneyBOT application.
Set the parameters or leave them on default.
159
Chapter 02: Architecture and Design
3.
Select Adapters.
4.
Go to a Windows 7 machine.
160
Chapter 02: Architecture and Design
5.
6.
Open Command Prompt.
Generate some traffic, for example, FTP.
7.
Go back to Windows Server 2016 and observe the logs.
8. Select the log by clicking on "Port" > "21."
161
Chapter 02: Architecture and Design
9. Right-click and go to “View Details.”
10. Right-click and go to “Reverse DNS.”
162
Chapter 02: Architecture and Design
DNS Sinkhole
In a postmortem of the WannaCry outbreak, Hutchins wrote, "A sinkhole is a server
that captures malicious traffic and prevents infected devices from being controlled by
the criminals who infected them." Security teams utilize sinkholes to attack, stop, and
collect information on infiltrating adversaries.
163
Chapter 02: Architecture and Design
Mind Map
Figure 2-07: Mind Map of Security Concepts
Virtualization and Cloud Computing Concepts
What is Cloud Computing, and how does it work?
Cloud computing is simply the process of storing data and connecting to computers via
the internet. It is the internet-based delivery of various computer services such as
servers, software, analytics, databases, and storage. Computing resources are delivered
on-demand through a cloud service platform with pay-as-you-go pricing. The
companies that are providing services are termed as “Cloud Providers.” There is a
number of cloud providers like Amazon, Google, and Azure.
Cloud Computing's Advantages
We are all aware that Cloud Computing has resulted in a significant shift in traditional
company thinking about IT resources. There are numerous advantages of using cloud
computing. Here are a few examples:
164
Chapter 02: Architecture and Design
1.
Cost
Cloud computing eliminates the capital cost of buying hardware and software
and of building and running in-house data centers – server racks, 24 hours’
electricity for power and cooling, etc.
2.
Scale Globally
Cloud computing services have the capacity to scale with elasticity. In the cloud,
it means that IT resources are provided more or less computing power, storage,
bandwidth – as per requirement and from the right place.
3.
Improve Agility and Speed
New IT resources are readily available, allowing resources to be scaled up and
down indefinitely to meet demand. This results in a significant boost in
organizational agility.
4.
Reliability
Cloud computing allows data backup, disaster recovery, and business continuity
as data can be replicated in the network of the cloud supplier on multiple
redundant sites.
5.
Security
The protection of their data is one of the main problems for any organization
regardless of its size and industry. Infringements of data and other cyber-crimes
can devastate the revenue, customer loyalty, and positioning of a company.
Cloud provides many advanced security features to strengthen the security of the
overall company. It also helps in protecting your data, application, and
infrastructure.
The Economy of Cloud Computing
In the traditional context of enterprises, where big capital expenditures are required,
the cloud is the most cost-effective solution to transition to a pay-as-you-go model.
Cloud reduces the Capital Expenditure (CapEx) cost and also gives some other benefits.
With Cloud Computing, you should move toward Operational Expenditure (OpEx).
VMs, App Services, and other Azure services are mostly priced on an hourly basis. There
is also consumption-based pricing, which is dependent on the number of times a
function is executed, the number of times a resource is used per second, or both. Azure
Function is an example of consumption-based pricing.
EXAM TIP:
165
Chapter 02: Architecture and Design
Capital Expenditure (CapEx) is the expenditure to maintain or acquiring fixed assets by
spending money. This includes land, equipment, etc.
Operational Expenditure (OpEx) is the cost of a product or a system that is running on
a day-to-day basis like electricity, printer papers, etc.
Technical Terms
To comprehend Cloud Computing, you must first comprehend a few technical phrases.
1. High Availability (HA) - It is the core of cloud computing. In traditional server
environments, companies own a large amount of hardware, and the workload is limited
to this hardware capacity. In case of extra load, capacity cannot be increased whereas,
sometimes this hardware seems extra for the workload. You do not own any of the
hardware in the cloud, and addition in servers is just a click away. By replacing the failed
server with a new one, you can achieve high availability for your servers as soon as it
fails. The number of VMs you set up to eventually cover in case one goes down
determines how well HA works.
2. Fault Tolerance - For resilience in the cloud, fault tolerance is also an important
factor. Fault tolerance gives you zero downtime. Fault tolerance refers to the fact that if
there is a fault on the Azure side, it is promptly mitigated by Azure.
3. Disaster Recovery (DR) – Used in case of any catastrophic disaster like a cyberattack. If such an occurrence occurs, there is a plan in DR to recover your business from
these essential systems or restore regular operations. DR has designated time to recover
and a recovery point.
4. Scalability - In cloud computing, scalability means adding or removing the resources
in an easy and quick way as per demand. It is important in such a situation where you
do not know the actual number of resources that are needed. Auto-scaling is an
approach for scalability depending on your requirement by defining the threshold
1.
2.
Elasticity refers to the ability to dynamically expand or contract network
resources in response to autonomous working load changes and maximizes
resource use. This can contribute to overall cost savings for services.
Agility - The ability to react rapidly and efficiently to changes in the business
environment is known as agility. The ability to quickly design, test, and deploy
business-driven software applications is often called agility. Instead of providing
and managing services, Cloud Agility lets them concentrate on other issues such
as security, monitoring, and analysis.
EXAM TIP:
166
Chapter 02: Architecture and Design
From the exam perspective, one must be familiar with all the terms like HA, Fault
Tolerance, DR, Elasticity, Scalability, and Agility.
Cloud Models
We know that all clouds are not the same, and not every business requirement for cloud
computing is the same. So, in order to meet the requirements, different models, types,
and services have been used. Firstly, you have to decide how the cloud service is being
applied by finding out the cloud deployment type or Architecture. The cloud computing
services are divided into the following basic models: IaaS, PaaS, Xaas, SaaS, public,
community, hybrid, and private. These are also known as a stack in cloud computing
because each of them is built on top of another. Let’s discuss each of them.
Infrastructure as a Service (IaaS)
It gives you a basic IT infrastructure for Cloud IT like VMs, Data Storage, Networks, OS
on a pay-as-you-go model.
Platform as a Service (PaaS)
Cloud computing platforms that provide an on-demand environment to build, test, and
Platform as a Service deliver and manage software applications. PaaS is designed to
facilitate the fast development of web or mobile apps for developers without setting or
maintaining the underlying server, storage, network, and database infrastructure
needed for development.
Software as a Service (SaaS)
Both servers and code are taken over by cloud providers. Cloud providers host and
maintain the applications and underlying infrastructure for SaaS and handle updates
such as software upgrades and security patches. Users link the app over the Internet,
usually through their phones, tablets, or PC’s web browsers.
167
Chapter 02: Architecture and Design
Figure 2-08: IaaS, PaaS, and SaaS Overview
Anything as a Service (XaaS)
Anything as a Service refers to a broad category of cloud computing and remote access
services. It acknowledges the vast number of products, tools, and technologies that are
now delivered as a service to users via the internet.
EXAM TIP:
IaaS – Servers, storage, and networking
PaaS – Servers, storage, networking, and management tools
SaaS – A complete application like Office 365
Serverless - No need for server; there is a single function that is hosted, deployed, and
managed on its own
168
Chapter 02: Architecture and Design
Figure 2-09: Types of Cloud Computing
Figure 2-10: Public, Private and Hybrid Cloud
Community
169
Chapter 02: Architecture and Design
A community cloud is a cloud service paradigm that provides a cloud computing
solution to a small number of people or businesses while being administered and
managed by a single entity and secured collaboratively by all participating organizations
or a third-party managed service provider.
Cloud Service Providers
Cloud service providers host cloud computing-based infrastructure and platform
services for customers using their own data centers and compute resources. Cloud
services are typically priced through a variety of pay-as-you-go subscription models.
MSP/MSSP stands for Managed Service Provider/Managed Security Service
Provider
A managed security service provider provides outsourced monitoring and
administration of security devices and systems. Common services include managed
firewalls, intrusion detection, virtual private networks, vulnerability testing, and antiviral protection. A managed service provider is a company that manages a customer's
IT infrastructure and/or end-user systems remotely, typically on a proactive and
subscription basis. ASPs concrete the way for cloud computing and companies that offer
remote support for customers' IT infrastructure.
On-Premises vs. Off-Premises
Cloud monitoring solutions are classified into two types: off-premise and on-premises
services. Off-premise solutions are typically delivered as a hosted service and are
licensed on a monthly subscription basis. On-premise cloud monitoring solutions rely
on software that is installed on virtual or physical servers that you manage.
Fog Computing
Fog computing is a decentralized computing infrastructure that distributes data,
processing, storage, and applications between the data source and the cloud. Fog
computing, like edge computing, brings the benefits and power of the cloud closer to
the point where data is created and acted upon.
Edge Computing
Edge computing is the computational processing of sensor data away from centralized
nodes and close to the network's logical edge toward individual data sources. It is a
distributed IT network architecture that enables mobile computing for data generated
locally.
170
Chapter 02: Architecture and Design
Figure 2-11: Edge Computing
Thin Client
A thin client is a computer that uses resources from a central server rather than a local
hard drive. Thin clients operate by connecting remotely to a server-based computing
environment, which stores the majority of applications, sensitive data, and memory.
Containers
In cloud computing, a Container is a method of virtualizing an operating system. This
allows the user to interact with a program and its dependencies using isolated resource
procedures. The application's code can be systematically bundled with configurations
and dependencies.
171
Chapter 02: Architecture and Design
Figure 2-12: Container and Hypervisor Architecture
Microservices/API
Microservices are a design approach for building cloud applications. Each application is
built as a collection of services, each of which runs in its own process and communicates
via APIs. Microservices architecture is a method of building applications that has
become a best practice over time.
Figure 2-13: Micro Service Architecture
Infrastructure as Code
Software-Defined Networking (SDN)
172
Chapter 02: Architecture and Design
SDN is a networking approach that uses software-based controllers or application
programming interfaces to communicate with underlying hardware infrastructure and
direct network traffic.
While network virtualization enables organizations to segment different virtual
networks within a single physical network or connects devices on different physical
networks to form a single virtual network, software-defined networking enables a new
method of controlling data packet routing through a centralized server.
Figure 2-14: SDN Architecture
Software-Defined Visibility (SDV)
Software-Defined Visibility is equivalent to Software-Defined Networking in terms of a
visibility infrastructure. SDV combines visibility's broad reach with an automation
173
Chapter 02: Architecture and Design
framework. Network switches and routers form the physical network or Layer 2-3 data
plane in an SDN infrastructure.
Serverless architecture
Serverless computing is a critical component of current cloud computing. It is a PaaS at
its most extreme. The infrastructure required for running code with serverless apps is
automatically offered, scaled, and managed by the cloud service provider. By removing
the requirement for developers to manage infrastructure, the serverless architecture
allows them to build applications faster.
EXAM TIP: It is critical to note that "serverless" does not imply that no virtual
machines are used. It simply means that the VM running your code is not explicitly
allocated to you, which means that you do not manage them. Your code is moved to
the VM, it is executed, and then it is moved off.
Benefits of a Serverless Model
No Infrastructure Management: Use fully managed infrastructure - developers can
avoid administrative tasks and concentrate on the core business logic. You simply
deploy the code with a serverless platform, and it runs with great availability.
Dynamic Scalability: The infrastructure can automatically scale up and down within
seconds to match any workload requirements for serverless computing.
Time to Market is Reduced: Serverless applications reduce the dependencies of
operations on each development cycle, increasing the agility of development teams to
produce more features in less time.
More Efficient Use of Resources: Shifting to serverless technology allows companies
to reduce TCO and resource reallocation to speed up the pace of innovation.
Services Integration
Cloud integration is a set of tools and technologies that connects various applications,
systems, repositories, and IT environments for real-time data and process exchange.
The benefits of service integration are:
1.
2.
3.
4.
5.
6.
7.
Improved operational efficiency
Increased flexibility and scalability
Faster time-to-market
Better internal communication
Improved customer service, support, and retention
Increased competitive edge
Reduced operational costs and increased revenue
174
Chapter 02: Architecture and Design
Resource Policies
Policies and Mechanisms for Cloud Resource Management Allocating resources for
individual instances is referred to as capacity allocation. An instance is a service
activation on behalf of a cloud user. Finding resources that are subject to several global
optimization restrictions needs a broad search.
Transit Gateway
A transit gateway is a network transit hub that connects your Virtual Private Clouds
(VPCs) and on-premises networks. Inter-Region peering connects transit gateways
using the AWS Global Infrastructure as your cloud infrastructure expands globally. Your
information is automatically encrypted and is never sent over the public internet.
Virtualization
Virtualization is a technique for creating a virtual ecosystem of storage devices and the
server operating system. In such cases, virtualization allows users to use multiple
machines that share a single physical instance of any resource.
Virtual Machine (VM)
A virtual machine is a digital representation of a real computer. Virtual machine
software is capable of running programs and operating systems, storing data,
connecting to networks, and performing other computing functions, but it requires
regular maintenance such as updates and system monitoring.
VMsprawl Avoidance
VM sprawl occurs when an administrator can no longer properly supervise and manage
all of the virtual machines on a network. This can happen when many VMs are put up
for use by various departments in quickly growing networks.
VM Escape Protection
A virtual machine escape is a security exploit that allows a hacker/cracker to gain access
to the primary hypervisor and the virtual machines it creates. Virtual machine escape
allows a user to bypass the hypervisor-created, manage guest OS boundary, and gain
access to the top-tier virtualization layer.
175
Chapter 02: Architecture and Design
Mind Map
Figure 2-15: Mind Map of Cloud Computing Concepts
Secure Application Development, Deployment, and Automation Concepts
Environment
Development
Software is created through a series of steps that include obtaining requirements,
planning, designing, coding, testing, and support. These responsibilities are carried out
according to the process model that the team members have defined.
Two of these are addressed in more detail below.
Waterfall Model
The Waterfall Model is one of the application development frameworks, which is a
“sequential design process.” In this process, each step is taken sequentially; that is, the
second step follows the completion of the first, the third step follows the completion of
the second, and so forth. The Waterfall model can be implemented in multiple ways,
but they all follow similar steps.
176
Chapter 02: Architecture and Design
The following are some of the most common pros and cons of the Waterfall model:
Pros
Cons
It is a sequential approach
Developers are unable to make changes to prior
steps; hence, each step is definitive.
Emphasizes methodical A fault in instructions can result in havoc as the
record-keeping
and project depends upon the initial input and
documentation
instruction
Clients know what
expected at every step
is Only at the end of the sequence is the test carried
out
Strong
documentation Change implementation can be a nightmare for
results in less hassle
developers
Table 1-01: Pros and Cons of the Waterfall Model
A common framework for application development:
Figure 2-16: The Waterfall Model
Agile Model
In the Agile Model, no sequential path is followed. Instead, multiple tasks are performed
simultaneously in development. One advantage of the Agile model is that it is simple to
make modifications, i.e., the Agile model's development process is continuous.
The following are the two main types of Agile development:
1.
2.
Scrum
Extreme Programming (XP)
177
Chapter 02: Architecture and Design
Some of the most common advantages and disadvantages of the Agile model are as
follows:
Pros
Cons
It is a team-based approach
Mismanagement could lead toward code
sprints with no ends
It allows us to make changes
The final project could be completely
different from a planned project
Testing can be done at any point It is impossible to identify who is
along the process.
working on what from the outside.
Simultaneous testing helps
launching a project quickly
in
Lack of emphasis on documentation
Table 2-02: Pros and Cons of the Agile Model
Test
Software testing determines if a software product satisfies the expected requirements
and ensures that it is free of defects. It comprises putting software/system components
to the test with manual or automated techniques in order to assess one or more
properties of interest.
Staging
Staging is the final stage of the deployment process before it is released to Production.
Staging is the final dress rehearsal before the project is handed over to Production. For
software testing, a staging environment (stage) is a near-exact replica of a production
environment. Staging environments are created to test codes, builds, and updates in a
production-like environment prior to application deployment.
Production
Production is the last environment in your software development process. The work is
ready to be made public, and only the most thoroughly tested code should be included.
Quality Assurance (QA)
Quality assurance helps identify errors and flaws in software code and design
throughout the development process to save time and money. It ensures that the final
product is competitive, secure, and performs its expected functions smoothly.
Provisioning and De-Provisioning
178
Chapter 02: Architecture and Design
Provisioning is the process of making IT systems available to customers. Depending on
your organization's needs, provisioning can be defined at the network, server,
application, and user levels:
1.
Network provisioning entails creating a network that users, servers, and
devices can access. Network provisioning is used in the telecommunications
industry, for example, to provide wireless solutions to customers.
2.
Server provisioning is the process of configuring a server for use on a network.
This could entail building a new machine. This includes setting up physical gear,
installing and configuring software, and connecting to networks and storage in a
data center.
Application provisioning is a technology that allows you to manage your
infrastructure.
3.
4.
Creating, updating, and removing rights and permissions to a company's apps as
part of the process of managing digital identities, files, networks, systems, and
resources, is known as user provisioning.
Deprovisioning is the process of withdrawing user access to software and network
services. Simply put, it is the inverse of provisioning and occurs when employees change
roles or leave a company.
Both provisioning and de-provisioning are important in securing IT systems and
applications, but effective and automated user provisioning should be at the top of any
organization's priority list if it wants to improve its security posture.
Integrity Measurement
Integrity measurement is a technique to enable a party to query the integrity status of
software running on a platform, e.g., through attestation challenges.
Secure Coding Techniques
The following secure coding techniques are used in the software development process:
Normalization
The process of restructuring data in a database so that it meets two basic standards is
known as normalization. There is no data redundancy; everything is kept in one place.
Data dependencies are understandable.
Stored Procedures
Stored Procedures are programs that are written to perform one or more DML
operations on a database. It is simply a collection of SQL statements that accept input
179
Chapter 02: Architecture and Design
in the form of parameters, perform some task, and may or may not return a value.
Parameters are used to provide information to the Procedure.
Obfuscation/Camouflage
Obfuscation is the process of making something difficult to understand. Programming
code is frequently obfuscated to protect intellectual property or trade secrets and
prevent an attacker from reverse engineering a proprietary software program. One
method of obfuscation is to encrypt some or all of a program's code.
Code Reuse/Dead Code
The practice of reusing existing code for a new function or piece of software is known
as code reuse. However, in order to reuse code, it must be of high quality. That means
it must be safe, secure, and dependable.
A section of a program's source code executed but whose output is never used in another
computation is called dead code. Dead code wastes both computation time and
memory.
Server-Side vs. Client-Side Execution and Validation
Client-side validation is used to validate and display form-level errors, whereas serverside validation is used to validate and display field-level errors. Client-side validation is
dependent on JavaScript and may be disabled in some browsers, resulting in invalid data
being saved, whereas server-side validation is extremely secure.
Memory Management
Software Development Kits (SDKs) and Third-Party Libraries Are Used
A third-party library is one in which the most recent version of the code is not
maintained and hosted by Moodle. "Mustache. PHP" is an example.
There are currently three SDKs available: iOS, Android, and Javascript. The iOS SDK
uses the keychain to secure key material, whereas the Keystore is used by the Android
SDK. This encrypts and safeguards the tokens against unauthorized use. When you use
the ForgeRock SDKs, you get all of these best practices for free.
Data Exposure
Data exposure occurs when information is left exposed in a database or server for
anybody to see. When system and application configuration details are left unprotected
online, sensitive data can be exposed.
Open Web Application Security Project (OWASP)
The Open Web Application Security Project specifies the number of general buffer
overflow prevention strategies. These are some of them:
180
Chapter 02: Architecture and Design
1.
2.
3.
4.
5.
6.
7.
8.
Auditing of code (automated or manual)
Bounds checking, the use of dangerous functions, and group standards are all
covered in developer training.
Non-executable stacks — This is something that many operating systems
support in some fashion.
StackShield, StackGuard, and Libsafe are examples of compiler tools.
Safe functions – Use strncat instead of strcat, strncpy instead of strcpy, etc.
Use strncat instead of strcat, strncpy instead of strcpy, and so on.
Patches — Make sure your web and application servers are adequately patched
and stay on top of bug reports for apps that your code relies on.
Periodically scan your application with one or more of the commonly available
scanners that look for buffer overflow flaws in your server products and your
custom web applications
Software Diversity
Software diversity is a research area concerned with the understanding and engineering
of diversity in the context of software.
Automation/Scripting
Script automation is the process of leveraging existing scripts with automation software
to deliver automation in a managed framework without the need for future custom
script development and maintenance.
Automated Courses of Actions
A scripting system can be assumed as a best friend for all the professionals who believe
in effective technical work as it provides an automated course of action to save time. The
importance of Scripts and Automation can be seen by the fact that it is specified by the
National Institute of Standard and Technology Special publication in the 800-53 series.
Continuous Monitoring
Continuous monitoring is an essential process in automation. A good continuous
monitoring program is adaptable and includes highly reliable, relevant, and effective
controls in dealing with potential threats. A continuous monitoring program's goal is to
determine whether the entire set of planned, required, and deployed security controls
within an information system or inherited by the system remain effective over time in
the face of the inevitable changes that occur.
Continuous Validation
As time changes, the system becomes outdated. We first design and configure the
system in a way that it should perform for what it has been designed for, along with the
validation of configuration against security standards. For the timely up-gradation of
181
Chapter 02: Architecture and Design
configuration, a method called automated testing can be used to resolve issues that may
include multiple configuration management.
Integration that is Ongoing
Continuous Integration (CI) is a development method in which developers integrate
code into a shared repository on a regular basis, preferably many times per day. An
automated build and automated tests can then be used to validate each integration.
Revision control, build automation, and automated testing are a few examples.
Continuous Delivery
Continuous delivery is a software development method that involves automatically
preparing code changes for production deployment. Continuous delivery enables
developers to automate testing beyond unit tests, allowing them to validate application
updates across multiple dimensions before releasing them to customers.
Continuous Deployment
Continuous Deployment (CD) is a software release process that employs automated
testing to determine whether or not changes to a codebase are correct and stable
enough for immediate autonomous deployment to a production environment. Over
time, the software release cycle has evolved.
Elasticity
Increasing the capacity of a system to handle the workload by using additional hardware
to scale up space is called an Elasticity. In other words, Elasticity is the capacity to
dynamically extend or minimize network resources to respond to autonomous working
load adjustments and optimize the use of resources. This can contribute to overall cost
savings for services.
Scalability
Scalability means the addition or removal of the resources in an easy and quick way as
per demand. It is important in such a situation where you do not know the actual
number of resources that are needed. Auto-scaling is an approach for scalability
depending on your requirement by defining the threshold.
Version Control
Version control tracks changes and can also revert back to see what changes have been
made. This version control feature is used in multiple software, as well as in the
Operating System, cloud-based files, and wiki software. It is also significant from the
standpoint of security because it highlights required changes in terms of time.
182
Chapter 02: Architecture and Design
Mind Map
Figure 2-17: Mind Map of Automation Concepts
Summarize Authentication and Authorization Design Concepts
Any technology service with IT applications that control the access of data from illegal
users is very important to provide a secure environment. In addition, it is also very
critical to find which user access which part of the infrastructure. Both authentication
and authorization are two major steps for ensuring network security. Authentication is
a way of finding out whether the user exists in the database or not. Once the user is
found from the database user ID and password, the next step is to ensure how many
services that user has the right to access.
Authentication
Authentication is a process that uses a database user ID and password to identify a user.
For example, if a user wants to use the Yahoo mail service, they cannot just access it
easily by opening the Yahoo mail page. The user must have a valid ID and password to
log in to the Yahoo mail page, and then they will be able to use its services such as view
183
Chapter 02: Architecture and Design
Newsbeat, send an email, etc. In short, Authentication confirms the validity of the user
by using its ID and password for the desired application.
Authorization
After authentication, the authorization procedure is carried out. When the user is
authenticated, then the next step is to find which kind of data access is available for the
authenticated user. For example, an Azure user is restricted to use limited Azure
resources and services such as SQL Database, Virtual Network, or Virtual Machine. If
that Azure user tries to use those resources for which he/she is not authorized, Azure
will not give access to that resources. Likewise, if a diabetes person visits an online
shopping app, the Azure service has the profile of the diabetes person. According to his
profile, he is only allowed to purchase sugar-free items. That’s is, a person is authorized
to buy only sugar-free items.
The process of identity service is clearly shown in the scenario defined in Figure 2-18.
Figure 2-18: Process of Identity Management
Authentication vs. Authorization
Authentication and authorization have very few differences. The summarized table
shows the difference between these two entities.
Authentication
Authorization
The first step toward accessing resources
A person can be authorized only when its
authentication has been done
A way to verify the customer or user’s Authorization allows authenticated users
identity
to access a file, database, mail, etc.
Normally, a user can be authenticated Controls user access
using a user ID and password
184
Chapter 02: Architecture and Design
Factor-based authentication is usually Authorization is the granular part of
preferred for security purposes
identity services
Table 2-03: Authentication vs. Authorization
EXAM TIP:
Authentication is the process of verification of users using user ID and password.
Authorization is the method of providing the rights to authenticated users.
Authentication Methods
Directory Services
Instead of maintaining individual local login accounts, you can use an external
authentication directory service (also known as an enterprise directory or
authentication login domain) to provide a single sign-on for groups of users. Fills in
their user name (typically, the Common-Name attribute, CN). Enters their login
information. The RADIUS (Remote Authentication Dial-In User Service) protocol is a
widely used authentication technique. TACACS+ (Terminal Access Controller Access
Control System Plus) is similar to RADIUS, but it is used on Unix networks. RADIUS
uses UDP (User Datagram Protocol), whereas TACACS+ uses TCP (Transmission
Control Protocol).
Federation
Federation is a system that grants access to other users who may not have local login. It
means a single token is given to the user who is entrusted or authenticated across
various systems, just like in SSO (Single Sign-On). A federated network is created by
third parties so that users can log in with separate credentials, for example, Facebook
credentials, Twitter credentials, etc. Before establishing a federated network, the third
party has to create a trust-based relationship.
185
Chapter 02: Architecture and Design
Figure 2-19: Example of Federation
Attestation
Attestation is an indication that makes something obvious. It means to certify in an
official capacity in the case of security, specifically security programs. Attestations and
certifications are used by the industry to assess your security defenses.
Technologies
Time-Based One-Time Password (TOTP)
A time-based one-time password is generated by a computer algorithm that uses the
current time as a source of uniqueness. A TOTP is a one-time passcode generated by an
algorithm that includes the current time of day as one of its authentication factors.
Time-based one-time passwords are widely used for two-factor authentication and are
gaining popularity among cloud application providers.
186
Chapter 02: Architecture and Design
Figure 2-20: TOTP
HMAC-Based One-Time Password (HOTP)
HOTP is an acronym that stands for Hash-based Message Authentication Code
(HMAC). In layman's terms, the HMAC-based One-time Password Algorithm (HOTP)
is an event-based OTP with a counter as the moving factor in each code. The moving
factor is incremented based on a counter each time the HOTP is requested and
validated. The generated code is valid until you actively request another one, at which
point the authentication server validates it. When the code is validated and the user
gains access, the OTP generator and the server are synced. Yumiko's Yubikey is an
example of a HOTP-based OTP generator.
187
Chapter 02: Architecture and Design
Figure 2-21: HOTP
Short Message Service (SMS)
Mobile devices that support SMS texting can be used for authentication using One Time
Password (OTP) and Challenge/Response (CR or Y/N). Because it is vulnerable to manin-the-middle attacks, it is a less secure form of strong authentication. SMS OTP sends
a one-time password to the user's phone via SMS.

SMS OTP sends a one-time password to the user's phone via SMS. The user is
approved after entering the OTP into their login authentication.

SMS Challenge-Response sends a question to the user's phone via SMS, asking if
the authorization attempt is approved. If the user replies with "Yes,"
authentication is complete, and the user is logged in. If the user responds with
"No," authentication fails, and the user cannot log in.
188
Chapter 02: Architecture and Design
Figure 2-22: SMS
Token Key
A security token (sometimes called an authentication token) is a small hardware device
that allows the owner to access a network service. The device could be in the form of a
smart card or embedded in a commonplace object like a key fob. Security tokens add an
extra layer of assurance by using two-factor authentication: the user has a Personal
Identification Number (PIN) that authorizes them as the owner of that specific device;
the device then displays a number that uniquely identifies the user to the service,
allowing them to log in. Each user's identification number is changed on a regular basis,
usually every five minutes or so.
Static Codes
Static authentication makes use of a single authenticator (e.g., static password). This
type of authentication only protects against attacks where an imposter is unable to
obtain the authenticator.
Authentication Applications
The Application Authentication dialogue allows users to enter their credentials and
store them in the application server password cache, so they are not prompted the next
time they run an application on that application server. Setting up Application
Authentication. Domains in Microsoft Windows.
Push Notifications
Notification via Push Authentication enables user authentication by sending a push
notification directly to a secure application on the user's device, alerting them to an
189
Chapter 02: Architecture and Design
authentication attempt. Users can view authentication details and approve or deny
access with the click of a button.
Phone Call
Mobile or phone call authentication is the process of verifying a user's identity using a
mobile device and one or more authentication methods for secure access. One-time
passwords via phone apps or SMS messages.
Smart Card Authentication
Smart Card Authentication is a method of authenticating users into enterprise resources
such as workstations and applications by utilizing a physical card in conjunction with a
smart card reader and software on the workstation. The smart card stores a user's public
key credentials as well as a personal identification number, which serves as the secret
key for the smart card's authentication. A smart card improves security because it
cannot be used to obtain user information (such as a PIN) by tampering with it.
Biometrics
Biometric authentication is a method of security that uses a person's unique biological
characteristics to verify that they are who they say they are. Biometric authentication
systems compare physical or behavioral characteristics to data in a database that has
been verified and confirmed to be authentic. Numerous biometric factors are used for
controlling access, including fingerprint, voice recognition, retinal scanner, facial
recognition, and iris scanner.
Fingerprint
Fingerprint recognition, the most popular biometric to date, can use a variety of
approaches to classification based on minutiae, which are reproductions of epidermal
friction skin ridges found on the palm side of the fingers and thumbs, the palms, and
soles of the feet. We can use them for authentication because of the following
fundamental principles:



A fingerprint will not change over the course of a person's life.
Fingerprints have general ridge patterns that allow them to be classified
systematically.
A fingerprint is unique because no two fingers have ever been found to have
identical ridge characteristics.
190
Chapter 02: Architecture and Design
Figure 2-23: Fingerprint
Retina
The most secure method of authenticating identity is retina-based identification. By
acquiring an internal body image, the retina/choroid of a willing person who must
cooperate in a way that would be difficult to counterfeit, retinal identification provides
true identification of the person.
Iris
Parts of the human eye are depicted in the image below.
Figure 2-24: Iris
191
Chapter 02: Architecture and Design
The iris is the colored tissue that surrounds the pupil of the eye and is made up of
intricate patterns with numerous furrows and ridges.
Facial
The system uses a digital video camera to capture face images, which are then analyzed
to determine facial characteristics such as the distance between the eyes, nose, mouth,
and jaw edges.
Voice
Voice verification systems are distinct from voice recognition systems. The process of
recognizing what someone says is known as voice recognition, whereas the process of
determining who is saying it is known as voice verification.
Vein
Palm vein authentication is a vein pattern authentication technology that uses the
biometric feature of palm veins. Because palm vein patterns exist beneath human skin,
copying or stealing someone's palm vein pattern is extremely difficult. This means that
forgery is extremely difficult under normal circumstances.
Gait Analysis
One of the most well-known biometrics for secretly recognizing people is gait
recognition-based authentication. It recognizes a person based on a sequence of images
received. Gait is a physiological feature of humans. A video camera that captures videos
of human subjects walking within its field of view serves as the sensor for a gait-based
biometric system. After that, the raw sensor video is processed to extract relevant
features that can be used for recognition.
Efficacy Rates
Even when the data is encrypted, storing biometric data on a device – such as the
iPhone's TouchID or Face ID – is thought to be safer than storing it with a service
provider. This risk is similar to that of a password database, in which hackers can breach
the system and steal data that is not properly secured.
False Acceptance or False Accept Rate
A false acceptance occurs when an illegal subject is accepted as legitimate. Suppose an
organization's biometric control generates a high number of false rejections. In that
case, the overall control may have to reduce the system's accuracy by reducing the
amount of data it collects when authenticating subjects. When data points are reduced,
the organization runs the risk of increasing the False Acceptance Rate (FAR). The
organization is vulnerable to an unauthorized user gaining access. This is also referred
to as a Type II error.
192
Chapter 02: Architecture and Design
The False Rejection or False Reject Rate
When an authorized subject is rejected as unauthorized by the biometric system, this is
referred to as a false rejection. False rejections are also referred to as Type I errors. False
rejections frustrate authorized users, reduce productivity due to poor access conditions,
and necessitate the expenditure of resources to revalidate authorized users.
Crossover Error Rate
The Crossover Error Rate (CER) denotes the point at which the false Reject Rate (FRR)
and false accept rate are both equal. CER is also referred to as the Equal Error Rate
(EER). The crossover error rate describes a biometric system's overall accuracy.
Figure 2-25: CER
Exam Tip: A false accept is more dangerous than a false reject. Most organizations
would rather reject genuine subjects than accept impostors. Type II errors (FARs) are
more harmful than Type I errors (FRRs). Because two is larger than one, you will recall
that FAR errors are more serious than FRRs.
AAA (Authentication, Authorization, and Accounting) Framework
The AAA (Authentication, Authorization, and Accounting) framework is the base of
network security. The process of identifying ourselves by providing ID and password
when we log into some account goes through this AAA framework.
193
Chapter 02: Architecture and Design
Authentication
The part of the framework deals with the authentication of any person who claims to be
authorized. For that, the person generally provides ID and password and usually other
additional authentication data.
Authorization
Once the identification process is completed, the authorization part will figure out what
the person can access or access to the sources.
Accounting
Accounting keeps the record of the following things:




A person who logs in
Login time
What data is delivered and received
Log out time
Multi-Factor Authentication
MFA (Multi-Factor Authentication) is a layer-based authentication method that uses
multiple forms of authentication. This means that attackers will be unable to get access
even if an individual is compromised. MFA is recommended by default. It is a feature of
AAD that allows you to authenticate users in several ways. MFA is needed in
organizations that have a large number of users, devices, and resources. To avoid any
collapse, extra security is required for protection and efficient throughput.
How MFA Works?
MFA is a method of user authentication that involves several processes. The first step is
to use a user ID and password to validate the user. The user's phone will be sent a code
for additional verification in the second phase. Biometric verification is the third step.
This is an optional step.
For example, a user wants to log in to the online booking web app. A large number of
people are already accessing that web application due to its efficient throughput and
fast response. Using MFA, the simplest way to use the application requires the user to
put user ID and password for verification. A user's ID and password have been entered
successfully. The second step of MFA verification is to confirm the user’s credentials
from the database by sending code on the user's phone. A combination of numbers in
the form of code is sent to the user’s phone to confirm the user. When the user gets the
code, they are required to put the code in the given area to confirm the validity. Once
the code is entered, the authentication of the user is complete. Another way to
authenticate the user is Fingerprint verification, but this step is only needed for highly
194
Chapter 02: Architecture and Design
advanced security purposes. The following figure shows the layer-based services offered
by MFA.
Figure 2-26: Multi-Factor Authentication
EXAM TIP
Multi-Factor Authentication provides the combined version of authentication that
results in an advanced level of security and protection.
In a AAA authentication mechanism, a user is asked for multi-factor authentication like
who you are, what you have, what do you know, what do you do, and etc. These additional
items may have a cost combined with them.
Something You Are
Biometric Authentication: Biometric authentication, like a fingerprint, does not
actually keep your real fingerprint. Instead, it keeps a mathematical representation of
your biometrics. The mathematical values used for biometric representation are
complex to modify because these biometric values are unique.
195
Chapter 02: Architecture and Design
Something You Have
Smart Card: These cards are inserted into the computer, and usually, these cards are
combined with a Personal Identification Number or PIN so that if some unauthorized
person may get access to your card, he may have to provide that additional information
or PIN.
USBToken: Another method of authenticating is the use of a USB Token. When
authentication is required, a specific certificate is stored on the USB and used.
Hardware and Software Token: This token generates synchronized pseudo-random
codes for authentication purposes.
Your Phone: Messages or codes are sent to the phone, and then those messages or codes
are used for authentication purposes.
Something You Know
Password: The most common way of authentication is a password. The password is a
secret word, code, or character that is known to the only person who created that
password.
PIN: PIN is abbreviated as Personal Identification Number. These PINs are usually asked
us when we use an ATM that is generally a 4-digit code used for authentication.
Pattern: A pattern is also a type of authentication. These types of patterns are seen on
the mobile phone lock screen nowadays commonly.
Figure 2-27: Password and Pattern Authentication
Somewhere You Are
Your Location: A useful method of authentication that is based on your geographical
location. In this type of authentication, when a person logs in to a system, they have to
provide the details of where they are, and the process of the transaction only completes
if that person is in that particular location.
IP Address: Another way to authenticate where the person is, is through an IP address.
It does not provide accurate geography but can help to some extent.
196
Chapter 02: Architecture and Design
Mobile Device Location: Mobile devices provide accurate geographical location as
compared to others through GPS (Global Positioning System).
Something You Can Do
Handwriting Analysis: Handwriting and signatures are another way to authenticate
who the person is.
Typing Technique: Typing technique is also used to determine the person because
every person has some kind of typing pattern.
Identity and Access Services
Gaining Access:
To gain access to network resources, credentials are needed that are first investigated
by the AAA server. For example, consider a client wants to get access to the resources
of a network, and he is authenticating through a VPN concentrator. The client first
requests the VPN concentrator to get access. This request contains authentication
credentials such as username/password. VPN Concentrator authenticates the
connection request through the AAA server. If the credentials are matched, AAA
approves the authentication. After validating the authentication credentials, the
connection is established.
Figure 2-28: Access Gaining Process
There are many protocols that are used by the AAA server for this authentication
process:
197
Chapter 02: Architecture and Design
RADIUS (Remote Authentication Dial-in User Service)
RADIUS is a popular protocol for authentication. It supports numerous devices or
networks other than dial-in networks. The services of RADIUS can be used to centralize
for a single authentication for various systems like Routers, Switches, Firewall, etc. The
services of RADIUS are almost available for every Operating System.
TACACS (Terminal Access Controller Access Control System)
It is a remote protocol for authentication that is typically needed to control access to
dial-up lines.


XTACACS: It is abbreviated as Extended TACACS. It is created with new features
induced by Cisco. It is only for Cisco devices as it is Cisco proprietary and supports
accounting and auditing too.
TACACS+: It is an authentication protocol developed by Cisco and released as a
standard open beginning in 1993. TACACS+ is an entirely new protocol and is not
compatible with its predecessors. TACACS+ encrypts all the information mentioned
above and therefore does not have the vulnerabilities present in the RADIUS
protocol.
The properties of RADIUS and TACACS+ are summarized and compared in this table.
L4 Protocol
TACACS+
RADIUS
TCP port 49
UDP ports.
1812/1645 for authentication
1813/1646 for accounting
Encryption
Encrypts full payload of Encrypts passwords only
each packet
Observations
Proprietary to Cisco,
very granular control of
authorization, separate
implementation of AAA
Open Standard, robust, great accounting
features, less granular authorization
control.
Another
protocol
named
DIAMETER may replace RADIUS in the
near future with enhanced capabilities
Table 2-04: Comparison of RADIUS and TACACS+
Cloud vs. On-Premises Requirements
On-Premises: A type of model that uses the same legacy IT infrastructure and runs
cloud resources within its own data center. It is also called the private cloud for its ability
to provide dedicated resources while maintaining total control and ownership of the
environment.
198
Chapter 02: Architecture and Design
Cloud: A type of model in which a third party makes computing resources for the public
over the internet. Cloud-based applications are fully deployed and run on the cloud.
There is no need to set up and maintain your own cloud servers in-house.
Mind Map
Figure 2-29: Mind Map of Authentication & Authorization Design Concepts
Implementation of Cybersecurity Resilience
Redundancy
In a cyber-system, redundancy means creating multiple resources that perform the
same function and can be replaced if the primary system resources fail.
Geographic Dispersal
As digital transformation and hyper-convergence open unintended doors to risks,
vulnerabilities, attacks, and failures, a cyber-resilience strategy becomes increasingly
important for your company. A cyber-resilience strategy can assist your company in
reducing risks, financial impact, and reputational damage.
Disk
Redundant Array of Inexpensive Disks (RAID) Levels
RAID stands for Redundant Array Independent Disks. It is used to increase the
reliability of storage disks. It takes data that is commonly stored on a disk and sends it
to many others, keeping the data stored in various places. RAID also increases the speed
of data recovery because multiple disks are busy recovering data rather than a single
disk.
199
Chapter 02: Architecture and Design
The following are some often used terminology in relation to RAID:



Striping: data is spread over several drives.
Mirroring: data is replicated across several disks.
Parity is also known as a checksum. Parity is a determined value that is used to
recreate data mathematically.
Various RAID levels are offered to fulfill the requirements of different applications. The
following table lists the RAID modes available on several StarTech.com products:
RAID Description
mod
e
RAID Striped disks
0
Operation
Advantages
Disadvantage
s
Recover
y
The data is
uniformly
distributed
across two or
more disks
Largest size
and quickest
speed
No
redundancy
RAID Mirrored
1
disks
The
information
on two or
more drives is
the same
Data is
distributed
evenly among
two or more
disks, as well
as a parity
drive
The data is
uniformly
distributed
among three
or more disks.
The parity is
divided
between the
disks
Four or more
drives are
striped to
Data will not
be lost if a
single drive
fails
The slowest
and smallest
disk limits
speed and size
For sequential
read/write
operations,
high speeds
are required
Multiple
simultaneous
instructions
provide poor
performance
Large size,
quick speed,
and
redundancy
are all
advantages
Parity reduces
the entire
array size
Array
failure
occurs
when
one or
more
drives
fail
For
recovery,
only one
drive is
required
A single
drive
failure
will
cause the
system to
rebuild
The
system
will
rebuild if
a single
drive
fails
RAID-2 is
larger and
faster than
RAID-1, and it
There is no
parity
RAID Set of stripes
3
with special
parity
RAID Disks with
5
distributed
parity that
are striped
RAID 1+0; Mirrored
10
Subset with
Stripes
200
In a
mirrored
set, only
Chapter 02: Architecture and Design
create two
mirrors
JBOD Just a Bunch
Of Disks
Big
Clon
e
Concatenatio
n or spanning
RAID 1 +
Spare
The operating
system can
access any
number of
drives
independentl
y.
Data is
written to the
first drive
until it is full,
then to the
next drive(s)
until it or
they are full
Two
drives
contain
identical data,
and one drive
is in use for
rebuilding in
case
of
a
primary array
failure
has more
redundancy
than RAID-0
Software RAID Hardware
modes are
RAID may
available
outperform
software RAID
one drive
can fail
Creates a large
and
straightforwar
d array
No
N/A
When one of
the drives in a
RAID-1 array
fails, the array
continues to
function
normally
The spare
drive is not
accessible to
the user
N/A
redundancy
Only one
drive is
needed
for
recovery
Table 2-05: Available RAID Modes
Multipath
Device-Mapper Multipathing (DM-Multipath) combines multiple I/O paths between
server nodes and storage arrays into a single device. These I/O paths are physical SAN
connections that may consist of multiple cables, switches, and controllers.
Network
Load Balancers
Load Balancer takes the load and distributes it among various resources without the
user being informed. The load balancer is able to provide fault tolerance and has very
fast convergence.
201
Chapter 02: Architecture and Design
A load balancer is something that takes the load of traffic and distributes it among
multiple resources or servers. This process of distributing load is invisible to the user. A
benefit of the load balancer is that it provides fault tolerance.
Scheduling
It is the scheduling algorithm on the basis of which the load balancer determines how
to distribute the traffic load among various internal servers. There are many different
scheduling algorithms; some of them are discussed below.
Affinity
The affinity is the characteristic of a load balancer, which means that for a particular
application or user, the load balancer will use the same server.
Round Robin
Round Robin is the kind of schedule in which every new request is sent over to the next
server in a cycle or rotation, and all these requests are forwarded in equal amounts
despite server load. The modified Round-Robin scheme involves a weight factor that
considers servers load and other principles when forwarding the request to the next
server in turn.
Active-Passive
In an active-passive load balancing scheme, there are two load balancers, one for doing
active balancing, and another load balancer passively observes the system and functions
when the primary load balancer fails.
Active-Active
In the active-active type of load balancing scheme, both the load balancer are active
means both of them are sharing the duty of load balancing.
Network Interface Card Teaming
Network Interface Card (NIC) teaming is a common method of grouping physical
network adapters in order to improve performance and redundancy. The primary
advantages of NIC teaming are load balancing (redistributing traffic across networks)
and failover (ensuring network continuity in the event of system hardware failure)
without the requirement for multiple physical connections.
Power
Uninterruptible Power Supply (UPS)
The ability to remotely monitor the devices, as well as their uninterruptible power
supply, has opened them up to external networks. Naturally, a UPS that lacks a network
card or other means of remote access is not directly vulnerable to a cyber-attack.
202
Chapter 02: Architecture and Design
Generator
The power control system is critical in ensuring that power is available in response to
customer demand. An imbalance in supply and demand can cause system frequency
instability, jeopardizing the power system's operational security. A central control
scheme is commonly used in traditional power systems, with a single control center that
collects information from and sends control commands to all agents. However, such a
central control architecture is no longer appropriate for today's power systems.
Geographically dispersed distributed generators, for example, are increasingly being
integrated into the power grid. Because of the requirement for plug and plug operation,
these are not suitable for coordination by central control. Central control is also
inapplicable in microgrid operations, where distributed generators must supply power
in island mode. Distributed control is preferred over central control because of its
dependability, scalability, and flexibility. Local controllers in distributed control, on the
other hand, have access to both local and neighbor information, making them
vulnerable to cyber-attack. By launching FDI attacks, a malicious entity can disrupt data
exchange between neighboring local controllers.
Managed Power Distribution Units
Advanced power distribution units, or PDUs, give system administrators more control
options, protect circuitry, and optimize energy allocation. Alarm thresholds aid in risk
mitigation by providing real-time warnings of potential circuit overloads. These
metering devices include both floor-mounted power distribution units for converting
raw power into lower-capacity feeds and smaller devices for distributing power within
racks with multiple appliance connections. Some power distribution units have LANnetwork access, allowing administrators to control electrical loads and schedule
shutdowns from afar. Power distribution units assist in balancing costs in order to meet
energy management targets.
Replication
Storage Area Network
A storage area network (SAN) is a specialized high-speed network or subnetwork that
links and presents many servers with shared pools of storage devices. A distinct,
dedicated, highly scalable, high-performance network designed to interface a number
of servers to an array of storage devices is provided by SAN technology, which fulfills
advanced business storage demands. After that, the storage can be arranged and
handled as tiers or pools.
VM
VM is basically a virtual machine. Supported Linux distributions are CentOS, Oracle
Linux, RHEL, Debian, OpenSUSE, SUSE LES, and Ubuntu. There are six types of VMs
203
Chapter 02: Architecture and Design
with 28 families. There is a set amount of Memory, vCPUs, and Temporary Storage. You
can also attach additional data disks to these VMs. Pricing is based on per-minute
billing. Reserved VMs are also available for significant discounts like you can get
discounts up to 72% on a pay-as-you-go model.
Backup Types
Backup utilities help you through unexpected disruptions in the system like the system's
failure, when it gets infected, and at the time of data loss. At Such crucial times, the
backed-up utilities become lifesavers. Having a backup of everything serves as the key
factor in the disaster recovery of any organization. Backup can be made to tape, disk,
optical drive, etc. For database backup, replication (online duplication) can be used.
Full
In order to back up files in an OS, there are various strategies that can be followed. One
of them is a full backup. Every time the backup process is performed, every single file is
copied sequentially in the full backup.
Incremental
In the incremental backup, those files are copied that have been modified since the last
time an incremental backup is performed.
Snapshot
Using snapshots is common to the backup operating system. A snapshot is a replicate
of virtual machines at a definite moment in time. A snapshot is generated by replicating
the files that keep the virtual machine.
Differential
Differential backup only backs up the changes and modifications that are done after the
last backup.
Tape
Tape backup is the practice of copying data from a primary storage device to a tape
cartridge on a regular basis so that it can be recovered in the event of a hard disk crash
or failure. Tape backups can also be used to restore data to storage devices when
necessary.
Disk
Hard disk storage has grown in popularity as it has become more affordable. Hard disks
are typically simple to use, widely available, and easily accessible. On the other hand,
hard disk backups are low-tolerance mechanical devices that can be damaged more
easily than tapes, particularly during transport. External hard disks can be connected
using local interfaces such as SCSI, USB, FireWire, or eSATA, as well as longer-distance
204
Chapter 02: Architecture and Design
technologies such as Ethernet, iSCSI, or Fibre Channel. Some disk-based backup
systems support data deduplication, whether via Virtual Tape Libraries or otherwise,
and can reduce the amount of disk storage capacity consumed by daily and weekly
backup data.
Network-attached storage
Network-Attached Storage (NAS) is a type of dedicated file storage that allows multiple
users and diverse client devices to access data from a centralized disk capacity. NAS
devices provide infrastructure for centralizing storage and supporting tasks such as
archiving and backup and a cloud tier.
Cloud
Cloud backup, also known as online backup or remote backup, is a method of storing a
copy of a physical or virtual file or database in a secondary, off-site location in the event
of equipment failure or disaster. A third-party service provider typically hosts the
secondary server and data storage systems, charging the backup customer a fee based
on storage space or capacity used, data transmission bandwidth, number of users,
number of servers, or number of times data is accessed.
Image
Image Backups are exactly what they sound like: a backup of your entire operating
system, including files, executable programs, and OS configurations. Professional
backup solutions will automatically create full or incremental images of the hard drive.
Online vs. Offline
Online backup storage is typically the most accessible type of data storage, with restores
starting in milliseconds. An example of an online backup is an internal hard disk or a
disk array (possibly connected to a SAN). This type of storage is convenient and quick,
but it is vulnerable to being deleted or overwritten, whether by accident, malicious
intent, or in the aftermath of a data-deleting virus payload.
Off-line storage necessitates some kind of direct action to gain access to the storage
media, such as inserting a tape into a tape drive or plugging in a cable. Because the data
is inaccessible to any computer except during the brief periods when it is written or read
back, it is largely immune to online backup failure modes.
Offsite Storage
Having an off-site backup is one of the best options. Off-site backup means that all the
data is copied and stored on some other site (other than your building). It also mitigates
the risk of backup loss.
Non-Persistence
205
Chapter 02: Architecture and Design
A system is said to be non-persistence when the changes made in it are not permanent.
Making the system non-persistence secures it from certain malware as the files,
applications, or programs installed in it are not permanent because the changes made
in its configuration are not saved.
Revert to a Known State
The capability of an operating system to snapshot any virtual machine is understood as
reverting to a known state. Most of the operating systems have this capability as a builtin program. This option is mainly found in Microsoft office, where the system creates a
restore point by default before the update processes.
Last Known-Good Configuration
The last-known-good configuration to a known configuration can also be defined as
getting back to a known state. For example, you can use this option if you make any
incorrect configuration to your system and you want to get back to the older state.
Live Boot Media
A bootable system known as live boot media is concluded to an optical disk or USB,
which is specially designed to be bootable from the media. This is used to boot the
system from an external operating system.
High Availability
High availability is the ability of a system to maintain a space for data and operational
services regardless of any disrupting events (faults). High availability has the same goal
as fault tolerance along with the availability of data and services.
Scalability
A design that makes a system accommodate more load by using additional hardware or
sources is known as scalability. This term is commonly used in server farms and
database clusters because these two mostly face scaling issues due to workload.
Restoration Order
During the process of application recovery, it is required to consider what applications
have higher priority because all the applications do not have the same priority. Such as
customer-facing applications or the application dealing with the billing process are of
higher priority.
The priority list of application restoration should be well defined by the management
of the corporation. This order of restoration list is changeable, which means the
management can change the order based on its priority.
Diversity
206
Chapter 02: Architecture and Design
Vendors
When you have multiple suppliers, it creates vendor diversity and reduces the risk from
a particular supplier. Relying on a single vendor increases the risk factor. For example,
if you have two firewalls from two different vendors, it reduces risk and adds diversity
because you can turn to the other firewall in case something happens to one firewall or
if the firewall contains flaws.
Controls
Control diversity is also important because it provides layered security that helps in
generating the desired result.
Administrative Control
Administrative control is by all means necessary. Administrative control includes all the
policies and procedures that are required to be followed by everyone in order to
maintain security.
Technical Control
Technical control is also essential to ensure that the hardware and software we use are
hardened or not. Active Directory authentication, firewall, and disk encryption are all
parts of technical control.
Mind Map
Figure 2-30: Mind Map of Cybersecurity Resilience
207
Chapter 02: Architecture and Design
The Security Implications of Embedded and Specialized Systems
Embedded Systems
An embedded system is a system that uses an embedded operating system, and the user
does not have any direct access to that operating system, and it is simply accessed
through the user interface. One of the impacts associated with this embedded system is
that if it is not updated or patched, it can develop hidden vulnerabilities in the system.
Raspberry Pi
The Raspberry Pi is a low-cost, credit-card-sized computer that connects to a computer
monitor or TV and operates with a standard keyboard and mouse. It is a little capable
device that allows people of all ages to experiment with computing and learn to program
in languages such as Scratch and Python.
Field-Programmable Gate Array
A Field-Programmable Gate Array (FPGA) is an integrated circuit that a customer or a
designer can configure after it has been manufactured – hence the term "fieldprogrammable." FPGAs are useful for prototyping ASICs or processors. The FPGA is
reprogrammed until the ASIC or processor design is bug-free, at which point production
of the final ASIC can resume. This FPGA method is used by Intel to prototype new ASIC
chips.
Arduino
An embedded system is a combination of hardware and software that must be in sync
with one another. The Arduino is an open-source computer hardware/software
platform for creating digital devices and interactive objects that can sense and control
the physical world around them.
Supervisory Control and Data Acquisition (SCADA)/Industrial Control System
(ICS) Facilities
SCADA abbreviates as “Supervisory Control and Data Acquisition System.” It is a process
used to control the system that is automated in a cyber-physical environment like a
traffic light, energy networks, water plants, refineries, environmental controls, building
automation manufacturing plants, etc. SCADA contains its own smart components,
each of which is an example of an embedded system.
SCADA is also known by different other names like Industrial Control System (ICS) and
Distributed Control System (DCS); these variations depend on the configuration and
industry.
Internet of Things (IoT)
208
Chapter 02: Architecture and Design
The world is rapidly moving towards automation. The need for automated devices
where we have control of daily tasks at our fingertips is increasing day by day. As we all
know, there is a performance and productivity difference between manual and
automated processes, and moving toward the interconnection of things will process
even faster. The term "things" refers to machines, appliances, vehicles, sensors, and
many other devices. An example of automation through the Internet of Things is a
CCTV camera in a building capturing an intrusion and immediately generating an alert
on client devices at their remote location. Similarly, we can connect devices over the
internet to communicate with other devices.
IoT technology requires a unique identity. IP addresses, especially IPv6 addresses,
provide each device with a unique identity. Planning and deploying IPv4 and IPv6 over
a complex network topology necessitates careful consideration of sophisticated tactics
and methodologies. Each network node in IP version 4 is given a 32-bit address for
identification; however, in IP version 6, each node is given a 128-bit address for unique
identification. IPv6 is an advanced version of IPv4 that can accommodate the emerging
popularity of the internet, the increasing number of users and devices, and
advancements in networking. Advanced IP addresses are required to be taken into
account IP addresses that guarantee efficiency, reliability, and scalability in the overall
network model.
Figure 2-31: IoT Workflow
How does the Internet of Things Work?
IoT devices can use IoT gateways to communicate with the internet or communicate
with the internet directly. The integration of controlled equipment, a logic controller,
209
Chapter 02: Architecture and Design
and advanced programmable electronic circuits make them capable of communicating
and being controlled remotely.
The architecture of IoT depends on five layers, as follows:
1.
2.
3.
4.
5.
Application Layer
Middleware Layer
Internet Layer
Access Gateway Layer
Edge Technology Layer
Figure 2-32: IoT Architecture





The Application Layer is responsible for delivering data to users. This is a user
interface for controlling, managing, and commanding these IoT devices
The Middleware Layer is for device and information management
The Internet Layer is responsible for endpoint connectivity
The Access Gateway Layer is responsible for protocol translation and messaging
The Edge Technology Layer covers IoT capable devices
IoT Technologies and Protocols
Wireless Communication
Wired
Short Range
Medium
Range
Long Range
Bluetooth Low
Energy (BLE)
Ha-Low
Low-Power
Wide Area
210
Operating
System
Communication
Ethernet
RIOT OS
Chapter 02: Architecture and Design
Networking
(LPWAN)
Light-Fidelity
(Li-Fi)
LTEAdvanced
Near Field
Communication
(NFC)
Very Small
Aperture
Terminal
(VSAT)
Multimedia over
Coax Alliance
(MoCA)
ARM
mbed OS
Cellular
Power-Line
Communication
(PLC)
Real Sense
OS X
Radio
Frequency
Identification
(RFID)
Ubuntu
Core
Wi-Fi
Integrity
RTOS
Table 2-06: IoT Technologies and Protocols
IoT Communication Models
IoT devices can communicate with other devices in several ways. The following are some
of the IoT communication models.
Device-to-Device Model
The Device-to-Device Model is a basic IoT communication model in which two devices
communicate with each other without interfering with any other device.
Communication between these two devices is established using communication
mediums such as a wireless network. An example of a device-to-device communication
model can be a mobile phone user and a Wi-Fi printer. The user can connect a Wi-Fi
printer using a Wi-Fi connection and send commands to the printer. These devices are
independent of the vendor. A vendor’s mobile phone can communicate with the
wireless printer of a different manufacturer due to interoperability. Similarly, any home
appliance connected with wireless remote control through a medium, such as Wi-Fi,
Bluetooth, NFC, or RFID, is an example of the device-to-device communication model.
211
Chapter 02: Architecture and Design
Figure 2-33: D2D Communication Model
Device-to-Cloud Model
The Device-to-Cloud Model is another IoT device communication model in which IoT
devices directly communicate with the application server. Consider a real-life scenario
in which a residence has several security sensors installed, such as motion detectors,
cameras, temperature sensors, and so on. The application server, which can be hosted
locally or in the cloud, is directly connected to these sensors. The application server
facilitates communication between various devices.
Similarly, Device-to-Cloud communication scenarios are found in a manufacturing
environment where different sensors communicate with the application server.
Application servers process data, perform predictive maintenance, execute required and
remediation actions to automate processes, and accelerate production.
Figure 2-34: Device to Cloud Communication Model
Device-to-Gateway Model
The Device-to-Gateway model is similar to the device-to-cloud model. IoT gateway
devices collect data from sensors and send it to the remote application server. This
212
Chapter 02: Architecture and Design
gateway can provide security and other functionality, such as data or protocol
translation. In addition, there is a consolidation point where the data being transmitted
can be controlled.
Figure 2-35: Device to Gateway Communication Model
Back-End Data-Sharing Model
The Back-end Data-sharing Model is an advanced model in which devices communicate
with the application servers. This scenario is used in a collective partnership between
different application providers. The Back-end Data sharing model extends the deviceto-cloud model to a scalable scenario where sensors are accessed and controlled by
multiple authorized third parties.
Figure 2-36: Back End Data Sharing Model
213
Chapter 02: Architecture and Design
The devices that are comprised of the Internet of Things or the Smart devices have taken
the world’s market by storm. Anything that contains a microcontroller seems to be
connected to the web so that it can be controlled remotely.
Wearable Technology: The use of smart devices that are wearable has majorly
increased. These wearable technologies include everything from smartwatches to step
counters to health monitors and more. As these devices are connected to the person,
they can track the person's location. The security concern that arises from the usage of
these wearable gadgets is the data/information stored and who can access that
data/information.
Home Automation: The driving factor behind the IoT movement is Home
Automation.
Home automation or smart home is a system in which every device is connected to the
internet and is controlled through the internet like doorbells, lights, fans, AC, TV, Door
Locks, etc.
These IoT devices are smart devices, and they know when we are home and when we
are not. If someone can gain access to this home automation system, it means they have
potentially gained access to the entire house.
Figure 2-37: Home Automation
Specialized
Medical systems
Embedded systems are also used for Medical purposes like heart monitors or insulin
pumps. The security concern related to these medical devices is that how the kernel is
patched in case the vulnerabilities are found because the medical devices are designed
and manufactured for a static system that does not require updating and patching. In
214
Chapter 02: Architecture and Design
case if the changes are made, then it will force towards a lengthy, time-consuming,
expensive requalification process. Therefore, it is recommended by most of the
manufacturers not to connect the medical devices to the outside network (isolate the
device), which in reality is not possible.
Note: In 2017, nearly half a million pacemakers were recalled for a software vulnerability
that allows the hacker to gain access to the device and make changes to the performance
characteristics of these devices. The good news related to this security issue is that
without removing the device, it can be patched, but it requires a doctor's visit to install
the new firmware.
Vehicles
Some current embedded system trends in automobiles include airbags, event data
recorders, anti-lock brake systems, cruise control, rain-sensing wipers, emission
control, traction control, automatic parking, in-vehicle entertainment, backup collision
sensors, navigation systems, and tire-pressure monitors.
Aircraft
The embedded systems are also inside the Aircraft or Unmanned Ariel Vehicles (UAV).
Flight Control System (FCS) and Air Traffic Control (ATC) are two primary control
systems of an airplane consisting of different components and embedded systems. Some
of the security issues arise when somebody performs Denial of Service (D0S) and creates
some interference to disturb the communication. Not only would it damage the aircraft,
but it would also be dangerous for the people on the ground.
Smart meters
A smart meter is an electronic device that records data such as electric energy
consumption, voltage levels, current, and power factor. Smart meters transmit data to
consumers for a better understanding of their consumption habits and electricity
suppliers for system monitoring and customer billing.
Voice over IP
Voice over IP (VoIP) is a method of converting your voice into a digital signal,
compressing it, and transmitting it over the internet. The call is set up between all
participants by a VoIP service provider. The digital data is then decompressed into the
sound you hear through your handset or speakerphone at the receiving end.
Heating, Ventilation, Air Conditioning
Heating, Ventilating, and Air Conditioning (HVAC) is an acronym for heating,
ventilation, and air conditioning. A complex system designed by the HVAC system
expert and installed in large buildings or enterprises. It is not a standalone unit; it is
usually integrated with other components within the infrastructure. A centralized PC is
215
Chapter 02: Architecture and Design
responsible for managing all these HVAC units that include making heating and cooling
decisions for data centers and workspace.
HVAC systems are usually not built keeping security in mind, and this leads to difficulty
in recovering from the infrastructure’s DOS.
Drones/AVs
Autonomous flight and position control are provided by a fully functional integrated
GPS system. The small-footprint drone can fly into small spaces, hover, capture video
images, and transmit real-time data to the user. While drones can be used for a variety
of purposes, including recreation, photography, commercial, and military use, their two
primary functions are flight and navigation. Drones fly thanks to a power source, such
as a battery or fuel, rotors, propellers, and a frame.
Multifunction Printer
An MFP (Multi-Function Product/Printer/Peripheral), All-in-One (AIO), or MultiFunction Device (MFD) is an office machine that combines the functionality of multiple
devices into one, allowing for a smaller footprint in a home or small business setting or
centralized document management/distribution/production in a large-office setting. A
typical MFP can function as one or more of the following devices: email, fax,
photocopier, printer, and scanner.
Real-Time Operating System
Real-Time Operating System (RTOS) is the system in which the processing must occur
in real-time and where the data cannot be queued for significant time-length. The RTOS
is designed for such types of system
RTOS is designed and programmed for a specific purpose. The scheduling algorithm in
RTOS deals with the time collision. However, RTOS generally processes each input as
received or within a specific time, defined as ‘response time.’ Mostly, the multi-tasking
system lacks real-time processing. Therefore, the RTOS, instead of handling multiple
tasks, emphasizes the thread in processing.
Surveillance Systems
Embedded system security is a proactive approach to safeguarding software running on
embedded systems from attack. An embedded system is a hardware component that
can be programmed and has a minimal operating system and software. Embedded
systems are created to carry out specific functions or functions.
Surveillance systems are an important part of keeping your home or business safe.
Wireless home security cameras to sophisticated alarm systems that alert law
enforcement at the first sign of trouble is examples of these systems.
System on Chip
216
Chapter 02: Architecture and Design
System on a Chip, or SoC, is one of the most popular embedded systems these days.
Multiple activities take place on a single piece of a silicon chip. That is, multiple
components run on a single chip. The whole process mainly relies on the chip, including
the functioning of peripheral devices.
For Example: In Raspberry Pi 2, the Broadcom chip is the SoC, then this chip is an
interface that gets you to the network USB interfaces or HDMI video interface.
Low power consumption and efficient designs are why SOCs are very common in the
markets. As far as the implication of security on the SOC-based system is concerned, all
the security issues are handled by the system and not by the specifics of SOC aspects.
Communication Considerations
5G
5G refers to the fifth generation of mobile networks. After 1G, 2G, 3G, and 4G networks,
it is a new global wireless standard. 5G enables a new type of network capable of
connecting virtually everyone and everything, including machines, objects, and devices.
Narrow-Band
Narrowband data communication and telecommunications tools, technologies, and
services use a smaller set or band of frequencies in the communication channel. These
use a channel frequency that is considered flat or a smaller number of frequency sets.
Baseband Radio
A twisted-pair subscriber loop that transmits voltage pulses between the serving central
office or access node and the user is known as a baseband digital loop. The pulses are
shaped for optimal transmission on twisted pairs and represent the values of bits or
groups of bits.
Subscriber Identity Module (SIM) Cards
SIMs (Subscriber Identity Modules) can be valuable evidence in and of themselves. They
contain a large amount of data and should be collected and analyzed.
There are a couple of numbers on the SIM that will be of particular interest. The
International Mobile Subscriber Identity (IMSI) is the first (IMSI). The Integrated
Circuit Card Identifier is the second (ICC-ID). The IMSI identifies a subscriber's account
information and services. The ICC-ID is the serial number found on the SIM card. The
SIM can include the following information:




Subscriber identification (IMSI)
Service provider
Card identity (ICC-ID)
Language preferences
217
Chapter 02: Architecture and Design





Phone location when powered off
User’s stored phone numbers
Numbers dialed by the user
SMS text messages (potentially)
Deleted SMS text messages (potentially)
A processor (CPU), RAM, Flash-based nonvolatile memory, and a crypto-chip are SIM
cards' individual components. They are present in all phones but are more common in
GSM, iDEN, and Blackberry handsets.
Zigbee
Zigbee is a wireless mesh network standard for low-cost, low-power devices in wireless
control and monitoring applications. Low-latency communication is provided by
Zigbee. Zigbee chips are frequently combined with radios and microcontrollers.
A radio transceiver is used by Zigbee smart devices to communicate with one another.
The chip operates on the IEEE 802.15. 4 protocol at 2.4 GHz, which is the same frequency
band as Wi-Fi and Bluetooth. A Zigbee message can also be copied and forwarded from
one device to the next.
Mind Map
Figure 2-38: Mind Map of Security Implications of Embedded Systems
The Importance of Physical Security Controls
When it comes to safeguarding anything, physical security is always the first priority. It
is also regarded as the first layer of protection in the field of information security.
218
Chapter 02: Architecture and Design
Physical security encompasses safeguarding against man-made threats like theft,
damage, and unwanted physical access, as well as natural disasters like rain, dust, power
outages, and fire.
Figure 2-39: Physical Security Measures
Physical security is essential to prevent stealing, tampering, damage, theft, and a variety
of other physical attacks. Fences, guards, CCTV cameras, intruder monitoring systems,
burglar alarms, and deadlocks are used to secure the premises and assets. Authorized
individuals should only access important files and papers. These files should not be left
at an unsecured location, even within an organization. Functional areas must be
separated and biometrically protected. Continuous or frequent monitoring such as
monitoring wiretapping, computer equipment, HVAC, and firefighting systems should
also be done.
Bollards/Barricades
A bollard is a short post that is used to direct traffic and protect against vehicle
intrusions. Bollards can be designed and installed to withstand significant vehicle
impacts, but they can also be used as decorative or aesthetically pleasing barriers. Many
bollards serve as decorative elements in the design of buildings and landscapes.
Mantraps
The implementation of a mantrap is an approach to oppose tailgating. A mantrap
contains two doors closely spaced together. Opening and closing of these doors are set
up in a way that only one door is open at a time. These doors are usually secure with
card/pin authentication. It eliminates the risk of tailgating and piggybacking.
219
Chapter 02: Architecture and Design
Badges
These security badges are intended to identify, validate, and implement the appropriate
security measures and features that govern how a company monitors, controls, restricts,
and protects its resources. At the very least, the security badge will include an
individual's photo and identification number.
Alarms
The function of an alarm is to alert the operator about any abnormal condition or
activity. If a company has too many alarm conditions, then the operator will not react
to the condition as desired. Tuning an alarm will provide accurate, useful, and desired
information.
Signage
Physical security entails the use of multiple layers of interconnected systems, such as
CCTV surveillance, security guards, protective barriers, locks, access control, perimeter
intrusion detection, deterrent systems, fire protection, and other systems designed to
protect people and property.
Cameras
Motion Recognition
For several years, physical security professionals have been drawn to the concept of
video motion detection. Significant advancements in image processing dedicated
hardware, image analysis algorithms, and software have accelerated the successful
application of video motion detection systems to a wide range of physical security
applications. Potential benefits claimed included increased benefits from existing video
surveillance systems, automatic detection, improved performance over human
observers, and cost-effectiveness.
Object Detection
Any security camera with Deep Learning Vision can detect any object you can think of.
The ability of artificial intelligence-powered security cameras to detect fast-moving
objects such as cars is one of their strengths.
Closed-Circuit Television (CCTV)
CCTV serves as a visual deterrent to unauthorized entry, theft, and violence. It can be
used to cover the Site access points, such as internal access to higher security zones and
perimeter access to specific physical assets or work areas.
The advantages of CCTV may include the ability to:

Keep an eye on event-triggered alarms
220
Chapter 02: Architecture and Design


Use it in conjunction with a Security Alarm System (SAS) to assist those
responsible for responding to the alarm
Use it in conjunction with an access control system to aid personal identification
for remote site entry control (suspicious package detection)
A CCTV system, on the other hand, can be an expensive investment. Ongoing
monitoring, maintenance, and support costs may be prohibitively expensive.
Industrial Camouflage
Camouflage is also known as Obfuscation, means “to hide the obvious meaning of
observation.” Camouflage is added to the system so that it becomes hard to be exploited
and understood by any attacker.
The Camouflage works well for data names or other such exposed elements, but it does
not work well for code construction. Camouflage code is not just hard to read but nearly
impossible to read, and an example of such code is the ticking time bomb. The basic
question that arises is that how it functions if someone needs the code to figure out how
it works or in case if any modification is needed if it stops working. These are some of
the reasons which are not considered good for the construction of code.
Figure 2-40: Code Camouflage Example
Personnel
Guards
Access control is the selective restriction of access to a location or other resource in the
fields of physical security and information security. Individuals, computer programs,
and even the computers that process the data must all be authorized.
Robot Sentries
Surveillance literally means "to watch from above," and surveillance robots are used to
monitor people's behavior, activities, and other changing information for the purpose
of managing, directing, or protecting one's assets or position.
221
Chapter 02: Architecture and Design
Two-Person Integrity/Control
The two-man rule is pretty straightforward when it comes to the data center and
information security. It refers to a situation in which two people must work together to
complete a task. The term is said to have military origins, referring to a process
instituted by the United States government decades ago for nuclear weapon launch: two
different people had two different keys, and each had to use their key at the same time
to initiate any kind of action.
Locks
Unauthorized access to information and physical assets can be deterred or delayed by
locks. On the other hand, Locks are only as strong as the fittings and hardware that
surround them. When choosing locks, consider the level of protection you require from
doors and frames.
USB Data Blocker
USB blocking is a data loss prevention technique that aids in data security. Untrusted
devices can be blocked from using USB ports using this method. Companies can use a
USB blocker or USB lockdown software to prevent unauthorized portable storage
devices from accessing endpoints. More information on USB security can be found.
Lighting
Proper lighting is an important aspect of physical security. Intruders can easily execute
illicit operations in dimly lit or unlit areas without risk of being recognized or
monitored. Internal and external lights are both necessary to detect any unwanted
activity and for additional security reasons.
Fencing
Fencing is referred to as a physical barrier around any secure area. It basically prevents
the free movement of unauthorized visitors around secure areas. Multiple types of the
fence like a perimeter fence, chain link fence, the Anti-scale fence is used outside of the
building. A chain-link fence can also be used inside of the building to prevent
networking gear, servers, & sensitive items from unauthorized access.
Fire Suppression
Fire suppression systems devices can detect fire, respond accordingly. They can be
portable, manual, or automatic.
Sensors
The critical spots in a network contain sensors. These sensors gather information from
the network devices. These may be integrated into the router, firewall, and switches,
etc. or might be built-in within the network.
222
Chapter 02: Architecture and Design
The information that the sensor gathers varies from system to system. For instance,
authentication logs information is going to be different from database transaction logs
or web server access logs, etc.
Motion Detection
The most common type of active motion detector employs ultrasonic sensor
technology, in which sound waves are emitted to detect the presence of objects.
Microwave sensors (which emit microwave radiation) and tomographic sensors are also
available (which transmit and receive radio waves).
Noise Detection
When sound waves strike the sound sensor, a thin piece of material called a diaphragm
vibrates (similar to how your eardrum vibrates when hearing sound). The sensor
converts the diaphragm's vibration into an electrical signal sent to the LEGO brick,
which recognizes that a sound has been heard. Noise sensors do not record audio. They
monitor changes in your home's noise level.
Visitor Logs
A visitor logbook is a useful tool for keeping track of who comes and goes from your
office. It is a record book that keeps track of the visitors on site, their identity, the
company they represent, who they came to see, the reason for their visit, contact
information, time in and time out.
Faraday Cages
A faraday cage serves as a protective shield against electromagnetic radiation from the
outside world or prevents electromagnetic energy radiated by the cage's internal
components from escaping.
Air Gap
The logical or physical separation of a network from all other networks is called Air gap,
designed to prevent unauthorized transfer of data to or from the network. However, the
flaw behind this air gap logic is that the data can be moved by other means like a USB
drive, and this unauthorized bypassing of the air gap is called “Sneakernet.”
The Demilitarized Zone (DMZ)
An IOS zone-based firewall is a specific set of rules that may help to mitigate mid-level
security attacks in environments where security is implemented via routers. In Zonebased Firewalls (ZBF), device interfaces are placed in different unique zones (inside,
outside, or DMZ), and then policies are applied to these zones. Naming conventions for
zones must be easy to understand in order to be helpful when it comes to
troubleshooting.
223
Chapter 02: Architecture and Design
ZBFs also use stateful filtering, which means that if the rule is defined to permit
originating traffic from one zone to another zone, for example, DMZ, then return traffic
is automatically allowed. Policies that allow traffic in both directions can be used to
enable traffic from separate zones.
One of the advantages of applying policies on zones rather than interfaces is that
whenever new changes are required at the interface level, policies are applied
automatically simply by removing or adding to an interface in a particular zone.
ZBF may use the following set of features in its implementation:
●
●
●
●
●
Stateful Inspection
Packet Filtering
URL Filtering
Transparent Firewall
Virtual Routing Forwarding (VRF)
The following Figure illustrates the scenario explained above:
Figure 2-41: Cisco IOS Zone-based Firewall Scenario
Protected Cable Distribution
The Protected Distribution or Protected Cabling is needed to protect the cable from
physical damage and avoid communication failure during cable installation. It
safeguards the cable between systems physically from physical hazards like tapping &
interception.
Secure Areas
224
Chapter 02: Architecture and Design
Vault1
A vault provides essential security and maybe your last line of defense against attacks
or unforeseen disasters such as floods, fires, and earthquakes. There is no such thing as
a typical vault. Vaults are created to meet the specific needs of the business owner. Let
suppose a bank vault is safe to keep money, valuables, records, and documents. Like a
safe, it is intended to protect its contents from theft, unauthorized use, fire, natural
disasters, and other threats. Modern vaults can be outfitted with a variety of alarms and
anti-theft devices.
Safe
Safes are physical storage devices that prevent unauthorized access to the content it
contains. Safes are of various shapes, sizes, and costs. They are not considered perfect.
They are rated on the basis of how long they can protect or secure content from fire or
theft, and the cost of the safe is directly proportional to the rating, i.e., better ratinghigh cost.
Hot Aisle
The hot aisle is enclosed by a Hot Aisle Containment System (HACS), allowing the rest
of the data center to function as a large cold-air supply into the servers and floor power
equipment. It is best if we take a step back and take a moment to better understand
what you have got in place and to go over your needs. Between the two, we see that hot
aisle containment is the most popular choice for raised floor Datacenters in new build
situations. In short, hot aisle containment consists of a physical barrier that directs hot
exhaust airflow back to the AC return and utilizes the natural process of ‘warm air rising'
to improve efficiency. By adjusting temperature, the higher the heat returned to the AC
coils, the greater the efficiency.
Figure 2-42: Hot Aisle
225
Chapter 02: Architecture and Design
Cold Aisle
A physical barrier that allows supply air to pool inside the cold aisle is one type of
containment. The cold air in the aisle is encased by a Cold Aisle Containment System
(CACS), allowing the rest of the data center to become a large hot-air return plenum.
This "lid" maintains a consistent and predictable air temperature at the server inlet.
Figure 2-43: Cold Aisle
Exam Tip: It should be noted that if the data center is cold aisle contained, any 3-phase
UPSs and floor PDUs must be considered for room cooling.
Secure Data Destruction
It is important to destroy the data that is no longer in use because that data or
information can be discovered and used by criminals in malicious activities like identity
theft, social engineering, etc. Criminals use dumpster diving for this purpose because
its value is well known to criminals.
For every organization, it is vital to have effective demolition and destruction policies
and associated procedures. The following are some methods of data destruction.
Burning
A method of destruction, which is regarded as a gold method, is referred to as Burning.
The data/media is carried out in a form that the fire can demolish, and then it is burned.
This is the process that is irreversible and makes the data be lost permanently.
226
Chapter 02: Architecture and Design
Shredding
Shredding, also referred to as physical destruction, is the method of splitting things into
small chunks and then mixing, making the reassembling impossible or difficult.
Everything that might be advantageous or useful to a criminal or dumpster diver should
be shredded.
Pulping
A process of recombining a paper into a new paper by suspending the paper fiber in
liquid. Once the paper is shredded, the pulping process erases the ink by bleaching, and
then those shredded pieces are recombined into new paper. This way, the layout of the
old paper is completely destroyed.
Pulverizing
Breaking things by external force into unusable pieces (that cannot be reconstructed) is
known as Pulverizing, also referred to as ‘Physical Process of Destruction.’ It is used for
hard disk drives like items. Encryption is the modern approach to pulverizing. In this
method, the owner encrypts the drive’s data and destroys the key. This process makes
the data non-recoverable depending on the strength of encryption.
Degaussing
The files on a magnetic storage device can be destroyed magnetically, i.e., using a
magnetic field; this method is known as degaussing. This is a safe technique for
degaussing the data or media. In this method, the magnetic particles get realigned by
discarding the organized format that displayed the data.
Third-Party Solutions
Third-party solutions are also known as Service-based Solutions that offer security and
auditing services to a network. These solutions can be hosted either inside or outside
the network. These third-party solutions are allowed to access and monitor the internal
network, so they carry a security risk.
Mind Map
227
Chapter 02: Architecture and Design
Figure 2-44: Mind Map of Importance of Physical Security Control
The Basics of Cryptographic Concepts
Cryptography
Cryptography is a technique of encrypting clear text data into scrambled code. The
encrypted data is then sent over a public or private network toward its destination to
ensure confidentiality. At the destination, the encrypted data, known as "Ciphertext," is
decoded and processed. To prevent key breaking, strong encryption keys are utilized.
Cryptography's goal is to provide not only confidentiality but also integrity,
authenticity, and non-repudiation.
Types of Cryptography
Symmetric Cryptography
Symmetric Key Cryptography is the oldest and most widely used cryptography
technique in the domain of cryptography. Symmetric ciphers use the same secret key
for the encryption and decryption of data. The most widely used symmetric ciphers are
AES and DES.
228
Chapter 02: Architecture and Design
Figure 2-45: Symmetric Cryptography
Asymmetric Cryptography/Public Key Cryptography
Unlike Symmetric Ciphers, in Asymmetric Cryptography, two keys are used. Everyone
publicly knows one key, while the other key is kept secret and is used to encrypt data
by the sender; hence, it is also called Public Key Cryptography. Each sender uses its
secret key (also known as a Private Key) for encrypting its data before sending it. The
receiver uses the respective sender’s public key to decrypt the data. RSA, DSA, and the
Diffie-Hellman Algorithm are popular examples of asymmetric ciphers. Asymmetric key
cryptography delivers confidentiality, integrity, authenticity, and non-repudiation
using public and private key concepts. The private key is only known by the owner itself,
whereas the public key is issued by Public Key Infrastructure (PKI), where a trusted
Certificate Authority (CA) certifies the ownership of key pairs.
Figure 2-46: Asymmetric Cryptography
Digital Signatures
229
Chapter 02: Architecture and Design
A Digital Signature is a technique to evaluate the authenticity of digital documents as
the signature authenticates the authenticity of a document. A digital signature confirms
the author of the document, date, and time of signing and authenticates the content of
the message.
There are two categories of digital signature:
1. Direct Digital Signature
2. Arbitrated Digital Signature
Direct Digital Signature
Direct Digital Signatures involve only the sender and receiver of a message, assuming
that the receiver has the sender's public key. The sender may sign the entire message or
hash it with the private key and send it toward the destination. The receiver decrypts it
using the public key.
Arbitrated Digital Signature
The job of the "Trusted Arbiter" in Arbitrated Digital Signatures is to validate the signed
messages, insert the date, and then send the message to the recipient. It necessitates a
sufficient amount of confidence and can be implemented using public or private keys.
Key Length
The length of a key is equal to the number of bits in the key of an encryption algorithm.
A short key length indicates a lack of security. The key length determines the maximum
number of combinations required to break an encryption algorithm. There are two to
the nth power (2n) possible keys if a key is n bits long.
Key Stretching
Key stretching techniques are used to make a potentially weak key, usually a password
or passphrase, more secure against brute-force attacks by increasing the resources (time
and possibly space) required to test each possible key. Key stretching can be done in a
variety of ways.
Bcrypt and Password-Based Key Derivation Function 2 (PBKDF2) are two common key
stretching techniques: Bcrypt, which is based on the Blowfish block cipher, is used to
protect passwords stored in the shadow password file on many Unix and Linux
distributions.
Salting
Salting is the process of adding additional characters to the password to create a oneway function. This addition of characters makes it more difficult for the password to
reverse the hash. A major advantage or primary function of password salting is that it
helps to defeat dictionary and pre-computed attacks.
230
Chapter 02: Architecture and Design
Consider the following example: one of the hashed values is of the password without
salting, while another hashed value is of the same password with salting.
Without Salting:
With Salting:
23d42f5f3f66498b2c8ff4c20b8c5ac826e47 146
87dd36bc4056720bd4c94e9e2bd 165c299446287
Adding a lot of random characters in a password makes it more complex and hard to
reverse.
Hashing
One-way Hashing condenses a message into an irreversible fixed-length value or hash.
A cryptographic hash function takes the Plain text as an input and returns a fixed-size
string. This string is called a hash value, message digest, digital fingerprint, digest, or
checksum.
Hash Algorithm
The Hash Algorithm has various names for one-way encryption, message digest, and
hash function. It is used to compute a fixed-length hash value based on the original
plain text. Using hash value, the original cannot be changed even with the knowledge
of hash function. A hash value is a unique number that is created from a sequence of
text using a mathematical formula. It is usually faster than encryption techniques.
The main purpose of the hash algorithm is to provide a digital fingerprint to any type of
data in order to assure that information has not been changed during the transmission
and provide a measure of information integrity. The hash algorithm is typically used for
two purposes:


Digital certificate
Data integrity check
Some of the hash algorithms that are commonly used are as follows:
Message Digest (MD)



MD2
MD4
Md5
Secure Hash Algorithm (SHA)

SHA1
Message Digest (MD): MD Algorithm is a sequence of byte-oriented cryptographic
hash functions that generates 128 bits (fixed length) hash value from a random length
input.
231
Chapter 02: Architecture and Design
Message Digest 2 (MD2): It was developed in 1989 by Ronald Rivest. It was produced
and enhanced for an 8-bit system having insufficient memory, for example, Smart Card.
The message is augmented initially to assure that its length is divisible by 16, and then
a 16-byte checksum is affixed to the message. The rising value is proceeded to figure out
a hash value.
Message Digest 4 (MD4): Ronald Rivest also developed in 1989 for a 32-bit system or
machine. It was identical to MD2 but specially designed for faster processing in
programs. In MD4, the message is first augmented to assure that its length in bits plus
64 is divisible by 512, and then 64 bit of the original message length is linked in series to
the message.
Message Digest 5 (MD5): It was developed in 1991 by Ronald Rivest as an improved
version of the MD4 algorithm and was specially designed to overcome the weaknesses
in the MD4 algorithm and ensure stronger security. MD5 is continuous to survive in
spite of several weaknesses, but algorithmically it is not highly secure due to analytical
attacks and possible collision that can be found in less than 1 hour.
Secure Hash Algorithm (SHA): SHA is a type of Hash algorithm that produces 160-bit
output. It was developed by National Security Agency (NSA) and declared as U.S govt.
Standard. SHA is more secure than MD5, but its processing is slower than MD5. This
algorithm, also known as SHA0, was published in 1993, and after two years, SHA1 was
introduced.
Secure Hash Algorithm 1 (SHA1): Most generally used algorithm that gives 160-bit
hash value as an output. It is recognized to be the replacement to the MD5 algorithm
and employed broadly in multiple applications and protocols such as TLS, SSL, PGP,
SSH, S/MIME, and IPsec. Four modifications SHA224, SHA256, SHA384, and SHA512,
which are jointly called SHA2, have now been introduced. These modifications are
illustrated in RFC4634 and can produce 224, 256, 384, or 512-bit length hash values. The
cryptographer has noted attacks on both SHA1 and SHA0. However, no attacks have
been noted on SHA 2 yet.
Key Exchange
Key exchange (also known as the key establishment) is a cryptographic method in which
cryptographic keys are exchanged between two parties to allow the use of a
cryptographic algorithm. Diffie Hellman (DH) is the algorithm that was introduced by
Stanford University professor Martin Hellman and a graduate student Whitfield Diffie
in 1976. DH protocol, also known as key exchange protocol, is a public key distributing
system that uses the Asymmetric Key Cryptography method. DH permits two end-users
that have no previous knowledge of each other to create a shared key over an insecure
communication channel, and that secret key can be used to encrypt subsequent
232
Chapter 02: Architecture and Design
messages using a symmetric key algorithm. DH algorithm is only used for secret key
exchange and not for digital signatures and authentication.
Figure 2-47: Key Exchange
Elliptic-Curve Cryptography
Elliptic Curve Cryptography (ECC) is a key-based data encryption technique. For
decryption and encryption of web traffic, ECC relies on pairs of public and private keys.
ECC is frequently mentioned in conjunction with the Rivest–Shamir–Adleman (RSA)
cryptographic algorithm.
Elliptic curves can be used for encryption, digital signatures, pseudo-random number
generators, and other purposes. They are also used in several integer factorization
algorithms with cryptographic applications, such as Lenstra elliptic curve factorization.
233
Chapter 02: Architecture and Design
Perfect Forward Secrecy
Forward Secrecy (FS), also known as Perfect Forward Secrecy (PFS), is a feature of
specific key agreement protocols that gives assurances that session keys will not be
compromised even if long-term secrets are used in the session key exchange are
compromised.
Quantum
Quantum cryptography is a technology that secures the distribution of symmetric
encryption keys by utilizing quantum physics. It is more accurately known as quantum
key distribution (QKD). It works by sending photons, which are light's "quantum
particles," across an optical link.
Communications
Quantum communication is an application of quantum physics closely related to
quantum information processing and teleportation. Its most intriguing application is
the use of quantum cryptography to protect information channels from eavesdropping.
Post-Quantum
The goal of post-quantum cryptography is to prepare for the era of quantum computing
by updating existing mathematical-based algorithms and standards. Terms to be aware
of: Post-quantum cryptography refers to algorithms that are thought to be capable of
defending against a quantum computer attack.
Ephemera
Ephemeral keys are just short-lived keys within a key establishment protocol and not a
specific type of key. They are usually not directly trusted because they are generated on
the fly. To name a single other application, ECIES may employ an ephemeral private
key.
Blockchain
Asymmetric-key algorithms and hash functions are the two types of cryptographic
algorithms used in blockchains. Hash functions are used to provide each participant
with the functionality of a single view of the blockchain. As a hash function, blockchains
typically employ the SHA-256 hashing algorithm.
The blockchain benefits from cryptographic hash functions in the following ways:



The avalanche effect occurs when a small change in the data results in a
significantly different output.
Uniqueness – Each input produces a distinct output.
Deterministic – If any input is passed through the hash function, the output will
always be the same.
234
Chapter 02: Architecture and Design


Rapidity – The output can be generated in a very short period of time.
Reverse engineering is not possible, which means we cannot generate the input
from the output and the hash function.
Public Ledgers
Blockchain is a type of public ledger that consists of a series (or chain) of blocks on
which transaction details are recorded after appropriate authentication and verification
by network participants.
Cipher Suites
A cipher suite is a collection of algorithms that aid in the security of a network
connection. To exchange a key between two devices, the key exchange algorithm is
used. This key is used to encrypt and decrypt messages between two machines. To
encrypt the data being sent, the bulk encryption algorithm is used.
Stream
A stream cipher encrypts plaintext messages by combining an encryption algorithm
with a stream of pseudorandom cipher digits (keystream). Each bit of the message is
encrypted with the corresponding keystream digit one by one. Stream ciphers are
typically used when both speed and simplicity are required.
Block
A block cipher uses a deterministic algorithm and asymmetric key to encrypt data in
blocks. Most encryption methods, like stream ciphers, encrypt bits one by one (stream
ciphers). Block ciphers, on the other hand, use a predetermined length key to encrypt
128-bit blocks.
Symmetric vs. Asymmetric
Symmetric Key Cryptography
Symmetric Key Cryptography is the oldest and most widely used cryptography
technique in the domain of cryptography. Symmetric ciphers use the same secret key
for the encryption and decryption of data. It is also known as a secret key or pre-shared
key algorithm.
Example: A block cipher takes a 128-bit block of plain text and returns a corresponding
128-bit block of ciphertext.
Symmetric Key Cryptography Algorithm: Following are some Symmetric Key
Cryptographic Algorithm:
Data Encryption Algorithm (DES): Most common symmetric algorithm designed by
IBM in the 1970s. DES uses a 56-bit key to encrypt a 64-bit datagram block. It is no
longer considered secure due to the reason that its keys’ size is too small.
235
Chapter 02: Architecture and Design
Triple-DES (3DES): It is an enhanced version of DES. It uses up to three 56 bit keys and
makes three encryption and decryption passes over the same datagram block. It is
mainly derived to enlarge the key length to 168 bits (Three 56-bit keys). In short, it
encrypts a 64-bit datagram block using three 56-bit keys (168-bit key).
Advanced encryption standard (AES): It is also known as ‘Rijndael’ and was
introduced by NIST in 2001. The most important feature of the AES algorithm is that it
can use variable block length and key length. Any combination of key lengths 128, 192,
256 bits and block length 128, 192, 256 bits can be used.
Asymmetric Key Cryptography
Unlike Symmetric Ciphers, two keys are used. One key is publicly known to everyone,
while another key is kept secret and is used to encrypt the data by the sender. Hence, it
is also called Public Key Cryptography. Each sender uses its secret key (also known as a
private key) for encrypting its data before sending it. The receiver uses the respective
public key of the sender to decrypt the data. RSA, DSA, and Diffie-Hellman Algorithm
are popular examples of asymmetric ciphers. Asymmetric Key Cryptography delivers
Confidentiality, Integrity, Authenticity & Non-Repudiation by using the Public and
Private key concepts. The private key is only known by the owner itself. In contrast, the
Public key is issued by using Public Key Infrastructure (PKI), where a trusted
Certification Authority (CA) certifies the ownership of key pairs.
Asymmetric Key Cryptography is also known as a Public-key algorithm and was
announced publically in 1976. It uses a two-key pair; one key is for the encryption of
plain text, and the other is for the decryption of ciphertext. Contrary to the symmetric
algorithm, the asymmetric algorithm requires no secret key sharing to securely
communicate over an insecure channel. It is commonly used in digital certification and
key management.
Asymmetric Key Cryptography Algorithm
Some asymmetric key algorithms are as follows:
RSA Algorithm: RSA is named after the initials of three MIT mathematicians
Ron Rivest, Adi Shamir, and Leonard Adleman, who developed this algorithm and was
publically described in 1976. As it is an asymmetric algorithm, which means it uses two
keys that are public and private. The public key is given to everyone, while the private
key is kept secret.
Example: A user sends its public key to the server and requests for some data. The
server will encrypt the data using the user’s public key and send the encrypted data to
the user. The user will receive the data and decrypt it.
It is the most widely used algorithm for key exchange, digital signature, and message
encryption. There are various standards of the RSA algorithm, and all of them use
236
Chapter 02: Architecture and Design
variable-size block lengths and key lengths. The standards are RC1, RC2, RC3, RC4, RC5,
and RC6.
Diffie Hellman (DH): This algorithm was introduced by Stanford University professor
Martin Hellman and a graduate student Whitfield Diffie in 1976. DH protocol, also
known as key exchange protocol, is a public key distributing system that uses the
Asymmetric Key Cryptography method. DH permits two end-users that have no
previous knowledge of each other to create a shared key over an insecure
communication channel, and that secret key can be used to encrypt subsequent
messages using a symmetric key algorithm. DH algorithm is only used for secret key
exchange and not for digital signatures and authentication.
Digital Signature Algorithm (DSA): Digital Signature Algorithm was introduced by
National Institute for Standards and Technology (NIST) in 1991 for (Digital Signature
Standard) DSS use, and it is also a Federal Information Processing Standards (FIPS)
standard for digital signature. It is mainly used for a digital signature to assure message
authentication.
Public-Key Cryptography Standard (PKCS): It is a collection of interoperable publickey cryptography standards and guidelines. It was developed and published by RSA
Data Security Inc.
PKCS Standards:
Name
Description
PKCS
#1
RSA
Cryptography
Standard
Description of RSA Public and Private key’s properties
and format
PKCS
#2
Withdrawn
Withdrawn and merged into PKCS #1. Covered RSA
Encryption of message digests
PKCS
#3
Diffie-Hellman
Allows two end-users with no previous knowledge of
Key Agreement each other to create a shared secret key over an
Standard
insecure communication path
PKCS
#4
Withdrawn
Withdrawn and merged into PKCS #1. Covered RSA
key syntax
PKCS
#5
Password-based
Encryption
Standard
Defined in RFC 8018 and PBKDF2
237
Chapter 02: Architecture and Design
PKCS
#6
Extended
Describes extensions to the old X.509 v1 certificate
Certificate Syntax specification, obsolete by X.509 v3
Standard
PKCS
#7
Cryptographic
Used to sign or encrypt messages under a PKI and also
Message Syntax used for certificate dissemination
Standard
PKCS
#8
Private-key
Information
Syntax Standard
It is used to carry private certificate key pairs, both
encrypted and unencrypted
PKCS
#9
Selected
Attribute Type
It describes the selected attribute type for use in
PKCS#6 (extended certificates), PKCS#7 (digitally
signed messages), PKCS#8 (private key information),
and PKCS #10 (certificate signing request)
PKCS
#10
Certification
Defines the pattern of messages sent to a Certification
Request Standard Authority to demand certification of a public key
PKCS
#11
Cryptographic
Token Interface
PKCS
#12
Personal
Defines a file format typically used to keep private keys
Information
with leading public-key certificates, protected with a
Exchange Syntax password-based symmetric key
Standard
PKCS
#13
Elliptic
Curve Apparently abandoned
Cryptography
Standard
PKCS
#14
Pseudo-random
Number
Generation
A Pseudorandom Number Generator (PRNG) is an
algorithm that generates a sequence of numbers that
are not truly random
PKCS
#15
Cryptographic
Token
Information
Format Standard
It defines a standard allowing users of cryptographic
tokens to identify themselves to applications,
independent
of
the
application’s
cryptoki
implementation (PKCS #11) or another API
An API is defining a generic interface to cryptographic
tokens. Used in Single Sign-on, Public Key
Cryptography & Disk encryption
Table 2-07: PKCS Standards
Note: A cryptographic key is called ephemeral if it is generated for each execution of a
key establishment process. In some cases, ephemeral keys are used more than once
238
Chapter 02: Architecture and Design
within a single session (e.g., in broadcast applications) where the sender generates only
one ephemeral key pair per message and the private key is combined separately with
each recipient's public key.
Lightweight Cryptography
Lightweight cryptography is an encryption type with a small computational footprint
and/or a low computational complexity. Its goal is to broaden the applications of
cryptography to constrained devices, and it is currently undergoing international
standardization and guidelines compilation.
Steganography
Steganography is a technique for hiding sensitive information in an ordinary message
to ensure confidentiality. A legitimate receiver extracts hidden information at the
destination. To maintain confidentiality and integrity, steganography employs
encryption. It also conceals encrypted data to avoid detection. The purpose of
steganography is to conceal information from a third party. An attacker may use this
technique to conceal information such as source codes, plans, and any other sensitive
information in order to transfer it undetected.
Classification of Steganography
Technical and Linguistic Steganography are the two types of steganography. Technical
Steganography is the concealment of information using methods such as invisible ink,
microdots, and others.
Figure 2-48: Classification of Steganography
239
Chapter 02: Architecture and Design
Types of Steganography
Steganography comes in a variety of forms, some of which are listed below:








Whitespace Steganography
Image Steganography
Image Steganography
Document Steganography
Video Steganography
Audio Steganography
Folder Steganography
Spam/Email Steganography
240
Chapter 02: Architecture and Design
Mind Map
Figure 2-49: Mind Map
White Space Steganography
White Space Steganography is a technique for hiding information in a text file using
extra blank space covering the file that is inserted between words. Using LZW and
Huffman compression methods, the size of the message is decreased.
Lab 2-02: Steganography
In the directory where Snow Tool is installed, create a text file with some data.
Go to “Command Prompt.”
Change the directory to run the “Snow” tool.
241
Chapter 02: Architecture and Design
Type the command:
Snow –C –m “text to be hide” –p “password” <Sourcefile> <Destinationfile>
As shown above, the source file is a Hello.txt file. The destination file will be an exact
copy of the source file containing hidden information.
Go to the directory. You will have a new file, HelloWorld.txt. Open the file.
The new file contains exactly the same text as the original file, with no hidden
information. This file can be sent to the intended recipient.
Recovering Hidden Information
On destination, the receiver can reveal information by using the command:
Snow –C –p “password 123” HelloWorld.txt
242
Chapter 02: Architecture and Design
The file has been decrypted, as shown in the above figure, and it contains hidden
information that was encrypted in the previous section.
Image Steganography
Hidden information in image formats such as PNG, JPG, BMP, and others can be kept
in Image Steganography. The basic idea behind image steganography is that the tool
replaces redundant bits of the image in the message. This replacement is done in such
a way that the human eye cannot detect it. You can perform image steganography by
applying different techniques such as:



Least significant Bit Insertion
Masking and Filtering
Algorithm and Transformation
Tools for Image Steganography


OpenStack
QuickStego
Lab 2-03: Image Steganography using QuickStego
1. Open the QuickStego application.
243
Chapter 02: Architecture and Design
2. Upload an image. This image is termed Cover, as it will hide the text.
3. Enter text or upload a text file.
244
Chapter 02: Architecture and Design
4. Click the “Hide Text” button.
5. Save image.
This saved image containing hidden information is called a Stego Object.
245
Chapter 02: Architecture and Design
Recovering Data from Image Steganography using QuickStego
1. Open “QuickStego.”
2. Click “Get Text.”
3. Open and compare both images.
The left image is without hidden text; the right image is with hidden text.
246
Chapter 02: Architecture and Design
Steganalysis is the use of steganography techniques to discover or retrieve hidden
information from suspected information. Steganalysis inspects any image for encrypted
data. Accuracy, efficiency, and noisy samples are the main challenges faced by
steganalysis for detecting encrypted data.
Figure 2-50: Steganalysis Methods
Homomorphic Encryption
Homomorphic encryption is a type of encryption that enables users to perform
computations on encrypted data without first decrypting it. This enables data to be
encrypted before being sent to commercial cloud environments for processing, all while
remaining encrypted.
Common Use Cases
Data integrity, entity authentication, data origin authentication, and non-repudiation
are now supported by cryptography. The following section delves more into the use of
symmetric algorithms for data confidentiality, authentication, and integrity and Cipher
Block Chaining and Cipher Feedback modes.
Limitations
Speed
The cloud computing environment has dramatically reduced the time and cost of new
IT services, thus increasing the speed at which organizations can access IT resources.
Weak keys
A weak key is a key that causes the cipher to behave in an unfavorable manner when
used with a specific cipher. Nonetheless, it is desirable for a cipher to have no weak keys.
A cipher with a flat, or linear, key space is one that has no weak keys.
247
Chapter 02: Architecture and Design
Mind Map
Figure 2-51: Mind Map
248
Chapter 02: Architecture and Design
Practice Question
1. Symmetric Key Cryptography requires __________________.
A. Same Key for Encryption & Decryption
B. Different Keys for Encryption & Decryption
C. Public Key Cryptography
D. Digital Signatures
2. AES & DES are the examples of _______________________.
A. Symmetric Key Cryptography
B. Asymmetric Key Cryptography
C. Public Key Cryptography
D. Stream Ciphers
3. The cipher that encrypts the plain text one by one is known as ________________.
A. Block Cipher
B. Stream Cipher
C. Mono-alphabetic Ciphers
D. Polyalphabetic Ciphers
4. The process of identifying flaws, design flaws, and security concerns in a network,
Operating System, applications, or website is known as pentesting.
______________.
A.
B.
C.
D.
Enumeration
Vulnerability Analysis
Scanning Networks
Reconnaissance
5. Which of the following is a phase of the Vulnerability Assessment Life Cycle?
A. Creating Baseline
B. Vulnerability Assessment
C. Risk Assessment
D. Remediation
6. Which of the following does not qualify as a Vulnerability Scanning tool?
A. Nessus
B. GFI LanGuard
C. Qualys Scan
D. Wireshark
249
Chapter 02: Architecture and Design
7. Which of the following does not constitute a Non-Electronic / Non-Technical
Password Attack?
A. Shoulder Surfing
B. Social Engineering
C. Dumpster Diving
D. Dictionary Attack
8. Bob attempts to crack a password using a list of known and common phrases until
the password is accepted. What type of attack is this?
A. Brute Force Attack
B. Default Password
C. Dictionary Attack
D. Password Guessing
9. An attacker attempts every possible combination of alphanumeric characters to
crack the password. Which of the following password cracking methods is this?
A. Brute Force Attack
B. Default Password
C. Dictionary Attack
D. Password Guessing
10. The process of adding characters to a password to make it a one-way function is
known as ______________.
A.
B.
C.
D.
Password Encryption
Password Hashing
Password Padding
Password Salting
11. Cracking password with pre-computed hashes is called ___________.
E. Rainbow Table Attack
F. Brute Force Attack
G. Dictionary Attack
H. Password Guessing
12. Which of the following is used for Backdoor installation?
E. Meterpreter
F. Zero-day Exploit
G. Exploit Kits
H. Persistence
250
Chapter 02: Architecture and Design
13. How can you mitigate a rainbow table attack?
E. Changing Default Password
F. Configuring Unpredictable Password
G. Password Salting
H. Password Hashing
14. Which of the following does not constitute an Open Source Web Server
architecture?
A. Apache
B. NGINX
C. Lighttpd
D. IIS Web Server
15. An attacker is attempting to gain access to restricted directories through trial and
error using dots and slash sequences. What kind of web server attack is it?
E. LDAP Attack
F. AD Attack
G. Directory Traversal Attack
H. SQL Injection
16. An attacker sends a request, allowing him to include a header response; now, he
can easily redirect the user to a malicious website. Which type of attack is this?
E. Web Cache Poisoning
F. HTTP Response Splitting Attack
G. Session Hijacking
H. SQL Injection
17. A piece of software created to solve a problem is referred to as _________________.
A.
B.
C.
D.
Hotfix
Patch
Bugs
Update
18. Which of the following is a Patch Management Tool?
A. Microsoft Baseline Security Analyzer
B. Microsoft Network Monitor
C. Syshunt Hybrid
D. SolarWinds SIEM Tool
251
Chapter 03: Implementation
Chapter 03: Implementation
Implement Secure Protocols
Protocols
Secure Real-time Protocol (SRTP)
▪
▪
▪
▪
▪
SRTP stands for Secure Real-Time Transport Protocol (Secure RTP).
It is the secure version of RTP.
The secure version of RTP is seen with other VOIP, but it adds encryption, using
AES to ensure that all the videos and audios are confidential.
It includes authentication integrity and replays protection by having HMACSHA1 (Hash-based message authentication code using SHA1) as a hashing
function.
With this in place, the user knows that they are receiving the original audio and
video. Nobody is sitting in the middle of the path listening to the conversation.
Domain Name System Security Extension (DNSSEC)
DNSSEC stands for Domain Name System Security Extensions; DNS protocol extensions
require cryptographic authentication for authoritative DNS server responses. Its goal is
to protect against techniques used by hackers to direct computers to malicious websites
and servers.
NTP
NTP is a network time protocol used to synchronize the clocks across the hosts and
network devices. The NTP is a vital protocol, as directory services, network devices, and
hosts rely on clock settings for login purposes and logging to record events
synchronizing the time system logs arrive at Syslog servers, NTP aids in event
correlation. NTP uses UDP port number 123, and its whole communication is according
to coordinated universal time (UTC).
The term stratum describes the distance between the NTP server and the device in NTP.
It is just like the TTL number that decreases every hop a packet passes by. Stratum value,
starting from one, increases with every leap. For example, if we see stratum number 10
on the local router, the NTP server is nine hops away. Securing NTP is also an essential
aspect as the attacker may change time in the first place to mislead the forensic teams
who investigate and correlate the events to find the root cause of the attack.
▪
It is used to synchronize all the devices that are connected to the network.
252
Chapter 03: Implementation
▪
It has been around since 1985 but does not have any security feature, and it is
seen that threat actors find a way to use it in denial of service attacks.
▪
NTPsec is a new protocol that is created to make NTP more secure.
▪
This more secure version of the NTP protocol started around June 2015.
▪
In NTPsec, the code base of NTP is updated, and all the vulnerabilities are
patched.
S/MIME
▪
Secure/Multipurpose Internet Mail Extension.
▪
This protocol allows the user to sign and encrypt the information that is being
used digitally.
▪
It has to be initially configured as the PKI is required or at least a way to manage
keys to provide public and private keys to be used in S/MIME communication.
SSL/TLS
▪
SSL stands for Secure Socket Layer, and TLS stands for Transport Layer Security.
▪
TLS is an updated version of SSL.
▪
SSL uses a combination of Symmetric and Asymmetric encryption to provide
confidentiality.
FTPS
▪
It stands for File Transfer Protocol Secure, i.e., FTP over SSL.
▪
It is not SFTP (SSH FTP), where SSH is used instead of SSL.
LDAP
▪
It stands for Lightweight Directory Access Protocol.
▪
It is a protocol for reading and writing directories over an IP network.
▪
It uses an ITU standard that is X.500 and uses TCP/IP.
▪
By enabling LDAPS, it can be made more secure.
▪
It is another way to implement SASL (Simple Authentication and Security Layer).
SSH
▪
It stands for Secure Shell.
▪
It is an encrypted terminal communication.
DHCP
▪
It stands for Dynamic Host Control Protocol.
253
Chapter 03: Implementation
▪
It does not include any built-in security.
▪
There is no secure version of DHCP.
Secure File Transfer Protocol (SFTP)
▪
Secure File Transfer Protocol, also known as SSH File Transfer Protocol, is a
network protocol that allows users to access, transfer, and manage files on
remote systems.
▪
Businesses can use SFTP to securely transfer billing data, funds, and data
recovery files.
Simple Network Management Protocol, version 3 (SNMPv3)
For safe configuration and control activities, secure SNMPv3 management is a vital
enabler technology. SNMPv3 enables authentication and privacy and view-based access
control and remote configuration for security and logical contexts.
Hypertext Transfer Protocol over SSL/TLS (HTTPS)
TLS-enabled HTTP Protocol SSL is commonly referred to as SSL. Still, it uses TLS, which
has improved security, patched vulnerabilities, and added additional hashing, key
exchange, and encryption methods.
IPSec
IPsec stands for IP security. For security and logical contexts, SNMPv3 provides
authentication and privacy and view-based access control and remote configuration.
IPsec's strength comes in its flexibility to support a variety of protocols and algorithms.
It also contains new encryption and hashing protocol advances. The primary goal of
IPsec is to offer CIA (Confidentiality, Integrity, and Authentication) for virtual networks
in today's networks. IPsec makes sure the above purposes are in action when a packet
enters a VPN tunnel and reaches the other end.
● Confidentiality: IPsec uses encryption protocols, namely AES, DES, and 3DES,
to provide confidentiality.
● Integrity: IPsec uses hashing protocols (MD5 and SHA) for providing integrity.
Hashed Message Authentication (HMAC) is also used for checking data integrity
● Authentication Algorithms: RSA digital signatures and Pre-Shared Keys (PSK)
are two methods used for authentication purposes.
Components of IPsec
254
Chapter 03: Implementation
Components of IPsec include:
●
●
●
●
●
IPsec Drivers
Internet Key Exchange (IKE)
Internet Security Association Key Management Protocol
Oakley
IPsec Policy Agent
Note: In the IPSec protocol suite, Internet Key Exchange (IKE) is a protocol that is used
to create Security Associations (SA). It uses X.509 certificate for authentication. The
Diffie–Hellman (DH) key exchange protocol is a secure technique of exchanging
cryptographic keys over a public channel. These keys are further used to encrypt or
decrypt packets.
Figure 3-01: IPSec Architecture
Modes of IPsec
There are two working modes of IPsec; tunnel and transport mode. Each has its features
and implementation procedures.
IPsec Tunnel Mode
Being the default mode set in Cisco devices, tunnel mode protects the entire IP packet
from the originating machine. It means that another packet is generated with a new IP
header for every original packet and is sent to the untrusted network and the VPN peer.
Tunnel mode is commonly used in cases involving Site-to-Site VPNs, where two secure
IPsec gateways are connected over the public internet using an IPsec VPN connection.
Consider the following diagram:
255
Chapter 03: Implementation
This shows IPsec Tunnel Mode with an Encapsulating Security Protocol (ESP) header:
Figure 3-02: IPsec Tunnel Mode with an ESP Header
Similarly, when Authentication Header (AH) is used, the new IP packet format will be:
Figure 3-03: IP IPsec Tunnel Mode with an AH Header
IPsec Transport Mode
In transport mode, the IPsec VPN secures the data field or payload of the originating IP
traffic using encryption, hashing, or both. New IPsec headers encapsulate only the
payload field while the original IP headers remain unchanged. Tunnel mode is used
when original IP packets are the source and destination address of secure IPsec peers.
For example, securing a router's management traffic is a perfect example of IPsec VPN
implementation using transport mode. For configuration, both tunnel and transport
modes are defined in the configuration transform set. These will be covered in the lab
scenario of this section.
This diagram shows IPsec Transport Mode with an ESP header:
Figure 3-04: IPsec Transport Mode with an ESP Header
Similarly, in the case of AH:
256
Chapter 03: Implementation
Figure 3-05: IPsec Transport Mode with an AH Header
Note: IPsec (Internet Protocol Security) is a set of protocols that provide secure private
communication across IP networks. IPsec protocol allows the system to establish a
secure tunnel with a peer security gateway.
Case Study: In this lab, we will learn how to configure IPSEC site-to-Site VPN on
routers. We already know that IPSEC is used to transmit data securely over an
unsecured network. Here, R1 and R2 are participating in IPSEC peers. Therefore, these
two routers are required to be configured to support IPSEC site-to-site VPN for the
traffic transmitting from their LANs. We have used two routers (R1 and R2), two
switches (SW3 and Sw4), and two Virtual PCs (VPC5 and VPC6).
Figure 3-06: Router and Switch Connection
Let's start the lab.
The following are screenshots to help you understand how to configure and verify the
IPsec site-to-site VPN.
Step 1: Configure all the devices in the topology
Assign IP address with Subnet mask and gateway to virtual PCs. The IP assigned to VPC5
is 192.168.1.2/24, and the gateway is 192.168.1.1.
257
Chapter 03: Implementation
The IP address assigned to VPC6 is 192.168.2.2/24, and the gateway is 192.168.2.1.
Now, assign an IP address to all the interfaces of Router 1 and Router 2, as shown on the
next page.
258
Chapter 03: Implementation
259
Chapter 03: Implementation
Step 2: ISAKMP Policy
Configure the parameters that will be used for the IKE phase 1 tunnel.
Step 3: Transform Set
Configure the parameters that will be used for the IKE phase 2 tunnel.
Step 4: ACL-Access Control List
Now, we will create an ACL to define what traffic will be sent over the Virtual Private
Network.
Step 5: Crypto Map
260
Chapter 03: Implementation
Using the previous parameters, configure and define the Crypto map.
Step 6: Crypto Map Implementation
Apply the crypto map to an interface.
Configuring Router 2
Now, repeat the above configuration steps on Router 2
Step 1. ISAKMP Policy
261
Chapter 03: Implementation
Step 2: Transform Set
Step 3: ACL-Access Control List
Step 4: Crypto Map
Step 5: Crypto Map Implementation
Verification (Test and Verify IPSEC Configuration)
Ping VPC6 and gateway from VPC5 to check and verify the connectivity.
262
Chapter 03: Implementation
Now, Ping VPC5 and gateway from VPC6.
263
Chapter 03: Implementation
Now for verification, use the command crypto isakmp policy on both routers. It will
show you the encryption algorithm we have configured and other details, as shown in
the screenshot.
Now, TEST and VERIFY the IPsec configuration on R1 as well.
Also, use the show crypto isakmp sa and show crypto ipsec sa command for
verification.
264
Chapter 03: Implementation
265
Chapter 03: Implementation
Secure Post Office Protocol (POP)/ Internet Message Access Protocol (IMAP)
For safe configuration and control activities, secure SNMPv3 management is a vital
enabler technology. SNMPv3 enables authentication and privacy and view-based access
control and remote configuration for security and logical contexts.
266
Chapter 03: Implementation
IMAP and POP send your username, password, and all message contents in plain text.
As a result, they can be easily intercepted. IMAP and POP, on the other hand, support
SSL encryption, which is similar to that seen on encrypted websites and is potentially
wholly safe.
Use cases
Email and web
A significant risk factor is the email system. Therefore, the DLP appliance is used by
many organizations that monitor, track, and filter all the inbound and outbound emails.
Web servers provide a link between clients and web pages. They are susceptible to
attacks as they are open to the internet. Therefore, the proper setting of external-facing
applications is the key to avoid unnecessary risk. For web servers, several reliable and
prescriptive sources of instruction are available to support administrators to protect and
secure the application properly.
Time Synchronization
Every device has its clock, and if the user wants to synchronize all the devices to a single
watch, then a standard protocol is required: NTP (Network Time Protocol). It allows all
the appliances to synchronize all these clocks to one single clock automatically. It is a
flexible and accurate method.
Mind Map
Figure 3-07: Mind Map of Secure Protocols
Implement Host or Application Security Solutions
Endpoint Protection
267
Chapter 03: Implementation
Endpoint security (also known as endpoint protection) refers to solutions that address
security flaws in network devices and protect them from attacks, unintentional data
leakage caused by human error, or zero-day exploits.
Antivirus
Antivirus software is designed to prevent, detect, and remove malware infections on
individual computing devices, networks, and information technology systems.
Antivirus software, which was initially designed to detect and remove viruses from
computers, can protect against many threats, including keyloggers, browser hijackers,
Trojan horses, worms, rootkits, and spy, adware, botnets, and ransomware.
Anti-malware
One of the most effective tools for protecting the computer and personal information is
an anti-malware program. An anti-malware program guards the computer against
malware such as spyware, adware, and worms. It scans the system for any malicious
software that has managed to infiltrate the system.
Endpoint Detection and Response
Endpoint Detection and Response (EDR), also known as Endpoint Threat Detection and
Response (ETDR), is a comprehensive endpoint security solution that combines
continuous real-time monitoring and data collection with rules-based automated
response and analysis capabilities.
An EDR security system's primary functions are as follows:
▪
▪
▪
▪
Monitor and collect endpoint activity data that could indicate a threat.
Analyze this information to identify threat patterns.
Respond to identified threats automatically to remove or contain them and
notify security personnel.
Forensic and analysis tools are used to investigate identified threats and look for
suspicious activity.
DLP
DLP is an acronym for Data Loss Prevention. It stops the data before the threat actor
receives it. The endpoint DLP tool on the computer observes the data and prevents its
unauthorized access. DLP appliance on the network connection constantly looks at all
the confidential information like credit card numbers that should not be cleartext. The
DLP system on the server watches the data and prevents it from getting into the hands
of the threat actor.
268
Chapter 03: Implementation
Next-Generation Firewall (NGFW)
NGFW is a relatively new term used for the latest firewalls with advanced feature sets.
This kind of firewall provides in-depth security features to mitigate known threats and
malware attacks. An example of next-generation firewalls is the Cisco ASA series with
FirePOWER services. NGFW delivers complete visibility into network traffic users,
mobile devices, Virtual Machines (VM) to VM data communication, etc.
Host-based Intrusion Prevention System (HIPS)
The Host Intrusion Prevention System (HIPS) detects suspicious activity on a single
host by analyzing events on that host. HIPS solutions defend the host against known
and unknown malicious attacks from the network and application layers.
Host-based Intrusion Detection System (HIDS)
A host-based intrusion detection system is an application that monitors a computer or
network for suspicious activity, which can include both external intrusions and internal
misuse of resources or data.
Host-based firewall
A host-based firewall is a type of firewall software that runs on a single computer or
device linked to a network. These types of firewalls provide granular protection for
individual hosts against viruses and malware and control over the spread of these
harmful infections throughout the network.
Boot Integrity
Boot Security/Unified Extensible Firmware Interface (UEFI)
Like the BIOS (Basic Input Output System), the Unified Extensible Firmware Interface
(UEFI) is a piece of firmware that runs when the computer starts up. On the other hand,
UEFI is positioned to replace BIOS because it is a more current solution that solves
many of the latter's restrictions.
UEFI defines a new method for communicating between operating systems and
platform firmware, providing a lightweight BIOS alternative that uses only the
information required to launch the OS boot process. Furthermore, UEFI provides
enhanced computer security features and backward compatibility with most existing
BIOS systems.
Measured Boot
Measured Boot is a method in which each of the software layers in the device's booting
sequence measures the layer above it and extends the value in a designated PCR. e.g.,
BIOS measures various Bootloader components and stores the results in PCRs 0-7.
269
Chapter 03: Implementation
Boot Attestation
Secure Boot is a method that checks that the system boot loader is signed with a
cryptographic key that a database has authorized in the firmware. Secure key storage
and remote attestation are not required for boot path validation.
Application Security
Injection attacks (SQL-Injections), Cross-Site Scripting (XSS), Session Hijacking, and
other web assaults are all protected by a WAF. A company's application security is
considerably improved when using a WAF in conjunction with a network firewall.
Input Validations
Input validation is the process of checking input received by an application for
conformity with a standard set inside the application. It might be as basic as inputting
a parameter or as complicated as using regular expressions or business logic to validate
data.
Hypertext Transfer Protocol (HTTP) Headers
HTTP headers allow the client and server to send additional data with an HTTP request
or response. An HTTP header comprises its case-insensitive name, a colon (: ), and its
value. Whitespace preceding the value is ignored.
Code Signing
Code signing verifies the publisher's identity and ensures that the code has not been
updated since it was signed. Certificates issued with signed software are required for
users to assess whether the software is valid before installing it.
Blacklisting and Whitelisting are the methods for controlling/managing the
applications of the Operating System.
▪
▪
Application Blacklisting: It is a method that determines which application(s)
should not be allowed to run on the machine.
Application Whitelisting: The opposite of blacklisting is whitelisting that
determines which application(s) should be allowed to run on the machine.
Microsoft uses two methods that are part of OS to control the use of applications to
their specified users. These methods are:
▪
Software Restrictive Policies: This is a primary mode used by the machine and
not by the users. It allows significant control over the application, executable
files, and scripts and is employed through group policies.
User Account Level Control: Used by the enterprise to control over who can access
and use installed software. It is enforced through AppLocker and allows which users can
use which application and programs.
270
Chapter 03: Implementation
Secure Coding Practices
Secure coding standards govern the coding practices, techniques, and decisions made
by software developers. They want to make sure that developers write code that
minimizes security flaws. Development tasks are typically solved in a variety of ways,
with varying degrees of complexity.
Static Code Analysis
Static Application Security Testing (SAST), also known as static analysis, is a testing
methodology that analyses source code to identify security flaws that make your
organization's applications vulnerable to attack. SAST inspects an application before it
is compiled. It is also referred to as white box testing.
Manual Code Review
The process of reading source code line by line to identify potential vulnerabilities is
known as manual secure code review. It is a time-consuming process that necessitates
skill, experience, perseverance, and patience.
Dynamic Code Analysis
The study of how the code behaves during execution is the foundation of dynamic code
analysis. While code analysis produces secure code, other issues, such as changes in the
system build, must also be considered to have a closed system.
Fuzzing
Fuzzing, also known as fuzz testing, is an automated software testing technique that
involves feeding a computer program with invalid, unexpected, or random data. The
program is then checked for crashes, failed built-in code assertions, and potential
memory leaks.
Hardening
Application hardening, also known as application shielding, is the process of adding
layers of security to applications to protect them from IP theft, misuse, vulnerability
exploitation, tampering, or even repackaging by malicious individuals.
Open Ports and Services
Applications and services use open ports, and they, like any other piece of code, may
contain vulnerabilities or bugs. The more applications and services that use open ports
for Internet communication, the more likely it is to have a vulnerability that can be
exploited.
Disk Encryption
Data encryption is a security method in which information is encoded and can only be
accessed or decrypted by a user who has the appropriate encryption key. Encrypted
271
Chapter 03: Implementation
data, also known as ciphertext, appears scrambled or unreadable to anyone or entity
who gains unauthorized access.
OS
The operating system serves as the interface between the physical hardware and the
application. Configuration guide from all the significant operating systems
manufacturers is available on the CIS platform.
Patch Management
Patch management is the process of software and application patch up-gradation,
including installing patches, acquiring, and testing. All Operating Systems require an
update and have different methods to keep their systems up to date.
There is a hierarchy that the vendor follows for software updates:
▪
Hotfix: A minor software update usually designed to discover problems
produced and released quickly. For example, buffer overflow.
▪
Patch: Refers to more significant updates as compared to Hotfix. It can address
several problems. Patches not only include enhancement or additional
capabilities, but they can also fix bugs.
▪
Service Pack: An extensive collection of Hotfixes and Patches, rolled in one
single package that makes the system up to date at once, is called Service Pack.
It saves users from downloading further updates.
Patch Management Lifecycle
Figure 3-08: The Lifecycle of Patch Management
272
Chapter 03: Implementation
Self-Encrypting Drive (SED)/ Full-Disk Encryption (FDE)
Full-disk encryption and self-encrypting drives encrypt and decrypt data written to and
read from the disk. FDE is appropriate for laptops, which are highly vulnerable to data
loss or theft. However, FDE is not appropriate for the most common risks encountered
in datacenter and cloud environments.
FDE/SED has the following advantages:
▪
▪
▪
The most straightforward method of deploying encryption
Applications, databases, and users can all see through it.
Hardware-based encryption with high performance
Hardware Root of Trust
A hardware root of trust serves as the foundation for all security operations of a
computing system. It stores the keys used for cryptographic functions and allows for a
secure boot process. It is inherently trustworthy, so it must be secured by design.
Trusted Platform Module (TPM)
TPM (Trusted Platform Module) is a computer chip (microcontroller) that can securely
store authentication artifacts, i.e., PC or laptop.
Sandboxing
To execute code in an environment that isolates the target system and the code from
direct contact is called Sandboxing. Sandbox is used for the execution of unverified and
untrusted code. Sandbox works like a virtual machine and can mediate several system
interactions like accessing memory, network access, and another program, device, and
file system. Sandbox offers protection, and its level of protection depends upon isolation
level.
273
Chapter 03: Implementation
Mind Map
Figure 3-09: Mind Map of Host or Application Security Solutions
Implement Secure Network Designs
Load Balancing
Load balancing is the process of distributing network or application traffic among
numerous servers in a server farm in a systematic and effective manner. Each load
balancer lies between clients and backend servers, receiving and distributing requests
to any server that can handle them.
Active/Active
A network of independent processing nodes, each with access to a shared replicated
database, allowing all nodes to participate in a single application, is known as an
active/active system. Two or more processing nodes are connected via a redundant
communications network in the application network.
Active/Passive
An active network has at least one voltage or current source that can continuously
supply energy to the network. An active source is not present in a passive network.
There are no electromotive force sources in passive networks. They are made up of
passive components such as resistors and capacitors.
274
Chapter 03: Implementation
Virtual IP
Virtual IP addresses are those that are not tied to specific machines. As a result, they
can switch between nodes in a Content Gateway cluster. On the same Subnet, it is
common for a single device to represent multiple IP addresses.
Network Segmentation
Virtual Local Area Network (VLAN)
By dividing workstations into different isolated LAN segments, VLANs enable network
administrators to limit access to a specified group of users automatically.
Administrators do not need to reconfigure the network or change VLAN groups when
users relocate their workstations.
DMZ
DMZ stands for Demilitarized Zone. It is the region between a trusted internal network
and an untrusted network.
Figure 3-10: DMZ (Demilitarized Zone)
It functions as a buffer region between the internet and the internal network. The idea
is to secure the internal network and not allow direct access from the internet to the
trusted internal network by directly forcing the user to make at least one hop in the
DMZ before accessing internal network information.
The servers directly accessed from the outside (untrusted zone) should be placed in
DMZ like Remote access server, Web server, External email server, etc. Similarly, all the
other standard servers like a Database server, DNS, File server, Print server, application
server, etc., should be placed in the internal network for security purposes.
275
Chapter 03: Implementation
East-West Traffic
East-West traffic refers to the flow of traffic within a data center. East-West traffic
indicates data flow among devices within a datacenter based on the most commonly
deployed topology of systems within the datacenter.
Extranet
There are some trusted third parties to whom we want to lend access to the resources
inside the internal network. A private DMZ, called 'Extranet,' is created to lend access
to trusted third parties.
The extranet is separate from the internal network and provides access to the outside
of the company. Authentication credentials are required from the user to gain access to
the resources. This additional authentication helps to allow only authorized users to
access the resources.
Intranet
A private network that is only accessible from within it and not from the outside world.
Essential resources or important internal documents are placed on an intranet. Access
is granted only to organizational users (company employees), with no other users
allowed/permitted access to those resources.
Zero Trust
Zero Trust is a strategic initiative that aims to eliminate the concept of trust from an
organization's network architecture to help prevent successful data breaches. The goal
of Zero Trust is not to make a system trustworthy but rather to eliminate trust.
Virtual Private Network (VPN)
A virtual private network, or VPN, is an encrypted Internet connection that connects a
device to the web. The encrypted connection aids in the safe transmission of sensitive
data.
The responsibilities of a VPN include managing the following security network design:
▪ Always-on
▪ Split tunnel vs. full tunnel
▪ Remote access vs. site-to-site
▪ IPSec
▪ SSL/TLS
▪ HTML5
▪ Layer 2 Tunneling Protocol (L2TP)
276
Chapter 03: Implementation
Network Access Control (NAC)
NAC is an acronym for Network Access Control. With NAC, the traffic flow from inside
or outside the network is controlled. Access control is based on different rules like user
type, location, application, etc. One of the advantages of access control is that it can be
enabled or disabled easily.
Agent and Agentless
In agent-based network access control, the code is kept on the host system for
activation, and it runs at the time of connection. Agentless network access control is
integrated with Windows Active Directory. In agentless access control, checks are
performed during login & log out, and it cannot be scheduled.
Out-of-Band Management
Out-of-band management in systems management entails using management
interfaces (or serial ports) to manage and network equipment. Out-of-band
management enables the network operator to set trust boundaries for accessing the
management function and applying it to network resources.
Port Security
Enabling Port Security will also mitigate against these attacks by limiting the port to
learning a maximum number of MAC addresses, configuring violation actions, aging
time, etc.
Broadcast Storm Prevention
Storm control prevents broadcast storms from disrupting LAN interfaces. When
broadcast packets flood the Subnet, they cause excessive traffic and degrade network
performance. Errors in the protocol stack or network configuration can result in a
broadcast storm.
Bridge Protocol Data Unit (BPDU) Guard
A BPDU is a data message sent across a local area network to detect loops in network
topologies. Guard functionality protects edge ports from malicious attacks. When a
malicious attacker sends a BPDU over the edge port, it causes unnecessary STP to occur.
Dynamic Host Configuration Protocol (DHCP) Snooping
DHCP is allocating the IP address dynamically so that these addresses are assigned
automatically and can be reused when hosts do not need them. Round Trip time is the
measurement of time from discovering the DHCP server up to obtaining the leased IP
address. RTT can be used to determine the performance of DHCP. Using UDP
broadcast, a DHCP client sends an initial DHCP-Discover packet because it initially
277
Chapter 03: Implementation
does not have information about the network they are connected to. The DHCP server
replies to the DHCP-Discover packet with a DHCP-Offer Packet offering the
configuration parameters. The DHCP client will send a DHCP-Request packet destined
for the DHCP server requesting configuration parameters. Finally, the DHCP server will
send the DHCP-Acknowledgement packet containing configuration parameters.
DHCPv4 uses two different ports:
•
•
UDP port 67 for server
UDP port 68 for client
Figure 3-11: Mi IPv4 DHCP Requests
A DHCP Relay Agent forwards the DHCP packets from server to client and client to
server. The relay agent helps the communication by forwarding requests and replies
between clients and servers. When receiving a DHCP message, the relay agent generates
a new DHCP request including default gateway information and the Relay-Agent
information option (Option-82) and sends it to a remote DHCP server. When the Relay
Agent gets the reply from the server, it removes Option 82 and forwards it back to the
client.
The working of the relay agent and the DHCPv6 server is the same as the IPv4 relay
agent and DHCPv4 server. The DHCP server receives the request and assigns the IP
address, DNS, lease time, and other necessary information to the client, whereas the
relay server forwards the DHCP messages
Figure 3-12: IPv6 DHCP Requests
278
Chapter 03: Implementation
DHCPv6 uses two different ports:
•
•
UDP port 546 for clients
UDP port 547 for servers
Media Access Control (MAC) Filtering
MAC (Media Access Control) filtering limits access to specific devices on the network.
Typically, it is used to keep neighbors out or ensure that only the people of a company
can connect to the network. The disadvantage of MAC filtering is that it is easy to
circumvent.
Network appliances
The Network Appliance includes the following components in security network design
for managing the network
▪
▪
▪
▪
Jump servers
Proxy servers
Forward
Reverse
Network-based Intrusion Detection System (NIDS)/Network-based Intrusion
Prevention System (NIPS)
Network Intrusion Detection
It is used to track traffic in real-time at specific points on a network. It investigates
protocol actions at the application, transport, and network levels. The study and
identification of network traffic patterns are based on a database of known assaults.
NIDS's behavioral, anomaly, and signature-based monitoring and detection improve
network security.
Functions of NID
▪
▪
▪
▪
The primary function of NID is to filter out the IP Address of the intruder by
configuring the firewall.
It launches a separate program to handle the event.
It can terminate the TCP session by forging a TCP FIN packet to force a
connection to complete.
It sends an entry to the system log file.
Network Intrusion Prevention
It is an "inline" NIDS that can terminate TCP connections and can discard packets.
279
Chapter 03: Implementation
Functions of NIPS
It can identify malicious packets using the following methods:
▪
▪
▪
▪
▪
Pattern Matching
Stateful Matching
Protocol Anomaly
Statistical Anomaly
Traffic Anomaly
It can also provide flow data protection through:
▪
▪
Monitoring full application flow content
Re-assembling whole packets
Difference between NIDS and NIPS
The significant difference between NIDS and NIPS is in their location:
▪
▪
NIPS would be located 'inline' on the firewall to allow NIPS to take action more
quickly against the attack.
NIDS has sensors that monitor traffic entering and leaving the firewall and report
back to the central device for analysis.
It is the basic working of the Intrusion Prevention System (IPS). The placement of the
sensor within a network differentiates the functionality of IPS over the IDS. When the
sensor is placed in line with the network, i.e., the common in/out of a specific network
segment terminates on the hardware or logical interface of the sensor and goes out from
the sensor's second hardware or logical interface. Every packet will be analyzed and pass
through the detector only if it contains anything malicious. By dropping the malicious
traffic, the trusted network or a segment can be protected from known threats and
attacks. However, the inline installation and inspection of traffic may result in a slighter
delay. IPS may also become a single point of failure for the whole network. If 'fail-open
mode is used, the good and malicious traffic will be allowed in case of any failure within
the IPS sensor. Similarly, if 'fail-close' mode is configured, the whole IP traffic will be
dropped in case of the sensor's failure.
280
Chapter 03: Implementation
Figure 3-13: Inline Deployment of IPS Sensor
If a sensor is installed in the position shown below, a copy of every packet will be sent
to the sensor to analyze any malicious activity.
Figure 3-14: Sensor Deployment as IDS
In other means, the sensor, running in promiscuous mode, will perform the detection
and generate an alert if required. As the normal traffic flow is not disturbed, no end-toend delay will be introduced by implementing IDS. The only downside of this
configuration is that IDS will not stop malicious packets from entering the network
because IDS is not controlling the overall traffic path.
This table summarizes and compares various features of IDS and IPS.
Feature
IPS
Positioning
Not in-line with the
In-line with the network. Every packet goes
network. Receives a copy
through it.
of every packet.
Mode
In-line/Tap
Delay
Introduces delay because every packet is Do not introduce delay
analyzed before being forwarded to the because it is not in line
destination.
with the network.
Point
failure
IDS
Promiscuous
Yes. If the sensor is down, it may drop as
well as malicious traffic from entering the No impact on traffic as
of
network, depending on one of the two IDS is not in line with the
modes configured on it, namely fail-open network.
or fail-close.
281
Chapter 03: Implementation
Yes. By dropping the malicious traffic,
Ability
to attacks can be readily reduced on the
mitigate an network. If deployed in TAP mode, then it
attack?
will receive a copy of each packet but
cannot mitigate the attack.
IDS cannot directly stop
an attack. However, it can
assist
some
in-line
devices like IPS to drop
specific traffic to stop an
attack.
Can you do
packet
Yes. Can modify the IP traffic according to
manipulatio a defined set of rules.
n?
No. As IDS receives
mirrored traffic, so it can
only
perform
the
inspection.
Table 3-01: IDS/IPS Comparison
Signature-based
A signature detects an anomaly by looking for some specific string or behavior in a single
packet or stream of packets
Heuristic/Behavior
The Heuristic Intrusion Detection and Prevention System (HIDPS) is a system that can
intelligently check for malicious behavior from a program that is either inside or trying
to access the system. The nature of the program determines whether access is given or
revoked.
HSM
HSM provides facilities for Cryptographic functions like hashing, encryption, etc. It
manages and stores keys in a secure location by keeping the backup of the key. To
restrict access to the key that HSM secures, it has a technique called tamper protection
technique.
It is a peripheral device that is usually "attached through USB or a network connection."
282
Chapter 03: Implementation
Figure 3-15: Hardware Security Module
Sensors and Collectors
The critical spots in a network contain sensors and collectors. These sensors and
collectors gather information from the network devices. They may be integrated into
the router, firewall, switches, etc., or built-in within the network.
The information that the sensor gathers varies from system to system. For instance,
authentication logs information will differ from database transaction logs or web server
access logs, etc.
Difference between Sensor and Collector
When the sensor provides the raw data, the collector converts this raw data into logical
information or the information that makes sense.
Aggregators
In modern networking, an aggregator is a device or service provider that can combine
multiple disparate circuits or carrier services into a single, simple-to-use, easy-tomanage course. To put it another way, an aggregator can make your job as a network
provider/manager easier.
Firewall
The primary function of using a dedicated firewall at the edge of a corporate network in
isolation. A firewall prevents the internal LAN from having a direct connection with the
internet or the outside world. This isolation is carried out by but is not limited to:
● A Layer 3 device using an Access List for restricting the specific type of traffic
on any of its interfaces
● A Layer 2 device using the concept of VLANs or Private VLANs (PVLAN) for
separating the traffic of two or more networks
● A dedicated host device with the installed software. This host device, also
acting as a proxy, filters the desired traffic while allowing the remaining traffic
Although the features above provide isolation in some sense, the following are reasons
for preferring a dedicated firewall appliance (either in hardware or in software) in
production environments:
Risks
Access by
Untrusted
Entities
Protection by firewall
Firewalls try to categorize the network into different portions. One
portion is the trusted portion of internal LAN. Public internet
interfaces are seen as an untrusted portion. Similarly, servers
accessed by untrusted entities are placed in a particular segment
283
Chapter 03: Implementation
known as a Demilitarized Zone (DMZ). By allowing only specific
access to these servers, like port 90 of the web server, firewalls hide
the functionality of a network device, making it difficult for an
attacker to understand the physical topology of the network.
Deep Packet
Inspection
and Protocol
Exploitation
One of the exciting features of a dedicated firewall is its ability to
inspect traffic at more than just IP and port levels. By using digital
certificates, Next-Generation Firewalls that are available today can
check traffic up to layer 7. A firewall can also limit the number of
established as well as half-open TCP/UDP connections to mitigate
DDoS attacks.
Access
Control
By implementing local AAA or by using ACS/ISE servers, the
firewall can permit traffic based on AAA policy.
Anti-virus
and
By integrating IPS/IDP modules with a firewall, malicious data can
Protection
be detected and filtered at the edge of the network to protect endfrom Infected users.
Data
Table 3-02: Firewall Risk Mitigation Features
Although a firewall provides excellent security features, any misconfiguration or bad
network design may have serious consequences, as discussed in the table above.
Another important deciding factor when deploying a firewall in the current network
design is whether the current business objectives can bear the following limitations:
● Misconfiguration and Its Consequences: The primary function of a firewall is to
protect network infrastructure in a more elegant way than a traditional layer 3/2
device. Depending on the vendor and their implementation techniques, many
features need to be configured for a firewall to work correctly. Some of these features
may include Network Address Translation (NAT), Access-Lists (ACL), AAA base
policies, and so on. Misconfiguration of any of these features may result in leakage
of digital assets, which may impact the business financially. In short, complex
devices like firewalls require deep insight and knowledge of equipment and the
general deployment approach.
● Applications and Services Support: Most firewalls use different techniques to
mitigate advanced attacks. For example, NATing, one of the most commonly used
firewalls, reduces reconnaissance attacks. When network infrastructure is used to
support custom-made applications, it may be necessary to re-write the whole
application to work correctly under the new network changes.
284
Chapter 03: Implementation
● Latency: Just as implementing NATing on a route adds some end-to-end delay, a
firewall, along with heavy processing demands, can add a noticeable delay to the
network. Applications like Voice Over IP (VOIP) may require a particular
configuration to deal with this.
Another essential factor to be considered when designing a network infrastructure's
security policies is using the layered approach instead of relying on a single element.
For example, consider the following scenario:
Figure 3-16: Positioning a Firewall in a Production Environment
The previous figure shows a typical Small Office Home Office (SOHO) scenario and
mid-sized corporate environments where several routers and switches support the
whole network infrastructure. If the edge firewall is the focal point of security
implementation, any slight misconfiguration may result in high-scale attacks. In
general, a layered security approach is followed, and packets pass through multiple
security checks before hitting the intended destination.
The position of a firewall varies in different designs. In some scenarios, it is placed on
the corporation's perimeter router, while in other formats, it is placed at the edge of the
network, as shown in figure 141. Apart from the position, it is good practice to
implement layered security. Some features, such as unicast reverse path forwarding,
access-lists, etc., are enabled on the perimeter router. Features such as deep packet
inspection and digital signatures are matched on the firewall. If everything looks good,
the packet is allowed to hit the intended destination address.
Network layer firewalls permit or drop IP traffic based on Layer 3 and 4 information. A
router with an access list configured on its interfaces is a typical example of a network
layer firewall. Although they operate very fast, network layer firewalls do not perform
deep packet inspection techniques or detect malicious activity.
285
Chapter 03: Implementation
Apart from acting as the first line of defense, network layer firewalls are also deployed
within internal LAN segments for enhanced layered security and isolation.
Firewall Architecture
Bastion Host
A Bastion Host is a computer system placed between public and private networks. It is
intended to be a crossing point through which traffic passes. The system is assigned
specific roles and responsibilities. A bastion host has two interfaces, one connected to
the public network and a private network.
Figure 3-17: Posi Bastion Host
Screened Subnet
Screened Subnet can be set up with a firewall with three interfaces. These three
interfaces are connected with the internal Private Network, Public Network, and
Demilitarized Zone (DMZ). In this architecture, each zone is separated by another zone
hence any compromise of one zone will not affect another.
Figure 3-18: Screened Subnet
286
Chapter 03: Implementation
Multi-homed Firewall
A Multi-homed Firewall is two or more networks where each interface is connected to
its network. It increases the efficiency and reliability of a network. A firewall with two
or more interfaces allows further subdivision.
Figure 3-19: Multi-Homed Firewall
Demilitarized Zone (DMZ)
An IOS zone-based firewall is a specific set of rules that may help to mitigate mid-level
security attacks in environments where security is implemented via routers. In ZoneBased Firewalls (ZBF), device interfaces are placed in different unique zones (inside,
outside, or DMZ), and policies are applied to these zones. Naming conventions for zones
must be easy to understand to be helpful when it comes to troubleshooting.
ZBFs also use stateful filtering, which means that if the rule is defined to permit
originating traffic from one zone to another zone, for example, DMZ, then return traffic
is automatically allowed. Traffic from different zones can be authorized using policies
permitting traffic in each direction.
One of the advantages of applying policies on zones rather than interfaces is that
policies are applied automatically simply by removing or adding to an interface in a
particular zone whenever new changes are required at the interface level.
ZBF may use the following set of features in its implementation:
●
●
●
●
●
Stateful Inspection
Packet Filtering
URL Filtering
Transparent Firewall
Virtual Routing Forwarding (VRF)
This figure illustrates the scenario explained above:
287
Chapter 03: Implementation
Figure 3-20: Cisco IOS Zone-based Firewall Scenario
Stateless Firewall
Initially, the firewalls analyze data packets to see if they match the particular rules and
then decide how to forward or drop the packets accordingly. This type of packet filtering
is referred to as stateless filtering. This type of filtering does not care either a packet is
part of an existing data flow or not. Each packet is analyzed individually based solely on
the values of specific parameters in the packet header. It is somehow similar to ACLs
packet filtering.
A stateless firewall monitors network traffic and restricts or blocks packets based on
static values like source and destination addresses. They are not aware of data flows and
traffic patterns.
A stateless firewall filter, sometimes also known as an Access Control List (ACL), does
not state-fully analyze traffic and is unaware of a communication path. The primary
purpose of a stateless firewall filter is to use packet filtering to enhance security. Packet
filtering lets you take the decision and actions based upon the policies you applied.
Stateless firewalls are faster and can perform better under heavier traffic loads.
The stateless firewall works like a packet filter. It does not keep track of the currently
active session. It looks at the traffic going by, and then compare it to a list of access
control and then either allows or restricts traffic to flow.
288
Chapter 03: Implementation
Figure 3-21: Stateless Firewall
Figure 3-22: Stateless Firewall-Traffic Blocking
Stateful Firewall
Stateful firewalls analyze the state of connections in data flows during packet filtering.
They explore whether the packet belongs to an existing flow of data or not. Stateful
firewalls can see traffic streams from one end to another. They know about the
communication paths, applying different IP Security (IPsec) functions such as
encryption and tunneling. Stateful firewalls let you know about other TCP connections
or port states either open, open sent, synchronized, acknowledged, or established.
Stateful firewalls are better at identifying unauthorized access from somewhere.
Operation
A stateful firewall can maintain the state of every connection, either incoming or
outgoing, through the firewall and thus replace long configuration lines. When the
traffic wants to go out through a firewall, the packet will be first matched against a
firewall rules list to check whether the packet is allowed or not. If this packet type is
allowed to go out through the firewall, then the process of stateful filtering will begin.
Usually, a stateful firewall uses the traffic that is using the Transport Control Protocol
(TCP). TCP is stateful, to begin with because TCP maintains a track of its connections
289
Chapter 03: Implementation
by using source and destination address, port number, and IP flags. A three-way
handshake will form an association (SYN, SYN-ACK, ACK), and a two-way exchange
(FIN, ACK) will sum up the connection. This process makes keeping track of the
connection's state easier.
State-full is a bit intelligent firewall. It keeps track of the flow of traffic and remembers
the 'state' of the session. It only allows the good traffic to flow.
Figure 3-23: Stateful Firewall
Difference between Stateless and Stateful Firewall
Stateless Firewall
Stateful Firewall
No session
Session
No login
Login
No basket
Basket
Static Content
Dynamic Content
Table 3-03: Difference between Stateless and Stateful Firewall
Application-Aware Security Device
As the name implies, it filters the traffic based on the application, a modern firewall
technique. It is also named Application Layer Gateway, State-full Multilayer Inspection,
and Deep Packet Inspection.
Types of Firewall
Packet Filtering Firewall
A Packet Filtering Firewall includes access lists to permit or deny traffic based on layer
three and layer four information. Whenever a packet hits an ACL configured layer three
device's interface, it checks for a match in an ACL (starting from the first ACL line).
290
Chapter 03: Implementation
Using an extended ACL in the Cisco device, the following information can be used to
match traffic:
●
●
●
●
●
Source Address
Destination Address
Source Port
Destination Port
Some extra features like TCP established sessions
This table outlines the advantages and disadvantages of using packet filtering
techniques:
Advantages
Disadvantages
Cannot mitigate IP spoofing attacks. An
attacker can compromise the digital
Ease of implementation by using a
assets by spoofing the IP source address
permit and deny statements
to one of the permit statements in the
ACL
Less CPU intensive than deep packet Difficult to maintain when ACL's size
inspection techniques
grows
Configurable on almost every Cisco Cannot implement filtering based on
IOS
session states
In scenarios in which dynamic ports are
Even a mid-range device can perform used, a range of ports will be required
ACL based filtering
to be opened in ACL, which malicious
users may also use
Table 3-04: Advantages and Disadvantages of Packet Filtering Techniques
Circuit-level Gateway Firewall
A Circuit-level Gateway Firewall operates at the session layer of the OSI model. It
captures the packet to monitor the TCP Handshake to validate whether the sessions are
legitimate. Packets forwarded to the remote destination through a circuit-level firewall
appear to be originated from the gateway.
Application-level Firewall
An Application-level Firewall can work at layer three up to layer 7 of the OSI model.
Usually, a specialized or open-source software running on a high-end server acts as an
intermediary between client and destination address. As these firewalls can operate up
to layer 7, it is possible to control moving in and out of more granular packets. Similarly,
291
Chapter 03: Implementation
it becomes challenging for an attacker to get the topology view of a trusted network
because the connection request terminates on Application/Proxy firewalls.
Some of the advantages and disadvantages of using application/proxy firewalls are:
Advantages
Disadvantages
Granular control over traffic is possible As proxy and application, firewalls run
by using information up to layer 7 of the in software. A very high-end machine
OSI model
may be required to fulfill the
computational requirements
The indirect connection between end Just like NAT, not every application
devices make it very difficult to has support for proxy firewalls, and few
generate an attack
amendments may be needed in the
current application architecture
Detailed logging is possible as every Other software may be required for the
session involves the firewall as an logging feature, which takes extra
intermediary
processing power
Any commercially available hardware Along with computational power, high
can be used to install and run proxy storage may be required in different
firewalls on it
scenarios
Table 3-05: Advantages and Disadvantages of Application/Proxy Firewalls
Stateful Multilayer Inspection-based Firewalls
As the name suggests, this saves the state of current sessions in a table known as a
stateful database. Stateful inspection and firewalls using this technique typically deny
any traffic between trusted and untrusted interfaces. Whenever an end-device from a
trusted interface wants to communicate with some destination address attached to the
untrusted interface of the firewall, it will be entered in a stateful database table
containing layer three and layer two information. The following table compares different
features of stateful inspection-based firewalls.
Advantages
Disadvantages
Helps in filtering Unable to mitigate application-layer attacks
unexpected traffic
It
can
be Except for TCP, other protocols do not have wellimplemented on a defined state information to be used by the firewall
broad
range
of
routers and firewalls
292
Chapter 03: Implementation
Can
help
in
mitigating denial of
service
(DDoS)
attacks
Some applications may use more than one port for a
successful operation. An application architecture
review may be needed to work after deploying the
stateful inspection-based firewall.
Table 3-06: Advantages and Disadvantages of Stateful Inspection-based Firewalls
Transparent Firewalls
Most of the firewalls discussed above work on layer three and beyond. Transparent
firewalls work precisely like the techniques mentioned above, but the firewall's
interfaces are layer 2 in nature. IP addresses are not assigned to any interface – think of
it as a switch with ports assigned to some VLAN. The only IP address assigned to the
transparent firewall is for management purposes. Similarly, as there is no extra hop
between end devices, the user will not be aware of any new additions to the network
infrastructure, and custom-made applications may work without any problem.
Next Generation (NGFW) Firewalls
NGFW is a relatively new term used for the latest firewalls with advanced feature sets.
This kind of firewall provides in-depth security features to mitigate known threats and
malware attacks. An example of next-generation firewalls is the Cisco ASA series with
FirePOWER services. NGFW delivers complete visibility into network traffic users,
mobile devices, Virtual Machines (VM) to VM data communication, etc.
Personal Firewalls
A Personal Firewall is also known as a desktop firewall. It helps to protect end-users
personal computers from general attacks from intruders. Such firewalls appear to be a
significant security line of defense for users who are constantly connected to the
internet via DSL or cable modem. Personal firewalls help by providing inbound and
outbound filtering, controlling internet connectivity to and from the computer (both in
a domain-based and workgroup mode), and alerting the user of any intrusion attempts.
Access control list (ACL)
A series of rules through which the firewall determines whether to allow or restrict the
traffic flow. It can also be called the group of variables (tuples) or security policies.
Route security Quality of service (QoS)
Quality of Service (QoS) is a network technology collection that ensures a network can
run high-priority applications and traffic despite limited network capacity reliably. It is
accomplished by QoS technologies, which provide differentiated handling and capacity
allocation to specific flows in network traffic.
Implications of IPv6
293
Chapter 03: Implementation
End-to-end encryption is possible with IPv6. As used in modern VPNs, encryption and
integrity-checking are standard components in IPv6, available for all connections and
supported by compatible devices and systems. As IPv6 becomes more widely used, manin-the-middle attacks will become much more difficult.
IPv6 also allows for more secure name resolution. The Secure Neighbor Discovery
(SEND) protocol can provide cryptographic confirmation that a host is who it claims to
be at the time of connection. Address Resolution Protocol (ARP) poisoning and other
naming-based attacks are made more difficult as a result. An attacker can easily redirect
traffic between two legitimate hosts and manipulate the conversation using IPv4. It is
made difficult by IPv6.
Port Spanning/Port Mirroring
Port mirroring is a straightforward notion. One port is reserved while configuring a
switch. The switch is then configured to "reflect" all traffic passing through that reserved
port. As mentioned earlier, when the switch processes a packet, it is copied and sent to
whatever is linked to the port. On a network switch, port mirroring sends a copy of
network packets seen on one switch port (or an entire VLAN) to a network monitoring
connection on another switch port.
Port Taps
The two most frequent methods for network traffic access used for data monitoring and
security analysis are network TAP (Test Access Point) and SPAN (port mirroring).
Monitoring Services
The collection, analysis, and escalation of indicators and alerts to detect and respond to
breaches on computer networks are known as network security monitoring. Proactive
network searches for security data and "hunting" for suspicious behavior are common
aspects of network security monitoring solutions.
File Integrity Monitors
As a member of the CIA trinity, file integrity refers to the processes and
implementations to protect data from unauthorized alterations, such as cyber-attacks.
The integrity of a file indicates whether it has been tampered with by unauthorized
users after it was generated, while it was being stored, or while it was being retrieved.
294
Chapter 03: Implementation
Mind Map
Figure 3-24: Mind Map of Secure Network Design
Wireless Security Settings
The use of wireless networks has dramatically increased, and therefore, the security of
the protocols used in a wireless network has become a vital determinant to observe
safety. Its security can be ensured through the implementation of encryption.
Cryptographic Protocols
Cryptographic protocols refer to the cryptographic methods and their implementation
to assure various vendors' equipment interoperability.
All can have a secure wireless communication channel by configuring WPA and WPA 2
encryption that permits only people with a password to communicate.
WiFi Protected Access II (WPA2)




Wi-Fi protected access to version 2
It is modern wireless encryption and was introduced in 2004.
It uses AES (Advanced Encryption Standard) for encryption that replaced RC4.
Also, it involves CCMP (Counter Mode with Cipher Block Chaining Message
Authentication Code Protocol) that replaced TKIP.
295
Chapter 03: Implementation
WiFi Protected Access III (WPA3)

The most recent iteration of common wireless network security is WPA3 (Wi-Fi
Protected Access 3).

Even when a simple password is provided, WPA3 provides higher security than
the WPA2 authentication mechanism.
Counter-mode/CBC-MAC Protocol (CCMP)



Uses 128-bit keys and encrypts in 128-bit block size.
Its services include Data confidentiality, Access control, and Authentication.
For data confidentiality, it uses AES.
Simultaneous Authentication of Equals (SAE)


For Mesh Networks, a Secure Password-Based Key Exchange is used.
The technique produces a cryptographically strong shared secret that can secure
other data, such as network communication. Passive, active, and dictionary
attacks are all resistant to SAE.
Authentication Protocols
Extensible Authentication Protocol (EAP)



It stands for Extensible Authentication Protocol.
It also serves as a framework for creating various types of authentication.
WPA and WPA2 also use five various EAP types for authentication on wireless
networks.
Protected Extensible Application Protocol (PEAP)



It stands for Protected Extensible Authentication Protocol.
It was developed by Microsoft, Cisco, and RSA for secure authentication.
In PEAP, EAP is encapsulated into a tunnel (TLS tunnel). The encryption
certificate is on the server-side, and all the EAP communication is sent over this
TLS tunnel.
EAP-FAST



One of the EAP types is EAP-FAST. It stands for EAP Flexible Authentication via
Secure Tunneling.
Cisco proposed it as a replacement of LEAP (Lightweight EAP) protocol that was
used with WEP.
It is a more secure protocol.
296
Chapter 03: Implementation
EAP-TLS



It stands for EAP-Transport Layer Security or EAP over Transport Layer Security.
EAP-TLS is a common way for encrypting web server traffic and authentication
methods, and it is used widely.
Common advantages include Strong security & support for various wireless
network types.
EAP-TTLS


It stands for EAP-Tunneled Transport Layer Security.
It functions almost the same as EAP-TLS, as the server authenticates to the client
with a certificate. Still, the client-side authentication is tunneled in this protocol
that permits the use of legacy authentication protocols such as PAP, CHAP, MSCHAP, etc.
IEEE 802.1x



A standard of authentication is commonly referred to as “Port-based NAC
(Network Access Control).”
Access is not granted until the authentication process is completed.
Over wireless, IEEE 802.1x uses either EAP-based protocol or IEEE 802.11i.
RADIUS Federation


As the name implies, RADIUS Federation simply means using RADIUS with the
federation.
Federation permits a member of one company to authenticate to another
company’s network using standard credentials; no separate credentials are
needed for visiting a distinct network.
Methods
For configuring wireless access points, there are various authentication methods
available.
PSK vs. Enterprise vs. Open System
An open system without any set security means no password is needed for
authentication in an available system. PSK is commonly named WPA-PSK because it
uses WPA2 encryption with a secret key. It stands for Pre-Shared Key. It needs to be
securely shared among users.
There are various security problems in organizations associated with using a shared key,
and WPA Enterprise helps reduce those problems. It authenticates all the users
individually with an authentication server.
297
Chapter 03: Implementation
WPS
It stands for Wi-Fi /Protected setup that was initially called ‘Simple Wi-Fi config.’ Using
WPS, there are various ways of authentication such as; Using an 8-digit PIN that is
configured on the access point (add that PIN to the mobile device), Pushing a button
on the access point, NFC-Near Field Communication (bring mobile near the access
point).
Captive Portal
Another authentication method for wireless networks is a captive portal. A pop-up that
you see when you open a browser and asks you for credentials. It is known as a captive
portal.
Installation Considerations
Site surveys
Site surveys are used to determine the number and location of access points (APs)
required for a facility to achieve full and efficient wireless coverage. Signal interference
and outside access flaws that unauthorized users could access can also be detected
through surveys.
Heat maps
A wireless heat map is a visual representation of the condition of wireless network signal
coverage across a specific area that can assist network engineers in visualizing wireless
network coverage, identifying dead zones, adjusting, and improving range in the
wireless network environment.
WiFi analyzers
The Wi-Fi Analyzer app, which has been named one of the 15 most useful Android apps,
one of The Best Apps for Fixing Your Wifi, and featured in The NY Times Wirecutter –
The Best Wi-Fi Router, allows users to optimize their current Wi-Fi network by
examining surrounding networks, identifying crowded.
Channel overlays
Peer-to-peer networks, IP networks, and virtual Local Area Networks are examples of
overlay networks (VLANs). Because their IP addresses identify endpoints, the Internet,
which employs layer-3 IP addressing, is an overlay network.
Controller and access point security
In 802.11 wireless deployments, the central node is the Access Point (AP). It is the
connection point between the wired and wireless networks, where all wireless clients
connect and exchange data.
298
Chapter 03: Implementation
Mind Map
Figure 3-25: Mind Map of Secure Network Design
Implement Secure Mobile Solutions
Security for mobile devices needs a multi-layered approach as well as a financial
commitment to enterprise solutions. Some of the primary vital elements are described
below:
Connection Methods and Receivers
The following are some ways that one can use to connect portable technology:
Cellular Network
▪
▪
▪
Through this, our cell phones can communicate over a vast network separated
into sectors called cells.
An antenna in mobile phones can communicate to the antenna that may be in
the local areas.
There are various security concerns with this, i.e., Traffic monitoring, Location
tracking, Wide access to mobile devices.
Wi-Fi
▪
▪
Another common way to connect devices is through Wi-Fi.
We have to make sure that every data that is being sent or received is encrypted.
299
Chapter 03: Implementation
▪
If the data is not encrypted, a man-in-the-middle and denial-of-service attack
risk will increase.
Standard
Frequency
Modulation
Speed
802.11a
5 GHz
OFDM
54 Mbps
802.11b
2.4 GHz
DSSs
11 Mbps
802.11g
2.4 GHz
OFDM, DSSS
54 Mbps
802.11n
2.4 - 5 GHz
OFDM
54 Mbps
802.16 (WiMAX)
10 - 66 GHz
OFDM
70-1000 Mbps
Bluetooth
2.4 GHz
1 – 3 Mbps
Table 3-07: Wireless Network Speed Comparison
Near Field Communication (NFC)
▪
▪
▪
It is commonly used when the communication is between the mobile device and
a device that is nearby.
Commonly used in the payment system.
It is also used to help with other wireless technologies, like supporting the
pairing process for Bluetooth. It is also used as an identity system where one can
identify themselves using the phone.
Some of the security concerns with NFC are as follows:
▪
▪
▪
▪
It is a wireless network (although short-range), but someone with an antenna
can capture and listen to the conversation.
Someone could jam the frequency and attack through denial of service.
There is also a concern about replay attacks.
If an NFC device is lost, it could be a significant security issue because the person
who stole the device will use that NFC instead of the legitimate user.
IR (Infrared)
▪
▪
In modern times, it is used in phones, tablets, and smart-watches to control IR
devices.
It could also be used for file transfer.
USB (Universal Serial Bus)
▪
▪
▪
Most standard mobile device connections.
It uses the physical wired connection.
It is more secure than wireless protocol.
300
Chapter 03: Implementation
Bluetooth
▪
▪
▪
Bluetooth allows for an automatic and wireless connection, but it can also expose
data to interception, providing a considerable security concern.
Hackers regularly use Bluetooth to send malicious files and viruses.
The best way to reduce the risk is to turn off the Bluetooth of the device.
Point-to-point
Point-to-point encryption secures (encrypts) payment card data from the time of
capture, such as when a card payment terminal scans the card until it reaches the secure
decryption endpoint. The fundamental characteristic of P2PE Solutions is point-topoint encryption.
Point-to-multipoint
Point-to-multipoint communication is a type of one-to-many communication in which
many paths from a single point to multiple points are available. This technique is
commonly used in wireless communications with a large number of end destinations or
end-users.
Global Positioning System (GPS)
▪
▪
▪
The GPS (Global Positioning System) is a "constellation" of around 30 satellites
that orbit the Earth and allow anyone with a terrestrial receiver to pinpoint their
location. The location precision for most equipment is between 100 and 10
meters.
The Global Positioning System (GPS) was developed to help military and civilian
users pinpoint their exact location.
It is based on the utilization of Earth-orbiting satellites that supply data that
enables the measurement of the distance between the satellites and the user.
RFID
RFID (Radio Frequency Identification) attacks include multiple attacks like:
▪
▪
▪
▪
Data Capture
Spoof the Reader
Denial of Service
Decryption of Communication
Mobile Device Management (MDM)
The primary purpose of implementing Mobile Device Management (MDM) is to deploy,
maintain, and monitor mobile devices that make up the BYOD solution. Devices may
include laptops, smartphones, tablets, notebooks, or any other electronic device that
can be moved outside the corporate office to home or some public place and then gets
connected to the corporate office by some means.
301
Chapter 03: Implementation
Some of the functions provided by MDM are:
▪
▪
▪
▪
▪
Enforcing a device to be locked after certain login failure attempts.
Enforcement of firm password policy for all BYOD devices.
MDM can detect any attempt at hacking BYOD devices and then limit the
network access of these affected devices.
Enforcing confidentiality by using encryption as per the organization's policy.
Administration and implementation of Data Loss Prevention (DLP) for BYOD
devices. It helps to prevent any data loss due to the end user's carelessness.
Application management
Application management is a difficult task. Not all applications are safe, and some are
malicious, which is a rising security issue.
Content management
A management challenge is to check and update the whitelist constantly.
Remote wipe
▪
▪
▪
Remote wipe is the security requirement of the security administrator. It
removes all the data from the mobile device, often managed by Mobile Device
Management.
It secures the data from unauthorized access if the device is lost, so it is essential
to back up some private data.
It needs to be configured ahead of time.
Figure 3-26: Remote Wiping
Geofencing
Geofencing is a location-based approach that allows a physical location to be given
virtual boundaries. These virtual perimeters can be shown on a map and used to initiate
actions or alerts when people enter, exit, or remain in the region.
302
Chapter 03: Implementation
Geolocation
Geolocation is the process of identifying and tracking the location of linked electronic
devices using location technologies such as GPS or IP addresses. Geolocation is widely
used to track and monitor people's movements and locations because these devices are
frequently carried on their person.
Some of the critical points of Geolocation are:
▪
▪
▪
▪
▪
Based on GPS or signals triangulation or other techniques, geo-locate the device.
In case a mobile device is lost, you can easily track where it is.
However, this can also be used for an evil purpose, like someone could know
precisely where you are or be able to track where you happen to be, based on the
mobile device's location.
The mobile device allows you to enable or disable this feature.
It is usually managed through Mobile Device Manager.
Screen locks
▪
▪
▪
A key security feature of any mobile device is to have that device lock its access.
Allows access to the device if the passcode or password is known.
The password can either be Numeric or Alphanumeric. You can set an option
through the mobile device manager and set it as the requirement to access any
data in the device.
▪ You can also decide what to do with the device on which password is entered
wrong too many times.
▪ You get to choose what that lockout policy might be. Like;
Erase the data on the device.
▪
Slow down the process to prevent brute force attacks.
Push notifications
Push notifications are messages delivered directly to a user's mobile device. They can
appear on the lock screen or at the upper part of a mobile device. An app publisher can
only send a push notification if the user has the app installed.
Passwords and pins
The PIN or password is used as the Key to decrypt data stored on an encrypted mobile
device. A Personal Identification Number (PIN) is a numerical code used in many
computerized financial transactions. Payment cards are often allocated unique
identification numbers, which may be required to complete a purchase.
A password is a string of characters used to validate a user's identity during the
authentication process. Passwords are often used in conjunction with a username and
are intended to be known only by the user to access a device, application, or website.
303
Chapter 03: Implementation
Passwords come in many shapes and sizes and can include letters, numbers, and special
characters.
Biometrics
▪
▪
▪
▪
An intelligent way to set security control on the mobile device.
The user can use face or fingerprint to gain access, but this is not the most secure
option.
It is much more secure to use a password or passcode rather than biometric
security.
It is turned on and off through MDM (Mobile Device Management).
Context-aware authentication
Context-aware authentication is a little beyond two-factor authentication. There, the
user can check another type of access to the device that can help to determine if the
device is in the hands of the right person. It may not qualify as the only type of
authentication, but it could be another security check.
The decisions are made upon the following factors:
▪
▪
▪
Where the user logs typically in.
Where the user is typically frequent (GPS).
Another device that may be paired (Bluetooth).
Containerization
▪
▪
▪
▪
Containerization is implemented where it is difficult for the user to maintain
both personal and business data.
Security management is complex for someone who uses a mobile phone for
corporate use at work and after work; it is used as a personal phone.
Containerization helps to separate an organization's data and application from
the user's personal data and application.
It creates a virtual container for company data that can also help wipe all the
organization's data if someone leaves the organization instead of wiping all the
mobile device data, keeping personal data secure.
Storage segmentation
▪
▪
▪
One technique to protect firm data on mobile devices is to use storage
segmentation.
It encrypts data and stores it in a secure region of the user's device. Access to this
segregated region is usually encrypted and requires authentication.
By isolating traffic, segmentation can increase performance, reduce congestion,
compartmentalize communication concerns like broadcast storms, and improve
security.
304
Chapter 03: Implementation
Full device encryption
▪
▪
▪
▪
Full device encryption is a popular method used by people these days.
No one could gain access to the encrypted data in case the device is lost.
It is handled in different ways by different devices and different operating
systems. For example: In Android, the encryption is configured from strong to
most substantial level to the mobile device.
Therefore, it is suggested and advised not to forget the passcode and keep a
backup of all the data and passcode because if the passcode is lost, the user will
not be able to gain access to the mobile data.
Mobile Devices
MicroSD HSM
A hardware security module in the shape of a microSD card is known as a MicroSD
HSM. It offers encryption, key generation and key life cycle management, digital
signature, authentication, and other cryptographic capabilities, all of which are powered
by hardware-based crypto engines.
MDM/Unified Endpoint Management (UEM)
Mobile device management software allows IT managers to regulate, secure, and
enforce policies on smartphones, tablets, and other endpoints. Unified Endpoint
Management (UEM) refers to the use of MDM to control PCs.
Mobile Application Management (MAM)
MAM (Mobile Application Management) is software that secures and allows IT to
handle enterprise applications on end users' corporate and personal cellphones and
tablets. On the same device, it also separates corporate apps and data from confidential
material.
SEAndroid
Security Enhancements for Android (SEAndroid) is a security solution for Android that
finds and fixes significant flaws. SEAndroid improves data isolation between programs
by regulating Inter-Process Communication (IPC) between apps and system services.
Enforcement and Monitoring
Third-party application stores
They are typically installed as application packages over the USB interface on Android
devices or as IPA files on jailbroken iOS devices. By using a computer, these packages
are often downloaded through third-party program stores like Amazon, Getjar,
Mobogenie, Slide, and Appbrain.
305
Chapter 03: Implementation
Rooting/jailbreaking
To "jailbreak" a phone means to give the owner complete access to the operating
system's root and all of its functions. Rooting is a phrase used to describe eliminating
restrictions from an Android phone or tablet, similar to jailbreaking.
Sideloading
Installing an application on a mobile device without utilizing the device's official
application distribution method is known as sideloading. Third-party apps may have
not been scanned for Malware and are therefore pirated.
Custom firmware
Firmware is software that controls and configures the hardware components of a
platform. Many of the protections required to secure the device and operating system
are set up by firmware. Configuring hardware security settings, verifying boot, and
handing over to the operating system are all part of this process.
Carrier unlocking
Unlocking your phone entails removing the carrier lock that prevents many devices
from running on competing for cellular networks. After opening it, you can bring your
phone to a carrier on a suitable network and sign on to their services.
Firmware Over-the-Air (OTA) updates
The method of remotely upgrading the code on an embedded device is known as overthe-air firmware updates. After a device has been deployed in the field, install new
software features to increase functionality over time. A wireless technique of sending
new software or firmware to mobile phones and tablets is known as over-the-air
updating. The OTA update can be done in two ways: automatically or manually.
Camera use
Tracking, bugging, monitoring, eavesdropping, and recording conversations and text
messages on mobile phones are all part of cellphone surveillance (also known as
cellphone spying). It also includes the tracking of people's movements using mobile
phone signals when phones are turned on.
Following are some examples of the camera types:







Box Camera
Dome Camera
PTZ Camera
Bullet Camera
IP Camera
Day/Night Camera
Thermal (FLIR) Camera
306
Chapter 03: Implementation

Camera
USB On-The-Go (USB OTG)
USB On-the-Go (OTG) allows two USB devices to communicate without the need for a
computer. OTG introduces the Dual-Role Device (DRD), which may serve as both a host
and a peripheral. The fact that a host and peripheral can swap roles if necessary is part
of the charm of OTG.
Recording microphone
A microphone is an electronic device that converts sound waves in the air into electronic
signals or records them on a medium. Microphones are used in various audio recording
devices for multiple applications, including communications, music, and voice
recording.
GPS tagging
The location services linked with your computer system, network, or mobile devices
perform geotagging. To track the position of their subscribers, most social networks and
related services employ some type of geotagging. It allows users to add their current
location to their articles and updates.
WiFi direct/ad hoc
Wi-Fi Direct (also known as peer-to-peer or P2P) enables your software to swiftly locate
and interact with neighboring devices over a longer distance than Bluetooth allows. WiFi peer-to-peer APIs would allow applications to connect to adjacent devices without a
network or hotspot requirement.
Tethering
Tethering uses a mobile device (such as a smartphone) as a modem to link another
device to the Internet, such as a laptop or another mobile phone. To do this, the phone
must be capable of using mobile data. Tethering is one way to make a mobile hotspot
(an ad hoc wireless access point).
Hotspot
A hotspot is a physical site where individuals can connect to the Internet via a Wireless
Local Area Network (WLAN) using a router connected to an Internet service provider,
generally utilizing Wi-Fi. These locations are commonly called "Wi-Fi hotspots" or "WiFi connections." Hotspots are physical locations where users may connect their mobile
devices to the Internet wirelessly, such as smartphones and tablets. A hotspot can be
found in private or public venues, such as a coffee shop, hotel, airport, or even an airline.
While many public hotspots provide free wireless connectivity through an open
307
Chapter 03: Implementation
network, others charge a fee. You will discover how to connect a mobile device to a WiFi hotspot later in the tutorial.
Payment methods
Mobile payment is a cash payment made with a portable electronic device such as a
tablet or cell phone for a product or service. Mobile payment systems, such as PayPal
and Venmo, can also be used to send money to friends and family members.
Deployment Models
Bring Your Device (BYOD)
▪
▪
▪
▪
BYOD stands for Bring Your Device or Bring Your Own Technology.
One of the most common ways for Mobile Device Deployment.
Employees own the device, bring their phones into the workplace, and use them
simultaneously for corporate and personal use.
The device needs to meet the requirement of the company.
The challenge concerning the security is that it is difficult to manage these devices
because it contains both corporative and personal information/data.
Corporate-Owned Personally Enabled (COPE)
▪
▪
▪
▪
It stands for Corporate Own, Personally Enabled.
The company purchases the device, and it is used for both personal and corporate
use.
The organization usually keeps control of the device through a centralized
mobile device, and it is managed similarly as the company manages laptops and
desktop computers.
Everything stored is under the preview of the company.
Choose Your Device (CYOD)
CYOD is an employee provisioning model in which an employer lets employees choose
their own mobile devices from a limited set of possibilities. With this strategy, it is also
easier to protect its data from both external and internal dangers.
Corporate-Owned - Virtual Desktop Infrastructure (VDI)
▪
▪
▪
▪
▪
▪
It is the most popular mobile deployment model.
It stands for Virtual Desktop Infrastructure/Virtual Mobile Infrastructure.
Applications are separated from the mobile devices that the employees use.
Data and applications are running on the remote server, and the employees are
simply using their mobile device as a window into that application.
Data is securely stored in the centralized area and not on the mobile device.
No data will be lost if the device is lost.
308
Chapter 03: Implementation
▪
▪
The application is written once for the VMI platform, and everyone can access it
through that platform.
The application is managed centrally, and no need to update all devices.
Mind Map
Figure 3-27: Mind Map of a Secure Network Design
Cybersecurity Solutions to the Cloud
Cloud Security Controls
Cloud Security
Cloud Computing Security refers to the security implementation and deployment of a
system to prevent security threats. Cloud security includes control policies, deployment
of security devices such as application firewalls and Next-Generation IPS devices, and
strengthening the cloud computing infrastructure. It also has actions at the service
provider end as well as the user end.
Cloud Security Control Layers
Application Layer
Several security mechanisms, devices, and policies provide support at different cloud
security control layers. At the application layer, web application firewalls are deployed
to filter traffic and observe its behavior. Similarly, Systems Development Life Cycle
(SDLC), Binary Code Analysis, and Transactional Security provide security for online
transactions, script analysis, etc.
Information
309
Chapter 03: Implementation
Different policies are configured to monitor data loss to provide confidentiality and
integrity of information communicated between Client and server. These policies
include Data Loss Prevention (DLP) and Content Management Framework (CMF). Data
Loss Prevention (DLP) is a feature that prevents information from leaking from the
network. Traditionally information may include a company or organization's
confidential, proprietary, financial, and other sensitive information. The Data Loss
Prevention feature also ensures compliance with rules and regulations using Data Loss
Prevention policies to prevent users from intentionally or unintentionally sending out
confidential information.
Management
Security regarding cloud computing management is performed through different
approaches such as Governance, Risk Management, Compliance (GRC), Identity and
Access Management (IAM), and Patch and Configuration management. These
approaches help to control and manage secure access to resources.
Network Layer
There are solutions available to secure the network layer in cloud computing, such as
deploying Next Generation IDS/IPS devices, Next-Generation Firewalls, DNSSec, AntiDDoS, OAuth, and Deep Packet Inspection (DPI). The Next Generation Intrusion
Prevention System, known as NGIPS, is one of the most efficient and proactive
components in the Integrated Threat Security Solution. NGIPS secures a network's
complex infrastructure by providing a solid security layer with deep visibility, increased
security intelligence, and advanced protection against emerging threats.
Cisco's NGIPS provides deep network visibility, automation, security intelligence, and
next-level protection. It uses the most advanced and effective intrusion prevention
capabilities to catch emerging sophisticated network attacks. It continuously collects
information regarding the network, including Operating System information, file and
application information, device and user information, etc. This information helps
NGIPS map the network maps and host profiles, providing contextual information to
make better decisions about intrusive events.
Trusted Computing
Validating each hardware and software component from the end entity to the root
certificate establishes the Root of Trust (RoT). Its goal is to ensure that only trustworthy
software and hardware may be utilized while still allowing for flexibility.
Computer and Storage
Cloud computing and storage can be secured by implementing Host-based Intrusion
Detection or Prevention Systems HIDS/HIPS. Examples of these are Configuring
Integrity Check, File System Monitoring and Log File Analysis, Connection Analysis,
310
Chapter 03: Implementation
Kernel Level Detection, Encrypting the Storage, etc. Host-based IPS/IDS is typically
deployed to protect a specific host machine, and it works strictly with the machine's
Operating System Kernel. It creates a filtering layer to filter out any malicious
application call to the OS.
Physical Security
Physical security is always a priority for securing anything. As it is also the first layer
OSI model, any security configuration will not be effective if a device is not physically
secure. Physical security includes protection against artificial attacks such as theft,
damage, and unauthorized physical access and the environmental impact such as rain,
dust, power failure, fire, etc.
High Availability Across Zones
High Availability (HA) refers to systems that are reliable enough to operate without
interruption. They've been thoroughly tested and may include redundant components.
The term "high availability" refers to systems that provide high operational performance
and quality over a long period.
The ability of computing infrastructure to continue to function even if some of its
components fail is referred to as high availability. The number "nine" is often used to
indicate a high level of Availability. "Five nines," for example, denotes a system that is
operational 99.999 percent of the time.
Resource policies
A cybersecurity policy offers guidelines for activities, including email attachment
encryption and social media usage restrictions. Cyberattacks and data breaches can be
expensive; thus, cybersecurity standards are crucial.
Secrets management
Secrets management refers to the tools and processes used to manage digital
authentication credentials (secrets) such as passwords, keys, APIs, and tokens for usage
in applications, services, privileged accounts, and other sensitive parts of the IT
ecosystem.
Integration and auditing
A security audit is a method of evaluating the security of a company's information
system by analyzing how well it meets a set of criteria. These audits are the three
fundamental types of security diagnostics, together with vulnerability assessments and
penetration testing.
311
Chapter 03: Implementation
Storage
The Storage Security Audit is a professional, methodical assessment and verification of
storage infrastructure security and information management procedures. A third party
or an internal audit function performs it.
Permissions
Permissions to read, write, and delete files on a computer are granted to a user or an
application. Access permissions can be assigned to a specific client or server and
directories within that system, programs, and data files.
Encryption
The use of encryption for data in transit and on storage media is referred to as storage
encryption. Data is encrypted as it travels to storage devices like hard disks, tape drives,
and the libraries and arrays that house them.
Replication
The process of transferring data from one location to another is known as data
replication. In a disaster, the technology allows an organization to have up-to-date
copies of its data. Reproduction can occur on a storage area network, a local area
network, or a vast area network, and in the cloud.
High Availability
High Availability refers to an architecture in which one or more servers run parallel with
the main one. The other servers are operational in this situation and share the burden
with the primary server. A continuously operating storage system is known as HighAvailability Storage (HA storage). Redundancy is a key element of high-availability
storage because it allows data to be stored in multiple locations and removes Single
Points of Failure (SPOF).
Network
Virtual networks
A virtual network uses software to connect virtual machines and devices, regardless of
their location. In addition, network adapters and physical Network Interface Cards
(NICs) are used to link computers and servers to the network. These and other tasks are
shifted to software by virtual networking.
Public and private subnets
"Send all outgoing traffic (anything to the CIDR block 0.0. 0.0/0) via this internet
gateway," says a routing table for a public subnet. A private subnet either does not allow
outward traffic to the Internet or includes a route that says, "All outbound traffic must
go via this NAT gateway."
312
Chapter 03: Implementation
Let consider the major components of the configuration for public and private subnets
as depicted in the diagram below.
Figure 3-28: Public and Private Subnets
This scenario's configuration contains the following:
1. A VPC had an IPv4 CIDR block size of /16 (for example, 10.0.0.0/16). There are
65,536 private IPv4 addresses available as a result of this.
2. A public subnet with an IPv4 CIDR block size of /24 (for example, 10.0.0.0/24).
It gives you 256 unique IPv4 addresses. A public subnet has a route to an
internet gateway and is coupled with a routing table.
3. A private subnet with an IPv4 CIDR block size of /24 (for example, 10.0.1.0/24).
It gives you 256 unique IPv4 addresses.
4. A doorway to the Internet. It establishes a connection between the VPC and the
Internet as well as other AWS services.
5. Instances in the subnet range with private IPv4 addresses (examples: 10.0.0.5,
10.0.1.5). It allows them to communicate with one other as well as other VPC
instances.
6. Elastic IPv4 addresses, which are public IPv4 addresses that allow them to be
reached via the Internet, are assigned to instances in the public subnet. Instead
313
Chapter 03: Implementation
of Elastic IP addresses, public IP addresses can be assigned to the cases at
launch.
7. A NAT gateway with an Elastic IPv4 address of its own. Through the NAT
gateway, instances on the private subnet can transmit IPv4 queries to the
Internet (for example, for software updates).
8. The public subnet is coupled with a custom route table. This route table
includes an entry that allows instances in the subnet to communicate over IPv4
with some other cases in the VPC and an admission that enables subnet-models
to communicate directly with the Internet.
9. It is the main route table for the private subnet. The route table includes an
entry that allows instances in the subnet to communicate over IPv4 with some
other cases in the VPC and an admission that will enable models in the subnet
to connect over IPv4 with the Internet via the NAT gateway.
Segmentation
Reasons for segmentation are as follows:
Security: The user should not communicate directly to the database server.
Performance: High bandwidth application.
Compliance: Mandated segmentation (PCI compliance).
Physical Segmentation
In physical segmentation, the devices are physically divided.
Logical Segmentation
In logical segmentation, the devices are logically divided into different segments, such
as configuring VLANs.
API inspection and integration
API security is a broad phrase that refers to procedures and technologies that protect
application program interfaces from malicious attacks or misuse (API). APIs, or
application programming interfaces, make software development and innovation easier
by allowing apps to communicate data and functionality securely. APIs have become a
target for hackers since they are essential for designing web-based interactions.
Compute
Security groups
User accounts, computer accounts, and other groups are grouped into security groups.
Various built-in accounts and security groups in the Windows Server operating system
are set up with the proper rights and permissions to execute specific activities.
314
Chapter 03: Implementation
Dynamic resource allocation
Dynamic resources, like a forklift, travel along with a predetermined path network and
can deliver entities between locations. They may also be required to process entities in
many places, such as an operator executing multiple jobs.
Instance awareness
A virtual server instance from a public or private cloud network is referred to as a "cloud
instance." In cloud instance computing, a single piece of hardware is turned into
software that runs on several computers. A cloud server can easily be relocated from
one physical machine to another without causing any downtime.
Virtual Private Cloud (VPC) Endpoint
A VPC endpoint enables private connections between your VPC and AWS services that
are supported, as well as VPC endpoint services offered by AWS PrivateLink. To
communicate with resources in the service, instances in your VPC do not require public
IP addresses. Virtual devices are VPC endpoints.
Container security
Container security refers to using security tools and rules to protect a container, its
application, and its performance against cyber security threats, such as those posed by
infrastructure, software supply chain, system tools, system libraries, and runtime.
Solutions
Cloud Access Security Broker (CASB)
By integrating CASB, you can make security policies work in the cloud. It can be
implemented as client software, local security appliances, or a cloud-based security
solution. CASB provides Visibility, Compliance, threat prevention, and data security.
Application security
OWASP stands for Open Web Application Security Project. OWASP provides unbiased
and practical information about computer and internet applications. According to
OWASP, the top 10 mobile threats are:
OWASP Top 10 Mobile Risks (2016)
OWASP Top 10 Mobile Risks
(2014)
Improper Platform Usage
Weak Server-Side Controls
Insecure Data Storage
Insecure Data Storage
Insecure Communication
Insufficient
Protection
315
Transport
Layer
Chapter 03: Implementation
Insecure Authentication
Unintended Data Leakage
Insufficient Cryptography
Poor
Authorization
Authentication
Insecure Authorization
Broken Cryptography
Client Code Quality
Client-Side Injection
Code Tampering
Security Decisions Via Untrusted
Inputs
Reverse Engineering
Improper Session Handling
Extraneous Functionality
Lack of Binary Protections
and
Table 3-08: OWASP Top 10 Mobile Risks
Next-generation Secure Web Gateway (SWG)
A Next-Generation Secure Web Gateway (NG SWG) is a new cloud-native solution for
protecting businesses against sophisticated cloud-based threats and data dangers. It is
the natural next step after the secure web gateway, commonly known as a web proxy or
filter.
Firewall considerations in a cloud environment
Like a regular firewall, a cloud firewall is a security solution that filters out potentially
dangerous network traffic. Cloud firewalls, unlike traditional firewalls, are hosted in the
cloud. This cloud-based firewall delivery paradigm is also known as firewall-as-a-service
(FWaaS).
Traditional firewalls build a virtual barrier around an organization's internal network,
while cloud-based firewalls form a barrier surrounding cloud platforms, infrastructure,
and applications. Cloud firewalls can also protect On-premise infrastructure.
Cloud-native controls vs. third-party solutions
Customers frequently inquire about whether they should utilize cloud-native security
measures or third-party solutions. Of course, the answer is not simple. When asked
what "third-party security solutions" means, most people say they want to use their
existing on-premise security measures. After all, using current tools gives you a sense of
security.
Who is in charge of cloud security?
Customers regularly ask if they should use third-party security solutions or cloud-native
security measures. Of course, the Key is not straightforward. Most people answer they
wish to use their existing on-premise security measures when asked what "third-party
security solutions" entails. Using modern tools, after all, provides you a sense of security.
316
Chapter 03: Implementation
The following are the obligations of the cloud provider:
▪
▪
▪
▪
The cloud provider's physical facilities, software, network, and hardware are all
protected
Security at the server level, i.e., protection against attacks that affect the entire
cloud server
Assuring that their systems are always up to date and that they have all of the
essential updates installed
Providing services and contingencies for company continuity in the event of an
accident or system breakdown
Table 3-09: Comparison between the Native Security Tools Offered by the Cloud Service Providers and
Cloud Control
317
Chapter 03: Implementation
Mind Map
Figure 3-29: Mind Map of Cybersecurity Solutions to the Cloud
Implement Identity and Account Management Controls
Identity
Identity management and access control are controlling access to organizational
resources to keep systems and data secure. As a vital component of your security
architecture, it can help validate your users' identities before granting them proper
access to workplace systems and information.
Identity Provider (IdP)
A service that saves and manages digital identities is known as an Identity Provider
(IdP). These services are used by businesses to link their staff or users to the resources
they require. They allow you to manage access by adding or deleting rights while
maintaining strict security.
Certificates
The purpose of an Identity Certificate is similar to a root certificate except that it
provides the public Key and identity of a client's computer or device. An excellent
example of this is a client router or web server that wishes to make SSL connections
with other peers.
318
Chapter 03: Implementation
Signed Certificate vs. Self-signed Certificate
Self-signed Certificates and Signed Certificates from a Certificate Authority (CA)
provide security in the same way. Communication using these types of certificates is
protected and encrypted by high-level security. The presence of a Certificate Authority
implies that a trusted source has certified the transmission. Signed Security Certificates
are purchased, whereas Self-signed Certificates can be configured to optimize cost. A
third-party Certificate Authority (CA) requires domain ownership verification and other
verification to issue a certificate.
Tokens
The token generator generates pseudorandom tokens that are used along with various
authentication methods.
SSH keys
An SSH key is a network protocol access credential for the SSH (secure shell). This
authenticated and encrypted secure network protocol is employed for remote
communication between machines on an unsecured open network. Remote file
transmission, network administration, and remote operating system access are all
possible with SSH.
Smart cards
These cards are inserted into the computer. Usually, these cards are combined with a
Personal Identification Number or PIN. If some unauthorized person may access your
card, he may have to provide that additional information or PIN.
Account Types
User account
It is a type of account that is most common among users and associated with a single
person. It allows limited access to the operating system. The user account assigns each
user a particular identification number. Multi-users can use the same computer to
access their resources only by using a User Account, which keeps each user's data secure
from another unauthorized user. By using the User Account, multi-user can log in to
the same computer and but they can only access their resources.
Shared and generic accounts/credentials
As the name suggests, this account can be used by more than one person. For example,
some operating systems allow users to log in to a guest account (Guest Login). The
shared understanding is difficult to manage because it is hard to identify the person
logging in. If the shared account password is changed, then everyone needs to be
notified that the password is changed, which brings complexity to the management of
319
Chapter 03: Implementation
the password. It is recommended to use a User account on the system rather than
Shared Account.
Guest accounts
User accounts are necessary for any system. The operating system includes several
different users' accounts. These users are assigned additional privileges. The system
administrator may have to enable or disable default user account such as guest accounts
and modify the credentials of root accounts.
If you disable a guest account, it means you have created a limit on people accessing
your system. By disabling interactive login for the account used as a service, the only
actual user can log in interactively to the operating system.
Service accounts
The operating system or services of the operating system using an internal account is
referred to as Service Account. It is used to run a database or web server and used only
on the local computer; no user can log in interactively. Different types of access
permission can be set up for various services when using Service Account, meaning
database and web server rights may vary. Some of the services accounts require a
username and password, and some do not.
Account Policies
Password complexity
To make the solid and unrecognizable password, one must use a combination of
uppercase letters and lowercase letters, numbers, and symbols and must belong (that
can easily be remembered). The organizations can set rules for password requirements
like the password must be of a 12-character length and must contain uppercase and
lowercase letters plus at least one number and symbol.
Password history
The number of unique new passwords that must be connected with a user account
before an old password can be reused is determined by the Enforce password history
policy setting. Users can change their password as many times as they need to reuse
their original password if you do not specify a minimum password age.
Password reuse
Password reuse is a big security problem in every organization. Many users want to keep
their account passwords the same as long as they can. The longer a password is used for
a given account, the more likely it is that an attacker will be able to brute force it out.
320
Chapter 03: Implementation
Network location
A network location is a profile with a set of network and sharing options applied to the
network to which you are connected. Features like file and printer sharing, network
discovery, and others may be enabled or blocked depending on the network location
allocated to your active network connection.
Geotagging
Geotagging is used in the Accounting Policies image result. Users can utilize geotagging
to find a range of location-specific information from their devices. For example, by
inputting latitude and longitude coordinates into a proper image search engine,
someone can see images taken near a specific location.
Time-based logins
Period-based authentication is a standard method of granting access to an area by
recognizing a person at an entrance and opening the barrier at a predetermined time.
It has no bearing on the person's ability to remain in the admitted area after going over
the barrier
Access policies
Different permission levels are associated with the Publisher and Advertiser accounts
that users have access to. These are the permissions: Owner - Has full write access to
the history and can manage Users with various access levels.
Account permissions
Different permission levels are associated with the Publisher and Advertiser accounts
that users have access to. These are the permissions: Owner - Has full write access to
the history and can manage Users with various access levels.
Account audits
Internal audit accounting is a procedure that focuses on reducing risk and identifying
cost-cutting opportunities. Audit accountants can also be independent specialists that
conduct external audits of a company's financial statements.
Impossible travel time/risky login
A risky login is a calculation that determines the likelihood of an identity being stolen.
Administrators can use this risk score signal to decide whether or not to enforce
administrative regulations. Users must have previously registered for a self-service
password reset before triggering the user risk policy.
Lockout
Account lockout means that the account is temporarily blocked due to incorrect
password entry too many times. Automatic Lockout is very common on most systems.
321
Chapter 03: Implementation
Disablement
Account disablement policies specify what happens to accounts when employees leave
permanently or for a while. Most regulations require administrators to disable the
report as quickly as possible to prevent ex-employees from accessing it.
Mind Map
Figure 3-30: Mind Map of Account Management Controls
Implement Authentication and Authorization Solutions
Authentication Management
In addition to the standard authentication techniques of login/password,
authentication management enables the development of connection processes utilizing
authentication mechanisms using physical tokens (smart cards, USB keys, RFID
badges), biometrics, or mobile phones.
Password keys
A key is a piece of information that may be used to lock and unlock cryptographic
functions like encryption, authentication, and authorization. An interactive technique
for two or more parties to establish cryptographic keys based on one or more parties'
knowledge of a password is called a password-authenticated key agreement method.
Password vaults
A password vault, often known as a password manager, is a tool that securely saves and
encrypts usernames and passwords for various applications. A single login and password
322
Chapter 03: Implementation
are required to access the password vault. Google or Apple may store your password
information in certain instances.
Trusted Platform Module (TPM)
Replacing and formatting the existing hard drive will not be enough to provide security
to it. It is better to take advantage of the built-in Trusted Platform Module (TPM), an
embedded security chip that stores encrypted keys, passwords, and digital certificates.
Different services can use the TPM chip even without the cost of this service. When you
use the TPM with a BIOS-level Administrator password and a User password required
at power-on, the system becomes virtually useless to a thief.
A piece of hardware that is in charge of handling all the cryptographic functions. TPM
contains persistent memory that comes with unique keys. It also has versatile memory
that stores configuration information, storage keys, or other different types of data. TPM
is password protected (requires authentication for gaining access), and there is no
chance of dictionary attack on TPM.
Figure 3-31: Internal components of TPM
323
Chapter 03: Implementation
Hardware Security Module (HSM)
It manages and stores keys in a secure location by keeping the backup of the Key. HSM
provides facilities for Cryptographic functions like hashing, encryption, etc. To restrict
access to the Key that HSM secures, it has a technique called the tamper protection
technique.
It is a peripheral device that is usually "attached through USB or a network connection."
Figure 3-32: Hardware Security Module
Knowledge-based authentication
Knowledge-based authentication, or KBA, is a type of authentication that aims to
establish the identity of someone using a service like a financial institution or a website.
It is a type of authentication that aims to verify that the individual giving identifying
information is, in fact, that person. KBA, as the name implies, is based on the
individual's knowledge.
Authentication
The part of the framework deals with the authentication of any person who claims to be
authorized. For that, the person generally provides ID and password and usually other
additional authentication data.
EAP
▪
▪
▪
It stands for Extensible Authentication Protocol.
It also serves as a framework for creating various types of authentication.
WPA and WPA2 also use five various EAP types for authentication on wireless
networks.
324
Chapter 03: Implementation
Challenge Handshake Authentication Protocol (CHAP)
CHAP is the abbreviated form of Challenge Authentication Protocol. For delivering
credentials over the network, it uses an encrypted challenge. A three-way arrangement
is used by CHAP for authentication that is:
1. The Client sends credentials to the server, and in response, the server sends an
encrypted challenge to the Client.
2. The Client responds to the challenge with a hash by combining the password and
the challenge.
3. The server compares its database information (it is hash) with the soup it has
received. If both matches, the user's authentication is correct and authorized to
communicate over the network.
Figure 3-33: CHAP Authentication Process
The challenge and response mechanism happens multiple times during the connection
without the user being aware of it.
CHAP Authentication Commands
Configuring Hostname
Router(config)#hostname R1
Configuring
remote
router R1(config)# username
hostname for incoming requests
password <password>
<remote_username>
PPP Encapsulation Command
R1(config-if)#encapsulation ppp
PPP Authentication with PAP
R1(config-if)#ppp authentication chap
PPP Debugging Command
R1#debug PPP authentication
Table 3-10: CHAP Authentication Commands
Password Authentication Protocol (PAP)
PAP is abbreviated as Password Authentication Protocol. Used in old systems (mostly
legacy systems) and not popular these days. PAP is a weak authentication method
because no encryption method is used, which means all the information delivered is in
cleartext. Analog dial-up lines do not need encryption because it is impossible for
someone to sit somewhere between the communication path to seize data.
325
Chapter 03: Implementation
Figure 3-34: PAP Authentication Process
Basic Commands for PAP authentication
Configuring Hostname
Router(config)#hostname R1
Configuring remote router hostname R1(config)# username
for incoming request
password <password>
<remote_username>
PPP Encapsulation Command
Router(config-if)#encapsulation PPP
PPP Authentication with PAP
Router(config-if)#ppp authentication pap
PPP Debugging Command
Router#debug PPP authentication
Table 3-11: PAP Authentication Commands
802.1X
▪
▪
▪
A standard of authentication is commonly referred to as "Port-based NAC
(Network Access Control)."
Access is not granted until the authentication process is completed.
Over wireless, IEEE 802.1x uses either EAP-based protocol or IEEE 802.11i.
RADIUS (Remote Authentication Dial-in User Service)
RADIUS is a popular protocol for authentication. It supports numerous devices or
networks other than dial-in networks. The services of RADIUS can be used to centralize
for a single authentication for various systems like Routers, Switches, Firewall, etc. The
benefits of RADIUS are almost available for every Operating System.
Single sign-on (SSO)
It is a feature that allows one-time authentication. Users do not have to type ID and
Password every time they want to access a device or account or connect to a service. It
saves a lot of time for the users. In Windows, there is Kerberos to accomplish Single
sign-on.
326
Chapter 03: Implementation
Security Assertions Markup Language (SAML)
SAML is an authentication and authorization method that is an open standard. The user
is authenticated through a third party for achieving entry to local sources. Shibboleth
software is an example of SAML. Modern mobile networks do not have SAML because
it was not created for mobile devices that are its major weakness.
Terminal Access Controller Access Control System Plus (TACACS+)
It is an authentication protocol developed by Cisco and released as a standard open
beginning in 1993. TACACS+ is an entirely new protocol and is not compatible with its
predecessors. TACACS+ encrypts all the information mentioned above and therefore
does not have the vulnerabilities present in the RADIUS protocol.
This table summarizes and compares the unique features of RADIUS and TACACS+.
TACACS+
RADIUS
UDP ports
L4 Protocol
TCP port 49.
1812/1645 for authentication
1813/1646 for accounting
Encryption
Encrypts full payload of
Encrypts only passwords
each packet
Observations
Open Standard, robust, great accounting
Proprietary to Cisco,
features, less granular authorization
very granular control of
control. Another protocol named
authorization, separate
DIAMETER may replace RADIUS soon
implementation of AAA.
with enhanced capabilities.
Table 3-12: Comparison of RADIUS and TACACS+
OAuth
OAuth was introduced by Google, Twitter, and other parties. It serves as an
authorization to
what resources a user can gain.
OAuth
is usually observed to
be used by Facebook, Google, etc. It is not a protocol for authentication and just
provides authorization between applications. OAuth is combined with OpenID
Connect (handles SSO), and then OAuth decides what resources a user may gain.
OpenID
OpenID Connect is a cross-platform authentication protocol based on the OAuth 2.0
family of standards. It enables clients of various types to conduct sign-in processes and
receive verifiable assertions about the identity of signed-in users, including browserbased JavaScript and native mobile apps.
327
Chapter 03: Implementation
Kerberos
The latest and the most trusted method of authentication is Kerberos. In Kerberos, you
only need to authenticate once, which means it is an SSO (no need to re-authenticate
every time for access gaining) method. It also prevents man-in-the-middle or replays
attacks by allowing mutual authentication between the server and the Client. Kerberos
was first introduced in 1980 by MIT. Microsoft started using this in Windows 2000, and
now it has been made compatible with all Windows systems.
For protecting Kerberos, use extensive cryptography.
How Kerberos Works
The Client provides a Ticket Granting Ticket to a Ticket Granting Service. The Ticket
Granting Service then provides Service Ticket to the Client. All the services on the
network are then authenticated through the Service Ticket. It means the user gains
access by simply showing the ticket behind the scene, and he does not have to be reauthenticated by putting ID and password again and again.
Figure 3-35: Kerberos Working Mechanism
Only the devices that are compatible with the Kerberos can use Kerberos
authentication. Other types of systems that are not Kerberos friendly can use LDAP,
RADIUS, or TACACS for authentication purposes.
Access Control Schemes
Attribute-Based Access Control (ABAC)
In the ABAC model, accessing the resources is allotted to the user depending upon the
policies collectively with the attributes. It is also considered the Next Generation
Model of authorization because many different attributes determine a user's type of
328
Chapter 03: Implementation
access. These attributes may include who is accessing (Role), from where is accessing
(Location), what is being accessed (Resource), and when is it being accessed (Time).
Role-based access control
The role-based access control model offers access based on the role of users in the
organization like CEO, manager, director, team leader, etc. The kind of access depends
on the user's part.
The administrator is responsible for allowing access to the users according to their
designated roles. The RBAC will enable users to gain access implicitly. For example,
if some type of access is provided to the team leader, then by becoming part of the team
leader group, a group member can also enjoy the rights of the team leader. Windows
group is used in Windows Operating System for providing role-based access control.
Rule-based access control
In a rule-based access control model, the administrator creates a set of rules. These rules
describe the limits and restrictions to access. A firewall is one of the rule-based access
control models we are familiar with. Example of management is: "Only the people in
Pakistan can gain access to the web page," "the web form can only be accessed through
explorer browser," "the web form can only be accessed between 4 to 8 pm", etc.
MAC
The operating system describes the limit on how much a user can access the resources
based on security clearance level. Each object that somebody requires to access is
assigned a label (confidential label, private label, etc.). Then users are provided with
some rights decided by the administrator, which the users cannot change. Through
these rights, a user can determine what they can access. Some users may access
confidential resources; some may access personal resources, and so on.
Discretionary Access Control (DAC)
Commonly used in most operating systems. It is a type of model in which the owner
decides who can access the object or what access the user can gain. The owner can also
modify access at any time.
The advantage of DAC: Flexible Model. The owner can quickly determine who can
gain access and modify the access control whenever he wants to.
The disadvantage of DAC: Security is weak. The whole system's security depends upon
the security settings made by the owner. For example, suppose you create a spreadsheet,
and as an owner, you decide who can access the objects of the file and what objects of
the file. You can modify the settings when required.
329
Chapter 03: Implementation
Conditional access
When you utilize Conditional Access rules, you can apply the proper access controls
when they're needed while staying out of your users' way when they are not. After the
first-factor authentication is complete, Conditional Access restrictions are
implemented.
Privilege access management
Privileged Access Management (PAM) is an information security (infosec) system that
protects identities with particular access or capabilities. Like all other information
security solutions, PAM relies on a mix of people, processes, and technology.
Filesystem permissions
Permissions on files determine which users are allowed to execute certain operations
on a file. Permissions on files are an essential aspect of any resistance plan. Only a
portion of public systems is open to the public. At the very least, attackers must be
prevented from modifying system files without permission. Furthermore, file
permissions on internal systems promote the best practices of least privilege and least
access, reducing the damage caused by insider attacks.
Mind Map
Figure 3-36: Mind Map of Authorization and Authentication Solutions
Implement Public Key Infrastructure
Public Key Infrastructure (PKI)
Key management is one of the most challenging aspects of cryptography. Traditional
cryptography approaches employ symmetric-key cryptography, in which the same key
is used for encryption and decryption. The secure transmission of the Key from one user
330
Chapter 03: Implementation
to another is complex. If an unauthorized person has access to the Key, they can read,
decrypt, and alter all data.
In 1976, PKI was introduced by Whitfield Diffie and Martin Hellman to solve key
management issues. Every user obtains two keys in public-key cryptography, i.e.
▪
▪
Public – Can be published to see or use by the user
Private – Always kept secret
In public-key cryptography, no secret or private Key is shared or transmitted, and all
the communication involves is only through the public Key. Hence, the sharing of the
secret fundamental problem in Symmetric Key Cryptography was solved using Public
Key cryptography.
In Public Key Cryptography, the initial message is encrypted by the sender using the
receiver's Public Key, and then they decrypt that message using their own private key.
Figure 3-37: Public Key Cryptography
The following are the features of Public Key Cryptography:
▪
▪
▪
It is efficient.
It is secure.
It is scalable for a large number of users.
PKI Components
It describes all the procedures, policies, & people that are required to manage Digital
certificates. It encapsulates the process to create, manage to revoke, and distribute these
certificates.
A PKI is a set of hardware, software, people, policies, and procedures needed to create,
manage, distribute, use, store, and revoke digital certificates and manage public-key
encryption. It permits users of an unsecured network to securely money and exchange
data over the use of a private and a public cryptographic key pair that has been obtained
through a trusted authority. The public key infrastructure delivers for a digital
certificate that can detect an individual or an enterprise and directory services that can
store and, when necessary, revoke the certificates.
331
Chapter 03: Implementation
PKI ties public keys with the characters of individuals, applications, and associations.
This "binding" is kept up by issuing and administering digital certificates by a Certificate
Authority (CA).
▪
▪
▪
▪
PKI Certificate Authority (CA): The CA is a secure third party that issues PKI
certificates to substances and individuals after checking their identity. It signs
these certificates are utilizing its private key.
Certificate database: The certificate database stores all certificates endorsed by
the CA.
PKI certificate: Certificates contain a substance's or individual's public key, its
motivation, the CA that approved and issued the certificate, the date extends
amid which the certificate can view as valid, and the algorithm utilized to create
the signature.
Certificate store: The certificate store resides on a local PC and stores issued
certificates and private keys.
Use of PKI
The use of PKI is server identification certificates. SSL requires a PKI certificate on the
server to prove its identity confidentially to the Client. Every HTTPS web server
connection uses SSL and, as such, uses PKI. This web page focuses on client-side PKI
applications that employ end-user PKI certificates rather than server certificates. Clientside applications of PKI consist of categories are:
▪
▪
▪
Authentication
Digital signatures
Encryption
332
Chapter 03: Implementation
Operations of PKI:
Figure 3-38: PKI Operation
▪
▪
▪
Alex initially requests a certificate from the CA. The CA authenticates Alex and
stores Alex's PKI certificate in the certificate database.
Alex communicates with Bob using his PKI certificate.
Bob communicates with the trusted CA using the CA's Public Key. The CA refers
to the certificate database to validate Alex's PKI certificate.
Key management
The creation of a key is the first step in Key Management. The management of keys
starts with the generation of a key. By using the proper cipher, keys with the requested
strength are generated. After that, the certificate is generated where a public key is
333
Chapter 03: Implementation
allocated to a user or device. Sequentially, it is distributed to the particular user and
stored to prevent it from any unauthorized access. In case unauthorized gain access to
the certificate, then these certificates are revoked or replaced. If the credentials are not
withdrawn, there is an expiry date, so the essential management process begins when
the certificate expires.
The Certificate Authority (CA)
Certificate authority initiates with a single CA, and all the certificates are generated from
that single authority. In some organizations, the Hierarchical structure is used that
consists of Root CA and Intermediate CA.
Intermediate CA
The SSL Certificate's signer/issuer is the Intermediate Certificate. The Intermediate
Certificate's signer/issuer is the Root CA Certificate. Once the Intermediate CA runs,
and the load is distributed, the Root certificate gets offline for protection.
Registration Authority (RA)
A Registration Authority is a firm or organization that receives and validates digital
certificates and public/private key pair requests. The key public infrastructure includes
a Registration Authority (RA) PKI.
Certificate Revocation List (CRL)
A certificate revocation list lists digital certificates that have had their issuing certificate
authority revoke them before their actual or assigned expiration date. To avoid
tampering, the CA signs the CRL file.
Certificate attributes
The use of a Digital Certificate to identify a user, machine, or device before giving access
to a resource, network, application, or other resource is known as certificate-based
authentication. It is common to use it in conjunction with more traditional techniques
like username and password when it comes to user authentication.
Online Certificate Status Protocol (OCSP)
Using the Online certificate status protocol, the browser can check certificate
revocation or the certificate's status. The message is usually sent to the OCSP Responder
through HTTP (HyperText Markup Language). Not all applications or browsers support
the OCSP protocol.
Certificate Signing Request (CSR)
It is easy to have a digital signature by the certification authority. The process starts
with the pair of key creations. One is a private key that is kept on the website, and the
other is a public key that is sent to the certification authority to be digitally signed. This
334
Chapter 03: Implementation
process is called Certificate Signing Request (CSR). The certification authority performs
some checks, and after that sign, the certificate and sometimes provides additional
features.
CN
The Distinguished Name's characteristic value, also known as the Fully Qualified
Domain Name (FQDN), is the Common Name (CN) DN. It usually consists of the Host
Domain Name and looks like "www.digicert.com" or "digicert.com."
Subject alternative name
It is a certificate that supports various domains in the same certificate. It is an X.509
standard extension and permits you to put a subject alternative name extension and list
out all the DNS names (additional identification information) linked with the
certificate.
Expiration
Using the same password for a long time opens paths for hackers to hack passwords
through brute force attacks. For this reason, many organizations force users to change
their passwords after a certain amount of time. In case of password loss, the password
recovery method helps to reset the password. There is a formal procedure for recovering
the password to ensure that the authentic person is recovering the password.
Types of certificates
Various kinds of certificates are used for different purposes. Some of them are as follows:
Wildcard
A Wildcard Domain Certificate can be applied to any domain and all the names
associated with it. So, the name of the server is not a piece of matter. The main aim is
the replacement of the asterisk (*).
Example: There are an asterisk and a period that a wildcard notation contains the
domain name.
*.domainname.com
* replacement – ftp.domainname.com, vpn.domainname.com, IPS.domainname.com.
Subject alternative name
A certificate that supports various domains in the same certificate. It is an X.509
standard extension and permits you to put a subject alternative name extension and list
out all the DNS names (additional identification information) linked with the
certificate.
335
Chapter 03: Implementation
Code signing
Code Signing Certificates are used by software developers to digitally sign apps, drivers,
and software programs as a way for end-users to verify that the code they receive has
not been altered or compromised by a third party. They include your signature, your
company's name, and, if desired, a timestamp.
Self-signed
The certificate is not required to be signed by the Certificate Authority (Public). This
internal certificate is signed by the same person bearing the certificate. For this, the
person creates their certificate authority that issues digitally signed certificates.
This certificate is used for the webserver that is only for an internal network of the
company. In this way, the person does not have to pay for any external certification
authority. These certificates are then installed on every device or web server within a
network. Then, every person who connects to the webserver will see the Internal
Certification Authority signature certificate.
Machine/computer
The certificate is used to allow and manage devices for communication on the network.
The purpose of this certificate is the authentication of devices. It means that only
authenticated devices can communicate over the web.
For that, certificates signed by the certification authority are placed on the devices, so
if any unauthorized person tries to connect to the network using a VPN, they will not
be allowed to communicate over the web because that particular person will not be
certified.
Email
The type of certificate that is usually attached with the email. The email certificate
permits us to send the email securely by encrypting the information to the other user.
To encrypt the data, it uses a recipient's Key (public) and allows only the receiver to
decrypt the information in the email.
This certificate can also be used as a Digital signature. If you do not want to encrypt the
information, you can digitally sign it through an Email Certificate.
User
It is a type of certificate usually assigned to a single user or an individual. Generally, it
is integrated into a smart card or digital access card.
Example: ID card
336
Chapter 03: Implementation
Root
A public certificate is assigned to the Root CA, and its purpose is to identify the Root
CA. Everything initiates with a Root certificate in PKI infrastructure. It is a Root
certificate that issues an intermediate certificate or another certificate.
In public key infrastructure, the root certificate is the most essential. If somebody gains
access to this root certificate private key, it will generate its certificate for any interest.
Domain validation
The person having a DV certificate has some control over the DNS domain associated
with the SSL.
Extended validation
The certificate receiving person is passed through some additional checks by the
certificate authority. If a person dies all the reviews, then that person gets an EV
certificate. The web owner's organization name appears in green color on the address
bar of the web, which is certified with an EV certificate.
Figure 3-39: Extended Validation Certificate
Certificate Formats
Distinguished Encoding Rules (DER)
The DER format is a binary representation of the ASCII PEM Certificate Format. This
format allows for storing a single certificate (it does not include the Certificate Chain's
Private Key). They are files in binary format.
Privacy Enhanced Mail (PEM)
PEM (privacy-enhanced mail) is specified through a series of RFCs (Request for
Comments) that establish methods and formats for ensuring email authenticity and
confidentiality. The term "privacy-enhanced mail" is frequently used interchangeably
with the term "secure email."
Personal information exchange (PFX)
A PFX file is a PKCS#12 certificate that contains the certificate, the intermediate
authority certificate required for the certificate's trustworthiness, and the certificate's
Private Key. Consider it a repository for everything you will need to deploy a certificate.
337
Chapter 03: Implementation
.cer
A CER file is a security file that confirms the validity of a website and is issued by a thirdparty Certificate Authority such as VeriSign or Thwate. It is placed on a webserver to
verify the legitimacy of a specific website hosted there.
P12
A digital certificate using PKCS#12 (Public Key Cryptography Standard #12) encryption
is stored in a p12 file. It is used to transfer personal private keys and other sensitive
information in a portable format. Various security and encryption programs employ P12
files.
P7B
P7B is a web service authentication security certificate file. There is no private key in
P7B files, only a basic certificate in ASCII Base64 format. Files in the P7B format can be
converted to PEM or PFX formats. Users and devices are identified and authenticated
using P7B papers.
Concepts
Online vs. offline CA
The infrastructure of a public key relies on trust, and typically this trust is provided by
the Certification Authority (CA). However, a compromised CA is a bad thing, and this
also creates trust issues with the Certificate Authority.
The Intermediate Certificate is the signer/issuer of the SSL Certificate. The Root CA
Certificate is the signer/issuer of the Intermediate Certificate. Once the Intermediate
CA runs and the load is distributed, the Root certificate gets offline for protection.
Stapling
As discussed above, the OCSP depends upon CA. It is the responsibility of CA to respond
to all the OCSP requests of the clients. In addition, if the numbers of devices that the
CA has to check are large, this creates scalability. In this case, OCSP Stapling is
implemented. In OCSP Stapling, the device that holds certificate can verify their status
and provide revocation status. This information is received from the appliance directly
rather than CA, and the knowledge of the group is stored on the server of the certificate
holder.
The OCSP status or the revocation is stapled into the TSL or SSL handshake, and a
digitally signed note by the certification authority is present with the OCSP stapled
information.
338
Chapter 03: Implementation
Pinning
The purpose of the Certificate pinning is to prevent the man-in-the-middle attack.
Certificate pinning is used when the server's certificate has been hard-coded into the
application by the application itself. In this case, the application communicates to the
server and receives a copy of the certificate to compare them. If both of them match,
then it means that the person is directly corresponding to the server. If the certificate
does not match, then a decision is made by the application accordingly. It shows an
error message that the certificate does not check, or it may shut it down.
Trust model
A trust model is a set of criteria that ensures the validity of digital certificates used by
CEF eDelivery components. Many trust models based on various trust anchor types and
regulations are available to produce, administer, distribute, store, and revoke digital
certificates.
Key escrow
Key escrow means a third party may have access to your Private Key or the decryption
key along with the backup of that Key. It can be employed by some organizations or
businesses where the employee's information or partner's data needs to be accessed or
decrypted.
Certificate chaining
As mentioned above, a single certificate authority is not a good idea. However,
hierarchical structures, having multiple levels within them, are preferable. All the
connections between different certificate authorities are known as Chain of Trust. The
certificates between Root CA and other Intermediate CA are listed in the Chain of Trust.
The chain of trust initiates with an SSL certificate (part of the webserver) and ends with
the Root certificate. In between, there is a certification authority that assigns the
certificate. The certificates between SSL certificate and Root CA are called "Intermediate
Certificate or Chain Certificate."
339
Chapter 03: Implementation
Figure 3-40: Certificate Chaining
The web server requires the configuration with an appropriate chain. It is common to
configure an SSL certificate and add an Intermediate certificate between Root CA and
SSL certificate.
Mind Map
Figure 3-41: Mind Map of Data Destruction & Disposal Methods
340
Chapter 03: Implementation
Practice Questions
1. Which of the following is not a type of Open Source Web Server architecture?
A. Apache
B. NGINX
C. Lighttpd
D. IIS Web Server
2. An attacker is attempting a trial and error method to access restricted directories
using dots and slash sequences. Which type of web server attack is this?
A. LDAP Attack
B. AD Attack
C. Directory Traversal Attack
D. SQL Injection
3. An attacker sends a request, which allows him to add a header response; now, he
redirects the user to a malicious website. Which type of attack is this?
A. Web Cache Poisoning
B. HTTP Response Splitting Attack
C. Session Hijacking
D. SQL Injection
4. Update that is specially designed to fix the issue for a live production environment
is called __________________.
A. Hotfix
B. Patch
C. Bugs
D. Patch Management
5. A piece of software developed to fix an issue is called _________________.
A. Hotfix
B. Patch
C. Bugs
D. Update
6. Jailbreaking refers to _________________________.
A. Root access to a device
B. Safe mode of a device
C. Compromising a device
D. Exploiting a device
341
Chapter 03: Implementation
7. When an iOS device is rebooted, it will no longer have a patched kernel and may
stick in a partially started state. Which type of Jailbreaking is performed on it?
A. Tethered Jailbreaking
B. Semi-Tethered Jailbreaking
C. Untethered Jailbreaking
D. Userland Exploit
8. Official Application store for Blackberry platform is ________________.
A. App Store
B. App World
C. Play Store
D. Play World
9. Which of the following is the most appropriate solution if an administrator is
required to monitor and control mobile devices running on a corporate network?
A. MDM
B. BYOD
C. WLAN Controller
D. WAP
10. An attack, which denies the services, and resources become unavailable for
legitimate users is known as _________.
A. DoS Attack
B. Application Layer Attack
C. SQL Injection
D. Network Layer Attack
11. DoS attack in which flooding of the request overloads web application or web server
is known as _______________.
A. SYN Attack / Flooding
B. Service Request Flood
C. ICMP Flood Attack
D. Peer-to-Peer Attack
12. DoS Attack focused on hardware sabotage is known as ________________.
A. DoS Attack
B. DDoS Attack
C. PDoS Attack
D. DRDoS Attack
342
Chapter 03: Implementation
13. DoS Attack, in which intermediary and secondary victims are also involved in the
process of launching a DoS attack, is known as _____________.
A. DRDoS
B. PDoS
C. DDoS
D. Botnets
343
Chapter 04: Operation and Incident Response
Chapter 04: Operations and Incident Response
Introduction
Incident Response (IR) development and review services ensure that you have a welldefined strategy for responding to an incident that potentially impacts your
organization.
We use your existing toolsets, data sources, and supplemental solutions introduced as
part of the engagement to achieve the essential environmental visibility during IR
engagements. Our team can receive current and historical situational awareness by
having full access across network, endpoint, logs, and other data sources, ensuring a
holistic view of any potential threat acting within the environment.
We then devise a complete remediation strategy based on a thorough understanding of
the identified dangers and their associated actions. This comprises tactical and strategic
recommendations for removing threat actors from your environment successfully, as
well as the formation of a baseline for future threat-related operations.
Appropriate Tools to Assess Organization Security
For many enterprise organizations, administering risk assessments requires building an
efficient cyber threat management system. The visibility gained from these assessments
provides insight that helps guide high-level cybersecurity decisions, creating them a
valuable plus for organizations of all sizes.
Network Reconnaissance and Discovery
Security experts use command-line tools every day for network discovery and
reconnaissance. As a result, you must be familiar with them in order to pass the
Security+ exam.
Tracert/Traceroute
The “Tracert/Traceroute” command allows mapping an entire path between two devices
to know what routes may be between point A and point B. This uses the tracert
command for Windows and the traceroute command for Linux/Unix/macOS. The
information displayed by the traceroute command is received by the router on the
network via ICMP “Time to Live Exceeded” error message.
You can easily send the packet out to the network, and those packets will cause the
routers to create an error message and send that back. The traceroute command uses
those error messages to build the route.
344
Chapter 04: Operation and Incident Response
Tracert options are available in all Operating Systems as a command line feature. Visual
traceroute, graphical, and other GUI-based traceroute applications are also available.
Traceroute or Tracert command traces the path information from source to destination
in the hop by hop manner. The result includes all hops between source and destination.
The development also provides latency between these hops.
Traceroute Analysis
Consider an example in which an attacker is trying to get network information by using
Tracert. After observing the following result, you can identify the network map.
10.0.0. 1 is the first hop, which means it is the gateway. The Tracert result of 200. 100.50.3
shows 200. 100.50.3, which is another interface of the first hop device, whereas
connected IP includes 200. 100.50.2 and 200. 100.50. 1.
192. 168.0.254 is the next to last hop 10.0.0. 1. It can either be connected to 200. 100.50.
1 or 200. 100.50.2 to verify and trace the following route.
345
Chapter 04: Operation and Incident Response
192.168.0.254 is another interface of the network device, i.e., 200.100.50.1 is connected
next to 10.0.0.1.
192.168.0.1, 192.168.0.2 and 192.168.0.3 are connected directly to 192.168.0.254.
346
Chapter 04: Operation and Incident Response
192.168.10.254 is another interface of the network device, i.e., 200. 100.50.2 connected
next to 10.0.0.1 192.168.10.1, 192.168.10.2, and 192.168.10.3 are connected directly to
192.168.10.254.
Traceroute Tools
Traceroute tools have been listed below:
Traceroute Tools
Path Analyzer Pro
Visual Route
Troute
3D Traceroute
Website
www.pathanalyzer.com
www.visualroute.com
www.mcafee.com
www.d3tr.de
Table 4-01: Traceroute Tools
nslookup/dig
Nslookup

Lookup information from DNS servers like IP addresses, Cache times, canonical
names, etc.
Dig


It stands for Domain Information Grouper
More advanced domain information
ipconfig/ifconfig
Determines TCP/IP and network adapter information and some additional IP details. In
Windows, the command used is “ipconfig” whereas, in Linux and Mac, the command
used is “ifconfig.”
Tcpdump
Captures packets from the command line.
Nmap
Nmap, in a nutshell, offers Host discovery, Port discovery, Service discovery. Operating
system version information. Hardware (MAC) address information, Service version
detection, Vulnerability & exploit detection can be found using Nmap scripts (NSE).
Using Windows or Linux command prompt, enter the following command:
nmap –sP –v <target IP address>
347
Chapter 04: Operation and Incident Response
Upon successful response from the targeted host, if the command successfully finds a
live host, it returns a message indicating that the IP address of the targeted host is up
along with the Media Access Control (MAC) address and the network card vendor.
Apart from ICMP Echo Request packets and using ping sweep, nmap also offers a quick
scan. Enter the following command for quick scan: nmap –sP –PE –PA<port numbers> <starting IP/ending IP>
For example:
nmap –sP –PE –PA 21,23,80,3389 <192.168.0.1-50>
Figure 4-01: Nmap
ping/pathping
In windows, a command is merged together with the functionality of ping and
traceroute to create a single command called pathping.
Pathping will run a traceroute to a destination IP address to determine what routes may
be in between your local devices and the one you are running as part of pathping.
348
Chapter 04: Operation and Incident Response
Figure 4-02: ping/pathping
hping
hping may be a command-line-minded transmission control protocol/IP packet
assembler/analyzer. The interface is impressed by the ping (8) operating system
command. However, hping is not solely able to send ICMP echo requests.
Hping is accustomed send massive volumes of TCP traffic at a target whereas spoofing
the supply information science address, creating it seem random or perhaps originating
from a particular user-defined source.
netstat
Netstat stands for “Network statistics.” It can be used in many different operating
systems.
349
Chapter 04: Operation and Incident Response
Figure 4-03(a): netstat
350
Chapter 04: Operation and Incident Response
Figure 4-03(b): netstat
netcat

It is used to read or write information to or from the network (open a port and
send or receive some traffic).
Multiple functions



Listens to a port number.
Scans ports and sends data to the port.
Transfers data.
IP scanners
IP scanner is a cmd tool to scan the network for IP addresses. This usually uses a number
of different techniques to identify and then display the devices and port numbers on
your systems.
351
Chapter 04: Operation and Incident Response
ARP
ARP stands for Address Resolution Protocol, which is a stateless protocol used within a
broadcast domain to ensure communication by resolving the IP address to MAC address
mapping. It is in charge of L3 to L2 address mappings. ARP protocol provides the
binding of IP addresses and MAC addresses. By broadcasting the ARP request with an
IP address, the switch can learn the associated MAC address information from the reply
of the specific host. In the event that there is no map or the map is unknown, the source
will send a broadcast to all nodes. Only the node with a coordinating MAC address for
that IP will answer the demand with the MAC address mapping packet. The switch will
feed the MAC address and its connection port information into its fixed length CAM
table.
Figure 4-04: ARP Operations
As shown in Figure 112, the source generates an ARP query by broadcasting the ARP
packet. A node with the MAC address that the query is destined for will reply only to
the packet. The frame is flooded out of all ports (other than the port on which the frame
was received) if CAM table entries are full. This also happens when the destination MAC
address in the frame is the broadcast address. The MAC flooding technique is used to
turn a switch into a hub, in which the switch starts broadcasting each and every packet.
In this scenario, each user can catch the packets, even those not intended.
ARP Spoofing Attack
In ARP spoofing, an attacker sends forged ARP packets over a Local Area Network
(LAN). In this case, the switch will update the attacker's MAC Address with the IP
address of a legitimate user or server. Once an attacker's MAC address is learned,
together with the IP address of an authentic user, the switch will start forwarding the
352
Chapter 04: Operation and Incident Response
packets to the attacker, assuming that it is the MAC of the user. Using an ARP Spoofing
attack, an attacker can steal information by extracting it from the packet intended for a
user over LAN that it received. Apart from stealing information, ARP spoofing can be
used for:









Session Hijacking
Denial-of-Service Attack
Man-in-the-Middle Attack
Packet Sniffing
Data Interception
Connection Hijacking
VoIP Tapping
Connection Resetting
Stealing Passwords
Figure 4-05: ARP Spoofing Attack
Route
The route command is used to view the device’s routing table and help to find the best
possible way in which the packets will go.
353
Chapter 04: Operation and Incident Response
Figure 4-06: Route
Curl
The curl command stands for “Client URL” “Uniform Resource Locator.” This command
refers to a URL that you can use to access the web pages, perform FTP, or receive emails.
This allows you to grab the raw data from different sites and display it on the terminal
screen.
The harvester
There is a fantastic amount of information that can be obtained free from public
websites. Such information is referred to as Open-Source Intelligence or OSINT. There
are many tools available to allow you to gather information from OSINT sites. To do
this, one way is to use the harvester tool. This allows collecting many different kinds of
information from many different kinds of sites. It allows gathering information from
sources like google, bing, or LinkedIn. It also provides DNS brute force to identify DNS
354
Chapter 04: Operation and Incident Response
services that may be publicly available but can find a host that may not be automatically
identified in a DNS server.
For example, you can find a VPN server or email server running some of the brute-force
tasks within a harvester.
Sniper
Sniper is the reconnaissance tool that integrates different reconnaissance tools into one
framework to provide one set of queries and outputs for all different functions. There
are many ways to configure the way sniper runs; some of these are very intrusive, and
others are specifically built to run in a stealth mode.
Scanless
One of the problems you may find when performing a pot scan is that your device is
easily identified as the scan source. To handle this, you can run a scan from a different
host that will act as a proxy for port scanning, and the utility that does this function is
called scanless. It includes support for many different services.
Dnsenum
The dnsenum command will enumerate DNS information from a DNS server. There is
a great deal of information you can gather and many hosts you can identify from that
DNS server. However, there are also hosts that you can find using a number of different
techniques, and dnsenum allows you to do this.
Nessus
The Nessus is one of the most popular vulnerability scanners because of its very large
database. They can easily find many different known vulnerabilities. Nessus is the
scanning tool that has extensive reporting help to identify vulnerabilities. It also helps
to resolve the vulnerabilities on the system.
Cuckoo
Cuckoo is s sandbox that is specifically written to run the programs inside and identify
any malware. This virtualized environment can consist of many different operating
systems, including Windows, Linux, macOS, and Android. It can perform API calls to
identify what the application is sending network traffic
File Manipulation
File management tools are utility package that manages files of the system. Since files
are a vital part of the system, all the info is held on within the files. Therefore, this utility
software facilitates browsing, searching, arranging, noticing information, and quickly
previewing the system files.
355
Chapter 04: Operation and Incident Response
head
The head command is used to see the top part of the file. There are multiple viewing
options available that help to view the file differently. For example, to view the first five
lines of the file, you can run the following command:
head -n 5 syslog
tail
The tail command is used to view the last portion of a file. The syntax of head and tail
commands are similar. For example, to view the last five lines of a file, run the following
command:
tail –n 5 syslog
cat
Cat is short for concatenate. Concatenating a file means that you would either view the
contents of files to the screen or link multiple files together to create a large file.
grep
The grep command allows us to find any bit of text that we require in the file, and we
can also search through multiple files at one time. For example, finding the pattern that
failed within a file called auth.log runs the following command:
grep failed auth.log
chmod
the chmod command allows changing the mode of the file system object. In this context,
the term mode means to change it to either read (r), write (w), or execute (x). You can
do set the mode commonly by setting the binary patterns or octal notation within an
individual file.
#
Permission
rwx
7
Read, Write, and Execute
rwx
6
Read and Write
rw-
5
Read and Execute
r–x
4
Read only
r--
3
Write and Execute
-wx
2
Write only
-w-
1
Execute only
--x
356
Chapter 04: Operation and Incident Response
0
none
--Table 4-02: Permissions
logger
The logger is responsible for adding the additional information into the system log in
that operating system, commonly a file syslog.
Shell and Script Environments
SSH (Secure Shell)
The Secure Shell Protocol, or SSH protocol, is a protocol for establishing secure remote
connections. It is a safe replacement for insecure protocols like Telnet, rlogin, and FTP.
SSH is used for remote login as well as other protocols like FTP and SCP (Secure Copy
Protocol) (SCP). Because it operates through SSH, SFTP (SSH File Transfer Protocol) is
widely used for secure file transfer. The SSH protocol operates on a client-server
architecture, with the SSH client connecting to the SSH server over an insecure network
over a secure SSH channel.
The Secure Shell (SSH) protocol is made up of three main parts:

The Transport Layer Protocol [SSH-TRANS] provides server authentication,
confidentiality, and integrity. It may optionally also provide compression. The
transport layer will typically run over a TCP/IP connection but might also be
used on top of any other reliable data stream.

The User Authentication Protocol [SSH-USERAUTH] establishes a connection
between the client and the server. It uses the transport layer protocol to operate.

The [SSH-CONNECT] Connection Protocol divides the encrypted tunnel into
many logical channels. It uses the user authentication protocol to operate.
PowerShell
For working with Windows, one of the more advanced shells available is called
Windows PowerShell. PowerShell is commonly used by system administrators on
Windows devices to control each and every aspect of the Window operating system.
Running a script inside o PowerShell has .ps1 file extension.
You can also run scripts inside a PowerShell, manipulate everything related to Windows
operating system or run certain scripts in a standalone executable mode as well.
EXAM TIP: PowerShell is a remarkably powerful tool for doing any type of
administration task on a Windows operating system. The system administrator will be
responsible for the applications running inside of Windows.
357
Chapter 04: Operation and Incident Response
Python
Python is a popular scripting language that works across many different operating
systems. The Python files have a .py file extension. Python is available in Linux, macOS,
and Windows. It is well supported across the entire industry primarily because it has
the flexibility to do much more things inside the operating system. Although, the
primary emphasis of Python is based around automation and orchestration of cloudbased systems.
OpenSSL
OpenSSL is a set of utilities and a library that lets you manage SSL and TLS certificates
in your systems. You must create X.509 certificates if you are establishing a Certificate
Authority (CA) within your organization. Users will send the Certificate Signing
Requests (CSRs), and you will be in charge of managing the Certificate Revocation List
(CRLs). This can be accomplished using OpenSSL's utilities.
OpenSSL also includes cryptographic libraries that can be used to conduct hashing
operations on a variety of hashing methods. You can also use OpenSSL's built-in
encryption and decryption features.
Packet Capture and Replay
Full packet capture tools permit security engineers to record and reproduce all the
traffic on the network. This permits the validation of IDS/IPS alerts and the validation
of things that NetFlow or log knowledge is showing.
Tcpreplay
When you have captured the packets, you can quickly look at the information present
inside the protocol docker like Wireshark. You can also reply to this information back
onto the network using a utility called tcpreplay. This allows you to take information
and send it to the network using a network interface card so that other devices on the
network can see the network traffic. It is a great way to test security devices. It checks
the IPS signatures and firewall rules to see if the information you are sending through
the network will be allowed or denied access at the firewall.
Tcpreplay can also send a large amount of information across the network to test for
monitoring tools.
Tcpdump
If you are working on the system at the command prompt, you may have a graphical
front end that you can use with WireShark. Instead of using the Wireshark, you can use
tcpdump to do the same function. It captures packets from the command line, displays
358
Chapter 04: Operation and Incident Response
packets onto the screen, and writes them in the files. This is often included in many
different Linux distributions that help to work with tcpdump capabilities easily.
Wireshark
Wireshark is the most extensively used Network Protocol Analyzer tool in the
commercial, governmental, non-profit, and educational sectors. It is a free, open-source
program that runs natively on Windows, Linux, MAC, BSD, Solaris, and other systems.
TShark, a terminal version of Wireshark, is also available.
Lab 4-01: Introduction to Wireshark
Procedure:
Open Wireshark to capture the packets.
Click Capture > Options to edit capture options.
359
Chapter 04: Operation and Incident Response
Here, you can enable or disable a promiscuous mode on an interface. Configure the
Capture Filter and click the Start button.
Click Capture > Capture Filter to select Defined Filters. You can add the filter by
clicking the Add button.
360
Chapter 04: Operation and Incident Response
Follow the TCP Stream in Wireshark
Working on TCP-based protocols can be very helpful by using the “Follow TCP Stream”
feature.
This helps to examine the data from a TCP stream in the way that the application layer
sees it. Perhaps you are looking for passwords in a Telnet stream.
361
Chapter 04: Operation and Incident Response
Examine the data from the captured packet.
Filters in Wireshark
Following are the Wireshark filters for filtering the output.
Operator Function
Example
==
Equal
ip.addr == 192.168.1.1
eq
Equal
tcp.port eq 23
!=
Not equal
ip.addr != 192.168.1.1
ne
Not equal
ip.src ne 192.168.1.1
contains
Contains specified value
http contains "http://www.ipspecialist.net"
Table 4-03: Wireshark Filters
Forensics
Our forensic investigation identifies pertinent evidence for incident responders,
network engineers, on-site security teams, human resources, and legal teams, allowing
you to successfully negotiate technical, legal, and public relations requirements.
dd
On the IBM mainframe, dd refers to the data definition that was transformed between
ASCII and EBCDIC. You can use dd to make a bit-by-bit copy of anything on a drive or
in a directory. This would be incredibly beneficial if you needed to save the data for
further study.
The command to create a disk image is:
362
Chapter 04: Operation and Incident Response
dd if=/dev/sda of=/tmp/sda-image.img
And, the required command to restore from an image is:
dd if=/tmp/sda-image.img of=/dev/sda
Memdump
The memdump command will send all of the information and system memory to a
specific location on your computer. Because much third-party forensics software can
read memory dump files and readily identify or discover information that may be saved
in the memory file, this is particularly valuable after the fact.
You can commonly store the memory dump files outside the system; memdump can be
used in conjunction with netcat, stunnel, openssl, etc.
WinHex
WinHex is a third-party editor that can display the dump files in their original format.
Hexadecimal mode is used to display all data. This will assist you in retrieving and
editing data from a file, memory, disk, or other location.
WinHex also has disk cloning capabilities, which allow you to copy all of the data from
a file and save it as an image file or copy it to a different storage device. Additionally,
WinHex makes it simple to do secure wipes, ensuring that all data in the file is
completely deleted and cannot be recovered using third-party programs.
FTK Imager
FTK Imager is a Windows executable that can mount a hard drive, image drives and
perform file operations. This is also supported by a large number of additional forensics
tools. This program aids in the capturing of data and the use of image files in other
programs on various operating systems. This program can also read encrypted disks. It
may also convert the files to a standard format like dd, expert witness, etc.
Autopsy
The Autopsy software performs digital forensics on data stored on storage devices or in
picture files. It also allows you to see and restore data from these devices. It can search
through a downloaded file, check the device's internet history, view email messages,
identify databases, and view graphical files, among other things.
Exploitation Frameworks
Exploitation frameworks are tools that may be used to design unique attacks. They allow
you to quickly build attack types and add extra tools for detecting vulnerabilities. These
are widely used frameworks that allow you to add modules to your system and use them.
For instance, metasploit, the social engineer toolkit, and so forth.
363
Chapter 04: Operation and Incident Response
Password crackers
Performing vulnerability tests against the system or going through it with forensics tools
may result in the discovery of password files or information, including password hashes.
You can use a brute force attack to find those passwords if you have that knowledge. A
password cracker can be used to accomplish this. Password crackers is an online
tracking tool that can perform multiple requests to a device.
Data sanitization
Data sanitization eliminates all data and transforms it into a format that contains no
useable information. This is typically done to clean the entire drive in preparation for
future use.
Note: There is no way to restore the drive once it has been removed from the data
sanitization tool unless you have a backup that has been irreversibly erased.
Mind Map
Figure 4-07: Mind Map
364
Chapter 04: Operation and Incident Response
Importance of Policies, Processes, and Procedures for Incident Response
Incident Response Plans
An incident response setup ensures that the correct personnel and procedures should
effectively cope with a threat in the event of a security breach. Having an event response
plan ensures that a structured investigation will occur to supply a targeted response to
contain and correct the threat.
Incident Response Process
As a Security Professional, you will be responsible for responding to security events that
occur in the organizations. Events may include a user clicking an email attachment and
execute malware. The malware then starts communicating with other services and
sending information outside of the organization.
The security incidents that occur in the organization require some type of response by
the security professional in the organization. The incident response team often
responds to the type of incidents. The team is the group of people that have been
specifically trained to deal with these circumstances. The team may include the IT
management for your security department, compliance officers, technical staff to help
troubleshoot, and users in the community for help in these situations.
NIST SP800-61
NIST stands for National Institute of Standard and Technology in the US and has
created a document to help understand handling the security incidents. This document
is NIST special publication 800-61 revision two titled “Computer Security Incident
Handling Guide.” This provides information about the entire lifecycle when you are
handling the security incidents. This includes:








Preparation
Detection
Analysis
Isolation and Containment
Eradication
Recovery
Reconstitution
Lesson Learned
Preparation
The key to handling the security incidents properly is to make preparation. This
includes the communication method, the choice of the right people, and processes,
including hardware and software used when an incident occurs.
365
Chapter 04: Operation and Incident Response
There will also be a need to have documentation of the organization’s network that
defines data location for security reasons. There is also a need to prepare to clean the
operating system and application images for the mitigation process.
The policies and procedures should be prepared that will apply when the security
incident occurs.
Detection
To be able to respond to the security incident, you should know that how the incident
occur. There are different ways to monitor and identify security incidents. This is a big
challenge because the organization receives several different types of attacks. There are
always some security tools available that will prevent the majority of these types of
attacks. Also, the security incidents often include different devices and operating
systems to identify legitimate threats.
Sometimes, the organization may also prefer to use incident precursors that help to
predict where a particular area of the network may receive a security breach.
Isolation and Containment
When you identify some malicious software or some type of breach, the best approach
is to isolate and contain that particular security incident.
Instead of malicious software, you can use a sandbox. The sandbox is an isolated
operating system that is specifically designed to run the software. This environment can
be completely deleted after performing the analysis so that you can easily be assured
that the malware is not present outside the sandbox.
Sometimes, the sandbox does not provide the perfect analysis of malware. Some
malware can recognize when running in a sandbox and perform differently in a
sandbox-like an open network. Some malware recognizes when you lose connectivity to
the internet. Therefore, you can isolate that system; it begins deleting the files or
damaging the operating system.
Eradication
Once you identified that an incident has occurred and identified that where the
malware exists in the system. You should recover that system. The first required step is
to eradicate the malware and remove it from that system to recover the system.
Sometimes, this includes completely deleting assets from the system, recovering all stuff
from known backup, and fixing the vulnerabilities that caused the incident to occur the
first time.
Recovery
After doing the process of eradication, use backup to restore the system’s assets quickly.
After retrieving the system assets, rebuild the entire system from scratch. And, lastly,
366
Chapter 04: Operation and Incident Response
you should lock down the perimeter of networks to stop the attack before it enters the
private network.
Reconstitution
On large networks, the reconstitution process can be very difficult and time-consuming.
A phased-based approach runs very slowly and takes a couple of months for recovery.
The plan of the reconstitution process should be efficient, start with quick, high-value
security changes. The quick changes may include sending patches to the systems,
modify the firewall to prevent a certain type of traffic from entering your network, etc.
Lessons learned
Once the incident is over, you can look at what processes worked and did not work
during an incident. You can also schedule the post-incident meeting where everyone
shares the experience that occurred during the process.
Exercises
Security incidents are usually after the fact that one has already occurred. However,
most of the work should be done before an incident occurs in the environment. You can
do several things before an incident occurring that can help with the planning process.
This required step is to perform exercises. This includes the testing process and
workflow that should be used when an incident occurs. These can be scheduled once or
twice a year to alert everyone about what they will have to do during an incident.
The organization should use the well-defined rules of engagement when performing
these exercises and monitor that nothing is affecting the production network.
In rare cases, some security incidents take a week or a month to resolve. However, to
perform an exercise, you have limited time.
Tabletop
The tabletop exercise entails putting everything together and conducting a full-scale
test of a specific security incident. This performance can be seen from beginning to end.
This disaster exercise will take a long time to complete, as well as a significant amount
of money and resources.
Instead of doing any task, the tabletop exercise refers to discussion with members about
the processes in the organization. You should define where and how the process and
procedure problems should be resolved before an actual incident occurs.
Walkthroughs
The walkthroughs allow you to test all the processes and procedures, not only with the
organization's management but also with the individual that will respond to the
367
Chapter 04: Operation and Incident Response
particular incident. This may include all of the different parts of the organization, and
you should all the available tools.
This exercise process allows us to go through every process and procedure and identify
the actual faults and missing steps by applying the concepts from the tabletop exercise.
Simulations
Many organizations perform ongoing simulations where they will visualize that how a
particular event has occurred. Some examples include phishing attacks, password
requests, and data breaches.
For example, to test the simulated event “Phishing attack,” the following steps are
required:



Going phishing
o Create a phishing email attack
o Send to the actual user community
o See who bites
Test internal security
Test the users
Attack Frameworks
Within an organization, a security professional is responsible for protecting the
network. The professional may find multiple attacks experience by an organization. It
is difficult to keep track of the exact type of attacks that have occurred and how you, as
a professional, can protect yourself against these attacks.
When the attack is occurring, your response must maintain and gather the ongoing
reconnaissance. The main challenge with this is that the attackers use several methods
in multiple ways. You should understand the attacks, determine if you are at risk in the
organization, and then use appropriate mitigation.
MITRE ATT&CK
One place to begin gathering the data information is through the MITRE ATT&CK
framework. This comes from the MITRE Corporation. They primarily support US
governmental agencies.
Using this framework, you can identify broad categories of attacks, identify points of
intrusion, and identify security techniques that can help you block any future attack.
Some tactics of the MITRE ATT&CK for ICS matrix are shown in Figure 4-08.
368
Chapter 04: Operation and Incident Response
Figure 4-08: Tactics of MITRE ATT&CK
The Diamond Model of Intrusion Analysis
The useful framework that is typically used when an intrusion occurs is called Diamond
Model. The intelligence community of the federal US government designed the
Diamond Model of intrusion analysis.
For further detail, you can visit the given URL
369
Chapter 04: Operation and Incident Response
https://apps.dtic.mil/docs/citation/ADA586960
The above-mentioned guide is focused on helping you understand the intrusion that
has been occurred in the environment.
The Diamond Model of intrusion analysis uses scientific principles and applies them
towards intrusion analysis. These may include measurement, repeatability, testability.
These are the focus of this Diamond Model.
Consider a scenario in which an attacker has deployed a capability against a victim via
infrastructure. The diamond model can assist in determining the relationship between
all of those different domains as well as gathering the necessary information and
documents to resolve this intrusion.
Figure 4-09: The Diamond Model of Intrusion Analysis
The adversary in the above diamond model is an attacker, which is what the attacker
uses (this could be malware, hacker tool, etc.). The infrastructure will describe what was
used to gain access (e.g., IP address, domain name, email addresses, etc.). A victim is a
person or asset on the network that is used. The diamond model defines the relationship
between each one.
Cyber Kill Chain
Lockheed Martin developed the Cyber Kill Chain framework. It is an intelligence-driven
defense model for identifying, detecting, and preventing cyber intrusion by
understanding the adversary tactics and techniques during the complete intrusion
cycle. This framework helps to identify and enhance the visibility into a cyber-attack. It
also helps blue teams in understanding the tactics of APT’s. There are seven steps of the
Cyber Kill Chain.
370
Chapter 04: Operation and Incident Response
1.
2.
3.
4.
5.
6.
7.
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command and Control
Actions on Objectives
Figure 4-10: Cyber Kill Chain
Reconnaissance
Reconnaissance is the beginning stage of the cyber kill chain. The adversaries, in this
planning phase, collect information about the target by using different techniques. This
information gathering helps the adversaries profile the target and helps understand
which vulnerability will lead them to meet their objectives. Following are some
reconnaissance techniques:






Information gathering via social networking platforms
Social engineering
Information gathering via search engines
Email address harvesting
Network scanning
WHOIS searches / DNS queries
For security teams, it is very difficult to identify and detect reconnaissance. Adversaries
can collect enough information about the target without any active connection.
However, to discover internet-facing servers, open ports, running services, and other
required information, adversaries need to build an active connection with the target. If
371
Chapter 04: Operation and Incident Response
security teams identify reconnaissance activity, it can help them reveal the intent and
subsequent actions. Organizations should have a strict policy regarding information
disclosure on public and social forums. Security teams should monitor and timely
respond if any confidential or even relevant information that adversaries can misuse is
publicly posted. Following are some behaviors the security team should monitor to
identify reconnaissance activities:




Website visitors log
Internal scanning activities
Port scanning on public-facing servers
Vulnerability scanning on public-facing servers
Weaponization
After the collection of sufficient information about the target, adversaries prepare the
operation in the Weaponization phase. Weaponization may include preparing an
exploit for an identified target's vulnerability or developing a malicious payload.
Following are some preparation techniques used by adversaries to weaponize
themselves:




Preparing a weaponizer or obtaining one from private channels
Preparing decoy documents (file-based exploits) for victims
Command and Control (C2) implantation
Compilation of backdoor
Security defenders cannot detect weaponization as the payload is not yet delivered.
However, it is an essential phase for defenders; they can keep their security controls
harden against advanced tactics and techniques of malware. Mostly, security teams
conduct malware analysis and reverse engineering, which helps them identify different
techniques of malware development and dropping techniques. In this way, security
teams prepare the most durable and resilient defense. Following are some blue team
techniques to counter:




Conducting malware analysis for trending malware
Building detection rules for weaponizers
Intelligence collection about new campaigns, IoCs
Correlation of artifacts with APT campaigns
Delivery
After all the preparation and weaponization, in the delivery phase, adversaries launch
the attack by conveying the malware or weaponized payload prepared specially for the
target. Following are some common methodologies of launching an attack:


Phishing emails
Malware on a USB stick
372
Chapter 04: Operation and Incident Response


Direct exploitation of web servers
Via compromised websites
This is an important phase for security defenders to identify, detect, and block the
delivery operation. Security teams monitor incoming and outgoing traffic, analyze
delivery mediums, and monitor public-facing servers to detect and block delivery.
Following are some actions for security teams to detect delivery of malware:





Monitoring Emails Campaigns
Leverage weaponizer artifacts to detect new malicious payloads at the point of
entry
Monitoring suspicious networks communications
Monitoring alerts, detections on security controls
Building signature-based detection rules
Exploitation
Exploitation is the phase in which an adversary gains access to the victim. To gain
access, the adversary needs to exploit a vulnerability. As the adversary already has
probably collected the information about the vulnerabilities in the reconnaissance
phase and has already been prepared in the weaponization, the adversary can exploit
the victim by using any of the following techniques:






Exploiting any software, hardware, or human vulnerability
Using exploit code
Exploiting operating system vulnerability
Exploiting application vulnerability
Victim triggered exploitation via phishing email
Click Jacking
To counter the exploitation phase, security teams should follow the traditional security
measures, but they also need to understand new tactics and techniques and harden
assets to prevent exploitation. Following are some key measures for security defenders
to counter exploitation:







User Awareness Training
Phishing Drill Exercises for Employees
Periodic Vulnerability assessment
Penetration testing
Endpoint Hardening
Secure coding
Network Hardening
Installation
373
Chapter 04: Operation and Incident Response
After successful exploitation, the adversary moves next to the installation phase. It
establishes persistency at the victim either by installing a backdoor or opening a
connection from the victim towards C2. This way, the adversary can maintain access for
lateral movements. Following are some ways of maintaining the access activities:



Installation of web shell
Installation of backdoor
Adding auto run keys
Security defenders use different security controls such as HIPS, EDR, AV engines to
detect block installation of backdoors. Security teams should monitor the following to
detect installations:






Suspicious application using administrator privileges
Endpoint process auditing
Suspicious file creations
Registry changes
Auto run keys
Security control alerts
Command and Control
The adversary establishes a two-way communication or command channel with its C2
server during the Command and Control (C2) phase. The adversary owns and manages
this C2 server, which is used to send commands to infected hosts. Adversaries can
change the victim's searches and commands from afar. C2 channels have the following
characteristics:



Victim opens two-way communication channel towards C2
Mostly, the C2 channel is on the web, DNS, or email
C2 queries encoded commands
This is the last chance in this death chain for security defenders to notice and block the
assault by blocking the C2 channel. If the C2 channel is blocked immediately, an
adversary cannot issue commands to the victim. Some strategies for security teams to
guard against C2 communication are as follows:




Collect and block C2 IoC via Threat Intelligence or Malware analysis
Require proxies for all types of traffic (HTTP, DNS)
DNS Sink Holing and Name Server Poisoning
Monitoring network sessions
Actions on Objectives
The adversary has a victim with persistent access to the C2 server at this point. The
adversary can now complete the tasks. What will the opponent do? That is contingent
374
Chapter 04: Operation and Incident Response
on his intentions. At this point, the enemy has access to CKC7. The following are some
various adversary intentions or possible next steps in this phase:







Collection of credentials from infected machines
Privilege Escalation
Lateral movement in the network
Data exfiltration
Data corruption
Data modification
Destruction
At this stage, Security defenders must detect the adversary as earliest as possible. Any
delay in detection at this stage can cause a severe impact. Security teams should be wellprepared and ready to respond in this stage to lower the impact. Following are some
preparations for security defenders:




Immediate incident response playbooks
Incident readiness
Incident response team with SMEs
Communication and incident escalation point of contacts
Stakeholder Management
An IT department usually has IT customers with applications, data, and other technical
resources that the IT department manages. These are the stakeholders in the
organizations. When something is not working properly, the stakeholder will identify
and resolve the problem. It is a good way to maintain a satisfactory relationship with
the stakeholder. You can involve them in the planning process for certain types of
security events.
If an event occurs, you can bring the stakeholders and involved them in the resolution
process. Most of this relationship built with them does not occur when an event
happens. It occurs before the event.
Communication Plan
Many of the problems during a high-stress event can be mitigated by simply having
good communication; when you plan for a security event, the first step to get your
contact list together is to inform everyone. In the organization, this could be the
CIO/head of information security/internal response teams.
You are also required to involve people, not in the IT organization, such as human
resources, public affairs, legal department, etc. However, you are also required to get in
touch with external sources such as the owner of data, federal or state authorities, etc.
Continuity of Operations Planning (COOP)
375
Chapter 04: Operation and Incident Response
You must have a plan in place to complete your role in the event of a disaster or security
incident. Continuity of operations planning, or COOP, is frequently required. This is
frequently done ahead of time before a calamity strikes.
Incident Response Team
Inside the organization, you should have some trained professionals to respond to
security incidents. These professionals made the incident response team efficiently deal
with the problem and determine what type of events require a response, such as virus
infection, ransomware, or DDoS.
The incident response team is not a separate department in the organization. Instead,
it contains a group of people that come together in a committee if an incident occurs.
This team is specifically responding to any incidents that occur. They provide the
analysis of what is occurring and what must be done to resolve it and provide the
reporting containing the information to make the network stronger for the next
incident.
Retention Policies
If you are involved in a security incident, the first main step is to identify how much
data is affected. The organization should have backups of the data.
During the security incident, the organization must protect data location and amount
of data. It should have copies of the information both at internal and external places.
Some organizations are also required to store a certain type of information for a certain
amount of time. This regulatory compliance may affect financial organizations or the
organizations that deal with a certain type of data.
The organization may also use some policies to make a backup available for operational
problems—for example, accidental deletion or disaster recovery.
376
Chapter 04: Operation and Incident Response
Mind Map
Figure 4-11: Mind Map
Appropriate Data Source to Support an Incident Investigation
Vulnerability Analysis
The scanning process includes vulnerability analysis. It is a crucial aspect of the hacking
process. This chapter will go through the definition of vulnerability assessment, the
stages of vulnerability assessment, the different types of assessments, the tools, and a
few other key points.
The Concept of Vulnerability Assessment
The discovery of vulnerabilities in an environment is a vital duty for a penetration tester.
Vulnerability assessment includes identifying environmental problems, design faults,
and other security concerns that could lead to the misuse of an operating system,
application, or website.
Misconfigurations, default configurations, buffer overflows, Operating System
weaknesses, Open Services, and other vulnerabilities are among them. Network
administrators and pentesters can use a variety of technologies to scan for
vulnerabilities in a network. The threat level of any discovered vulnerabilities is
377
Chapter 04: Operation and Incident Response
classified into three categories: low, medium, and high. They can also be classified as a
certain exploit range, such as local or remote.
Vulnerability Assessment
Vulnerability Assessment can be defined as examining, discovering, and identifying
weaknesses in systems and applications and evaluating the implemented security
measures. The security measures deployed in systems and applications are evaluated to
identify the effectiveness of the security layer to withstand attacks and exploitations.
Vulnerability assessment also helps to recognize the vulnerabilities that could be
exploited, any need for additional security layers, and information that can be revealed
using scanners.
Types of Vulnerability Assessment

Active Assessment: Active Assessment includes actively sending requests to the
live network and examining the responses. In short, it is a process of assessment
that requires probing the targeted host

Passive Assessment: Packet sniffing is commonly used in passive assessments
to find vulnerabilities, running services, open ports, and other data. The targeted
host, on the other hand, is not involved in the assessment process.

External Assessment: External Assessment is a process of assessment carried
out from a hacker’s point of view to discover vulnerabilities and exploit them
from the outside. Outside of the network refers to how a potential attacker could
cause a threat to a resource. External network vulnerability assessment identifies
how someone could cause a threat to your network or systems from outside of
your network

Internal Assessment: This is another method for spotting flaws. Internal
assessments include scanning the internal network and infrastructure for
vulnerabilities. Internal network vulnerability assessments are typically based on
IT industry best practices and technical implementation instructions from the
Department of Defense (DoD). During the internal assessment, there are
misconfigurations, flaws, policy non-compliance vulnerabilities, patching
difficulties, and other concerns. An internal network assessment is concerned
with securing network infrastructure.
378
Chapter 04: Operation and Incident Response
Figure 4-12: Vulnerability Assessment Types
Vulnerability Assessment Life Cycle
The Vulnerability Assessment life cycle consists of the following phases:
Creating a Baseline
The vulnerability assessment life cycle begins with the creation of a baseline. A pentester
or network administrator conducting an assessment determines the characteristics of
the corporate network, applications, and services at this phase. They compile a list of all
resources and assets, which aids in the management and prioritization of the evaluation.
In addition, the pentester maps the infrastructure and learns about the security
controls, policies, and standards in place at the company. Additionally, the baseline aids
in the efficient planning of the process, scheduling tasks, and managing tasks according
to priority levels.
Vulnerability Assessment
The Vulnerability Assessment phase focuses on the assessment of the target. This phase
includes examining and inspecting security measures such as physical security, security
policies, and controls. This phase evaluates the target for misconfigurations, default
configurations, faults, and other vulnerabilities by probing each component individually
or using assessment tools. Once the scanning is complete, the findings are ranked in
terms of their priority level. At the end of this phase, the vulnerability assessment report
shows all detected vulnerabilities, scope, and priority.
379
Chapter 04: Operation and Incident Response
Figure 4-13: Vulnerability Assessment Life Cycle
Risk Assessment
Risk Assessment includes scoping identified vulnerabilities and their impact on the
corporate network or an organization.
Remediation
The Remediation phase includes remedial action in response to the detected
vulnerabilities. High-priority vulnerabilities are addressed first because they can cause
a huge impact.
Verification
The Verification phase ensures that all vulnerabilities in an environment are eliminated.
Monitor
The Monitoring phase includes monitoring the network traffic and system behaviors for
any further intrusion.
Annualized Loss Expectancy (ALE) is the product of Annual Rate of Occurrence (ARO)
and Single Loss Expectancy (SLE), i.e., mathematically expressed as:
ALE = ARO * SLE
While performing quantitative risk assessment, ALE estimation defines the cost of any
protection or countermeasure to protect an asset. SLE defines the loss value of a single
incident, whereas ARO estimates the frequency – how often a threat successfully
380
Chapter 04: Operation and Incident Response
exploits a vulnerability. Exposure Factor (EF) is the subjective potential percentage of
loss to a specific asset if a specific threat is realized.
SLE = EF * AV
Real-World Scenario: An organization is approximating the cost of replacement and
recovery operations. The maintenance team reported that the hardware costs $300,
which needs to be replaced once every three years. A technician charges $ 10 per hour
for maintenance; it takes 14 hours to completely replace the hardware and install the
software. The EF (Exposure Factor) is one (100 %). Calculating the Single Loss
Expectancy (SLE), Annual Rate of Occurrence (ARO), and Annualized Loss Expectancy
(ALE) is a need for quantitative risk analysis.
Calculation:
Asset Value (AV)
=
$300 + (14 * $ 10) = $440
Single Loss Expectancy (SLE)
=
EF * AV = 1 * $440 = $440
Annual Rate of Occurrence (ARO)
=
1/3 (Once in every three year)
Annual Loss Expectancy (ALE)
=
SLE * ARO = 1/3 * $440 = $ 146.6
Vulnerability Assessment Solutions
Product-based Solution Vs. Service-based Solution
Product-based solutions are deployed within the corporate network of an organization
or a private network. These solutions are usually dedicated to internal (private)
networks.
Third-party solutions that provide security and auditing services to a network are
known as service-based solutions. These solutions can be hosted on-premises or in the
cloud. These third-party solutions provide a security concern since they can access and
monitor the internal network.
Tree-based Assessment Vs. Inference-based Assessment
Tree-based Assessment is an assessment approach in which an auditor follows different
strategies for each component of an environment. For example, consider a scenario of
an organization's network on which different machines are live—the auditor may use a
different approach for Windows-based machines and a different approach for Linuxbased servers.
Inference-based Assessment is another approach to assessing vulnerabilities depending
on the inventory of protocols in an environment. For example, if an auditor finds a
protocol using an inference-based assessment approach, they will look for ports and
services related to that protocol.
381
Chapter 04: Operation and Incident Response
Best Practice for Vulnerability Assessment
To acquire effective results, the following are some recommended stages for
vulnerability assessment. These recommended practices for vulnerability assessment
must be followed by a network administrator or auditor.

Before starting any vulnerability assessment tool on a network, the auditor must
understand the complete functionality of that assessment tool. This will help in
selecting the appropriate tool for extracting the desired information.

Make sure that the assessment tool does not cause any sort of damage or render
services unavailable while running on a network..

Be specific about the scan’s source location to reduce the focus area.

Run a scan frequently for identifying vulnerabilities.
Vulnerability Scanning Tools
Various tools have made detecting vulnerabilities in an existing environment relatively
straightforward in this era of current technology and innovation. There are a variety of
automatic and manual tools available to assist you in finding vulnerabilities.
Vulnerability Scanners are automated utilities specially developed to detect
vulnerabilities, weaknesses, problems, and loopholes in an Operating System, network,
software, and applications. Scripts, open ports, banners, running services, configuration
errors, and other areas are all thoroughly examined by these scanning tools.
The following are some of the vulnerability scanning tools:

Nessus





OpenVAS
Nexpose
Retina
GFI LanGuard
Qualys FreeScan, etc.
Security experts do not only use these tools to find any risks and vulnerabilities in
running software and applications but are also used by attackers to find any loopholes
in an organization's operating environment.
1.
Nessus
Nessus Professional Vulnerability Scanner is the most comprehensive vulnerability
scanner software powered by Tenable Network Security. This scanning product focuses
on vulnerabilities and configuration assessment. By using this tool, you can customize
and schedule scans and extract reports.
382
Chapter 04: Operation and Incident Response
2.
GFI LanGuard
GFI LanGuard is a network security and patch management software that performs
virtual security consultancy. This product offers:






Patch Management for Windows®, Mac OS®, and Linux®
Path Management for third-party applications
Vulnerability scanning for computers and mobile devices
Smart network and software auditing
Web reporting console
Tracking latest vulnerabilities and missing updates
383
Chapter 04: Operation and Incident Response
3.
Qualys FreeScan
Qualys FreeScan tool offers Online Vulnerability scanning. It provides a quick snapshot
of the security and compliance posture of a network and web, along with
recommendations. Qualys FreeScan tool is effective for:
 Network Vulnerability scans for server and App
 Patches
 OWA SP Web Application Audits
 SCAP Compliance Audits
Go to http://www.qualys.com to purchase this vulnerability scanning tool or register for
the trial version and try to perform a scan. Qualys offers a Virtual Scanner to scan the
local network, which can be virtualized on any virtualization hosting environment. The
figure below shows the results of a vulnerability scan performed on a targeted network.
384
Chapter 04: Operation and Incident Response
Vulnerability Scanning Tools for Mobiles
Following is a list of vulnerability scanning tools for mobiles:
Application
Website
Retina CS for Mobile
http://www.byondtrust.com
Security Metrics Mobile Scan
http://www.securitymetrics.com
Nessus Vulnerability Scanner
http://www.tenable.com
Table 4-04: Vulnerability Scanning Tools for Mobiles
385
Chapter 04: Operation and Incident Response
Figure 4-14: Secuirty Metrics Mobile Scan
Lab 4-02: Installing and Using a Vulnerability Assessment Tool
Main Objective: In this lab, you will learn how to install and use a vulnerability
assessment tool. There are many tools available for vulnerability scanning. The one we
will be installing and using is Nessus.
Go to the browser and type Nessus Home. Click on the Nessus home link, as marked
below.
386
Chapter 04: Operation and Incident Response
This will take you to the Nessus registration page. You need to register in order to get
the activation code, which you are going to need to activate Nessus.
For registration, you need to put in your first name, last name, and email address. Check
the checkbox and click on Register.
Now to download Nessus, click on the download link.
387
Chapter 04: Operation and Incident Response
Select the Operating System on which you are going to install Nessus. Here, we will
install it on Windows 8 machine (64 bit); therefore, we will download the first link for
the 64-bit version of Windows.
Now read the agreement, click on I Agree, and save the file to your computer.
388
Chapter 04: Operation and Incident Response
Download and install the software.
Select I Agree and click Next.
389
Chapter 04: Operation and Incident Response
If you want to change the file destination, click on the Change button or just click Next.
Click the Install button.
390
Chapter 04: Operation and Incident Response
The installation process will now start.
The installation is complete. Click Finish.
391
Chapter 04: Operation and Incident Response
When you see this window, click on Connect via SSL.
Click on the Advanced option.
392
Chapter 04: Operation and Incident Response
Now click on Confirm Security Exception to proceed to localhost.
Now you have to create an account for the Nessus server. Here, you will choose a login
name and password – make sure you remember it because this is what you will use to
393
Chapter 04: Operation and Incident Response
log in to Nessus from now on. After inserting your username and password, click the
Continue button.
Now choose the scanner type that you want. Here, we have selected the first one, which
is Home, Professional, or Manager.
Go to the email, copy the activation code that was forwarded to you and paste it here.
Then, click Continue.
394
Chapter 04: Operation and Incident Response
After that, you are going to see the Initializing window. It fetches all the plugins for
Nessus, which can take about 15 to 20 minutes.
Once all the plugins are installed, a window will appear. This is what Nessus looks like.
Now, the first thing you have to do is create a policy. Click on Policies.
Now click on Create a new policy.
Here, you have multiple scanner options available. What we are going to do now is
Basic Network Scan. So for this, click on the Basic Network Scan option.
395
Chapter 04: Operation and Incident Response
When you see this window, you have to name the policy. You may name it anything you
want; for now, we will name it Basic Scan.
In basic settings, you have another setting option that is the Permission setting. In this,
you have two options: one is No Access, and the other is Can Use. Here, we are going
to leave it as default. Now click the Discovery option.
396
Chapter 04: Operation and Incident Response
Here, you have to choose the Scan Type. You can either choose to scan common ports,
all ports, or customize it. After selecting your desired option, click on Assessment.
Here, you will see three scanning options. Choose whichever you want and then click
on Report.
397
Chapter 04: Operation and Incident Response
In this window, you have multiple options, and you can see that some of them are
‘checked’ by default. We will leave it as default, but if you want to change some settings,
you may change them according to your needs.
Here in the Advanced setting option, you have three options to choose from. Select any
of them and click on the Credentials button.
398
Chapter 04: Operation and Incident Response
Here, we are going to select “Windows” as we are using Windows OS. However, if you
have Mac or Linux, then you have to select SSH.
Go ahead and insert your credentials and authentication method. If you have a domain,
you may insert that (optional). Check the boxes and click the Save button.
And that is it; the policy has been created. Now in order to scan, you have to click on
the Scan button at the top of the page.
399
Chapter 04: Operation and Incident Response
Click on the Create a new scan option.
Go to the User Defined option. Click on Basic Scan.
400
Chapter 04: Operation and Incident Response
Now, name this scan. We are going to name it Basic Scan – the same as the policy name.
You can also add a description if you want.
Select the folder where you want to save a scan, and finally, insert the IP address of the
target.
You may insert the target in different ways. For example, 192. 168. 1. 1, 192. 168. 1. 1/24,
and test.com.
401
Chapter 04: Operation and Incident Response
You can also schedule your scan. For this, click on Enabled, then select the frequency,
start time, and Time zone.
If you want to get a notification, you can add your email address. After configuring all
the settings, click on the Save button.
402
Chapter 04: Operation and Incident Response
Here, you can see that the scanning process has started. Once the scanning process is
complete, you can see the results by clicking on the section that is marked below.
Below is the scan result. The result is shown in multiple colors. The red represents the
Critical Vulnerability, the orange is for High, yellow is for Medium, green is for Low,
and blue is for Info.
403
Chapter 04: Operation and Incident Response
Now, click on the Vulnerability next to the Host option. Here you will see the
vulnerabilities that have been found. Click on any one of them.
You can see the description of a particular vulnerability as well as a solution for it.
404
Chapter 04: Operation and Incident Response
Here are some other vulnerabilities that were found.
405
Chapter 04: Operation and Incident Response
Lab 4-03: Vulnerability Scanning using the Nessus Vulnerability Scanning Tool
Case Study: In this case, we will scan a private network of 10.10.10.0/24 for
vulnerabilities using a vulnerability scanning tool. This lab is performed on a Windows
10 virtual machine using the Nessus vulnerability scanning tool. You can download this
tool from Tenable’s website: https://www.tenable.com/products/nessus/nessusprofessional.
Configuration:
1. Download and install the Nessus vulnerability scanning tool.
2. Open a web browser.
3. Go to the URL http://localhost:8834
4. Click on the Advanced button.
406
Chapter 04: Operation and Incident Response
5. Proceed to Add Security Exception.
6. Click Confirm Security Exception.
407
Chapter 04: Operation and Incident Response
7. Enter Username and Password of your Nessus Account (You have to register to
create an account to download the tool from the website).
408
Chapter 04: Operation and Incident Response
8. The following dashboard will appear.
9. Go to the Policies tab and click Create New Policy.
10. In Basic Settings, set the name of the policy.
409
Chapter 04: Operation and Incident Response
11. Go to Settings > Basics > Discovery to configure discovery settings.
12. Configure port scanning settings under the Port Scanning tab.
410
Chapter 04: Operation and Incident Response
13. Under the Report tab, configure settings as per your requirements.
14. Under the Advanced tab, configure parameters.
411
Chapter 04: Operation and Incident Response
15. Now go to the Credentials tab to set credentials.
412
Chapter 04: Operation and Incident Response
16. Enable/disable desired plugins.
17. Check whether the policy is successfully configured or not.
18. Go to Scan > Create New Scan.
413
Chapter 04: Operation and Incident Response
19. Enter the name for a new scan.
20. Enter target address.
414
Chapter 04: Operation and Incident Response
21. Go to My Scan, select your created scan and launch it.
22. Observe the status to check if the scan has successfully started or not.
415
Chapter 04: Operation and Incident Response
23. Upon completion, observe the result.
24. Click on the Vulnerabilities tab to observe the detected vulnerabilities. You can
also check other tabs like Remediation, Notes, and History to get more details
about the history, issues, and remediation actions.
25. Go to the Export tab to export the report and select the required format.
416
Chapter 04: Operation and Incident Response
26. The below figure is displaying a preview of the exported report in PDF format.
417
Chapter 04: Operation and Incident Response
Note: Nessus is a proprietary network vulnerability scanner developed by Tenable that
uses the Common Vulnerabilities and Exposures architecture for easy cross-linking
between compliant security tools. Nessus employs the Nessus Attack Scripting
Language (NASL), a simple language defining individual threats and potential attacks.
Vulnerability Assessment Reports
Vulnerability Assessment reports help security teams in addressing the weaknesses and
discovered vulnerabilities. VA reports outline all discovered vulnerabilities, weaknesses,
security flaws within a network and its connected devices. VA reports should also
contain remediation, recommendations, and countermeasures to address the outlined
security issues. The VA process consists of two phases, vulnerability scanning and VA
reporting. Following are the critical elements of a VA report:





Scope of the Vulnerability Assessment: Scope should define the approved
scanning tools, version information, Hosts, Subnets, and Ports information to be
scanned.
Executive summary of the report
Detailed information about existing vulnerabilities on each target
Severity level of each vulnerability, i.e., High, Medium, Low
Correlation of discovered vulnerabilities with Vulnerability frameworks, such as
CVSS
Analyze Vulnerability Scan Results
Asset Categorization
We use public, private, limited, and secretive analyses to structure the assets. The ability
to classify an organization's assets aids in the identification of its vulnerabilities and
their impact on the broader organizational process. Consider the following example:
Public
There is no risk to the organization with a public analysis if it is disclosed but does
present a risk if it is not modified or accessible.
Private
A private analysis poses some risk to the organization if a competitor has it or it is
modified or unavailable.
Restricted
This is informationally restricted to a small number of users and may cause serious
disruption to business operations.
Confidential
418
Chapter 04: Operation and Incident Response
If the information is made public, it has a tremendous impact on the company and its
clients. Personal Identifiable Information (PII), Protected Health Information (PHI), or
Payment Card Information are examples of this type of data (PCI).
It can also be divided into groups based on individuals, applications, servers, and places.
Adjudication
The goal of the adjudication process after a vulnerability scan is to determine the value
and legitimacy of the scan result. It assesses and ranks vulnerabilities according to the
risk they provide to the organization. The Common Vulnerability Scoring System
(CVSS) is one of the most common methods.
Common Vulnerability Scoring System
The Common Vulnerability Scoring System aids in the diagnosis of a vulnerability's
main characteristics and generates a numerical score indicating the severity of the
vulnerability. To assist organizations in correctly assessing and prioritizing their
vulnerability management process, the numerical score can be translated into a
qualitative representation (low, medium, high, or critical).
Security
Base Score Rating
None
0.0
Low
0.1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 10.0
Table 4-05: CVSSv3 Scoring
False Positives
In vulnerability scanning, False Positives occur when the scanner can access only a
subset of the required information, preventing it from accurately determining whether
a vulnerability exists. False positives use more than one type of scan and cross-reference.
The most common false positives occur on static web pages.
A false positive is when the system incorrectly receives a biometric sample as being a
match. Biometric sensors can sometimes make mistakes for several reasons. A
biometric, such as a fingerprint or iris scan, is submitted to the system, and it is
compared to all entries in a database for a match. A one-to-many search is what this is
called. Live biometrics change due to climate, age, or a possible injury on a finger.
419
Chapter 04: Operation and Incident Response
Vendors refer to these threshold settings as False Acceptance Rates (FARs) and False
Rejection Rates (FRRs).
Prioritization of Vulnerabilities
The majority of these vulnerabilities are considered high or critical based on the
industry-standard CVSS. Vulnerability Management strategies allow them to respond
to the growing number of threats of the digital age. We find the Vulnerability
Prioritization within these strategies.
Vulnerability Prioritization represents one of the key reasons for the Vulnerability
Management process.
The Benefits of Vulnerability Prioritization
There are several benefits of Vulnerability Prioritization; Few are as follows:
Faster and more effective responses: Among the enormous volume of vulnerabilities
that affect one organization, there are trivial numbers compared to others. By
prioritizing the most important threats, the security team avoids wasting time on
solving less significant problems.
Better use of resources: Vulnerability prioritization allows organizations to use their
resources more intelligently. Whether referring to security professionals or vulnerability
scanners, companies can invest in useful resources without worrying about wasting time
and money addressing minor threats.
Lack of Best Practices
Each tetwork and running service rtype equires best practices to be followed while
planning, deploying, and functioning. These best practices help the administrator to
control and monitor the network and running services with ease. Best practices for
wired networks may differ from the recommendations suggested for wireless networks.
Similarly, applications and software services running on different operating systems and
servers are recommended with different best practices. Several worldwide standard
organizations manage and govern standards and policies for organizations providing
services across the globe. These best practices are based on past experiences and
consider disclosed vulnerabilities detected threats and industry experts'
recommendations.
Appropriate Solutions/Recommendations
Vulnerabilities
to
Remediate
the
Discovered
The following are five recommendations for implementing controls that will help
organizations maintain a regularly configured environment that is secure against known
vulnerabilities.
420
Chapter 04: Operation and Incident Response
Threat Monitoring Process
Your security staff must stay up to date on these risks. They accomplish this by
examining vendor notifications of threats, patches, and system updates and receiving
information from US CERT, which is always up to current with the most recent
information. Vulnerability remediation management must address any dangers
discovered by the team.
Regularly assess your vulnerability
This is not something you do once and never think about again. Because the evaluation
is merely a snapshot of your position at a certain point in time, it can alter if new
vulnerabilities are discovered. As a result, you must ensure that you create a structured
program with clearly defined roles and duties that focus on developing and maintaining
good performance.
Set up and stick to a set of baseline setups
Using documented configurations and applicable standards, standardize the
configuration of similar technology assets inside your firm. Your security team must
document all baseline configurations in your environment, keep these documents up to
date, and ensure that they are integrated into your system build process and enforced
throughout.
Remediate vulnerabilities
This is the process of assessing the vulnerabilities you have discovered, assigning risk to
them, preparing responses to them, and then logging any activities taken to mitigate
the vulnerabilities you have discovered. Finding flaws and doing nothing about them is
pointless and leaves your company vulnerable to a variety of attacks.
Patch vulnerabilities
Vulnerability and patch management is best handled in the following manner:




You must have processes in place to discover and confirm vulnerabilities utilizing
relevant tools and services that will help you detect suspected or confirmed
threats to your organization.
The next step is to examine your findings in order to comprehend the hazards
fully. How can you put the right measures in place to cope with them if you do
not have a true understanding?
After you have completed your analysis, you will be required to address the
issues.
Once you have put your "repair" in place, you will be required to rescan or retest
it to make sure the effectiveness.
SIEM DashBoard
421
Chapter 04: Operation and Incident Response
SIEM stands for Security Information and Event Management. This is usually a logging
information device from any different resources on the network and consolidating all of
those logs back to one single reporting tool. SIEM allows you to analyze the data to
create security alerts and real-time information about what is happening on the network
right now since you can collect all the information and aggregate it into a single place
and create long-term storage to easily create some extensive reports over a long period
of time.
Figure 4-15: SIEM Dashboard
Sensors
A SIEM can collect data from a variety of sources. You can collect the log files for a
particular operating system, such as Windows or Linux, and have them forwarded to a
central SIEM database. Switches, routers, firewalls, and other devices all have log files.
You can also use third-party sensors that follow the standards, such as NetFlow that
provide information about traffic flows across the network.
Sensitivity
It is almost overwhelming when you consolidate all of the information from so many
different devices into a single database and then read through the database to find the
information that you can use; therefore, it is important to use a SIEM to parse the data
and put the information into different categories (like information, urgent, warning,
etc.).
Trends
As all the gathered information over a very long time, you can see the change that
identifies the change over time. You can also see a spike whenever a particular security
event occurs, or network utilization is less than normal.
422
Chapter 04: Operation and Incident Response
Alerts
SIEM also features intelligence that can interpret the collected data, look for specifics,
and offer you proactive alarms and alerts. You could then use the data in the SIEM to
build reports and view additional information about the occurrence.
Correlation
You can also begin correlating different data types into a standard set of information.
For example, you can view the relationship between source and destination IP
addresses, user, source type, and other information gathered from the log files.
Log Files
Several devices connected to the networking infrastructure can provide you with
feedback about the things that may be occurring on the network. This includes switches,
routers, firewalls, VPN concentrators, and other devices.
An example is shown in Figure 4-15. This is a switch log file that contains information
about the interfaces. The switch's security information is also defined in this file. For 60
seconds, all TCP SYN traffic destined for the local system is immediately blocked. The
receiving logs may provide this type of information.
Figure 4-16: Log Files
Network
The log file may define the routing updates, authentication issues, and network security
issues in terms of networking information.
System
When you see the log files on the operating system, you will see extensive information
and must include the information about the operating system. The files and the
applications are running on that OS.
The information about the program configuration, the system, and forwarded events is
also included in the security events area of Windows. The operating system can keep an
eye out for security or authentication events and log everything. Because these
operating system log files contain so much data, you will need a way to filter it. Massive
events are kept in a log file on the event viewer. Fortunately, Event Viewer includes a
variety of options that allow you to filter the data in a variety of ways.
423
Chapter 04: Operation and Incident Response
Application
Many applications also keep their own log files. You will find the application log
information in the "Event Viewer” under application log-in windows. For Linux/macOS,
it is present under /var/log.
Security
The security log files provide detailed security-related information. You have many
devices that gather the security details to easily see what traffic flows have been allowed
or blocked through the network. You can also view any exploits that may have been
attempted.
You would see if any of the URL categories have been blocked by the firewall or proxy
or DNS sinkhole traffic, telling you what devices attempted to connect to a known
malicious location.
Most of the log and security details are created on the security devices connected to the
network, such as intrusion prevention systems, firewalls, or proxies. This can provide
detailed security information about every single traffic flow going through the network.
Firewall
The firewall logs can give information about traffic flows that may be allowed or
blocked. It also provides information on what IPv6 packets have been blocked on the
network. It also provides information on website access that has been denied.
Web
If you have a web server, you have an extensive log that defines exactly who is connected
to the website server and what pages they can view. It also defines the information
occurring, especially if someone is trying to access non-existent files or files associated
with known vulnerabilities.
DNS
A Domain Name Server can provide information about what queries have been made
against the DNS server. You can view the IP address of the request, and many log files
will store the fully qualified domain name for the request.
Since you have full control of your DNS server, you can block any attempts to resolve a
known malicious site. You can then use that list to identify the potentially infected
device, and then you can clean those devices and remove them to focus your network.
Authentication
The process of validation is called Authentication. TWhen a client requests a resource
request, thewebserver has to verify a user's identity in the authentication process This
way, user credentials are supplied, and the webserver validates them—the
424
Chapter 04: Operation and Incident Response
authentication attack targets and attempts to exploit the authentication process for the
user’s identity. Un-authenticated hackers can gain network access by exploiting these
vulnerabilities. Credentials of the user include name, user ID, and password to verify
the identity of a user. The system determines whether the credentials are rightly used.
The system authenticates user identity via login passwords in public and private
networks. A user’s identity is simply determined by what they know, what they have, or
what they are. The verification of at least two or all the three authentication factors is
essential for security. Authentication has different factors that include:
Single-factor Authentication
The simplest authentication method depends on a simple password. A system such as a
website or a network grants access using the verified credentials’ identity. Login
credentials are the most common examples of single-factor authentication for which
only a password and user name are required.
Two-factor Authentication
A two-step verification process requires a username, password, and something only the
user knows to guarantee tecurity such as an ATM pin. With an additional piece of
confidential information along with a username and password, any attempt to steal
valuable data becomes more difficult.
Multi-Factor Authentication
This authentication method uses two or more levels of security from the independent
categories of authentication to grant access to a system. The factors must be
independent of each other to remove any existing vulnerabilities in the system.
Multiple-factor authentication is used by banks, law enforcement agencies, and
financial organizations to protect their applications and data from threats.
The types of attacks that are considered authentication attacks are as follows:
Attack types
Brute Force
Attack description
Allows an intruder or attacker to predict a person's user name,
credit card number, password, or cryptographic key using an
automatic procedure of trial and error
Insufficient
Authentication
Allows an attacker to access a website comprising content that
is sensitive or functions without having to authenticate with
the website
Weak
Password Permits an intruder or attacker to access a website that offers
Recovery
them the ability to illegally obtain, change, or recover another
Validation
user's password
425
Chapter 04: Operation and Incident Response
Table 4-06: Authentication Attacks
Dump Files
The memory dump files are those that can create on-demand. You can take a single
application using task manager and Windows and create a dump file that will store
everything in memory associated with the application into a single file. This file is
normally created when working with technical support to resolve an application
problem and send that memory dump file to the developer to try to locate and resolve
that issue.
The dump files can be easily created from Windows Task Manager
VoIP and Call Managers
Although, most of the environments you are working in have moved from the
traditional plain old telephone system, running over analog phone lines to voiceover IP
and digital packets.
The call manager log includes the inbound and outbound call information and security
information.
Session Initiation Protocol (SIP) Traffic
Voiceover IP protocols, such as Session Initiation Protocol, can provide detailed log
information (SIP). It sets up the phone call and messages so that you can monitor the
call setup, management, and teardown. You will also be able to see information on
inbound and outbound traffic.
syslog/rsyslogs/syslog-ng
Syslog is a common way for transmitting log files from a single device to a centralized
database. This is built into the SIEM (Security Information and Event Manager). It is a
centralized log server that collects logs from all of the devices and consolidates them.
Journalctl
If you are managing the Linux operating system, there are many different logs available
on that device. Some of them are specific to the operating system itself, and some of the
logs are created by the demons running on the system or application.
There is a standard format for storing system logs on Linux in a special binary format.
This optimizes the storage area and allows to query the information very fast. However,
you are not able to see it with a text editor because of binary formatting.
Fortunately, Linux has a utility called “journalctl.” It allows to query information present
in the system journal and provide output on what may be present there.
nxlog
426
Chapter 04: Operation and Incident Response
nxLog is a multiplatform log collection and centralization solution that includes log
enrichment and forwarding capabilities.
nxLog may be used as a single tool to process all of the different types of logs that your
company generates. Various sources, such as files, databases, Unix domain sockets,
network connections, and other sources, can be used to collect logs.
Bandwidth monitors
One of the first statistics you want to gather from log files is information on the
bandwidth. This is a fundamental network statistic that shows the percentage of the
network that has been used over time. There are different ways to gather these metrics:
Simple Network Management Protocol (SNMP), NetFlow, sFlow, IPFIX, etc. You can
also use a protocol analyzer through the software agent that is running on a particular
device.
EXAM TIP: Bandwidth monitoring is always good to qualify that you have the
bandwidth available to transfer information for the application because if the
bandwidth has been exceeded and you are running out of the available space on the
network, then none of the applications will perform properly.
Metadata
Metadata is data that describe other types of data. It contains within the files that are
using on the device.
Email
If you send and receive an email, there is metadata within the email messages you
normally do not see. The information is present in the email message's header; the
information defines which servers are used to transfer the email from one point to
another.
Mobile
In terms of phones, there is an extensive amount of metadata that could be stored. For
example, if you take a picture or store video on the mobile device, it could be kept in
that metadata, the type of phone used to take a picture ,or the GPS location where the
picture was taken.
Web
If you are using a web browser to connect to the webserver, then metadata will be
transferred back and forth there.
For example, you could send your operating system information, the type of browser
you are using, and the IP address you are sending it from.
427
Chapter 04: Operation and Incident Response
File
You can store files or documents in Microsoft Office; you may find the metadata inside
that document that shows the name, address, contact number, title, and other
identifying information.
Netflow
NetFlow is a standardized way for collecting network information from switches,
routers, and other network devices. NetFlow data is frequently pooled into a single
NetFlow server, from which you may examine data from all of your devices through a
single administration console.
NetFlow is a well-known standard that makes it simple to collect data from devices
made by a variety of different manufacturers. Bring all of the data back to a single central
NetFlow server.
The NetFlow architecture is an architecture that separates the probe from the collector.
The architecture may have a different number of devices, such as individual NetFlow
probes or the NetFlow capability built into the network device that it is using.
These probes are either sitting inline within the network traffic or receiving a copy of
the network traffic, and all the other details are exported to a central NetFlow collector
where you can easily create different reports.
Figure 4-17: NetFlow
428
Chapter 04: Operation and Incident Response
sFlow
One of the difficulties with collecting network traffic and developing metrics based on
the discussions taking place on the network is that it can consume a lot of resources,
especially if you run a very high-speed network. Sampled Flow (sFlow) is used to balance
the available resources with the demand to examine more statistics on the network. This
allows viewing the selected portion of the network traffic to gather metrics.
Because of the lower resources required for sFlow, you can embed this capability in a
number of infrastructure devices.
IPFIX
IPFIX is the industry standard for exporting IP flow data. It is also regarded as a new
NetFlow version. It was made with NetFlow v9 in mind (version 9). This gives us more
freedom in terms of what data we gather and what information is sent to a centralized
server. The functionality is similar to the NetFlow, except you can customize exactly
what kind of data you receive from those collectors.
Protocol Analyzer Output
Protocol analyzers are commonly used to diagnose complex application problems since
they capture every bit of data from the network and explain what is happening across
those specific network channels.
Wireless networks and wide area networks can also benefit from the protocol analyzer.
This analyzer gives you precise information about unknown traffic, packet filtering, and
security control, as well as a plain-language description of the application data.
429
Chapter 04: Operation and Incident Response
Mind Map
Figure 4-18: Mind Map
Use of Mitigation Techniques or Controls to Secure an Environment
Reconfigure Endpoint Security Solution
Endpoints refer to the devices that are using day today to do the jobs. This includes a
desktop computer, laptops, tablets, smartphones, etc.
There are multiple ways available to exploit these devices. The endpoint is a critical
piece of security. These devices should be protected from malware, operating system,
or vulnerabilities. The IT security team is responsible for monitoring all these devices,
and they are constantly watching for alerts and alarms that can let them know when
something usually might be happening on the endpoint.
Application Whitelisting
One security control is to define that what applications are allowed or not allowed on a
particular endpoint. When the user downloads any software from a third-party website
and software has some malware, the IT security team can create a more secure and
stable environment. by providing control of the applications running on the endpoint
430
Chapter 04: Operation and Incident Response
One approach on how to implement this type of control is through the use of an
approved list. That means that the IT security team would create a list of approved
applications and allow them to run only that application on the endpoint.
Application Blacklisting
Another way to implement the control is to have a blocklist or deny list. The blocklist
contains the applications that are specifically be prevented from running on the
particular endpoint. This means that the users are allowed to install the application
unless that application is listed in the deny list. It is very common for anti-virus or antimalware to have their own deny list, and if the user tries to launch that application, the
anti-malware software will prevent that application from running.
Quarantine
If the endpoint security software recognizes an application that seems to have malicious
software, it can remove that from the system and place it into a quarantine area. This
can be a folder on the existing system where no applications are allowed to run.
Configuration Changes
Secure configuration refers to the security precautions taken when developing and
installing computers and network equipment in order to reduce cyber vulnerabilities.
One of the most prevalent security flaws that criminal hackers attempt to exploit is
security misconfigurations more than 96% of the time. Internal penetration tests
frequently meet a network or service misconfiguration, according to recent research
from Rapid 7.
Firewall rules
The latest generation of firewall allows you to allow or deny certain applications from
traversing the network. The firewall allows access to a Microsoft SQL Server application;
however, deny access to a web application. The firewall rules are most commonly used
to manage application flows and block dangerous applications.
Mobile Device Manager (MDM)
The Mobile Device Manager (MDM) can allow or deny access to mobile devices. The
MDM allows the IT security administrator to set policies on all of the mobile devices
and always protect the devices from malicious software.
Data Loss Prevention (DLP)
The DLP’s role is to identify and block the transfer of any personally identifiable
information. When someone is trying to transfer personal records, social security, or
anything that is sensitive, it could be blocked by DLP.
431
Chapter 04: Operation and Incident Response
Content Filter/URL Filter
The Uniform Resource Locator (URL) can be used as a security control. If anyone tries
to visit malicious sites, the URL can block access to that particular location. And, if
anyone is trying to access a known location, the URL will allow access to those sites as
well. Many of the URL filters can also be integrated with third-party blocklists. These
blocklists are constantly updated and can provide a real-time blocking of known
malicious sites.
Update or revoke certificates
A Certificate Revocation List, or CRL, is used to verify that a digital certificate is still
valid. Before connecting VPN tunnels, VPN appliances employ CRLs to check for invalid
certificates. The certificate is validated during phase 1 discussions when using digital
certificates with VPNs.
The appliance tries to retrieve a CRL via LDAP (Lightweight Directory Access Protocol)
or HTTP (Hypertext Transfer Protocol), which is defined inside the CA certificate if no
CRL has been loaded into the VPN. Many VPN appliances additionally let you choose
an address to which the CRL should be sent.
Isolation
The concept of isolation is one where you can move a device into an area with limited
or no access to other resources. Isolation is a key strategy, especially when trying to fight
with malicious software or software constantly trying to communicate back to a
command and control location.
The isolation concept is often used when someone is trying to connect to the network
and does not have the correct security posture on their device. Perhaps, they have not
updated to the latest antivirus signatures. Therefore, the devices will be put on a
separate remediation VLAN that would give them access to update the signature. Once
those signatures are updated, they are then allowed access to the rest of the network.
You can also implement process isolation. If you identify a process running on the
device that seems suspicious, you can disallow any access from that process to the rest
of the network. Therefore, the user will still be able to communicate using the normal
trusted applications.
Containment
Containment inhibits or logs harmful behaviors in an application that is constantly
changing based on containment criteria. Every application is executed in its own
sandbox, with only limited access to the operating system and other processes.
This means that if the computer is compromised with ransomware, the malware could
infect that specific program.
432
Chapter 04: Operation and Incident Response
The containment can be reactive because once some machine identifies ransomware,
you can change the security event, disable administrative shares, remote management,
local account access, and also change the local administrator password.
Segmentation
Network segmentation helps protect against data breaches, ransomware attacks, and
other cybersecurity threats. In a correctly segmented network, groups of end devices
such as servers and workstations have only the connectivity required for legitimate
business use. This limits the potential of ransomware to spread or an attacker pivot from
one system to another.
SOAR
SOAR stands for Security Orchestration, Automation, and Response (SOAR). SOAR
platforms are a set of security software solutions and applications that allow you to
browse and collect data from various sources. SOAR solutions then evaluate this
disparate data using a combination of human and machine learning to comprehend and
prioritize incident response actions.
An administrator can use SOAR to connect numerous third-party products and make
them function together. Runbooks serve as the foundation for the integration.
Runbooks
A runbook contains explicit instructions on how to do a certain task. It also includes
extensive instructions on how to reset a password, create a website certificate, and
backup application data, among other things.
Playbooks
Playbooks can be made by combining the runbooks. A playbook is a more detailed
description of what to do if a specific event occurs.
For example, if you want to recover from ransomware, you will need a playbook that
lays out all of the procedures you will need to do to get rid of the ransomware.
433
Chapter 04: Operation and Incident Response
Mind Map
Figure 4-19: Mind Map
The Key Aspect of Digital Forensics
Digital Forensics describes the process of collecting and protecting information that is
usually related to the same type of security event. This covers many different techniques
for gathering data across many types of digital devices. It also describes different
methods used for protecting that information once you have retrieved it.
Documentation/Evidence
RFC 3227 is the guideline for evidence collection and archiving. It is a great best practice
to get what is involved with the digital forensics process. This RFC describes three
phases for the digital forensics process the acquisition of data, the analysis of that data,
and reporting of that data.
Legal hold
Legal hold is a legal technique to prevent relevant information requested by legal
counsel. It describes what type of data needs to be preserved for later use. The data
434
Chapter 04: Operation and Incident Response
copied for this legal hold is often stored in a separate repository, and it is referred to as
Electronically Stored Information or ESI. These legal holds may ask for many different
kinds of information and many types of applications, and the information is stored for
a certain amount of time or maybe of indefinite hold.
When you receive the legal hold and have the responsibility to gather and maintain the
data, you will preserve all of the information.
Video
Another good source of information to gather is from video. Video can provide
information external to the computer and network.
For example, you can capture the screen information and other details around the
system that normally would not be captured through other means.
Admissibility
Not all data can be used in a legal environment, and the laws are different depending
on where you may be. The important part of the collected data is w set of standards that
aallowthe data to be used in the legal environment.
Legal authorization
If you are authorized to gather the information, the data itself is protected. In other, the
network administrator may complete the access to that data.
Procedures and tools
The correct tools are used the correct way. You should use the best practices for tools
and procedures that you follow.
Laboratories
If the laboratories use the data, the proper scientific principles should be used to analyze
the evidence.
Chain of Custody
To verify that no changes occur to the collected data, you require documentation that
maintains the integrity. This documentation is called a chain of custody.
It is common to have a catalog that labels and documents everything collected into a
central database. You can also use hashes during the collection process to easily verify
the data you are looking at is the same data that was collected.
Timelines of Sequence of Events
As time goes on, the important information is to document the time zone information
associated with the device that you are examining.
Timestamps
435
Chapter 04: Operation and Incident Response
Different file systems store timestamps differently.
FAT: If you are using the File Allocation Table file system, all of the timestamps are
stored in the local time on that file system.
NTFS: If the device was storing the information in a file system using NTFS, the
timestamps are stored in Greenwich Mean Time (GMT).
Time offset
The time offsets can be different depending on the operating system you are using, the
file system in place, or the device
Tags
Reports
When all the data is collected, there is a need to analyze and report exactly what
occurred during that security event. The report should start with a summary providing
a high-level overview of what occurred during the security event.
There should also be detailed documentation describing how the data was collected,
the analysis performed on that data, the inferences, and the conclusion gathered based
on that analysis.
Event Logs
Event logs provide a wealth of information because they store details about the
operating system, the security events, and the applications running in the operating
system.
Interviews
Interviews will allow you to ask questions and get information about what a person saw
when a particular security event occurred.
Acquisition
Order of Volatility
When collecting data from a system, one challenge you have when collecting data from
a system is that some of the data is more volatile than others. Certain data will be stored
on the system for an extended period of time, while other data may only be available for
a few minutes. Therefore, you need to start collecting the data with the information that
is more volatile and less volatile. The order of volatility is shown in Figures 4-20.
436
Chapter 04: Operation and Incident Response
Figure 4-20: Order of Volatility
Disk
There is a great deal of information stored on a system’s hard drive or SSD. If you want
to learn the best way to gather the information for forensics, the first step is to prepare
the drive to be imaged. You can power down the system so that nothing can be written
to that drive, and you can also easily remove the storage drive from the system.
After that, you will connect the drive to a device specifically designed for imaging. These
are the handling systems designed with the right protection so that nothing on that
drive can be altered. You will then copy all of the data on the drive.
Random-Access Memory (RAM)
The important source of data is the information in memory. This can be difficult to
gather, not only because the information changes constantly; however, capturing the
information from memory can change a portion of that memory.
There are also third-party tools available that can provide memory dump. They will take
everything in the system's active memory and copy it to a separate system or a separate
connected device.
You can also gather as much as you can from the memory because some of the
information is never written to a storage drive. The important data like browsing keys,
clipboard information, encryption keys, and command history may be found in
memory; however, they do not display on the storage drive itself.
Swap/pagefile
A swap or pagefile is a temporary storage region in current operating systems. These
pagefiles have slightly different operating systems depending on whatever operating
system you use.
437
Chapter 04: Operation and Incident Response
In many places, the swap drive is a section of the storage device that may be used to
swap data out of random access memory and free up space for other applications to run.
A piece of an application is contained in the swap. You can transfer an application that
is not currently in use to active memory and store it on a local drive temporarily. As a
result, the application should run smoothly.
Note: The swap also collects information from active RAM and contains data
comparable to the RAM dump.
OS
The files and data present on the operating systems can help to understand the security
events. The operating system also contains information like a number of logged-in
users, open ports on devices, currently running processes, and attached devices.
If you investigate the malware infection or ransomware installation, then the attached
devices from the operating system can provide important information during the
analysis.
Device
There are several tools available for collecting the same type of information from a
mobile device. There are capture methods available, that you could either use a backup
file that was previously made from that device, or you cannot directly be connected to
the device, usually over USB, and create a new image from the device.
Inside of the mobile device, you can easily find information about the phone call,
contact, text message, email data, images, movies, etc.
Firmware
With some security events, you may have noticed that the firmware of a device has been
modified. The firmware implementation is specific to the platforms. The attackers gain
access to the device and install the updated and hacked version of the firmware. Getting
access to the firmware may help understand how the device was exploited, the firmware
functionality, and the real-time data sent to and from the device.
Snapshot
When working with virtual machines, you can easily get details from the snapshot. The
snapshot is like an image of the virtual machine.
Taking the snapshots starts with the original image that will act as a full backup of the
system. It is common to then take subsequent snapshots of the virtual machine.
Especially when you change and update the VM due to any reason, you will be required
to take every updated snapshot.
438
Chapter 04: Operation and Incident Response
To restore the virtual machine from the snapshots, you will be required to use the
original snapshot with all the incremental snapshots (updated version).
Cache
The operating system and applications can speed themselves up through the use of a
cache. A cache is a temporary storage area designed to speed up the performance of an
application or an operating system.
There are many different kinds of cache, including CPU cache, disk cache, the cache for
a browser, and cache connected to the network.
The cache often contains very specialized data.
CPU cache – It contains all the data specified on the operation of a single CPU.
Browser cache – It only contains the URLs of the location visiting with some browser
page components, including text, images, etc.
The cache is usually writing information that was queried originally so that if the other
query was made that was identical, you can simply go to the cache instead of performing
the query against the original service.
Network
The network contains a wealth of information. You can see all of the different
connections made over the network.
The networks are useful for the inbound and outbound session with the device's
operating system and application traffic.
In large environments, extensive packet captures occurring, and storage of large
amounts of data is sent across the network. There might also be smaller packet captures
available on the security devices like firewalls, Intrusion Prevention System (IPS), etc.
Artifacts
The artifacts are the things stored in a log. It may be a flash memory, prefetch cache
files, information stored in the recycle bin, and the information that you are storing in
the browser.
Note: Bookmarks and log-in records are also considered artifacts.
On-Premises vs. Cloud
We have discussed the digital forensics process with devices that would be in the
possession. It can be a computer, laptop, mobile device, etc.
To perform digital forensics in the cloud, complexities are added concerning cloud
technologies. The technical challenges become wide as the devices are located in
another facility somewhere in the cloud. It is also very difficult to associate the cloud439
Chapter 04: Operation and Incident Response
based data to one specific user. As many people access the cloud-based service
simultaneously, picking out an individual’s piece of data adds extra complexities to the
forensics process.
The legal issues are also associated with cloud-based data, especially since the rules and
regulations around the data can be of different types due to your location in the world.
Right-to-Audit Clauses
Before you work to get access to cloud-based data for forensics purposes, it would be
valuable to have already created an agreement on how the data could be accessed.
Therefore, working for a cloud provider or a business partner will be very useful to
qualify how the data should be shared, and outsourcing would work.
The right to audit clauses in the agreement will permit knowing where the data is being
held, how the data is being accessed over the internet, and what security features may
be in place to protect the data.
As the initial contract with the cloud provider is being created, the right to clause can
be added to specify how to create a security audit of that data.
Regulatory/Jurisdiction
The technology behind cloud computing is evolving rapidly, and the legal system is
trying to make changes with the technology. That is why forensics professionals need
to work with the legal team. Very different regulations may bind the data in a different
jurisdiction.
In cloud-based applications, the data can be located in a completely different country.
In a particular case, the physical location of the data center may determine the legal
jurisdiction for that data.
Data Breach Notification Laws
Another concern is that notification laws associated with data breaches are called data
breach notification laws. Many states and countries have laws and regulations stating,
“if any consumer data happens to be breached, then the consumer must be informed of
that situation.
These notification laws can be different depending on the location of where the data
would be stored. If there is a cloud-based application, then the data will be storing
information from all countries into a single database, and a breach of that data may have
a broad impact on who gets notified.
The notification requirement varies depending on the geography. There may be rules
and regulations regarding the type of breached data, who needs to be notified if a breach
occurs, how quickly you get notify, etc.
440
Chapter 04: Operation and Incident Response
Integrity
Hashing
When you are collecting data for evidence, you want to be sure that nothing will change
with your collected information. One way to ensure this is to create a hash of that data.
This is a way to cryptographically verify that what you have collected will be exactly the
same as what you will examine later.
Checksums
A relatively simple integrity check can be done with checksum. This is commonly done
with network communication to ensure that the information you have sent from one
side of the network to the other has shown up without any type of corruption. This is
not designed to replace a hash. However, it provides a simple integrity check that may
be useful in certain situations.
Provenance
The source of the data is called provenance. This provides the documentation of where
this data originated. It is also useful to have a chain of custody for data handling. This
also provides an opportunity to take advantage of newer blockchain technologies that
can provide more detailed information tracking.
Preservation
It is very important when working with data as evidence that you can preserve the
information and verify that nothing has changed with the information while it has been
stored.
Additionally, you should manage the collection process from mobile devices. The live
collection of data becomes an important skill. Data is converted into an encrypted form,
making it difficult to collect after powering down.
The gathering of information requires the best practices to ensure the admissibility of
data legally. This will be useful, especially if the data will be used later for some reason.
E-discovery
There is a legal mechanism used to gather information called discovering. When this
mechanism applies to digital technologies, it is referred to as Electronic discovery (Ediscovery). This process gathers the data. Hence there is no need to examine or analyze
the information. For data, you are simply required to search from the list of information
that is being requested.
The process of E-discovery often works in conjunction with digital forensics. For
example, with E-discovery, you will obtain the storage drive and provide that to the
authorities. The authorities will then look for that drive and notice the information on
441
Chapter 04: Operation and Incident Response
that drive is smaller than expected. At that point, you will bring in some digital forensics
experts that can examine the drive and attempt to recover any data that have been
deleted.
Data recovery
Recovering missing processes can be a complex process. There is no single way to
recover the data. The recovery requires extensive training and expertise to find the best
way for data recovery.
The exact process of data recovery may be based on:




Deleted files on the drive
Hidden files
Hardware and software corruption
Damaged storage device
Non-repudiation
Non-repudiation is the process of proving the data integrity and the origin of data. With
this process, you know who sent the data; however, you have high confidence of exactly
who sent that information. This means that the only person who could have sent the
data is the original sender.
There are two ways to providing non-repudiation:
Message Authentication Code (MAC) – With MAC, the two parties that are
communicating back and forth are the two that can verify that non-repudiation.
Digital Signature – Anyone who has access to the public key of the person who wrote
the information can verify that they can use it.
EXAM TIP: With MAC, the two parties can verify non-repudiation. In contrast,
the non-repudiation can be publicly verified in the digital signature.
Strategic Intelligence/ CounterIntelligence (CI)
Gathering evidence can also be done by using strategies intelligence, also known as
counterintelligence. This is when you are focusing on the domain and gathering threat
information about that domain. This is useful when finding out business information,
geographic information, or details about a specific country.
You can also gather much of this information from threat reports that you crate
internally or information gathered from a third party. There might also be some other
data sources, especially with Open Source Intelligence (OSIT), that provide some
additional information as well.
442
Chapter 04: Operation and Incident Response
Strategies intelligence also helps to determine the threat landscape based on the trends.
If you are the subject of someone’s strategy intelligence, you may want to prevent that
intelligence from occurring, and instead, you should perform the strategy
counterintelligence. With CI, you could easily identify someone trying to gather
information and attempt to disrupt that process. CI also helps to gather threat
information on foreign intelligence operations.
Mind Map
Figure 4-21: Mind Map
443
Chapter 04: Operation and Incident Response
Practice Questions
1. Which of the following commands is used to determine the network adapter
information?
A. ipconfig
B. Nmap
C. hping
D. curl
2. Which of the following methods is used to gather the network statistics?
A. Metadata
B. Data Recovery
C. NetFlow
D. None of the above
3. Which of the following is a temporary storage area?
A. Swap
B. Firmware
C. Snapshot
D. Cache
4. Which of the following defines a set of security software solutions and applications to
browse and collect data from different sources?
A. Evidence
B. SOAR
C. E-Discovery
D. File manipulation
5. Which of the following has cryptographic libraries to perform hashing functions?
A. SSH
B. CLI
C. PowerShell
D. OpenSSL
6. Which of the following is the stateless protocol that ensures the binding of IP and MAC
addresses?
A. TCP
B. ARP
C. FTP
D. SMNP
444
Chapter 04: Operation and Incident Response
7. Which of the following allows and denies access to the mobile device?
A. MDM
B. DLP
C. URL Filter
D. All of the above
8. Which of the following is used to troubleshoot complex application problems?
A. Log Files
B. SIEM Dashboard
C. Protocol Analyzer Output
D. Metadata
9. Which of the following store an application that seems to have malicious software?
A. Application Whitelisting
B. Application Blacklisting
C. Cache
D. Quarantine
10. Which of the following is the legal mechanism to gather information from electronic
devices?
A. E-discovery
B. Data recovery
C. Non-repudiation
D. None of the above
11. How many ways are there to provide non-repudiation?
A. Three
B. Two
C. Four
D. Five
12. Which of the following allows to perform analysis of data for security alerts and realtime information?
A. SOAR
B. Acquisition
C. Forensics
D. SIEM
13. How many types of vulnerability assessment are there?
445
Chapter 04: Operation and Incident Response
A. Two
B. Four
C. Three
D. Five
14. Which of the following is a third-party editor tool that provides a raw representation
of dump files?
A. WinHex
B. FTK Imager
C. Autopsy
D. Memdump
15. Which of the following attack framework apply security techniques to block future
attacks?
A. Cyber Kill Chain
B. The Diamond Model of Intrusion
C. MITRE ATT&CK
D. None of the above
446
Chapter 05: Governance, Risk, and Compliance
Chapter 05: Governance, Risk, and Compliance
Introduction
The Governance, Risk, and Compliance (GRC) is a combined collection of potentials
that allows the organizations and companies to reliably achieve ethical management,
minimizing the risk of failures and ensuring the organization is complying with state
requirements.
GRC Concepts
Governance
The governance is about how an organization has to be run in an efficient and
responsible manner, and they report their policy to all stakeholders. Processes and goals
of the organization have to be aligned.
Compliance
Compliance is an integral part of GRC, which demonstrably meets the applicable rules
and regulations.
Risk
Identify all risks through risk management and register the related management
measures and then report on these.
Figure 5-01: GRC Concepts
Why GRC?
The importance of embedding GRC in an organization can have to do with whether the
organization wants to:

Steer performance
447
Chapter 05: Governance, Risk, and Compliance



Improve the quality of products and services
Prevent damage
The controlled and structured environment
Functions Supported by GRC
The different functions supported by the GRC platform are summarized in table 5-01.
Functions
Description
Vendor Management
It includes the vendor selection on a risk
basis with relationship management and
compliance monitoring
Policy Management
Defines the workflow and policy lifecycle
that can help to review, change, and
archive policies to authoritative sources
Risk & Compliance Management
Defines the workflow, reporting, analysis,
and remediation of risks that will help the
organizations to understand and deal with
risks
Business Continuity
Recovery Management
Plan/Disaster Integrate the functionality of Business
Continuity Plan and Disaster Recovery for
an organization to perform a Business
Impact Analysis to minimize the risk of
failures and improve the value of business
processes
The incident, Threat, and Vulnerability These
include
the
consolidate
Management
vulnerabilities and patch information from
the security intelligence providers to better
explore the vulnerability results
Asset Management
Handle the system, databases, applications,
and infrastructure assets to key the
business processes for better compliance,
business continuity, and disaster recovery
tasks
Table 5-01: Functions Supported by GRC
448
Chapter 05: Governance, Risk, and Compliance
Analyze Risks Associated with Cloud Infrastructure
A cloud-based system should be managed and approached as other outsourced
platforms, with the same types of concerns, risks, and audit/governance prerequisites
as an external hosting environment. Eventually, all risks related to a Cloud
infrastructure must be customized for their individual needs. Risks to consider include:





Policy and organization Risks
Loss of governance
Provider lock-in
Compliance challenges
Provider exit
Risk Assessment/Analysis
A major risk in a Cloud environment is the sanitization of data. In a traditional data
center, physical media can be destroyed to guarantee data destruction, which is not
possible in a Cloud environment, so concepts of overwriting and cryptographic erasure
are highly used. Data protection is the security of system images within a Cloud
environment. The images themselves are just files on a file system without any physical
partition of servers, shared with the possibility of malware being injected into an image
even when it is not running; their security becomes essential in a Cloud environment,
where the Cloud provider bears sole duty for assurance.
Cloud service providers have a generally huge innovation scale, which influences risk.
This one result relies upon the circumstance. considerations include:



Larger scale platforms require more technical skills to manage
Shifts control of technical risks toward the cloud service provider
Consolidation of Cloud and IT infrastructure leads to the consolidation of points
of failure.
Cloud Attack Vectors
In Cloud Computing, the following are the most common attacks used by an attacker
to extract sensitive information such as credentials or gain unauthorized access. Cloud
Computing Attacks include:








Service Hijacking using Social Engineering Attacks
Session Hijacking using XSS Attack
Domain Name System (DNS) Attack
SQL Injection Attack
Wrapping Attack
Service Hijacking using Network Sniffing
Session Hijacking using Session Riding
Side Channel Attack or Cross-guest VM Breaches
449
Chapter 05: Governance, Risk, and Compliance


Cryptanalysis
Dos / DDoS Attacks
Service Hijacking using Social Engineering Attacks
The attacker may try to guess the password using Social Engineering tactics.
Unauthorized access to sensitive information is gained as a result of social engineering
assaults, depending on the privilege level of the affected user.
Service Hijacking using Network Sniffing
Using Packet Sniffing tools by placing himself in the network, an attacker can capture
sensitive information such as passwords, session ID, cookies, and other web servicerelated information such as UDDI, SOAP, and WSDL
Session Hijacking using XSS Attack
By launching Cross-Site Scripting (XSS), the attacker can steal cookies by injecting
malicious code into the website.
Session Hijacking using Session Riding
Session hijacking is the goal of session riding. An attacker could take advantage of this
flaw by trying cross-site request forgery. By tracking the user to click on a malicious link,
the attacker exploits presently active sessions to execute requests such as data
alteration, data erasure, online transactions, and password change.
Domain Name System (DNS) Attacks
DNS poisoning, cybersquatting, domain hijacking, and domain snipping are examples
of DNS attacks. An attacker could try to fake by poisoning the DNS server or cache in
order to gain internal user credentials. Theft of the Cloud service domain name is known
as domain hijacking. Phishing scams can also lead to consumers being led to a bogus
website.
Side-Channel Attacks or Cross-Guest VM Breaches
Side-Channel Attacks or Cross-Guest VM Breach is an attack that requires the
deployment of a malicious virtual machine on the same host. For example, deploying a
malicious VM co-resident of the target VM will result in resource sharing. An attacker
can extract cryptographic keys. Similarly, the attacker can also exploit shared high-level
cache memory to launch side-channel attacks. A malicious insider or an attacker can do
the installation by impersonating a legitimate user.
Similarly, other attackers are also vulnerable to Cloud Computing, such as SQL Injection
attacks (injecting malicious SQL statements to extract information), Cryptanalysis
Attacks (weak or obsolete encryption), Wrapping attacks (duplicating the body of a
message), Denial-of-Service (DoS), and Distributed Denial-of-Service (DDoS) Attacks.
450
Chapter 05: Governance, Risk, and Compliance
Virtualization Rısks
Virtualization can expand the security of IT because it is easier to set up the correct
network access controls between machines.
A Layered-based approach in virtualization also raises some risks that are not found in
the traditional server-based model. Compromising the hypervisor layer will also
compromise the hosted virtual machines because the hypervisor is an authoritative
layer over the hosts. As the hypervisor is hosting all the VMs on it, it is a single point of
failure resulting in a denial of services. Any unauthorized access to the hypervisor can
result in operational changes, access restrictions, service hijacking, and much more.
Similarly, installation of obsolete or unpatched, or pre-configured virtual machines can
also increase the risk in a virtual environment. Additionally, some virtual environments
are over-allocated, resulting in an exhaust of resources.
Another risk of server virtualization is called “Resource Abuse,” where one guest (or
tenant) is over-using the physical resources, in this manner keeping alternate guests of
the resources required to run their workloads. This is also called the “noisy neighbor”
issue. The hypervisor may have the capacity to limit the over usage of a guest, but the
administrator must consider restricting a large number of visitors on a single host. Few
guests mean you are not saving money sufficiently.

Numerous guests mean you risk performance issues.
With virtual servers, it becomes easy to clone, replicate, snapshot, and stop images.
However, there are benefits of using virtual servers, with a probability of new risks. It
can prompt enormous sprawl or proliferation of server images that need to be stored
somewhere. This can become difficult to manage, and it represents a security risk.
Counter-Measure Strategies
Cloud computing faces the same difficulties as other networks and infrastructures that
use the internet; there are numerous ways in which counter-measures can avert the
risks and threats that are manageable against cloud security.
There are various counter-measures that can be executed in the cloud infrastructure.
These include:







Access Management
Centralized Directory
Role-based Access Control
Privileged User and Access Management
User Access Certifications
Identity and Access Reporting
Separation of Duties
451
Chapter 05: Governance, Risk, and Compliance
Other counter-measures are conventional in order to prevent the use of attacks that
include better techniques for transforming sensitive data over public cloud
deployments. More significantly, cloud servers need improved data portability and
protection from external threats. This includes creating an identity and access
management guidance. Encryption should be increasingly unique and secure to protect
files and other user data. Better encryptions permit better methods in storage,
provisions for security, acquisitions of data, and information from service providers and
vendors that support regulations, dimensions, and opportunities in the cloud.
Cloud environments are of high availability in nature with redundancy, rapid elasticity,
and auto-scaling. This architectural plan makes the maintenance, patching, and
isolation of hosts in case of a conceivable security breach much easier because they can
be removed from production pools. It also allows for scanning, updating, and making
configuration changes without impacting the customer and users of a system or
application, consequently reducing this risk to availability.
Security Controls
In order to protect a sound security policy and overall governance, the cloud security
professional must concentrate on some different areas, as discussed in this section.
Physical and Environmental Protection
The word physical and environmental security refers to measures taken to ensure the
safety and security of infrastructure against natural disasters, environmental effects,
human attacks. While the access and technologies used with a cloud infrastructure offer
a single set of services to customers, covered it is all is a classic data center model. While
in most cases on a much larger scale. Because a cloud is a system that is accessible over
broad networking, such as the public Internet, physical protection should also extend
to those systems that are used to access the cloud.
The physical assets in the concrete data center include servers, physical racks, power
distribution units, cooling units, as well as real physical facilities and the auxiliary
systems located on the premises, for example, power conduits, battery backups, fuel
tanks, generators. Outside the Datacenter property, there are still further physical
devices and infrastructure that are essential to the cloud security professional. These
include the power and network conduits that the data center depends on, as well as the
endpoints of access for the users and customers, for example, workstation, laptops, and
mobile devices.
Examples of relevant controls based upon one or more regulations:

Procedures and policies recognized for maintaining safe and secure working
environments; including, offices, facilities, rooms, and secure areas
452
Chapter 05: Governance, Risk, and Compliance


Restricted physical access of users and support personnel to information assets
and functions
Physical security perimeters such as fences, guards, barriers, walls, and so on
Protecting Datacenter Facilities
Datacenters are essential to have a redundant, multi-layered way to deal with user
access control. Controls are requisite to be at the facilities level, the computer floor level,
and at the data center/facility staff level to guard against risk.
System and Communication Protection
Cloud computer run on physical systems that use services need protection. A number
of these services are:







Hypervisor
Volume Management
Storage Controller
IP Address Management
Identity Service
VM Image Service
Management Databases
Other factors to consider for system and communication security include:



Detecting and logging of security events
Responsibilities of protecting the Cloud: Cloud provider is responsible for
underlying software and hardware regardless of the cloud service model.
Including knowing where the responsibility among cloud service providers and
cloud customers
Automation of configuration
Category of Security Control
The security controls are categorized at different levels:



Technical
Management
Operational
Technical – This category covers the access control that can authenticate onto different
resources present on the network. Additionally, it defines audit, accountability, system,
and communication protection.
Management – It includes managing different aspects of risk like security assessment,
how you provide authorization to different resources that exist in the network,
planning, risk management, service, system acquisition, program management, etc.
453
Chapter 05: Governance, Risk, and Compliance
Operational – This category is more important in terms of hardware and software
mechanisms that can be used to manage and protect the information and information
systems. It also defines how do you handle the changes that occur in configuration
management, how you can protect the resources physically, etc. In short, these controls
are designed, configured, implemented monitored at the technology level.
Types of Security Control
Deterrent Control
A Deterrent Control serves to inhibit the attacker by reducing the possibility of success
from the viewpoint of the attacker.
Preventive Control
Preventive Control refers to the prevention of specific action from occurring.
For example, Firewall
Detective Control
Detective Control helps to detect a physical security breach. It alerts the operator to
specific conditions and acts during an event.
Corrective Control
Corrective Control is an attempt to reduce the amount of damage and is used after an
event. For example, ‘Backup’ helps the rapid restoration of operation.
Compensating Control
To directly address the threat when there is no control available, one thing needed to
meet the requirement is ‘Compensating Control.’ For example, the ‘Fire suppression
System’ that do not stop fire damage but can limit fire damage.
Technical Control
When some form of technology is used to address the physical security issue, it is
referred to as a ‘Technical Control.’ For example, Biometrics.
Administrative Control
Limiting the security risks through policies and procedures is known as ‘Administrative
Control.’ For example: Giving instructions to a security guard.
Physical Control
Physical Control refers to restricting specific physical activity from occurring. For
example, Mantrap prevents tailgating. It basically restricts the accidental operating and
specific human interaction with a system.
454
Chapter 05: Governance, Risk, and Compliance
Mind Map
Figure 5-02: Mind Map
Importance of Applicable Regulations, Standards, or Frameworks that Impact
Organizational Security Posture.
The regulatory frameworks are the set of policies defined by the platform to meet the
regulatory requirements. These rules should be followed by organizations, businesses,
and companies to strengthen security, improve processes and capabilities.
EXAM TIP: The Language Understanding (LUIS) can work with text as well as with
audio for a single file cohesive result.
Regulations, Standards, and Legislation
455
Chapter 05: Governance, Risk, and Compliance
The regulations defined in the security system refer to the directives with information
that should be followed by the organizations and companies to protect their
information from cyberattacks like Denial of Service (DoS), unauthorized access, etc.
The standards are the things with guidelines and requirements for the product, services,
and system. The legislation is the set of rules defined by the cybersecurity administrative
to do any task. All systems are mandatory to follow them.
Some of the common cybersecurity regulations include:
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the biggest European Union
legislation giving ordinary people and precedented control over how your data is
collected, used, and forced companies to justify everything they do with it. It has a huge
effect on businesses outside the EU, including the US.
As everything moves their future towards the digital domain, the massive collection of
sensitive data requires strict and protected regulations from holding them.
Any type of data that can identify you with your name, contact details, username, IP
address, and location is required by the GDPR. The organizations will have to prove that
they have a lawful reason for holding the particular kind of data
Why is it needed?
Before smartphones, a massive amount of sensitive information was collected from the
sources like Google and Facebook. GDPR gives organizations guidelines on what they
can and cannot do with personal data. It also makes them gives users more clarity over
the kind of data being used and how companies will use it.
National, Territory, State Laws
Information security breaches in the past two decades necessitated the creation of new
legal and regulatory frameworks and changes to current legal and regulatory
frameworks to include security related to compliance needs across several countries.
Due to the worldwide nature of internet services, cross-border information interchange,
and electronic commerce services, the need to comply with regulatory and legislative
frameworks has expanded dynamically. The following are some key legal and legislative
phrases in the field of information security.
Legislative and Regulatory Compliance
The legal system that relies on common law is known as a common law legal system,
and it is based on court rulings. Common law is followed in countries such as the United
Kingdom, the United States, Canada, Australia, South Africa, India, Malaysia, Singapore,
and Hong Kong.
456
Chapter 05: Governance, Risk, and Compliance
In general, the common law establishes three categories:
1. Regulatory law: Administrative law is another name for it. It is concerned with
the rules and regulations of the government's administrative agencies. The
legislative statute, also known as statutory law, is a legal system established by
the legislative part of the government.
2. Criminal law: It is concerned with the breaking of government laws. A legal
system founded on religious beliefs is known as religious law—for example,
Islam, Hindu, and Christian laws.
3. Civil law: It deals with litigation brought by private individuals. Civil laws, in
contrast to common law, are a legal system based on codified law. Civil laws are
followed in countries such as France, Germany, and others.
Privacy Requirements in Compliance
Privacy is the protection of Personally Identifiable Information (PII) or Sensitive
Personal Information (SPI) that can be used to identify a person in context with a group
or individual.
National Institute of Standards and Technology (NIST)
The National Institute of Standards and Technology (NIST) is releasing guidance to
protect the privacy of Personally Identifiable Information (PII). Personally Identifiable
Information (PII) is defined as follows by NIST special publication 800-122:
1. Any information that can be used to find out the individual’s identity, such as his
name, social security number, date, and birthplace, or biometric records.
2. Any information which belongs to an individual, such as medical, educational,
financial, and employment information.
Privacy Laws
Privacy laws deal with protecting and preserving the rights of an individual’s privacy.
Privacy laws in the U.S include the following:



Health Insurance Portability and Accountability Act (HIPAA)
Financial Services Modernization Act (GLB), 15 U.S. Code: 6801-6810
Final Rule on Privacy of Consumer Financial Information, 16 Code of Federal
Regulations, Part 313
In the UK, they include the following:


Data Protection Act 1998 (United Kingdom)
Data Protection Directive (European Union)
457
Chapter 05: Governance, Risk, and Compliance
Legal & Regulatory Issues
Legal and regulatory issues will be bundled together with information compromise that
could result in civil or criminal liability for a company.
The issues listed below may have legal or regulatory ramifications.
Cyber Crime - Cybercrime refers to criminal activities carried out across
communication networks such as the Internet, telephone, radio, satellite, and mobile
networks.
Cyber Terrorism – It is a sort of cybercrime that targets computers and computer
networks, and it is usually premeditated. The main goal of these attacks could be to
injure people on the basis of social, ideological, religious, political, or other factors.
Cyber Stalking Cyber stalking is a sort of cybercrime in which the offender uses the
Internet and other electronic tools to harass or frighten the victim.
Information Warfare - Information warfare is a sort of cybercrime that aims to disrupt
adversaries, such as organizations and institutions, in order to obtain a competitive
advantage. False propaganda, for example, or web page defacement, to name a few
examples.
Denial-Of-Service (DoS) Attack or Distributed Denial-Of-Service (DDoS) - DoS /
DDoS attacks are cybercrimes where websites of any user's computer systems are made
inaccessible using multiple services request to overload the web and application servers.
Payment Card Industry Data Security Standards (PCI DSS)
To determine security controls, a variety of standards are available. PCI-DSS (Payment
Card Industry Data Security Standard) is an industry-specific security standard. Other
standards include OCTAVE®, ISO 17799/27002, and COBIT, which are more widely
used.
The Payment Card Industry Data Security Standard (PCI-DSS) is a multi-layered
security standard that includes requirements for security management, policies,
procedures, network architecture, software design, and other critical protective
measures. This widely adopted standard aims to assist enterprises in protecting
customer account data in a proactive manner. The Payment Card Industry Security
Standards Council produced the PCI-DSS security standard (PCI-SSC). American
Express, Discover, Master Card, Visa, and other credit card companies are represented
on the council. PCI-DSS aims to protect credit cards by forcing merchants who use them
to follow certain security precautions.
The core principles of PCI-DSS are:
458
Chapter 05: Governance, Risk, and Compliance






Build and Maintain a Secure Network and System
Protect Cardholder Data
Maintain a Vulnerability Management Program
Implement Strong Access Control Measures
Regularly Monitor and Test Networks
Maintain an Information Security Policy
Center for Internet Security (CIS)
The Center for Internet Security (CIS) is a major security control that guides the global
community in securing the internet. It is a non-profit organization that harnesses the
worldwide IT community's capacity to protect private and public enterprises from cyber
threats. Global standards and accepted best practices for safeguarding IT systems and
data from the most ubiquitous assaults are accessible controls and benchmarks. The
volunteer, a global community of IT experts, keeps these tried-and-true principles up to
date.
NIST Risk Management Framework
Managing and controlling the risk is one of the major goals of businesses, particularly
in the information security program. Risk management gives the vehicle for maintaining
the balance between resources, compliance, and security. Organizations should be able
to protect their information assets by establishing and creating an efficient risk
management program, considering the organization’s environment, threats, resources,
and sensitivity of its data.
The NIST Risk Management Framework (RMF) process is defined in NIST 800-37 r2
(Risk Management Framework for Information Systems and Organizations). It provides
a comprehensive, flexible, repeatable, and measurable 7-step process that any
organization can use to manage information security and privacy risk for organizations
and systems, as well as links to a suite of NIST standards and guidelines to aid in the
implementation of risk management programs to meet the Federal Information Security
Modernization Act's (FISMA) requirements
459
Chapter 05: Governance, Risk, and Compliance
Figure 5-03: The 7-Step Process of NIST RMF
The main purpose of each step required in the Risk Management Framework is
summarized in table 5-02.
Step #
Step name
Purpose
1.
Prepare
It holds all the essential activities to help prepare
all the levels that an organization required to
measure its security and privacy risk
2.
Category
The steps find all the disastrous effects in terms of
loss of confidentiality, integrity, availability of the
system, information processes, etc. It is also
responsible for informing the organizational risk
management processes and tasking about these
effects
3.
Select
It selects, documents, and pile up all the necessary
controls to safeguard the corresponding risk faced
by the system and organization
4.
Implement
This step implements all the necessary controls for
security and privacy
5.
Assess
This step is responsible for ensuring that all the
controls are implemented correctly, operating as
planned and create the desired results required to
460
Chapter 05: Governance, Risk, and Compliance
meet the security and privacy requirements for the
system and the organization
6.
Authorize
It provides the responsibility features if the
security and privacy risk based on the operation of
a system is allowed
7.
Monitor
It maintains the current situational information
regarding the security and privacy posture of the
system and organization to accept the risk
management based findings
Table 5-02: Purpose of Steps in RMF
EXAM TIP: The Risk Management Framework process can also be useful to the
new provisioning systems and technologies (e.g., IoT, control systems), etc.
NIST Cybersecurity Framework
Today, data is the most valuable asset, which is the reason why security has become the
highest priority-based agenda. The data breaches and security failures introduce risk
and require national and economic security. Therefore, the US issued an executive to
develop a Cybersecurity Framework to help reduce the cyber risk
Also, the NIST Cybersecurity Framework combines the industry standards with best
practices to help the systems and organizations manage and monitor their cybersecurity
risk (threats, vulnerabilities, and impacts). The designed framework also helps to reduce
the risks by utilizing the customized measures.
The usage of the Cybersecurity Framework is shown in Figure 5-02. According to the
information technology research company, the Cybersecurity Framework is used by
30% of the US organization because of its response and recovery feature against
cybersecurity incidents.
461
Chapter 05: Governance, Risk, and Compliance
Percentage of US Organzations
Cybersecuirty Framework Usage
2012
2015
2020
50
30
2
Years
Figure 5-04: Cybersecurity Framework Usage
Note: The NIST Cybersecurity Framework, which was launched in early 2014, was
created by the private sector and the US government. In the “Cybersecurity
Enhancement Act of 2014,” Congress confirmed this initiative as a NIST obligation.
According to the US Chamber of Commerce,
“The NIST Framework has proved that the designed framework has incorporated into
cybersecurity recommendations including auto manufacturers, the chemical industry,
communication, transportation, and corporate directors.”
Why Cybersecurity Framework (CSF)?
The Cybersecurity Framework will help organizations and systems better understand,
manage, and reduce their cybersecurity risks. It will assist in determining which
activities are most important to assure critical operations and service delivery in turn
that will help in prioritizing investments and maximize the impact of each spend money
on cybersecurity.
It shifts from compliance to action and specifies outcomes by providing a common
language to address cybersecurity risk management. It is especially helpful in
communicating inside, outside the organization that includes improving
communication awareness and among IT planning and operating units as well as senior
executives of organizations.
462
Chapter 05: Governance, Risk, and Compliance
The Cybersecurity Framework allows you to assess where you are now and where you
need to go. It may be adopted in stages or to varying degrees, making it more appealing
to businesses.
Built-in maturity models in the framework eliminate the need for extra maturity models
on top of the Cybersecurity Framework.
CSF Components
The NIST Cybersecurity Framework consists of three main components, namely:



Core implementation tiers
Framework profiles
Framework core
CSF Components
Core
implementation
tiers
Framework profiles
Framework core
Figure 5-05: CSF Components
Core implementation tiers – It explains how an organization manages cybersecurity
risk and the extent to which risk management methods display important features.
Framework profiles – The profiles are an organization's unique arrangements of
organizational requirements and goals, as well as an asset against the framework core's
covered outcomes.
Framework core – Assists organizations in monitoring and reducing their
Cybersecurity risks in a way that complements their existing Cybersecurity and risk
management processes.
International Standard Organization (ISO)
The International Organization for Standardization (ISO) is a global standard-setting
organization made up of representatives from various national standards bodies. The
organization, which was founded on the 23rd of February 1947, develops and publishes
international technical, industrial, and commercial standards.
463
Chapter 05: Governance, Risk, and Compliance
ISO 27001
As the risk associated with cyberattacks and data breaches continues to increase,
information security has become a critical issue for every business. An effective
approach should help defend against both external attacks and common internal threats
such as incidents breaches and human error.
The international standard ISO 27001 specifies the requirements for an Information
Security Management System (ISMS). Through risk management, this systematic
approach of people procedures and technology assists you in protecting and managing
all of your organization's information.
ISO 27002
The information technology security technique ISO 27002 relates to. It outlines
organizational information security standards and an information security management
code of practice for information security controls, including control selection,
implementation, and management while taking into account the organization's
information security risk environment (s).
It is intended for usage by companies that want to:



Select controls within the process of implementing an Information Security
Management System based on ISO 27001
Implement commonly accepted information security controls
Develop their own information security management guidelines
ISO 27701
The International Organization for Standardization (ISO) and International ElectroTechnical Commission (IEC) are organizations that globally develop and maintain their
standards. The ISO/IEC 2700 1:20 13 standard ensures that an information security
management system is implemented, maintained, and improved. This standard is a
revised edition (second) of ISO/ISE 27001:2005, which was first published in 2005. The
following major aspects of information security are covered by ISO/IEC 27001:2013:





Implementing and maintaining security requirements
Information security management processes
Assurance of cost-effective risk management
Status of information security management activities
Compliance with laws
ISO 31000
Organizational risk can have ramifications in terms of financial performance,
professional reputation, and environmental safety. As a result, efficiently managing risk
aids firms in operating smoothly in an uncertain environment.
464
Chapter 05: Governance, Risk, and Compliance
The ISO 31000 standard lays forth general concepts and standards for businesses to
follow when dealing with risks. Any organization, regardless of size, activity, or sector,
can use it. It can also assist organizations in increasing the possibility of meeting goals,
improving the identification of opportunities and threats, and effectively allocating and
using resources for risk management.
SSAE SOC
The teams that analyze the security procedures should be aware of the output and
reporting capabilities for the data. Any information that is of important consideration
must be reported to the management teams immediately so that they are alert of
possible risks or harm. Depending on their roles and responsibilities, the information
sent to management teams may move via several levels.
The kind of reports that must be used depends on the type of auditing that is being
done. A Service Organization Control (SOC) report is required by the American
Statement on Standards for Attestation Engagements (SSAE) 16 audit, for example.
There are two types of SOC1 reports:
SOC 1 Type 1
The findings of an audit, as well as the completeness and correctness of the documented
controls, systems, and facilities, are outlined in this report. Type 1 reports are concerned
with the systems of a service organization. It also includes reporting on the control's
adequacy for achieving the goal.
SOC 1 Type 2
The Type 1 report is included, as well as information on the effectiveness of the
procedures and controls in place for the near future. Type 2 reports are focused on the
systems of service organizations and include a report on whether the control is running
properly to fulfill its goal.
SOC 2
A SOC 2 audit examines a service organization's non-financial reporting controls in
relation to the Trust Services Criteria, which include the system's security, availability,
processing integrity, confidentiality, and privacy.
SOC 2 Type 1
The type 1 audit reports are placed in operation at a specified point in time.
SOC 2 Type 2
This type autotests the effectiveness of the controls over a period of time.
465
Chapter 05: Governance, Risk, and Compliance
SOC 3
This report includes general audit results as well as a certification level for datacenters.
These reports are for users or clients who require control security, process integrity and
confidentiality, and availability assurance. SOC3 reports can be freely exchanged and
publicized.
Cloud Security Alliance
The Cloud Security Alliance is a non-profit organization whose mission is to encourage
the implementation of best practices for providing security assurance in Cloud
Computing and educating people about how Cloud Computing may assist protect other
types of computing.
The Cloud Security Alliance (CSA) was founded in 2008, and its first product was
"Security Guidance for Critical Areas of Focus in Cloud Computing." In 2009, CSA
became a corporation in Nevada and received US Federal 501(c)(6) non-profit status.
Membership
The Cloud Security Alliance has a network of chapters worldwide that are separate legal
entities from the CSA but operate within guidelines set by the CSA.
Note: Individuals who are interested in cloud computing and have the experience to
assist in making it more secure receive a complimentary individual membership based
on a minimum level of participation.
CSA Cloud Controls Matrix (CCM)






Provides a fundamental security principle to guide Cloud vendors and to assist
prospective cloud customers in assessing the entire security risk of a cloud
provider.
The CSA CCM is aligned to the Cloud Security Alliance guidance in 13 domains.
Customized relationship to important industry security standards, guidelines,
and controls frameworks such as the ISACA COBIT, ISO 27001/27002, PCI, NIST,
Jericho Forum, and NERC CIP
CCM provides organizations with the needed structure, in detail and clarity, and
related information security tailored into the Cloud industry.
It provides operational risk management and standardized security and seeks to
normalize security expectations, cloud taxonomy, and terminology.
It has the following versions:
o Cloud Control Matrix v3.0.1
o Cloud Control Matrix v3
o Cloud Control Matrix v1.4
o Cloud Control Matrix v1.3
o Cloud Control Matrix v1.2
466
Chapter 05: Governance, Risk, and Compliance
o Cloud Control Matrix v1.1
o Cloud Control Matrix v1.0
CSA Reference Architecture
The Enterprise design is a technique and a collection of tools that alter security,
enterprise architects, and risk management professionals to leverage a standard set of
solutions that fulfill their common must be ready to assess wherever their internal IT
and cloud suppliers are in terms of security capabilities and to arrange a roadmap to
fulfill the protection wants of their business.
BUSINESS
OPERATION
SUPPORT
SERVICES
(BOSS)
INFORMATION
TECHNOLOGY
OPERATION &
SUPPORT (ITOS)
PRESENTATION
SERVICES
APPLICATION
SERVICES
SECURITY &
RISK
MANAGEMENT
INFORMATION
SERVICES
INFRASTRUCTURE
SERVICES
(SABSA)
(ITIL)
(TOGAF)
(Jericho)
Table 5-03: CSA Reference Architecture
Benchmarks/Secure Configuration Guides
When the operating systems, database servers, web servers, or other technologies are
installed, they are far away from the secure configuration. Systems with a default
configuration are not secure. Some guidelines are needed to keep everything safe and
secure.
Platform-Specific Guide
The platform-specific guide is the finest guide that comes from the manufacturer. This
guide includes all the essential principles regarding installation, configuration, and
sometimes operations as well.
1. Web Server
Web servers provide a link between clients and web pages. They are susceptible to
attacks as they are open to the internet. Therefore, the proper setting of external-facing
applications is the key to avoid unnecessary risk. For web servers, several reliable and
prescriptive sources of instruction are available to support administrators to properly
protect and secure the application.
Web Server Concepts
467
Chapter 05: Governance, Risk, and Compliance
A Web Server is a program that hosts websites based on both hardware and software. It
delivers files and other content on a website over Hypertext Transfer Protocol (HTTP).
As the use of the internet and intranet has increased, web services have become a major
part of the internet. They are used for delivering files, email communication, and other
purposes. Web servers support different types of application extensions, whereas all of
them support HTML for basic content delivery. Web servers can be differentiated by
security model, operating system, and other factors.
Open Source Web Server Architecture
Open source web server architecture is a web server model in which an open-source
web server is hosted on either a web server or a third-party host over the internet. The
most popular and widely used open-source web server are:





Apache HTTP Server
NGINX
Apache Tomcat
Lighttpd
Node
Figure 5-06: Open Source Web Server Architecture
IIS Web Server Architecture
468
Chapter 05: Governance, Risk, and Compliance
The Internet Information Services (IIS) service is a Windows-based request processing
architecture. IIS 7.x is the most recent version. Windows Process Activation Services
(WAS), Web Server Engine, and Integrated Request Processing Pipelines are all part of
the design. IIS contains multiple components that are responsible for several functions
such as listening to the request, managing processes, reading configuration files, etc.
Components of IIS
Components of IIS include:




Protocol Listener: Protocol listeners are responsible for receiving protocolspecific requests. They forward these requests to IIS for processing and then
return responses to requestors.
HTTP.sys: The HTTP protocol stack is a kernel-mode device driver that
implements the HTTP listener (HTTP.sys). HTTP.sys is in charge of listening for
HTTP requests, sending them to IIS for processing, and then providing the
results to client browsers.
World Wide Web Publishing Service (WWW Service)
Windows Process Activation Service (WAS)
In the previous version of IIS, World Wide Web Publishing Service (WWW Service)
handles the functionality, whereas in version 7 and later, WWW Service and WAS
service are used. These services run svchost.exe on the local system and share the same
binaries.
Figure 5-07: IIS Web Server Architecture
2. Operating System
469
Chapter 05: Governance, Risk, and Compliance
The operating system serves as the interface between the physical hardware and the
application. Configuration guide from all the significant operating system
manufacturers is available on the CIS platform.
3. Application Server
The application server resides between the back-end database and the webserver. It is
sometimes called Middleware. A proper configuration guide for application servers is
available at CIS and STIGs.
4. Network Infrastructure Device
Network infrastructure devices include routers, switches, firewalls, concentrators, and
any other devices that are required for the network to function effectively. Configuring
these devices correctly is difficult but vital because any failure can compromise the
security of the data being handled.
General Purpose Guide
CIS control is a first-rate general-purpose guide that comprises 20 common security
control sets. The framework maintained by the Center for Internet Security can be
found on this link: https://www.cisecurity.org/controls/
470
Chapter 05: Governance, Risk, and Compliance
Mind Map
Figure 5-08: Mind Map
Importance of Policies to Organizational Security
Policies
Policies can be documented and articulate in a formal manner the desired or required
systems and operations standards for any IT system or organization. They are crucial
for implementing an effective data security strategy. Typically, they act as the
connectors that hold many parts of the data security together across both technical and
non-technical elements. The failure to implement and utilizes policies in cloud-based
computing or non-cloud-based computing would likely become in different parts or
isolation of activities, efficiently operating as standalone and leading to multiple
duplication and limited standardization.
The policies designed for organizational security consist of several rules and procedures
that can be imposed by operations of an organization to protect and manage critical and
sensitive data.
471
Chapter 05: Governance, Risk, and Compliance
Personnel Security
Personnel security policies apply to those who work for the company, including
employees, contractors, consultants, and users.
The following policies are included in these policies:




Screening processes to validate security requirements
Understanding their security responsibilities
Understanding their suitability to security roles
Reducing the risk of theft, fraud, or the misuse of facilities
General Concepts
Acceptable Use Policies (AUPs)
The Acceptable Use Policies (AUPs) are those policies that describe the right usage of
the organization’s resources (like computers, the Internet, and Network). These policies
are described by the organization, as they should be concerned about any personal use
of these resources that do not serve the organization.
Job Rotation
Job rotation, also known as a rotation of duties or responsibilities, aids an organization
in reducing the risk of a single employee having too many rights. Rotation of
responsibilities simply means that no one individual performs important functions or
obligations for a long period of time. An accountant, for example, might move from
payroll to accounts payable, then accounts receivable. The major purpose of job rotation
is to reduce the amount of time that one individual spends on one task. This reduces
the possibility of mistakes or malevolent actions going undiscovered. Job rotation can
also be used to cross-train team members to reduce the impact of an unplanned
absence.
Mandatory Vacations
Mandatory vacations are a part of employee ship and a requirement in some
organizations. On mandatory vacations, the employees are required to take a vacation
for a certain period of time during the year.
In some organizations, employees are forced to take mandatory vacations, and in case
if they do not want to, the organization becomes cautious of the possibility of them
being involved in any illegal activity or fraud. Therefore, mandatory vacations, in some
way, helps the organization to discover illegal activities of employees. Thus, the policy
may prove to be a security protection mechanism at times.
472
Chapter 05: Governance, Risk, and Compliance
Separation of Duties
Implementing the separation of duties principle ensures that no one person can
complete all required tasks for a business process or function. Separation of duties is
also a part of the business policy. Separation of duties is divided into two types, i.e., Split
Knowledge and Dual Control. Split knowledge refers to the separation of duties in which
no single person has all the information needed to perform a specific task. Rather, it is
split into two arsons. It means that each person has half of a safe combination.
Another type is Dual Control that requires both persons to be present at the same time
for performing a specific task. Both persons have their secret keys. (they do not have to
disclose their secret keys with each other). Secure access will require both keys at a time.
Least Privilege
The least privilege is considered a significant principle in the management of the
account. The principle allows the user to have only the rights and permission that are
necessary for them to perform their task or accomplish their objective, and no extra
rights are given to the user. By limiting the access rights of objects (user, process, or
application), the administrator can also limit the cause of harm and malware.
Clean Desk
As one of the very effective business security policies, the Clean Desk policy enforces
that when an employee leaves their desk, it should be when the person leaves the desk,
it should be clean and clear, i.e., PC should be shut down properly, and no paperwork
should be left on the desk. In short, employees should clean their desks before leaving
the office, so no one can see any of their information. It is an efficient security policy for
the one who deals with sensitive data.
Background Checks
A background check is also called pre-employment screening. A background check is
performed by the organization to check if the person they are hiring is trustworthy and
verify if their provided information is authentic or not. This basically provides all the
necessary information to the HR members so that they can make the right decision.
Exit Interview
In terms of security, an exit interview can be a powerful tool for gathering information
when an employee leaves the organization. This also includes termination of all the
accounts and collection of mobile devices supplied to the employee at the time of hiring.
Non-Disclosure Agreement (NDA)
The purpose of the Non-Disclosure Agreement (NDA) is to protect confidential
information that is disclosed, shared, received, or exchanged with customers, suppliers,
473
Chapter 05: Governance, Risk, and Compliance
and other parties. Therefore, an NDA should be used when individuals or companies
enter:



Consulting Engagements
Service Agreements
Strategic Alliance
A person can either construct a free-standing confidentiality agreement, depending
on the circumstances. An NDA binds a recipient to keep secret information from
being revealed to a third party or the general public. The following are examples of
confidential information:







Business and marketing plans, strategies, and programs
Financial budgets, projections, and results
Employee or contractor list and records
Business methods, operating, and production procedures
Technical, engineering, scientific research, development, methodology, devices,
and processes
Trade secrets and unpublished patent applications
Software development tools and documentation
Social Media Analysis
Social media analytics is the process of tracking, collecting, and analyzing data from
social networks and media channels. With the right tools, you can easily analyze and
track the social performance of the products and companies,
On-Boarding
On-Boarding refers to the hiring of new personnel in the organization. For account
management, the administrator needs to have an agreement and AUC (Acceptable Use
Policy) to be signed by the onboarding member. After the agreement signing step, the
administrator creates an account of the new member and puts him in an appropriate
access control group according to their requirement.
Off-Boarding
Prior to on-boarding, off-boarding refers to the removal of personnel from the
organization or group, or team. When the member is off-boarded, some proper steps
should be followed by the administrator; that is, the off-boarding personnel’s account
should be disabled (not deleted), and they should be removed from the access group.
Perform Routine Audits
Routine Auditing allows the administrator to check or to assure that the account
policies are being followed by everyone. It means that the administrator will check the
validation of all the accounts of the users and ensure if all members are in their
474
Chapter 05: Governance, Risk, and Compliance
respective groups. Routine auditing is necessary because of the timely On-Boarding and
Off-Boarding of the members. Some audits are automatic that automatically generate a
list of alerts.
Auditing
Auditing can be categorized into two main types; one is Permission Auditing, and the
second is Usage Auditing.


Permission Auditing-Type of auditing to ensure that every user has legit
permission or only the permission they need. It also assures that all the users are
in a proper group.
Usage Auditing-Type of auditing to assure that all the resources are being used
correctly and to review how and where the files are being stored and if the system
is secure.
User Training
Users are fundamental elements in the security defense of an organization. Users also
serve as a significant reason behind vulnerabilities. Therefore, it is necessary to have a
strong security defense that can be achieved by enforcing user training programs for
guiding the users to recognize between safe and unsafe computing behavior.
Gamification
Gamification is the use of game mechanics and game thinking to have interactions with
users in finding issues and inspiring them by introducing parts of competition and
reward.
Capture the Flag
A cybersecurity capture the flag may be a team-based competition during which
participants use cybersecurity tools and techniques to search out hidden clues or “flags.”
The team that locates the foremost flags throughout the event wins. These events are
usually beginner-level and open to the public.
Phishing Campaigns
A phishing campaign is an associate email scam designed to steal personal info from
victims. Cybercriminals use phishing, the fallacious plan to acquire sensitive
information comparable to master card details and login credentials, by disguising as a
trustworthy organization or prestigious person in email communication.
Phishing
The Phishing process is a technique in which a fake email that looks like an authentic
email is sent to a target host. When the recipient opens the link, he is enticed to provide
information. Typically, readers are redirected to fake web pages that resemble an official
475
Chapter 05: Governance, Risk, and Compliance
website. Because of the resemblance, the user provides sensitive information to a fake
website believing that it is an official website.
Spear Phishing
Spear Phishing is a type of phishing that focuses on a target. This is a targeted phishing
attack on an individual. Spear phishing generates a higher response rate compared to a
random phishing attack.
SMS Phishing
SMS phishing, also called Smishing, is the act of sending a short message to try to gain
sensitive information or installing malware like Trojan without the user’s knowledge.
The malware captures and transmits all the stored data such as credit card numbers,
bank account details, and other data like username, password, and email account. SMS
phishing occurs when a cell phone receives an SMS from a fake person or entity. Thus,
a user can easily ignore an SMS phishing attack.
Voice Phishing
The words phishing and voice create an attack known as Vishing. Instead of using
traditional attacks, fishers use an internet telephone service (VoIP) where, even if you
do not answer the phone call, the attacker can leave a voice message provoking a
response. A phone call can be from someone pretending to be from a charitable
organization, debt collection department, or healthcare department, or it can be a call
telling you that you have won a prize and demand money to collect it. The attacker's
aim is to collect sensitive information such as bank details, so they can access your
account or steal your identity.
Whaling
Whaling is a targeted attack at the senior management of a company, such as the CFO,
CEO, or other executives who have full access to sensitive data. Attackers use formal
emails and websites to make the communication appear as legitimate as possible.

Phishing Simulation – Phishing simulations guarantee your workers will find
and avoid phishing or social engineering threats. These styles of interactive
phishing tests can be a region of any security awareness training initiative and
permit your organization to check user information with a real-world scenario.
Phishing simulations add a robust dimension to awareness campaigns and
facilitate the method of coaching your legion of cyber experts
Computer-Based Training
Computer-based training is an automated pre-built training that will be doing in the
time that you schedule into your computer. This training generally includes video,
476
Chapter 05: Governance, Risk, and Compliance
audio, Q&A, and some games. Instead of using the proper training room, it gives the
same training environment as other platforms provide.
Role-Based Training
Role-based Access Control (RBAC) governs how information on a system is accessed
based on the subject's role. Role-based or task-based access restrictions describe a
subject's capacity to access an object in terms of his or her role or assigned tasks. Groups
are frequently used to achieve (role-BAC). Users do not have discretion over which
groups of objects they are authorized to access, and they are unable to move objects to
other subjects, making RBAC a sort of non-discretionary access control. RBAC is widely
used in businesses and is considered an industry-standard practice.
A bank, for example, may employ loan officers, tellers, and managers. As illustrated in
Figure 5-09, administrators can create a group called Loan Officers, add the user
accounts of each loan officer to it, and then provide suitable privileges to the group. If
the company recruits a new loan officer, administrators simply add the new loan
officer's account to the Loan Officers group, and the new employee is given the same
permissions as the existing loan officers in the group. Tellers and managers would be
subjected to comparable procedures by administrators.
Figure 5-09: Role-Based Access Control
477
Chapter 05: Governance, Risk, and Compliance
Role-based Awareness Training
Data Owner
One of the roles for which the training is offered is “Data Owner.” This designated post
is of executive level and has the responsibilities of administrating data and application.
System Administrator
The system administrator is the one who administrates the operation of the system.,
The responsibilities of a system administrator include modifying product access
privileges for other members, changing the operational roles of members, and
inviting/removing members to/from an organization. An organization can have more
than one administrator.
System Owner
A system owner is the one who purchases the subscription. A system owner has all the
privileges, including buying, upgrading, downgrading, and canceling subscriptions.
Also, modifying product access privileges and removing/inviting members from/to an
organization comes under his authority.
User
The users are those who have the least privilege access to the applications. As the name
implies, the users are the application users. Users can be categorized into two types
which are as follows:

Privileged User
A user who has a higher level of rights and permission is known as a “Privilege User.”
This may be an area manager or the one who creates a report. Someone has permission
to do a wider range of tasks. A database administrator is also an example of a privileged
user who needs database function access but not to all servers or operating system
options.

Executive User
A user who is holding the responsibility of overall application use and operation. He is
responsible for making a decision related to the usage of data or
applications.
NDA
NDA stands for Non-Disclosure Agreement that is a standard document of a
corporation that sets the boundaries of information and secret material of the company.
This agreement is responsible for controlling the disclosure of any secret or confidential
information to an unauthorized person or party.
478
Chapter 05: Governance, Risk, and Compliance
On-boarding
An important element when on-boarding a workforce is to assure that the workforce
must understand and be aware of its responsibilities related to securing information and
assets of the company.
Continuing Education
Advancement in technology and security is a continuous process. Therefore, proper
training and education are required for retaining skilled personnel in security. To
modify the skill set of the security personnel, the “Continuing Education” programs help
a lot.
Adverse Actions
When employees break the rules or policies, they face disciplinary action. The following
are the two sorts of adverse actions:

Zero Tolerance
When staff breach the rules or do not follow the regulations correctly, they will be
treated with zero tolerance. One of the benefits of this move is that the company
maintains a code of conduct, which leads to improved performance. There is also a
downside to this action, that is, the organization may lose an outstanding long-term
employee due to a single mistake under strict rules.

Discretionary Action
Adverse issues are examined by adopting the rule that is “violation will be punished
through a variety of HR actions including termination.” This is more challenging for the
management of the organization to figure out the correct adverse action. This action
offers flexibility to the valuable workforce member who made uncharacteristic mistakes.
General Security Policies
Social Media Network/Application
In today’s world, where everyone is connected to each other socially, the organization
needs social media policies for security purposes that establish a balance between the
company’s requirements and social media.
These policies represent the company’s requirements and expectations (company’s code
of conduct). It is part of social media policy that the confidential information of the
company should not be shared on social media, and it is the personal responsibility of
each employee to put only the information on social media that the company approves.
Personal Email
The policies that are used for a business email account by the company are known as
Personal Email Policies. Some companies allow their corporate email account for both
479
Chapter 05: Governance, Risk, and Compliance
personal and business use. Typically, business email addresses are for official use only.
All the policies related to the use of a business email account must be documented
properly.
Diversity of Training Techniques
IT security strategies for any organization that involves multiple security technologies
and devices are commonly referred to as Defense in depth. Defense in depth is an
assortment of multiple devices and security technologies in order to strengthen
security.
Vendor Diversity
When you have multiple suppliers, it creates vendor diversity and reduces the risk from
a particular supplier. Relying on a single vendor increases the risk factor. For example,
if you have two firewalls from two different vendors, it reduces risk and adds diversity
because you can turn to the other firewall in case something happens to one firewall or
if the firewall contains flaws.
Control Diversity
Control diversity is also significant since it provides tiered security, which aids in the
production of the desired outcome.
Administrative Control
Administrative control is by all means necessary. Administrative control includes all the
policies and procedures that are required to be followed by everyone in order to
maintain security.
Technical Control
Technical control is also essential to ensure that the hardware and software we use are
hardened or not. Active Directory authentication, firewall, and disk encryption are all
parts of technical control.
Third-Party Risk Management
The risk management framework used by third parties is identical to the risk
management framework used by a business internally. A third-party contract ensures
cost-effective and impartial outcomes. Both the organization and the third party must
be prepared and understand their roles, responsibilities, and restrictions well. Both
sides can assure effective productivity if they work together. Confidential information
should only be shared with identified personnel by third parties.
Key Challenges in Third-Party Risk Management


Increases the complexity of third-party network & it is management
Risk of failure to manage regulatory compliances
480
Chapter 05: Governance, Risk, and Compliance



Additional Cost for monitoring third-parties
Lack of collaboration among parties
Risk of information/data leakage
Minimum security requirements
Before acquiring services, having any agreement, or starting any process with the third
party, the organization must have to evaluate the agreed criteria, capabilities, roles,
responsibilities, limitations, and risks of the third parties.



The third-party assessor must be certified in Information Security Management
System (in accordance with ISO/IEC 27001: 2005).
Third parties should be willing to comply with the organization’s security
policies & procedures.
Third parties should have certified personnel in information security areas
(organizations should check the accuracy of third-party assessor’s
qualifications).
Key Components of Third-Party Risk Management Framework
Following are the key components of the Third-Party Risk Management (TPRM)
Framework.










Planning & Processes Definition
Segmentation & Screening
Qualification
Security & Permissions
Workflows
Risk Mitigation
Continuous Monitoring
Reports & Dashboard
Centralized Repository
Alert & Notification
Vendors
If you are a part of the company, then you are certainly required to connect with thirdparty vendors. These could be people that are providing the payroll for the organization,
customer relationship management, email marketing, etc. In each one of these
relationships, the company’s data will be shared with a third party. You will be required
to use the cloud-based service for sharing purposes.
From the security perspective, the understanding of the risk associated with providing
the data to the third party is very important. For simplification, you can categorize the
481
Chapter 05: Governance, Risk, and Compliance
risk for each individual vendor and then apply the security policies and procedure that
helps to protect against the highest risk vendors.
Supply Chain
In September 2015, the researchers found that many Cisco routers were infected by a
malicious firmware called “SYNful Knock.” This malicious firmware allows the threat
actor to gain backdoor access to the infrastructure devices, which creates trust issues.
End users realized that they need vendors in the supply chain that they can trust, so
they know exactly where this hardware is coming from. They also need to check and
make sure that these very critical devices are not connected to the Internet before
security is in place. It is always useful to verify in some way that the hardware and the
firmware inside of that hardware are secure.
Supply-Chain Management
It is crucial for organizations to consider the implications of non-secure software
beyond their corporate boundaries. The ease with which software components with
uncertain development processes can be combined to produce new applications has
built a complex and highly dynamic software supply chain (API management).
We utilize software that is being developed by a third party or accessed with or through
third-party libraries to enable or create functionality without having a clear
understanding of the origins of the software. This typically leads to a situation where
there is complex and highly dynamic software interaction taking place between and
among more than one service and system within an organization and between
organizations via Cloud.
This supply chain provides agility in the rapid development of applications to meet
customer’s demands. Therefore, it is important to assess all codes and services for
accurate and secure functioning, no matter where they are sourced.
Business Partners
Your organization may have a third party that you have work with very closely as a
business partner. There may be a direct network connection between your corporate
network and the network on the business partner side. Because of this relatively open
path, there could be significant security concerns that have to be addressed.
During communication with business partners, it is often difficult to identify malicious
activity. This monitor this behavior, there are some policies required to use. These
defined policies focus on what best practices are required for the connection between
your organization and business partner. The policies also handle the data between the
organizations and also provide the way to how to deal with Intellectual Property (IP).
482
Chapter 05: Governance, Risk, and Compliance
Service Level Agreement (SLA)
A Service Level Agreement (SLA) is a contract between a company and a third-party
vendor. The SLA outlines performance expectations and, in many cases, contains
consequences if the vendor fails to satisfy them. Many businesses, for example, rent
servers using cloud-based services. A vendor offers access to the servers and ensures
that they are operational. An SLA can be used by the organization to specify availability,
such as with the fewest possible interruptions. Keep in mind that while working with
third parties, a company should have a thorough understanding of its expectations and
ensure that the SLA addresses these criteria.
Interoperability Agreement
To provide products and services, every organization needs to work with a third party.
It is important to make an agreement before handling sensitive data of your
organization to a third party. The question that arises is why an organization would
share its sensitive data with a third party. One reason might be that the organization
may need a third party that provides web hosting, firewall management, or payroll
services to your organization.
ISA
ISA stands for Interconnection Security Agreement. A type of agreement that takes
place between the organization and the interconnected IT system. The requirements of
the security that are associated with the interconnection are documented in the ISA
agreement. The document is detailed with all the legitimate plans of action about how
the connection will be established, maintained, and disconnected by the two parties.
MOU/MOA
A Memorandum of Understanding (MOU) is a contract that can be bilateral or
multilateral, meaning it is between two or more parties. It is a form of agreement
between two or more parties that includes a "series of desired actions" aimed at
achieving a common objective.
Measurement System Analysis (MSA)
Measurement System Analysis (MSA) can be a structured procedure that we have a
tendency to use to assess the flexibility of a measuring system to produce sensible
quality data.
Master Service Agreement (MSA)
The terms that an organization will employ for future work are defined in a Master
Services Agreement (MSA). This simplifies ongoing engagements and SOWs because
the overall MSA is referenced in the SOW, eliminating the need to renegotiate terms.
483
Chapter 05: Governance, Risk, and Compliance
MSAs are common when organizations anticipate working together over a period of
time or when a support contract is created.
Business Partnership Agreement (BPA)
A Partnership Agreement defines as a contract between one or a lot of businesses or
people who are selecting to run a business together. Usually, every member can rouse
the initial business contributions corresponding to capital, intellectual property, real
property, or producing area to secure their valuable assets from cyber-attacks.
Note: Partnership Agreements outline the initial contribution and future contributions
that are expected of the partners.
End of Life (EOL) System
An 'End of Life system' is one that no longer functions or performs as planned. End-oflife systems can be caused by a variety of factors, including a lack of vendor support or
incompatibility with other system features. Because the vendor no longer assists it with
patches and updates, this vulnerability makes the system easy to target for an attacker.
End of Support (EOS)
EOS happens once software system updates, patches, and different styles of support are
no longer offered, leading to software changing into liable to future security
vulnerabilities.
Data
Classification
Data classification aids in the implementation of appropriate and effective security
procedures and controls to effectively secure information assets. The primary goal of
data categorization is to define the level of confidentiality, integrity, and availability
protection that each type of dataset requires. It is not a smart approach to consider
confidentiality as the only part of data security without also classifying the data. Data
classification aids in defining the Confidentiality, Integrity, and Availability
requirements (CIA).
484
Chapter 05: Governance, Risk, and Compliance
Figure 5-10: Security, Functionality, & Usability Triangle
The Level of Security in a System is a measurement of the system's security,
functionality, and usability. The Security, Functionality, and Usability triangle refers to
these three elements. Consider a ball in this triangle; if the ball is centered, it means all
three components are stronger. On the other hand, if the ball is closer to security, it
means the system is consuming more resources for security and feature, function, and
Usability requires attention. A secure system must provide strong protection along with
offering all services, features, and usability to the user.
The simplicity with which a high level of security is implemented has a direct impact on
the level of functionality and usability. With a drop in performance, the system becomes
less user-friendly. When designing an application or deploying security in a system,
security specialists must ensure that the application is functional and easy to use. The
triangle's three components must be balanced.
Data Classification Procedures
The processes required for proper data classification are outlined below:
1. Define classification levels.
2. Identify the criteria that determine the classification of data.
3. Identify data owners who are responsible for classifying data.
4. Identify the data custodians who are responsible for maintaining data and its
security level.
5. Indicate the security controls or protection mechanisms required for each
classification level.
6. Document any exceptions to the previous classification issues.
7. Indicate the methods that can be used to transfer custody of the information to
a different data owner.
485
Chapter 05: Governance, Risk, and Compliance
8. Establish a mechanism for reviewing classification and ownership on a regular
basis. Notify the data custodian of any modifications.
9. Indicate procedures for declassifying the data.
10. Integrate these issues into the security-awareness program so all employees
understand how to handle data at different classification levels.
Classifications Levels
There are no set guidelines for categorizing data levels. Here are a few different levels
of data classification.
1. Data classification for commercial businesses.
2. Data classification for the military.
Each classification should have its own set of handling requirements and procedures for
accessing, using, and destroying data.
Classification
Definition
Public
Disclosure is not welcome, but it
would not cause an adverse
impact on the company or
personnel
Sensitive
It requires higher than the
normal assurance of accuracy
and completeness
Private
The personal information for use
within a company
Confidential
For use within the company
Unclassified
Data is not sensitive or classified
Sensitive but
classified
Secret
Minor secret
Top secret
If disclosed, it could cause
serious damage to national
security
If disclosed, it could be crucial
damage to national security
486
Example
Upcoming
projects
Application
Commercial
business
Financial
information
Commercial
business
Human
resource
information
Trade secrets
Programming
code
Recruiting
information
Medical data
Commercial
business
Commercial
business
Military
Military
Military
Deployment
Military
plans for troops.
Spy
satellite Military
information
Chapter 05: Governance, Risk, and Compliance
Espionage data
Table 5-04: Commercial Business and Military Data Classifications
Governance
Data governance is the capability inside a corporation to assist shield for top-quality
data throughout the lifecycle. Data integrity, data security, availability, and consistency
are all part of this. It also involves people, procedures, and technology that help to
change how information is handled within the organization.
Data in Media
The physical protection of equipment, as well as the security needs relating to the media
where the data is stored, are both addressed by assets retained in the form of digital
media.
Additional security procedures are required for storage media such as hard disks,
backup tapes, and CDs to ensure the security of the data they carry. Controls should
ensure that data is not disclosed or modified by an unauthorized person.
Consider the following controls for media security:

Storage controls are the most common way to secure data on storage mediums,
including hard disks, magnetic tapes, and CDs. Encrypted keys should be used
to protect this consideration. When backup media is stored offshore, further
security precautions are required.
 Maintenance is a process that is carried out on a regular basis to guarantee that
the data stored on the storage medium is not corrupted or damaged. Media
handling methods should be used to assure maintenance.
 Usage instructions should be provided properly to users and operators to
handle the media.
 Media usage should comply with the established policies and procedures.
 Formatting the media is used to destroy data. Formatting may not totally
remove all data in a single session. For total data deletion, some of the standards
recommend formatting the media seven times.
Data in Hardware
Stealing is one of the most common threats that need to be addressed for personal
computers, laptops, or media protection.
To avoid being stolen, the following controls should be considered:

Cable locks are used to physically secure PCs and laptop computers. These locks
prevent the computer or laptop from being detached and stolen.
487
Chapter 05: Governance, Risk, and Compliance

Port protection ensures that unauthorized workers cannot access media
sharing devices such as CD-ROMs, floppy drives, USB, Wi-Fi ports, printers, and
scanners. The goal of port protection is to prevent unauthorized users from
downloading and transferring confidential information on a portable medium.
 Switches are used to prevent a malicious user from powering on/off the systems.
 BIOS checks help in password protection during the boot-up process so that
access to the operating system is controlled.
 Encryption secures folders and data, preventing unauthorized access and
change. Information can also be shared using encryption techniques via an
unsafe communication connection.
Data with Personnel
The information in the minds of people, employees, managers, and other related
individuals should also be secured. It can be secured and protected by training the
individuals about the risk and impact of disclosure of any information on an
organization. Individuals should avoid discussing confidential or personally identifiable
information in public areas, social networking platforms, unofficial organizations, or
exchanging information through publicly available channels as part of their social
engineering awareness and countermeasures.
Credential Management System
When SSO is not available, a credential management system centralizes the handling
of credentials. These solutions often enhance the capability of a standard directory
service's default capabilities. A credential management system, for example, might
maintain account passwords automatically, even if the accounts are in a third-party,
public cloud, or an on-premises directory service. Users can frequently check out
accounts for administrative needs using credential management systems. To prevent
the un-authentication process, the management system encrypts the credentials.
Consider an example of a Credential Manager tool within a Windows system. Users
enter their credentials into the Credential Manager, and the operating system collects
them and submits them automatically as needed. Users enter the URL, login, and
password when utilizing this for a website. When the user visits the website later, the
Credential Manager knows the URL and immediately delivers the credentials.
An organization's risk level rises when it has multiple methods and unmanaged
applications. When a single credential management system is implemented, it usually
improves efficiency and security.
When it comes to credential security, credential management is required. Instead of
being stored on the client, the credential should be stored on the server. Also,
credentials should not be transferred over the network in clear text (they should be
encrypted).
488
Chapter 05: Governance, Risk, and Compliance
Credential Policies
We can use username, password, and other credentials as a critical part of our data
security strategy. Without the proper credential management, the data would be
accessible to anyone. It is remarkable then how often the implementation of passwords
might be on a system. On several occasions, run an application that stores the password
as part of the application. This is unquestionably not a secure method of credential
management. Rather, all of the credentials must be stored on the server.
Personnel
In terms of privacy perspective, everyone wants to log into the system securely with
their personnel accounts. This is an account that is not shared with anyone, and the
only person who could be logging in with this account is the single owner of that
account.
One of the important security policies associated with these user accounts is that the
user does not have privileged access to the operating system.
Third-Party
The third-party accounts use to log into the external system. This is common when
accessing cloud-based systems which do not require the authentication method to
access the database.
This type of account is required when someone is logging into the cloud platform for
payroll, enterprise resource planning, etc. The business partners or vendors that log into
the local computer system usually use this account.
Note: The third-party accounts used by someone outside of the organization and could
be connected to the network from anywhere on the internet. In both of these situations,
it is mandatory to use some additional security features like authentication.
Devices
Sometimes, we need to define some additional credential policies for mobile devices by
deploying device certificates. This will easily identify that the device is a trusted piece
of hardware and the one that has already been validated by the security team. All those
security standards are managed through the Mobile Device Manager (MDM). MDM
provides a uniform set of policies for all mobile devices.
Account Types
User Account - This is a type of account that is most common among users and
associated with a single person. It allows limited access to the operating system. Each
user is assigned a particular identification number by the user account. Multi-users can
use the same computer for accessing their resources only by using a User Account,
which also keeps each user’s data secure from another unauthorized user. This means
489
Chapter 05: Governance, Risk, and Compliance
that by using the User Account, multi-user can log in to the same computer and but
they can only access their own resources.
Shared Account - As the name suggests, this account can be used by more than one
person. For example, some operating systems allow the user to log in to a guest account
(Guest Login). The shared account is difficult to manage because it is hard to identify
the person logging in. If the password of the shared account is changed, then everyone
needs to be notified that the password is changed, and this brings complexity to the
management of the password. It is recommended to use a User account on the system
rather than Shared Account.
Service Account - The operating system or services of the operating system use an
internal account that is referred to as Service Account. It is used to run a database or
web server. Used only on the local computer, and no user can log in interactively.
Different types of access permission can be set up for various services when using
Service Account, which means database and web server rights may vary from each other.
Some of the services accounts require a username and password, and some do not.
Privileged Account - Also known as Root account or an administrator. Generally, these
accounts can access the complete operating system. If you have to install application or
device drivers or have to manage hardware, then you need to log in to Privileged
Account.
Organizational Policies
Change Management
One of the key processes on which to focus in for improvement is change management.
Changes during a product’s life cycle can cause a lot of chaos if not treated properly and
appropriately. Changes can interrupt the development, testing, and release of products.
An organization should have a change control process that includes documenting and
understanding a change before attempting to implement it.
Request Control
The request control provides an organized framework for users to request changes,
managers to do cost-benefit analyses, and developers to prioritize actions.
Change Control
The change control process is used by developers to regenerate the situation
encountered by the user and analyze the appropriate changes to fix the situation. It also
provides an organized framework within which multiple developers can create and test
a solution before moving into a production environment.
As we know, documentation is always needed when we make configuration changes in
the future. Therefore, these documents should be changed with the system changes. In
490
Chapter 05: Governance, Risk, and Compliance
this section, we will discuss documenting the reasons for the change, change requests,
approval processes, maintenance windows, notifications, and final documentation of
the changes.
Document Reason for a Change
Every change in a network should be properly documented. Although, it is not an easy
duty to update the document concerning any changes that occur in the network. For
this, many organizations hire people to perform the responsibility. Some use software
to update the track.
Change Request
A change should start its process as a change request. This request will move through
various stages of the approval process and should include certain parts of information
that will guide those tasked by approving or denying it.
Configuration Procedures
The particular steps required to implement the change and the particular devices
involved should be detailed. Complete documentation must be produced and
submitted with a formal report to the change management board.
Rollback Process
Change is always fraught with risk. Before any changes are made, strategies for reversing
the modifications and recovering from any negative consequences of the changes
should be in place. Before implementing the modifications, those making them must be
fully educated on the rollback methods and demonstrate a thorough grasp of the
changes.
Potential Impact
One of the advantages of going through this procedure is that it can indicate systems
that need to be watched more closely for their reaction to the change as it happens.
Notification
When all systems that may be affected by the change are identified, system owners
should be notified of all changes that could potentially affect them.
Approval Process
The actual approval process will depend on the organization. Some organizations may
approve with a verbal statement of the change, while others may require
documentation. The main factor is that the change should reflect the company's overall
goals regarding network connectivity, disaster recovery, fault tolerance, security, and so
on.
Maintenance Window
491
Chapter 05: Governance, Risk, and Compliance
During the execution of modifications, a maintenance window is the amount of time a
system will be offline or unavailable. All affected systems should be reviewed for their
criticality in supporting mission-critical operations before this window of time is
specified.
Authorized Downtime
When the time required to make the change has been compared to the maximum
allowable downtime, a system may suffer, and the optimum time for the change is
identified, and thus the authorized downtime can be specified. These amounts help
reach a final decision on when the change will be made.
Notification of Change
When the change has been completed and sufficient time has passed for issues to
manifest themselves, all affected members should be notified that the change is
complete. At that time, these affected members can continue to monitor the situation
for any residual problems.
Documentation
The procedure is not finished until all of the paperwork is completed. In this case, the
following items should be updated to reflect the network's current state:



Network configurations
Additions to network
Physical location changes
Release Control
Once the changes are finalized, they must go through the release control procedure to
be approved for release. Before deploying the new software to production, ensure that
any code included as a programming help during the change process, such as debugging
code and backdoors, is deleted.
Asset Management
A general approach to operational information security requires organizations to focus
on systems as well as the people, data, and media. Systems security is another vital
component of operational security, and there are specific controls that can greatly help
system security throughout the system's lifecycle. Asset management can be separated
into two categories, each of which is briefly detailed below:
Configuration Management
Basic configuration management is responsible for activities such as preventing
superfluous services, deleting unwanted programs, enabling security features like
492
Chapter 05: Governance, Risk, and Compliance
firewalls, antivirus, and intrusion detection and prevention systems, and establishing
security and audit logs.
Baselining - The process of obtaining a snapshot of the current system security
configuration is known as security baselining. Baselining is a simple way to capture the
current security configuration of a system, which can be incredibly useful for
responding to a possible security event.
Vulnerability Management - Vulnerability management refers to regularly identifying
vulnerabilities, evaluating vulnerabilities, and taking steps to mitigate risks associated
with vulnerabilities. It is not possible to eliminate all the risks; similarly, it is also not
possible to eliminate all the vulnerabilities. However, an effective vulnerability
management program helps an organization that ensures regular evaluating
vulnerabilities and mitigating the vulnerabilities that represent the greatest risks.
493
Chapter 05: Governance, Risk, and Compliance
Mind Map
Figure 5-11: Mind Map
Risk Management Processes and Concepts
Risk management can also be called the “Decision Making Process.” All the components
like threat assessment, risk assessment, and security implementation approach
arranged within the process of business management describe the risk management
494
Chapter 05: Governance, Risk, and Compliance
Threat Assessment
An organized interpretation of threat that encounters a firm is known as Threat
assessment. Threats cannot be changed; however, the way it affects can be changed.
Therefore, threats are necessary to figure out.
Environment
The Environment is one of the biggest sources of threat to the system. There is a variety
of sources that cause an environmental change like weather, storm, flood, lightning, etc.
These environmental changes disrupt the normal operation of the system and increase
risk. To overcome this situation, make the system resilient so that it mitigates the risk
sources and reduces impacts on the enterprise.
Manmade
As the name implies, manmade threats are those threats caused by the action of a
person. These threats are the result of both the adverse action of the attacker and
accidents by the users. Therefore, appropriate control against intended and unintended
actions is necessary to deal with the risk of the system.
Risk Types
The risk can define the identifiable assets that could be affected by an attack. Several
types of risk can define, identify the threats and expose the disruption of service.
External Threat
The risk can occur from the external side of an organization where a hacker group tries
to access the data or might be a former employee of an organization.
Internal Threat
The risk could also be presented inside the organization. It might be the employees who
are coming to work every day or any partner. Some disgruntled employees have access
to the internals of the network. They can easily use this access to create a security event.
Legacy Systems
If you do not pay attention to the assets of your network, then those assets could be
used against you. The legacy system normally runs the outdated operating systems, and
the manufacturer no longer supports older software that you might find in your
network.
There may be significant security concerns with the software that is running on those
systems. As these devices become older, it becomes more difficult and complex to find
security patches.
495
Chapter 05: Governance, Risk, and Compliance
Multi-party
Sometimes, security breaches may involve more than one entity. It could be your
organization, and many others are involved because all of your networks are connected
in the same way.
In May of this year, the American Medical Collection Agency was a prime illustration of
this. This company handled debt collection for a variety of companies, and they suffered
a data breach that affected 24 million people. This collection agency was in charge of 23
different healthcare groups. As a result, one data breach impacted 23 additional
companies, forcing them to notify their consumers that their information had been
exposed.
Intellectual Property (IP) Theft
IP theft can be significant if an organization has a lot of IPs, such as an idea, inventions,
and creative expressions. Third parties could gain access to the intellectual property
through no fault. It could be that people have a mistake in how they set up permissions
in the cloud, and all of that information is available to the world.
It is also possible that someone is actively hacking your system to find this Intellectual
Property (IP) or someone inside the company who has access.
Software Compliance/Licensing
Another risky area of concern is software compliance in the organization and how you
are handle the application licensing. You should purchase a proper license according to
your organization's requirements. The unneeded license in the organization creates
some hurdles, such as:



The operational risk with too few licenses
The financial risk with budgeting and over-allocated licenses
Legal risk if proper licensing is not followed
Risk Management Strategies
Acceptance
Risk can be accepted. Risk acceptance is the practice of accepting the specific risk,
typically based on an organizational decision that may also weigh the cost versus the
benefits of dealing with the risk in another way.
Avoidance
It is possible to escape danger. Risk avoidance is the process of devising a plan to avoid
the occurrence of the risk in the issue.
496
Chapter 05: Governance, Risk, and Compliance
Transference
It is possible to transfer risk. The activity of passing on risk to another entity, such as an
insurance company, is known as risk transfer.

Cybersecurity Insurance - Cybersecurity insurance is intended to mitigate
losses from a spread of cyber incidents, as well as knowledge breaches, business
interruption, and network damage.
Mitigation
The majority of the development approaches covered in the preceding section include
a way for performing a risk analysis of the current development cycle. When a risk has
been recognized, a strategy for mitigating that risk should be devised. Furthermore, it
can document causes of risk that might be ignored or not addressed during a certain
phase of the development process.
Risk Monitoring
Risk monitoring is a continuous process that tracks and evaluates the levels of risk in an
organization. Along with monitoring itself, the discipline tracks evaluate the
effectiveness of risk management strategies. The findings that are produced by risk
monitoring processes can be used to assist in creating new strategies and updating
previous strategies that may have proved to be ineffective.
The objective of risk monitoring is to constantly track the risks that occur and the
effectiveness of the responses that are implemented by an organization. Monitoring can
help to ascertain whether the suitable policies were adopted, whether new risks can now
be identified, or whether the old strategies to do with these risks are still valid.
Monitoring is most important because the risk is not static.
Analyze Risks Associated with Cloud Infrastructure
A cloud-based system should be managed and approached as other outsourced
platforms, with the same types of concerns, risks, and audit/governance prerequisites
as an external hosting environment. Eventually, all risks related to a Cloud
infrastructure must be customized for their individual needs. Risks to consider include:





Policy and Organization Risks
Loss of Governance
Provider Lock-in
Compliance challenges
Provider Exit
497
Chapter 05: Governance, Risk, and Compliance
Risk Register
The risk register is something that contains the list of all the risks linked with the system
and all the information regarding those risks; for example, their Types to arrange them,
Mitigation factor, Possibility of occurrence, Impact to a business, etc.
Risk Matrix/Heat Map
Risk must communicate in a straightforward and easy-to-understand manner. It may
also be necessary to share risk information with others outside the organization. The
organization must agree on a set of risk management KPIs in order to be successful.
Using a risk scorecard is recommended. The impact and probability of each risk are
assessed separately, and then the outcomes are joined to give an indication of exposure
using a five-level scale in each of these quantities:





Minimal
Low
Moderate
High
Maximum
This enables a clear and simple graphical representation of project risks.
Likelihood
Minimal
Low
Moderate High Critical
1
2
3
4
5
A (almost certain)
H
H
E
E
E
B (likely)
M
H
H
E
E
C (possible)
L
M
H
E
E
D (unlikely)
L
L
M
H
E
E (rare)
L
L
M
H
H
Table 5-05: Risk Scorecard
Note:
E = Extreme Risk: Immediate action required to mitigate the risk or decide if not to
proceed.
H = High Risk: Action must be taken to compensate for the risk.
M= Moderate Risk: Action must be taken to monitor the risk.
L = Low Risk: Routine acceptance of the risk
498
Chapter 05: Governance, Risk, and Compliance
Risk Control Assessment
After detecting and identifying the risk, a risk heat map will be created to identify how
this risk will affect the organization. After that, the cybersecurity requirement will be
created around the identified risk. You can also determine the gaps that may be in the
security posture; this can require a formal audit to have someone in every aspect of the
organization. After identifying the gaps, you can easily build the security control that
would fill in all those risky areas.
The risk control assessment also determines if existing controls are compliant or noncompliant.
Note: Make plans to bring all of the security systems into the compliant domain.
Risk Control Self-Assessment
In a smaller organization, you may be able to do a self-assessment to be able to find the
gaps in the security posture.
Risk Awareness
Risk awareness is like a constantly changing battlefield. There is a constant change with
the type of risk that you have to prepare for, and there is also a new risk that is emerging
all the time. The amount of information on existing and newer threats are almost
overwhelming, and it takes constant study to stay up to date allows you to manage the
defense.
Note: Understanding how to recognize the security risk events and protect against
them is the responsibility of individuals.
Inherent Risk
Inherent risk is the risk that exists in the absence of security control. This means that
when there is no external influence, the system will experience a certain amount of risk.
In some models that describe inherent risk, you would also include your existing
security controls.
Residual Risk
The reason a company implements counter-measures is to reduce its overall risk to an
acceptable level. As no system or environment is 100 percent secure, which means there
is always some risk left over to deal with. This is called residual risk.
The residual risk is the combination of inherent risk that exist and the effectiveness of
security controls. After combining, you can add a firewall to provide additional security
controls that will then allow calculating the residual risk. Some models of residual risk
include some additional security controls that would add on top of what is already
existing.
499
Chapter 05: Governance, Risk, and Compliance
Control Risk
Control risk, also called internal control risk, is when the current internal control cannot
detect or fail to protect against significant error.
Risk Appetite
The type or the amount of risk that an organization is prepared to pursue, take or retain
is called Risk Appetite. An organization's risk appetite is its willingness to tolerate risk
within the environment. If a company is highly risk-averse, it may choose to run scans
more regularly to reduce the period between when a vulnerability is discovered and
when it is discovered by a scan.
Regulations that Affect Risk Posture
There are several constant sets of threats that you have to keep track of. From an IT
perspective, there is an extensive number of regulations affecting cybersecurity. Many
of these regulations are associated with protecting someone’s critical, sensitive, and
financial information.
Several regulations describe the disclosure of information breaches.


HIPAA – Health Insurance Portability and Accountability Act is a board
regulation that covers many different areas. From the risk and security
perspective, it provides the privacy of patient records. The record includes the
information from other sources, storage requirements, network security, and
how to protect the information against threats.
GDPR – General Data Protection Regulation, European Union-based data
protection, and privacy regulation. It ensures that personal data must be
protected and managed for privacy.
Risk Assessment
The process of determining potential risk based on mathematical and statistical design
is called risk assessment. For measuring the risk assessment value, any of the methods
can be adopted by the user. A simple technique is to calculate ALE (Annualized Loss
Expectancy) that generates the financial value of impact, and its calculation starts with
the measurement of SLE (Single Loss Expectancy).
Risk Assessment Types
There are two main types of risk assessment.
Qualitative - To subjectively figure out the impact of an action which affects a business
or program is known as “Qualitative Risk Assessment. Experienced and expert
judgments are needed to perform this assessment.
500
Chapter 05: Governance, Risk, and Compliance
Risk Factor
Impact
Annualized Rate
of Occurrence
Cost of
Controls
Overall Risk
Legacy
Windows
Clients
Medium
Low
Medium
Low
Untrained Staff
High
Medium
High
Medium
No Anti-Virus
Software
Medium
Low
Medium
Low
Table 5-06: Qualitative Risk Assessment
Quantitative - To objectively figure out the impact of an action which affects a business
or program is known as “Quantitative Risk Assessment.” In order to perform this
assessment, the use of models and metrics are involved commonly.
Likelihood of Occurrence
The “Likelihood of Occurrence,” which can be quantitative or qualitative, is the
probability of a specific danger occurring. When qualitatively stated, the likelihood of
recurrence is usually described on an annual basis in order to compare it to other yearly
measurements. It is utilized to generate rank-order results if it is described
quantitatively.
Supply Chain Assessment
All the organizations are required to look at not only the risk linked to a system but the
risk enclosed in a system. The process of exploration and identification of these risks is
known as “Supply Chain Assessment.”
Impact
When an incident or risk occurs, it creates an impact on an organization. The impact
can be a financial gain or instability, reputational rise and fall, and much more.




Financial gain/loss
Variation in reputation
Unavailability
Degradation
Some IT systems are used in the healthcare industry. As a result, any system malfunction
can result in the victim's damage or death. This loss or injury to life is an issue that the
substitute will not be able to remedy. To avoid impact, it is therefore vital to ensure that
the system is very unnecessary.

Property
501
Chapter 05: Governance, Risk, and Compliance
Unmitigated risks result in property damage. Property damage to an organization’s
property or other’s property and environmental damage caused due to the toxic release
in an industrial setting are all those damages that are caused by IT security failure.

Safety
“Protection against risk, danger, or injury” is how safety is defined. Safety concerns (as
a result of failure) increase losses and can cause work interruptions. Because computers
are now involved in every part of business, they can have an impact on safety.

Finance
The final arbiter of all work is 'Finance,' which assists us in keeping track of a score.
Profit can be used to quantify gain, whereas unchecked threats can be used to assess the
loss. When consequences exceed the projected costs associated with the planned
residual risks, it becomes a problem and has a negative impact on earnings.

Reputation
One of the essential values in marketing is Reputation. Junky history or shoddy record
ruins the company’s reputation and costs the company in client base and revenue. For
example, nobody wants to give up personal information or contract with a bank with a
junky history
Asset Value
The amount of money that is required to equate the value of an asset is known as ‘’Asset
Value.’’ The term Asset Value is commonly used with the term exposure factor for the
determination of SLE.
Single Loss Expectancy (SLE)
SLE refers to the loss value that is expected from an event. The mathematical formula
for calculating SLE is as follows:
SLE = asset value × exposure factor
The determination of the amount of loss of a resource is called the Exposure factor, or
we can say it is a measurement of the risk level of an asset (how much it is at risk).
Asset=Resource
Annualized Loss Expectancy (ALE)
ALE is determined by multiplying SLE and ARO after SLE has been calculated; the
mathematical formula is as follows:
ALE= SLE * ARO
Where;
502
Chapter 05: Governance, Risk, and Compliance
ARO stands for Annualized Rate of Occurrence, and it refers to the period of time the
event is supposed to take place in a year.
Annualized Rate of Occurrence (ARO)
The ARO is the amount of time the event takes to occur in a year or less; it can also be
called “events frequency in a standard year.”
For example: If the event is taking place twice in 15 years, then the ARO is 2/15
Disaster
When talking about the risk of an organization, the disaster is also necessary to discuss.
There are different types of disaster can be possible when handling the security risk.
Environmental
The environmental disaster threats could be a tornado, hurricane, earthquake, or severe
weather.
Person-made
There are some person-made threats possible. This may include human intent,
negligence, or error. These types of threats could also include severe disasters like arson,
crime, civil disorder, fires, riots, etc.
Internal and External
The disaster types can also be categorized in terms of internal and external threats.
The internal threats tend to be from the employees present in the organization.
The external threats come from outside of the organization.
Business Impact Analysis
The process of determining the source and relative impact value of a risk element is
known as business impact analysis. It also refers to the document that outlines the
sources of risk as well as the procedures for mitigating them.
Recovery Time Objective (RTO)
RTO stands for Recovery Time Objective, and it is the objective time for resuming
operations after an incident has occurred, as the name implies. More efforts and
coordination are required for a shorter RTO. As a result, the costs are higher. This word
is frequently used in disaster recovery and business continuity activities.
Recovery Point Objective (RPO)
RPO stands for Recovery Point Objective, which is defined as the time period that
represents the maximum period of acceptable data loss. It determines the backup
503
Chapter 05: Governance, Risk, and Compliance
frequency essential for preventing unacceptable data loss. The RPO answers how much
data loss is affordable.
Mean Time to Repair (MTTR)
Mean Time to Repair is the time required to repair a given failure. Mathematically,
MTTR is formulated below:
MTBF = Σ (start of downtime – start of uptime) / number of failures
Availability is defined as the time in which the system performs its intended function.
Its mathematical formula is as follows, and it is defined in terms of percentage.
Availability = MTBF / (MTBF + MTTR)
Mean Time Between Failure (MTBF)
Mean Time Between Failure (MTBF) is a measure of a system's reliability, and its
expression describes the average time between failures. MTBF is defined
mathematically as the arithmetic means of system failures, which is written as:
MTBF = Σ (start of downtime – start of uptime) / number of failures
Functional Recovery Plans
All businesses must prepare processes to develop IT disaster recovery plans within the
event IT systems to ensure the continuity of the business. The recovery procedures
should aim at restoring data, applications, and hardware in time to fulfill the
requirements of the recovery of business functions.
Single Point of Failure
The Single point of failure is defined as any of the system’s components whose
breakdown or flaw could result in the entire system’s breakdown. For example:


Fine for a small firm
A single connection to the internet
Disaster Recovery (DR) and Business Continuity (BC)
Most organizations cannot afford to be unable to perform their business processes for a
very long period. The tolerable downtime can be measured in minutes, hours, or days,
depending on the unique company. In some noncritical sectors, days may be acceptable.
Consequently, the organization needs such a plan that process regardless of what
happens around us. As introduced in the previous chapter, business continuity is the
term used to describe the processes enacted by an organization to ensure that its vital
business processes remain unaffected or can be quickly restored by experiencing a
serious incident.
504
Chapter 05: Governance, Risk, and Compliance
Disaster Recovery Sites
When a disaster strikes, it is usually too late to begin the response method. As a result,
catastrophe recovery sites must be constructed. There are numerous choices for
constructing a disaster recovery site, including a hot site, a warm site, and a cold site.
Disaster Recovery Plan (DRP)
After a human-caused or natural disaster, a Disaster Recovery Plan (DRP) is the process
of regaining access to data, hardware, and software needed to continue crucial business
activities (such as storm, flood, tornado, etc.). DRP's major goal is to quickly restore or
recover essential parts or elements of the business following a disaster or other incident.
DRP is part of a larger process known as business continuity planning.
The below steps can be used to build a disaster recovery plan:




Plan for an unexpected scenario: Form a team, perform a Business Impact
Analysis (BIA) for your technologies, identify a budget and figure out which
business processes are mission-critical.
Review your technologies: Set the recovery time objective and recovery point
objective, develop a technology plan, review vendor support contracts, and
create or review disaster recovery plans.
Build the communication plan: Finalize who needs to be contacted, figure out
primary and alternative contact methods, and ensure that everybody can work,
possibly from a backup location.
Coordinate with external entities: Communicate with external units such as
the police department, government agencies, partner companies, and the
community.
Mission Essential Functions
The security squad can use the important mission function to correctly build up
defenses for securing systems and data in a way that corresponds to the related risk. It
also ensures that service will be restored.
Identification of Critical Systems
The identification of the critical system is used in continuity planning to figure out what
you need to protect as part of the plan. The first step would be to make a list of all the
critical systems and identify the different processes running inside an organization.
After that, list down all of the business processes, including the accountability system,
manufacturing application, VoIP. It is also important to associate the tangible and
intangible assets and resources with the business processes.
505
Chapter 05: Governance, Risk, and Compliance
Site Risk Assessment
Site risk assessments are the chance evaluations that have been adjusted to a particular
location ad as they contain important data for that specific extend. Site-specific risk
assessment takes into consideration the reallocation and sort of extending and address
as it were the important dangers.
MindMap
Figure 5-12: MindMap
Privacy and Sensitive Data Concepts in Relation to Security
This section of the chapter focuses on the data privacy and sensitivity of data in terms
of security.
Organizational consequences of privacy breaches
The organizational consequences of privacy breaches include:
506
Chapter 05: Governance, Risk, and Compliance
Reputation damage
During every step of the information life cycle, there is a potential for a data breach.
One consequence of the data breach is damage to one’s reputation. If the organization
is not trusted to store the data then, it could have a negative impact on how other
organization might view. Additionally, there is also a negative impact on the products
and services.
Identity theft
One of the major concerns is that the data can be used for identity theft and easily taking
advantage of other people’s private information. If the data gets into the hands of a third
party, then it is an organizational responsibility to have a public disclosure. This activity
will create some credit monitoring costs. This will constantly monitor your
organization’s data.
Fines
There are some fines and lawsuits associated with the data breach.


In 2016, the company “Uber” had a data breach and did not disclose it. Instead,
Uber contacted the hackers that originally stole the data and paid them $100,000.
There was a lawsuit settlement from Uber of about $148 million
In 2017, “Equifax” had a data breach when the US government fined them over
$700 million
IP Theft
In the form of Intellectual Property, many organizations contain data that they have
generated themselves (IP). If someone has access to these trade secrets, they may be
able to use them for their own gain, ultimately putting you out of business.
Notifications of Breaches
In many cases, the discovery of these data breaches occurs inside of the organization
initially.
Escalation
Internal Escalation Process


Breaches are often found by a technician
Provide a process for making those finding known
External Escalation Process


Know when to ask for assistance from external resources
Security experts can find and stop an active breach
Breaches
507
Chapter 05: Governance, Risk, and Compliance
A data breach exposes confidential, sensitive, or protected info to an unauthorized
associate person. The files in an information breach are viewed and/or shared without
permission.
Public Notification and Disclosure
Once the initial phase of the escalation process is over, the public of the data breach
needs to be informed. There are a number of security breach notification laws in almost
every geography, all 50 US states, the European Union, Australia, and almost every
country has laws regarding public disclosure. Normally, these disclosures occur
relatively. However, there may be times when criminal investigations are underway, and
it may be more important to keep that information private until the investigation is
over.
Data Types
Classification
The data can be classified into the following categories:









Public
Private
Sensitive
Confidential
Critical
Proprietary
Personally Identifiable Information (PII)
Health and financial information
Government and customer data
Public
Public data refers to the data with no restrictions. The data can be easily viewed from
any source, location, and region across the world.
Private
Private data is used to limit access to public data. This may require a Non-Disclosure
Agreement (NDA). The data are only available for internal use.
Sensitive
Sensitive data is that classified data that has to be protected and is inaccessible to
outsiders unless given specifically granted permission. The information will be in
physical or electronic form; however, sensitive data can be considered as personal
information or data.
Confidential
508
Chapter 05: Governance, Risk, and Compliance
Confidential data is very sensitive data that allow only certain people have approved
access.
Critical
Critical data is the information that organizations hold essential for success or data that
needs to be preserved for regulative purposes. For example, customer data.
Proprietary
Proprietary data is a type of sensitive data and is considered the personal property of an
organization. It can include trade secrets, passwords, or often unique data of an
organization.
Personally Identifiable Information (PII)
This type of data can be used to identify an individual with the name, date of birth,
biometric information, etc.
Health Information
Sensitive health information comes into the category of Protect Health Information
(PHI). It holds the health-related information associated with an individual—for
example, health care records, health status, payment, insurance, etc.
Financial Information
Financial information is the knowledge regarding the monetary transactions of an
individual or business. The information may include the records of a business's financial
situation. They embrace commonplace reports such as the balance sheet, financial gain
or profit, and loss statements, and income statements.
Government Data
The information holds all the records that are done by the government in terms of
policies, agreements, projects, budgets, etc.
Customer Data
Customer data includes the details about the customer with respect to certain activities
that have been done, like the name of the purchased product, pricing, discount,
customer’s biodata, location, etc.
Privacy Enhancing Technologies
The application developers may have techniques that they can use to help keep data
safe and secure. Different ways of enhancing privacy are available in the security
domain.
509
Chapter 05: Governance, Risk, and Compliance
Data minimization
One way to enhance privacy is through the use of data minimization. Whenever you
require data to perform some functions, you can use the data minimization technique.
This is included in many different regulations like HIPAA that has a “Minimum
Necessary” rule and GDPR.
These techniques also minimize some of the information like cell phone numbers or
addresses from the registration process and also limit the internal data required to
perform some organizational tasks.
Data masking
One way to protect data is to simply hide it. This is called data masking. It is a way to
obfuscate data in a way that shows data exists; however, it does not allow you to see any
of the portions of data. This technique is helpful in protecting your Personally
Identifiable Information (PII), financial details, or any other sensitive data.
The data masking process hides the data from the screen and displays only relevant
information. However, it does exist in its complete form in the database. This technique
also allows you to control what exactly you want to display on the screen by defining
certain policies and permissions.
EXAM TIP: There are multiple techniques available for data masking, such as
substituting, shuffling, encryption, masking out, etc.
Figure 5-13: Before Masking
510
Chapter 05: Governance, Risk, and Compliance
Figure 5-14: After Masking
Tokenization
Tokenization is the way of using personal data without using the actual data. This is
when we take sensitive data and replace it with a completely different bit of data (nonsensitive placeholder) that is called a token.
A token provides a way to store the data in the database according to the SSN token
number and display it on the screen with some other number. You can easily use
tokenization many times in a day like it is used in credit card processing.
EXAM TIP: Tokenization is the hashing technique, not an encryption technique.
There is no need to care about the processing, memory, CPU, and any other type of
overhead.
Figure 5-15: Tokenization
511
Chapter 05: Governance, Risk, and Compliance
Anonymization
Anonymization is the process of making it difficult to correlate anything with the
preserved data. You can anonymize data in a variety of ways, including hashing it to
make it unreadable or using masking techniques to replace actual data with asterisks.
You can even anonymize portions of the data while leaving the rest intact. This is
especially important if you wish to conduct some sort of analysis.
The fundamental disadvantage of anonymization is that it is impossible to return to the
original data. After the data has been anonymized, it is stored with the desired hashes
and masking techniques in the data.
Pseudo-anonymization
The Pseudo-anonymization technique replaces personal information with pseudonyms.
This technique can convert the data back to its original shape if you need to provide it
for other processes. There are different replacements available for data protection. You
can display the same names with different alphabets every time. This technique also
helps to maintain consistency. If you need to access some particular record, you might
have a consistent replacement for this.
EXAM TIP: Pseudo-anonymization is a data protection technique used to maintain
statistical relationships.
Roles and Resposnibilities
There are many people in an organization responsible for data. Some of them are a
technician that works at a very low level with the data. However, there are many
responsibilities in the management layer of the organization.
Data owners
At the management level, there is a data owner who is responsible for a certain set of
data. The accountability of the specific data is often handled and managed by the data
owner. The Vice President (VP) of sales owns the customer relationship data, or there
might be a treasure in charge of the financial information of the organization.
Data controllers
Separating the people who process the data from the people who control the data is a
good idea. The data controllers are in charge of the data's processing purposes and
methods.
512
Chapter 05: Governance, Risk, and Compliance
Data processor
The data processors are working on behalf of the data controllers, or sometimes this can
be a third party.
For example, the payroll process within an organization can be utilized by the payroll
department and payroll company. The payroll department would play a role as a data
controller and defines the payroll amount and timeframe whereas, the payroll company
would act as a data processor and processes payroll and stores employee information.
Data custodian/steward
Data custodian/steward is one of the additional data roles. This will be responsible for
the accuracy of the data, for keeping all the data privacy and security associated with
the data that is stored in the system. This may include a user or a group of users that
will identify or set labels associated with data. The user groups will also keep track of all
the laws and regulations associated with data so that the organization complies with all
of those roles. They are also responsible for implementing the security control for the
data and determine who has accessed that information.
Data Protection Officer (DPO)
Data Protection Officer is the higher-level manager who is responsible for the
organization’s overall data privacy policies. DPO will define the exact privacy policies
for the organization and implement the processes and procedures.
Information Lifecycle
The entire life cycle of the information consists of:
Creation and receipt
The life cycle of the information starts with the creation and receipt of the data that is
used inside the organization or received from a third party.
Distribution
After the data has been created or received, it needs to be processed. Commonly, you
would sort the data and store it in the appropriate area.
Use
After setting up and storing the data, the data will be ready to be used. The data will
probably use to make business decisions, create products and services.
Maintenance
With several data source, regular, constant monitoring and maintenance procedure is
required to retrieve the data and transfer it to other location.
513
Chapter 05: Governance, Risk, and Compliance
Disposition
When the data are successfully retrieved and transferred, you need to archive it or find
a secure way to dispose of the data.
Creation and
receipt
Disposition
Distribution
Maintenance
Use
Figure 5-16: Information Life Cycle
Privacy Impact Assessment
Privacy Impact Assessment (PIA) is an organized way of figuring out the gap between
the needed privacy act and the actual privacy act. PIA ensures the compliance of the
process and system with the existing laws and regulations. It analyzes how the PII
(Personally Identifiable Information) is gathered, secured, and used. All this
information is provided to the users in the written privacy statement.
Terms of Agreement
There are several areas where you may learn more about how a company handles data.
One of these is during the agreement's term. This is a legal agreement, and before
utilizing a service, a user must agree to these terms and conditions.
Privacy Notice/ Privacy Policy
Privacy notice or privacy policy is a separate document required on where the
organization happens to do business. This document also defines how the organization
is going to manage the data that you provided to them and also gives you options on
what you can do to help protect data, and you can contact that organization for more
information.
514
Chapter 05: Governance, Risk, and Compliance
Mind Map
Figure 2-17: Mind Map
Data Security and Privacy Practices
Data Destruction and Media Sanitization
It is important to destroy the data that is no longer in use because that data or
information can be discovered and used by criminals in malicious activities like identity
theft, social engineering, etc. Dumpster diving is used by criminals for this purpose
because its value is well known to criminals.
For every organization, it is vital to have effective demolition and destruction policies
and associated procedures. The following are some methods of data destruction and
media sanitization.
515
Chapter 05: Governance, Risk, and Compliance
Burning
A method of destruction, which is regarded as a gold method, is referred to as Burning.
The data/media is carried out in a form that can be demolished by the fire, and then it
is burned. This is the process that is irreversible and makes the data be lost permanently.
Shredding
Shredding, which is also referred to as physical destruction, is the method of splitting
things into small chunks and then mixed making the reassembling impossible or
difficult. Everything that might be advantageous to a criminal or dumpster diver should
be shredded.
Pulping
Puling is the process of recombining a paper into a new paper by suspending a paper
fiber in a liquid. Once the paper is shredded, the pulping process erases the ink by
bleaching, and then those shredded pieces are recombined into new paper. This way,
the layout of the old paper is completely destroyed.
Pulverizing
Breaking things by external force into unusable pieces (that cannot be reconstructed) is
known as Pulverizing, which is also referred to as ‘Physical Process of Destruction.’ Used
for hard disk drives like items. Encryption is the modern approach to pulverizing. In
this method, the owner encrypts the drive’s data and destroys the key. This process
makes the data non-recoverable depending on the strength of encryption.
Degaussing
The files on a magnetic storage device can be destroyed magnetically, i.e., using a
magnetic field; this method is known as degaussing. This is a safe technique for
degaussing the data or media. In this method, the magnetic particles got realigned by
discarding the organized format that displayed the data.
Purging
A process of discarding and erasing data from the storage zone permanently is known
as purging. A key expression that reflects the purging is “removing data,” which is
planned to clear up the storage zone for re-use—for example, Circular Buffer.
Wiping
Wiping is the technique of repeatedly rewriting the media in storage with a 1's and 0's
pattern series to remove all traces of the original data or media. Because it is a nondestructive procedure, it is suitable for the method. Depending on the level of data
protection, several data wiping techniques are available with different passes, such as 3,
7, or 35.
516
Chapter 05: Governance, Risk, and Compliance
Data Sensitivity Labelling and Handling
Confidential
A ‘Confidential’ labeled data on exposure to an illegitimate or unauthorized party leads
to severe harm to the corporation. The data is specified by the policy that covers detail
regarding who possesses the authority to issue the data. Software Codes, Trade Secrets,
and Product Design are all included in confidential data.
Private
A ‘Private’ labeled data on exposure to an illegitimate or unauthorized party leads to
disruption or harm to the corporation. Private data is commonly related to the personal
data that belongs to an individual or less often with the corporation. The damage level
related to the private data is less as compared to the confidential data but still
significant.
Public
A ‘Public’ labeled data can be viewed by the public and carries no protection in regards
to confidentiality. Nevertheless, protection is still required for its integrity. For example,
Press Releases, Public Web Pages, etc., are all examples of public data.
Proprietary
‘Proprietary’ is something that is owned and controlled by an individual or organization.
Therefore, proprietary data is something that is confined to a business for competitive
use.
Proprietary labeled data can be shared with a group of users other than a competitor,
and the label of proprietary is for alerting the group not to further share that proprietary
data. For protecting proprietary data, the laws of secrecy, copyright, patent are used.
PII
Personally Identifiable Information (PII) is a term that refers to data that can be used to
identify a person. It refers to the data needed to distinguish or detect an individual's
identification, such as a person's name in combination with one or more of the
following:



Social security number
Driving License number
Account number or credit card number or other identifying information that is
linked to a specific person
In other words, a set of data elements that leads to the identity of a specific individual.
PII is mostly used in online transactions. There always exists a possibility that it can be
517
Chapter 05: Governance, Risk, and Compliance
misused by any unauthorized person or miscreant. Therefore, it is necessary to protect
that personal information.
PHI
Protected Health Information (PHI) refers to an individual's health information, such
as a health care record, a payment for health treatment, insurance information, and any
other medical-care-related information. The Health Insurance Portability and
Accountability Act (HIPAA) protects personal health information.
Data Retention
Data retention refers to the storage of data logs. Another important characteristic of
data retention is to determine what data needs to be stored and for how long. Data is
retained for multiple purposes like a contractual obligation, accounting, and billing,
warranty history, etc. However, storing data for a long period of time may cause risks if
not maintained properly.
Legal and Compliance
Some of the data security and privacy actions are retained under legal requirements and
regulatory compliance. An organization must have to follow regulations and standards
to meet data security. Following are some general-sector specific regulations:



Federal Information Security Management Act (FISMA), U.S
Security of Network and Information Systems (NIS Directive), Europe
General Data Protection Regulation (GDPR), Europe
518
Chapter 05: Governance, Risk, and Compliance
Mind Map
Figure 5-18: Mind Map
519
Chapter 05: Governance, Risk, and Compliance
Practice Questions
1. What is the purpose of Governance, Risk, and Compliance?
A. Achieve Objectives
B. Address Uncertainty
C. Act with Integrity
D. All of the above
2. Which of the following privacy breaches create credit monitoring costs?
A. Fines
B. Identity Theft
C. Reputation Damage
D. None of the above
3. Which of the following provides the storage for data logs?
A. Data Retention
B. Data Roles
C. Governance
D. All of the above
4. How many roles and responsibilities are there at the management layer of the
organization?
A. Seven
B. Six
C. Five
D. Four
5. Which of the following assessment ensures the compliance of the process and system
with the existing laws and regulations?
A. Risk Assessment
B. Risk Control Assessment
C. Impact Assessment
D. Privacy Impact Assessment
6. How many categories are there for security control?
A. Four
520
Chapter 05: Governance, Risk, and Compliance
B. Three
C. Two
D. Five
7. Which of the following security control type helps to detect physical security breaches?
A. Detective
B. Technical
C. Preventive
D. Corrective
8. The information lifecycle consists of ___________ strategies.
A. Four
B. Three
C. Five
D. Two
9. Which of the following agreement is used to protect confidential information?
A. Non-Disclosure Agreement
B. Service Level Agreement
C. Business Partnership Agreement
D. Interoperability Agreement
10. Which of the following is responsible to rapidly recover the disaster?
A. Disaster Recovery Sites
B. Mission Essential Functions
C. Disaster Recovery Plans
D. Business Continuity
11. Which of the following defines the security policies concern with the people associated
with the organization?
A. Personnel Security
B. Privacy Policies
C. Role and Responsibilities
D. Organizational Policies
12. How many account types can be included in the credential policies?
521
Chapter 05: Governance, Risk, and Compliance
A. Four
B. Three
C. Two
D. Six
13. Which of the following is also called rotation of duties or rotation of responsibilities?
A. Separation of Duties
B. Social Media Analysis
C. Phishing
D. Job Rotation
14. An organized interpretation of threat that encounters a firm is called
_________________.
A. Risk Monitoring
B. Risk Assessment
C. Threat Assessment
D. Supply Chain Assessment
15. How many types of Risk assessment are there?
A. One
B. Two
C. Three
D. Four
522
Appendix A: Answers
Answers
Chapter 01: Threats, Attacks, and Vulnerabilities
1. Answer: B
Ethical Hackers always require legal permission.
2. Answer: B
Gray Box penetration testing is a sort of penetration testing in which the pentester has
very little prior knowledge of the system and no information about the targets.
3. Answer: C
White Hat Hackers always have legal permission to perform penetration testing against
a target system.
4. Answer: C
Hacktivists draw attention to the target to deliver a message or promote an agenda.
5. Answer: A
Script Kiddies have no or very low knowledge about hacking.
6. Answer: C
White Box testing requires complete knowledge of a target.
7. Answer: D
Suicide Hackers are those who aim for destruction without worrying about punishment.
8. Answer: B and C
Penetration testing is required in an environment to perform an audit, find
vulnerabilities, and exploit them to address them before an attacker reaches them.
9. Answer: B
Gray Hats are those who work for both offensively and defensively.
10. Answer: B
523
Appendix A: Answers
The process of finding, quantifying, and prioritizing (or ranking) the vulnerabilities in
a system is known as vulnerability assessment.
11. Answer: A
The Black Box is a sort of penetration testing in which the pentester is blind or doubleblind tested, meaning that the pentester has no prior knowledge of the system or
information about the target.
12. Answer: D
Vulnerability is a weak point or loophole in any system or network, which can be
exploited by an attacker.
13. Answer: C
A Directory Traversal Attack is a sort of attack in which an attacker attempts to enter
restricted directories by applying dots and slash sequences in a trial and error technique.
The attacker can divulge sensitive information about the system by accessing folders
outside the root directory.
14. Answer: B
An attacker sends a response splitting request to the server in an HTTP Response
Splitting Attack. An attacker can add the header response in this manner. As a result,
the response will be split into two parts by the server. The attacker controls the second
response, which is used to redirect the visitor to a malicious website.
15. Answer: A
Active and passive reconnaissance methods are also popular for gaining information
about the target, either directly or indirectly. This phase's ultimate purpose is to
maintain contact with the target in order to obtain information without being
recognized or warned.
16. Answer: A
Footprinting is basically the collection of every possible information regarding the
target and target network.
17. Answer: A
524
Appendix A: Answers
Social engineering is a psychological manipulation approach used in information
security. This approach is used to acquire information from persons who are interfering
with you either directly or indirectly.
18. Answer: A
Every possible combination of characters is computed for the hash to create a rainbow
table. When a rainbow table contains all possible pre-computed hashes, the attacker
captures the password hash of the target and compares it with the rainbow table.
19. Answer: D
Meterpreter is a popular backdoor of the Metasploit framework. It is used to create a
control channel for lateral access after a successful attack.
20. Answer: C
Salting a password is the process of adding an extra character to it to make it a one-way
function. The inclusion of characters makes it more difficult to reverse the hash of the
password. The primary benefit or function of password salting is to protect against
dictionary and pre-computed attacks.
21. Answer: B
Malware stands for Malicious Software and is an abbreviation for it. Malware is a blanket
term that covers a wide range of potentially harmful software. This malicious program
was created with the intent of getting access to target machines, stealing data, and
causing harm to the target system.
525
Appendix A: Answers
Chapter 02: Architecture and Design
1. Answer: A
Being the oldest and most widely used technique in the domain of cryptography,
Symmetric Ciphers use the same secret key for the encryption and decryption of data.
2. Answer: A
Being the oldest and most widely used technique in the domain of cryptography,
Symmetric Ciphers use the same secret key for the encryption and decryption of data.
The most widely used symmetric ciphers are AES and DES.
3. Answer: B
Stream Cipher is a type of symmetric-key cipher that encrypts the plain text one by one.
4. Answer: B
The process of identifying weaknesses in an environment is known as vulnerability
assessment. Among the vulnerabilities are misconfigurations, default configurations,
buffer overflows, operating system flaws, Open Services flaws, and other flaws. To scan
a network for vulnerabilities, network administrators and pentesters can use a variety
of tools.
5. Answer: A
Creating a Baseline is a pre-assessment phase of the vulnerability assessment life-cycle
in which the pentester or network administrator who is performing the assessment
identifies the nature of the corporate network, the applications, and services. The
pentester creates an inventory of all resources and assets, which helps to manage,
prioritize the assessment. Furthermore, they also map the infrastructure, learns about
the security controls, policies, and standards followed by the organization.
6. Answer: D
Wireshark is the most popular Network Protocol Analyzer tool in commercial,
governmental, non-profit, and educational environments. It is a free and open-source
tool that runs natively on Windows, Linux, MAC, BSD, Solaris, and other platforms.
7. Answer: D
526
Appendix A: Answers
Non-Electronic Attacks, also known as Nontechnical Attacks, are attacks that do not
necessitate any technical understanding or knowledge. Shoulder surfing, social
engineering, and dumpster diving can all be used to carry out this type of attack.
8. Answer: B
In Dictionary Attack, to perform password cracking, a password cracking application is
used along with a dictionary file. This dictionary file contains an entire dictionary or list
of known and common words to attempt password recovery. It is the most fundamental
type of password cracking. When systems use strong, unique, and alphanumeric
passwords, they are usually not vulnerable to dictionary attacks.
9. Answer: A
Brute Force Attack tries every possible combination of characters to recover the
password. Until the password is accepted, each combination pattern is tried. Brute
forcing is the most common and basic method for obtaining passwords.
10. Answer: D
Password salting is the process of adding extra characters to a one-way function's
password. The addition of characters makes it more difficult to reverse the hash of the
password. The primary benefit or function of password salting is to defeat dictionary
and pre-computed attacks.
11. Answer: A
Every possible combination of characters is computed for the hash to create a rainbow
table. When a rainbow table contains all possible pre-computed hashes, the attacker
captures the password hash of the target and compares it with the rainbow table.
12. Answer: D
Meterpreter is a popular backdoor of the Metasploit framework. It is used to create a
control channel for lateral access after a successful attack.
13. Answer: C
Password salting is the process of adding an extra character to a password in order to
make it a one-way function. The addition of characters makes it more difficult to reverse
the hash of the password. The major advantage or primary function of password salting
is to defeat dictionary attacks and pre-computed attacks.
527
Appendix A: Answers
14. Answer: D
Microsoft's Internet Information Services is an extensible web server designed for use
with the Windows NT operating system. HTTP, HTTP/2, HTTPS, FTP, FTPS, SMTP, and
NNTP are all supported by IIS.
15. Answer: C
Directory Traversal Attack is a type of attack in which an attacker attempts to access
restricted directories through trial and error by using dots and slash sequences. The
attacker can obtain sensitive information about the system by accessing directories
other than the root directory.
16. Answer: B
HTTP Response Splitting Attack is a technique in which an attacker sends a request to
the server for response splitting. An attacker can add the header response in this
manner. As a result, the server will split the response into two responses. The second
response is under the control of the attacker so that the user can be redirected to the
malicious website.
17. Answer: B
Patches are pieces of software that are specially designed for fixing the issue.
18. Answer: A
The Microsoft Baseline Security Analyzer is a Microsoft-powered patch management
tool for Windows. MBSA detects missing security updates as well as common security
misconfigurations.
528
Appendix A: Answers
Chapter 03: Implementation
1. Answer: D
Internet Information Services is an extensible web server created by Microsoft to be
used with the Windows NT family. IIS supports HTTP, HTTP/2, HTTPS, FTP, FTPS,
SMTP and NNTP.
2. Answer: C
Directory Traversal Attack is a type of attack in which an attacker attempts using a trial
and error method to access restricted directories by applying dots and slash sequences.
By accessing the guides outside the root directory, the attacker can reveal sensitive
information about the system.
3. Answer: B
HTTP Response Splitting Attack is the technique in which an attacker sends a response
splitting request to the server. In this way, an attacker can add the header response. As
a result, the server will split the response into two answers. The second response is
under the attacker's control so that the user can be redirected to the malicious website.
4. Answer: A
A hotfix is a hot system specially designed for a live production environment where fixes
have been made outside a normal development and testing to address the issue.
5. Answer: B
Patches are pieces of software that are specially designed for fixing the issue.
6. Answer: A
Jailbreaking allows root access to an iOS device, which permits downloading unofficial
applications. Jailbreaking is famous for removing restrictions, installation of additional
software, malware injection, and software piracy.
7. Answer: A
In Tethered Jailbreaking, when the iOS device is rebooted, it will no longer have a
patched kernel. It may be stuck in a partially started state. With Tethered Jailbreaking,
a computer
must boot the device each time; i.e., the device is re-jailbroken each time. Using
Jailbreaking tool, the device is started with the patched kernel.
529
Appendix A: Answers
8. Answer: B
Blackberry App World is the official application distribution service.
9. Answer: A
The primary purpose of implementing Mobile Device Management (MDM) is to deploy,
maintain, and monitor mobile devices that make up BYOD solutions. Devices may
include laptops, smartphones, tablets, notebooks, or any other electronic device that
can be moved outside the corporate office to home or some public place and then gets
connected to the corporate office by some means.
10. Answer: A
Denial-of-Service (DoS) is an attack in which service offered by a system or a network
is denied. Services may be rejected, reducing the functionality or preventing access to
the resources even to legitimate users.
11. Answer: B
Service Request Flood is a DoS attack in which the attacker floods the request towards
a service such as a Web application or Web server until all the services are overloaded.
12. Answer: C
The Permanent Denial-of-Service Attack is the DoS attack, which instead of focusing on
the denial of services, focuses on hardware sabotage. Affected hardware by PDoS attack
become damaged and requires replacement or reinstallation of hardware. PDoS is
performed by a method known as "Phishing" that causes irreversible damage to the
hardware or "Bricking a system" by sending fraudulent hardware updates.
13. Answer: A
A Distributed-Reflection-Denial-of-Service Attack is the type of DoS attack in which
intermediary and Secondary victims are also involved in the process of launching a DoS
attack. The attacker sends requests to the intermediary victim, which redirects the
traffic towards the secondary victim. The secondary victim redirects the traffic toward
the target. The involvement of intermediary and secondary victims is for spoofing the
attack.
530
Appendix A: Answers
Chapter 04: Operations and Incident Response
1. Answer: A
Explanation: Determines TCP/IP and network adapter information and some
additional IP details. In Windows, the command used is “ipconfig” whereas, in Linux
and Mac, the command used is “ifconfig.”
2. Answer: C
Explanation: NetFlow is one of the standardized methods of gathering network
statistics from switches, routers, and other devices on the network. The NetFlow
information is usually consolidated onto a central NetFlow server, and you can view the
information across all of the devices on a single management console.
3. Answer: D
Explanation: A cache is a temporary storage area designed to speed up the performance
of an application or an operating system.
There are many different kinds of cache, including CPU cache, disk cache, cache for a
browser, and cache connected to the network.
4. Answer:
B
Explanation: SOAR stands for Security Orchestration, Automation, and Response
(SOAR). SOAR platforms are a collection of security tools and programs that let you
search and collect data from a variety of sources. SOAR systems then use a combination
of human and machine learning to understand and prioritize incident response
activities based on this heterogeneous data.
Using SOAR, an administrator can integrate multiple third-party tools and have them
all work together. The integration is based on the runbooks.
5. Answer: D
Explanation: OpenSSL is a library and a series of utilities that allow you to manage SSL
and TLS certificates into the systems. If you are building a Certificate Authority (CA)
inside the company, you must create X.509 certificates. Users will send the Certificate
Signing Requests (CSRs), and you will have to manage the certificates revocation list
(CRLs). This can be done by the utilities available in OpenSSL.
OpenSSL also includes cryptographic libraries that can be used to conduct hashing
operations on a variety of hashing methods. You can also use OpenSSL's built-in
encryption and decryption features.
6. Answer: B
531
Appendix A: Answers
Explanation: ARP stands for Address Resolution Protocol, which is a stateless protocol
used within a broadcast domain to ensure communication by resolving the IP address
to MAC address mapping. It is in charge of L3 to L2 address mappings. ARP protocol
ensures the binding of IP addresses and MAC addresses.
7. Answer: A
Explanation: The Mobile Device Manager (MDM) can allow or deny access to mobile
devices. The MDM allows the IT security administrator to set policies on all mobile
devices and always protect the devices from malicious software.
8. Answer: C
Explanation: Protocol analyzers are generally used to troubleshoot complex
application problems because they collect every bit from the network and provide a
breakdown of exactly what is going across those particular network links.
The protocol analyzer can also be used on wireless networks or wide area networks as
well. This analyzer provides detailed information such as unknown traffic, verifying
packet filtering and security control, and gives the plain-language description of the
application data.
9. Answer: D
Explanation: If the endpoint security software recognizes an application that seems to
have malicious software, it can remove that from the system and place it into a
quarantine area. This can be a folder on the existing system where no applications are
allowed to run.
10. Answer: A
Explanation: There is a legal mechanism used to gather information called discovering.
When this mechanism applies to digital technologies, it is referred to as Electronic
discovery (E-discovery). This process gathers the data. Hence there is no need to
examine or analyze the information. For data, you are simply required to search from
the list of information that is being requested.
11. Answer: B
Explanation: There are two ways to providing non-repudiation:


Message Authentication Code (MAC) – With MAC, the two parties that are
communicating back and forth are the two that can verify that non-repudiation.
Digital Signature – Anyone who has access to the public key of the person who
wrote the information can verify that they can use it.
12. Answer: D
532
Appendix A: Answers
Explanation: SIEM allows you to analyze the data to create security alerts and realtime information about what is happening on the network right now. Since you can
collect all the information and aggregate it into a single place and create long-term
storage to easily create some extensive reports over a long period of time.
13. Answer: B
Explanation: There are four types of vulnerability assessment. These are:




Active Assessment
Passive Assessment
External Assessment
Internal Assessment
14. Answer: A
Explanation: WinHex is the third-party editor tool that can provide the raw
representation of the dump files. All information is displayed in hexadecimal mode. This
will help you pull and edit information located in the file, memory, disk, etc.
WinHex also has disk cloning capabilities, which allow you to copy all of the data from
a file and save it as an image file or copy it to a different storage device. Additionally,
WinHex makes it simple to do secure wipes, ensuring that all data in the file is
completely deleted and cannot be recovered using third-party programs.
15. Answer: C
Explanation: WinHex is the third-party editor tool that can provide the raw
representation of the dump files. All information is displayed in hexadecimal mode. This
will help you pull and edit information located in the file, memory, disk, etc.
There are also disk cloning capabilities built into WinHex that help you copy all the data
from a file and store that data into the image file or copy it to a separate storage device.
Also, you can easily perform secure wipes with WinHex to ensure that all the
information that exists within the file will be completed wiped will not be recoverable
with third-party utilities.
533
Appendix A: Answers
Chapter 05: Governance, Risk, and Compliance
1. Answer: D
Explanation: The Governance, Risk, and Compliance (GRC) is a combined collection
of potentials that allows the organizations and companies to reliably achieve ethical
management, minimizing the risk of failures, and ensuring the organization complying
with state requirements.
2. Answer: B
Explanation: One of the major concerns is that the data can be used for identity theft
and easily taking advantage of other people’s private information. If the data gets into
the hands of a third party, then it is an organizational responsibility to have a public
disclosure. This activity will create some credit monitoring costs. This will constantly
monitor your organization’s data.
3. Answer: A
Explanation: Data retention refers to the storage of data logs. Another important
characteristic of data retention is to determine what data needs to be stored and for how
long. Data is retained for multiple purposes like a contractual obligation, accounting,
and billing, warranty history, etc.
4. Answer:
C
Explanation: There are five roles and responsibilities available at the management
layer of the organization.





Data Owners
Data Controllers
Data Processor
Data Custodian/Steward
Data Protection Officer (DPO)
5. Answer: D
Explanation: The Privacy Impact Assessment (PIA) is a method of determining the gap
between the required and existing privacy legislation. PIA guarantees that the process
and system comply with all applicable rules and regulations. It examines how personally
identifiable information (PII) is collected, stored, and used. The users are given all of
this information in a written privacy statement.
6. Answer: B
Explanation: The security controls are categorized at different levels:

Technical
534
Appendix A: Answers


Management
Operational
7. Answer: A
Explanation: Detective Control helps to detect a physical security breach. It alerts the
operator to specific conditions and acts during an event.
8 Answer: C
Explanation: The entire life cycle of the information consists of:





Creation and Receipt
Distribution
Use
Maintenance
Disposition
9. Answer: A
Explanation: The purpose of a Non-Disclosure Agreement (NDA) is to protect
confidential information that is disclosed, shared, received, or exchanged with
customers, suppliers, and other parties.
10. Answer: C
Explanation: Disaster Recovery Plan (DRP) is the process of recovering access to data,
hardware, and software necessary to continue critical business operations after a
human-induced or natural disaster (such as storm, flood, tornado, etc.). The main
purpose of DRP is to rapidly re-establish or recover critical areas or elements of the
business after a disaster or similar incident.
11. Answer: A
Explanation: Personnel security policies concern people associated with the
organization, such as employees, contractors, consultants, and users.
These policies involve the following:




Screening processes to validate security requirements
Understanding their security responsibilities
Understanding their suitability to security roles
Reducing the risk of theft, fraud, or the misuse of facilities
12. Answer: A
Explanation: There are four account types included in the credential policies.


User Account
Shared Account
535
Appendix A: Answers


Service Account
Privileged Account
13. Answer: D
Explanation: Job rotation, also known as a rotation of duties or rotation of
responsibilities, helps an organization to mitigate the risk associated with any individual
having too many privileges. Rotation of duties simply requires that one person does not
perform critical functions or responsibilities for an extended period of time. For
example, an accountant might move from payroll to accounts payable and then to
accounts receivable. The primary goal of job rotation is to reduce the length of one
person being in a certain job for too long minimizes the chances of errors or malicious
actions going undetected. Job rotation can also be used to cross-train members of teams
to minimize the impact of an unexpected leave of absence.
14. Answer: C
Explanation: Threat assessment is a systematic interpretation of a threat that comes
into contact with a company. Threats cannot be changed, but the way they influence
people can. As a result, threats must be identified.
15. Answer: B
Explanation: There are two main types of risk assessment.


Qualitative - To subjectively figure out the impact of an action which affects a
business or program is known as “Qualitative Risk Assessment.” Experienced and
expert judgments are needed to perform this assessment.
Quantitative - To objectively figure out the impact of an action which affects a
business or program is known as “Quantitative Risk Assessment.” In order to perform
this assessment, the use of models and metrics are involved commonly.
536
Appendix B: Acronyms
Acronyms
3DES
Triple Digital Encryption Algorithm
AAA
Authentication, Authorization, and Accounting
ABAC
Attribute-based Access Control
ACL
Access Control List AD Active Directory
AES
Advanced Encryption Standard
AES256
Advanced Encryption Standards 256bit
AH
Authentication Header AI Artificial Intelligence
AIS
Automated Indicator Sharing
ALE
Annualized Loss Expectancy
AP
Access Point
API
Application Programming Interface
APT
Advanced Persistent Threat
ARO
Annualized Rate of Occurrence
ARP
Address Resolution Protocol
ASLR
Address Space Layout Randomization
ASP
Active Server Pages
ATT&CK
Adversarial Tactics, Techniques, and Common Knowledge
AUP
Acceptable Use Policy
AV
Antivirus
BASH
Bourne Again Shell
BCP
Business Continuity Planning
BGP
Border Gateway Protocol
BIA
Business Impact Analysis
BIOS
Basic Input/Output System
BPA
Business Partnership Agreement
BPDU
Bridge Protocol Data Unit
BSSID
Basic Service Set Identifier
BYOD
Bring Your Own Device
537
Appendix B: Acronyms
CA
Certificate Authority
CAC
Common Access Card
CAPTCHA
Humans Apart
Completely Automated Public Turing Test to Tell Computers and
CAR
Corrective Action Report
CASB
Cloud Access Security Broker
CBC
Cipher Block Chaining
CBT
Computer-based Training
CCMP
Counter-Mode/CBC-MAC Protocol
CCTV
Closed-Circuit Television
CERT
Computer Emergency Response Team
CFB
Cipher Feedback
CHAP
Challenge-Handshake Authentication Protocol
CIO
Chief Information Officer
CIRT
Computer Incident Response Team
CIS
Center for Internet Security
CMS
Content Management System
CN
Common Name
COOP
Continuity of Operations Planning
COPE
Corporate-owned Personally Enabled
CP
Contingency Planning
CRC
Cyclic Redundancy Check
CRL
Certificate Revocation List
CSA
Cloud Security Alliance
CSIRT
Computer Security Incident Response Team
CSO
Chief Security Officer
CSP
Cloud Service Provider
CSR
Certificate Signing Request
CSRF
Cross-Site Request Forgery
CSU
Channel Service Unit
538
Appendix B: Acronyms
CTM
Counter-Mode
CTO
Chief Technology Officer
CVE
Common Vulnerabilities and Exposures
CVSS
Common Vulnerability Scoring System
CYOD
Choose Your Own Device
DAC
Discretionary Access Control
DBA
Database Administrator
DDoS
Distributed Denial-of-Service
DEP
Data Execution Prevention
DER
Distinguished Encoding Rules
DES
Data Encryption Standard
DHCP
Dynamic Host Configuration Protocol
DHE
Diffie-Hellman Ephemeral
DKIM
Domain Keys Identified Mail
DLL
Dynamic Link Library
DLP
Data Loss Prevention
DMARC
Domain Message Authentication Reporting and Conformance
DMZ
Demilitarized Zone
DNAT
Destination Network Address Transaction
DNS
Domain Name System
DNSSEC
Domain Name System Security Extensions
DoS
Denial-of-Service
DPO
Data Protection Officer
DRP
Disaster Recovery Plan
DSA
Digital Signature Algorithm
DSL
Digital Subscriber Line
EAP
Extensible Authentication Protocol
ECB
Electronic Code Book
ECC
Elliptic-curve Cryptography
ECDHE
Elliptic-curve Diffie-Hellman Ephemeral
539
Appendix B: Acronyms
ECDSA
Elliptic-curve Digital Signature Algorithm
EDR
Endpoint Detection and Response
EFS
Encrypted File System
EIP
Extended Instruction Pointer
EOL
End of Life
EOS
End of Service
ERP
Enterprise Resource Planning
ESN
Electronic Serial Number
ESP
Encapsulating Security Payload
ESSID
Extended Service Set Identifier
FACL
File System Access Control List
FDE
Full Disk Encryption
FIM
File Integrity Monitoring
FPGA
Field Programmable Gate Array
FRR
False Rejection Rate
FTP
File Transfer Protocol
FTPS
Secured File Transfer Protocol
GCM
Galois/Counter Mode
GDPR
General Data Protection Regulation
GPG
GNU Privacy Guard
GPO
Group Policy Object
GPS
Global Positioning System
GPU
Graphics Processing Unit
GRE
Generic Routing Encapsulation
HA
High Availability
HDD
Hard Disk Drive
HIDS
Host-based Intrusion Detection System
HIPS
Host-based Intrusion Prevention System
HMAC
Hash-based Message Authentication Code
HOTP
HMAC-based One-time Password
540
Appendix B: Acronyms
HSM
Hardware Security Module
HSMaaS
Hardware Security Module as a Service
HTML
Hypertext Markup Language
HTTP
Hypertext Transfer Protocol
HTTPS
Hypertext Transfer Protocol Secure
HVAC
Heating, Ventilation, Air Conditioning
IaaS
Infrastructure as a Service
IAM
Identity and Access Management
ICMP
Internet Control Message Protocol
ICS
Industrial Control Systems
IDEA
International Data Encryption Algorithm
IDF
Intermediate Distribution Frame
IdP
Identity Provider
IDS
Intrusion Detection System
IEEE
Institute of Electrical and Electronics Engineers
IKE
Internet Key Exchange
IM
Instant Messaging
IMAP4
Internet Message Access Protocol v4
IoC
Indicators of Compromise
IoT
Internet of Things
IP
Internet Protocol
IPS
Intrusion Prevention System
IPSec
Internet Protocol Security
IR
Incident Response
IRC
Internet Relay Chat
IRP
Incident Response Plan
ISA
Interconnection Security Agreement
ISFW
Internal Segmentation Firewall
ISO
International Organization for Standardization
ISP
Internet Service Provider
541
Appendix B: Acronyms
ISSO
Information Systems Security Officer
ITCP IT
Contingency Plan
IV
Initialization Vector
KDC
Key Distribution Center
KEK
Key Encryption Key
L2TP
Layer 2 Tunneling Protocol
LAN
Local Area Network
LDAP
Lightweight Directory Access Protocol
LEAP
Lightweight Extensible Authentication Protocol
MaaS
Monitoring as a Service
MAC
Media Access Control
MAM
Mobile Application Management
MAN
Metropolitan Area Network
MBR
Master Boot Record
MD5
Message Digest 5
MDF
Main Distribution Frame
MDM
Mobile Device Management
MFA
Multifactor Authentication
MFD
Multifunction Device
MFP
Multifunction Printer
MITM
Man-in-the-Middle
ML
Machine Learning
MMS
Multimedia Message Service
MOA
Memorandum of Agreement
MOU
Memorandum of Understanding
MPLS
Multiprotocol Label Switching
MSA
Measurement Systems Analysis
MSCHAP
Microsoft Challenge Handshake Authentication Protocol
MSP
Managed Service Provider
MSSP
Managed Security Service Provider
542
Appendix B: Acronyms
MTBF
Mean Time Between Failures
MTTF
Mean Time to Failure
MTTR
Mean Time to Repair
MTU
Maximum Transmission Unit
NAC
Network Access Control
NAS
Network-attached Storage
NAT
Network Address Translation
NDA
Non-disclosure Agreement
NFC
Near-field Communication
NFV
Network Function Virtualization
NGFW
Next-generation Firewall
NG-SWG
Next-generation Secure Web Gateway
NIC
Network Interface Card
NIDS
Network-based Intrusion Detection System
NIPS
Network-based Intrusion Prevention System
NIST
National Institute of Standards & Technology
NOC
Network Operations Center
NTFS
New Technology File System
NTLM
New Technology LAN Manager
NTP
Network Time Protocol
OAUTH
Open Authentication
OCSP
Online Certificate Status Protocol
OID
Object Identifier
OS
Operating System
OSI
Open Systems Interconnection
OSINT
Open-source Intelligence
OSPF
Open Shortest Path First
OT
Operational Technology
OTA
Over-The-Air
OTG
On-The-Go
543
Appendix B: Acronyms
OVAL
Open Vulnerability and Assessment Language
OWASP
Open Web Application Security Project P12 PKCS #12
P2P
Peer-to-Peer
PaaS
Platform as a Service
PAC
Proxy Auto Configuration
PAM
Privileged Access Management
PAM
Pluggable Authentication Modules
PAP
Password Authentication Protocol
PAT
Port Address Translation
PBKDF2
Password-based Key Derivation Function 2
PBX
Private Branch Exchange
PCAP
Packet Capture
PCI DSS
Payment Card Industry Data Security Standard
PDU
Power Distribution Unit
PE
Portable Executable
PEAP
Protected Extensible Authentication Protocol
PED
Portable Electronic Device
PEM
Privacy Enhanced Mail
PFS
Perfect Forward Secrecy
PGP
Pretty Good Privacy
PHI
Personal Health Information
PII
Personally Identifiable Information
PIN
Personal Identification Number
PIV
Personal Identity Verification
PKCS
Public Key Cryptography Standards
PKI
Public Key Infrastructure
PoC
Proof of Concept
POP
Post Office Protocol
POTS
Plain Old Telephone Service
PPP
Point-to-Point Protocol
544
Appendix B: Acronyms
PPTP
Point-to-Point Tunneling Protocol
PSK
Pre-shared Key
PTZ
Pan-Tilt-Zoom
PUP
Potentially Unwanted Program
QA
Quality Assurance
QoS
Quality of Service
PUP
Potentially Unwanted Program
RA
Registration Authority
RAD
Rapid Application Development
RADIUS
Remote Authentication Dial-in User Service
RAID
Redundant Array of Inexpensive Disks
RAM
Random Access Memory
RAS
Remote Access Server
RAT
Remote Access Trojan
RC4
Rivest Cipher version 4
RCS
Rich Communication Services
RFC
Request for Comments
RFID
Radio Frequency Identifier
RIPEMD
RACE Integrity Primitives Evaluation Message Digest
ROI
Return on Investment
RPO
Recovery Point Objective
RSA
Rivest, Shamir, & Adleman
RTBH
Remotely Triggered Black Hole
RTO
Recovery Time Objective
RTOS
Real-time Operating System
RTP
Real-time Transport Protocol
S/MIME
Secure/Multipurpose Internet Mail Extensions
SaaS
Software as a Service
SAE
Simultaneous Authentication of Equals
SAML
Security Assertions Markup Language
545
Appendix B: Acronyms
SCADA
Supervisory Control and Data Acquisition
SCAP
Security Content Automation Protocol
SCEP
Simple Certificate Enrollment Protocol
SDK
Software Development Kit
SDLC
Software Development Life Cycle
SDLM
Software Development Life-cycle Methodology
SDN
Software-defined Networking
SDP
Service Delivery Platform
SDV
Software-defined Visibility
SED
Self-Encrypting Drives
SEH
Structured Exception Handling
SFTP
SSH File Transfer Protocol
SHA
Secure Hashing Algorithm
S-HTTP
Secure Hypertext Transfer Protocol
SIEM
Security Information and Event Management
SIM
Subscriber Identity Module
SIP
Session Initiation Protocol
SLA
Service-level Agreement
SLE
Single Loss Expectancy
SMB
Server Message Block
S/MIME
Secure/Multipurpose Internet Mail Extensions
SMS
Short Message Service
SMTP
Simple Mail Transfer Protocol
SMTPS
Simple Mail Transfer Protocol Secure
SNMP
Simple Network Management Protocol
SOAP
Simple Object Access Protocol
SOAR
Security Orchestration, Automation, Response
SoC
System on Chip
SOC
Security Operations Center
SPF
Sender Policy Framework
546
Appendix B: Acronyms
SPIM
Spam over Internet Messaging
SQL
Structured Query Language
SQLi
SQL Injection
SRTP
Secure Real-time Transport Protocol
SSD
Solid State Drive
SSH
Secure Shell
SSID
Service Set Identifier
SSL
Secure Sockets Layer
SSO
Single Sign-on
STIX
Structured Threat Information eXpression
STP
Shielded Twisted Pair
SWG
Secure Web Gateway
TACACS+
Terminal Access Controller Access Control System
TAXII
Trusted Automated eXchange of Indicator Information
TCP/IP
Transmission Control Protocol/Internet Protocol
TGT
Ticket Granting Ticket
TKIP
Temporal Key Integrity Protocol
TLS
Transport Layer Security
TOTP
Time-based One Time Password
TPM
Trusted Platform Module
TSIG
Transaction Signature
TTP
Tactics, Techniques, and Procedures
UAT
User Acceptance Testing
UAV
Unmanned Aerial Vehicle
UDP
User Datagram Protocol
UEBA
User and Entity Behavior Analytics
UEFI
Unified Extensible Firmware Interface
UEM
Unified Endpoint Management
UPS
Uninterruptable Power Supply
URI
Uniform Resource Identifier
547
Appendix B: Acronyms
URL
Universal Resource Locator
USB
Universal Serial Bus
USB OTG USB
On-The-Go
UTM
Unified Threat Management
UTP
Unshielded Twisted Pair
VBA
Visual Basic
VDE
Virtual Desktop Environment
VDI
Virtual Desktop Infrastructure
VLAN
Virtual Local Area Network
VLSM
Variable-length Subnet Masking
VM
Virtual Machine
VoIP
Voice over IP
VPC
Virtual Private Cloud
VPN
Virtual Private Network
VTC
Video Teleconferencing
WAF
Web Application Firewall
WAP
Wireless Access Point
WEP
Wired Equivalent Privacy
WIDS
Wireless Intrusion Detection System
WIPS
Wireless Intrusion Prevention System
WORM
Write Once Read Many
WPA
WiFi Protected Access
WPS
WiFi Protected Setup
WTLS
Wireless TLS
XaaS
Anything as a Service
XML
Extensible Markup Language
XOR
Exclusive Or
XSRF
Cross-site Request Forgery
XSS
Cross-site Scripting
548
Appendix C: References
References
https://www.safaribooksonline.com/library/view/mike-meyerscomptia/9781260026559/
https://www.safaribooksonline.com/library/view/comptia-security-all-inone/9781260019292/
https://www.safaribooksonline.com/library/view/comptia-securityreview/9781118922903/
https://trustsds.com/downloads/white-papers/Governance-Risk-Compliance.pdf
file:///C:/Users/ad/Downloads/White%20Paper%20RSA%20Archer%207%20Steps%20
to%20Build%20a%20GRC%20Framework%20H16083%204-2017.pdf
file:///C:/Users/ad/Downloads/White%20Paper%20RSA%20Archer%207%20Steps%20
to%20Build%20a%20GRC%20Framework%20H16083%204-2017.pdf
https://www.zurichna.com/-/media/project/zwp/zna/docs/kh/tech/site-securityassessment-guide.pdf
https://www.sciencedirect.com/topics/computer-science/organizational-security
https://www.osibeyond.com/blog/it-security-policies-every-organization-must-havethem/
https://cybersecurity.att.com/blogs/security-essentials/data-governance.at-the-heartof-security-privacy-andrisk#:~:text=Data%20governance%20is%20the%20capability,security%2C%20availabili
ty%2C%20and%20consistency.
https://www.cisa.gov/cybersecurityinsurance#:~:text=Cybersecurity%20insurance%20is%20designed%20to,business%20i
nterruption%2C%20and%20network%20damage.&text=In%20recent%20years%2C%2
0the%20Cybersecurity,this%20emerging%20cyber%20risk%20area.
https://www.cisecurity.org/blog/end-of-support-software-report-list/
https://www.wwt.com/article/the-risk-of-end-of-support-eos-infrastructure-in-yourdata-center
https://startacybercareer.com/what-is-a-cybersecurity-capture-the-flag/
https://www.mass.gov/files/documents/2016/07/uo/hsn-business-partner-securityagreement.pdf
https://ctf101.org/#:~:text=Capture%20The%20Flags%2C%20or%20CTFs,building%20
nature%20and%20competetive%20aspect.
549
Appendix C: References
https://onlinedegrees.sandiego.edu/bringing-gamification-to-cyber-security-training/
https://www.synthesio.com/glossary/social-media-analysis/
https://www.skillsoft.com/course/comptia-security-analyzing-application-networkattacks-cf202d2d-86a1-4a7f-8d64-6fed4db6997e
https://www.securitymagazine.com/articles/93509-the-importance-of-acybersecurity-framework
https://suppliers.rollsroyce.com/GSPWeb/ShowProperty?nodePath=/BEA%20Repository/Global%20Supplie
r%20Portal/Section%20DocLink%20Lists/SABRe_2/Main/Column%201/Briefs%20and
%20Guidance/B3.7:%20Measurement%20Systems%20Analysis/Documents/MSA%20h
andbook//file
https://hrdqstore.com/blogs/hrdq-blog/effective-diversity-training-methods
https://www.edgepointlearning.com/blog/types-of-diversity-training/
https://terranovasecurity.com/phishing-simulation/
https://www.e-ir.info/2020/03/14/international-law-on-cyber-security-in-the-age-ofdigital-sovereignty/
https://www.upguard.com/blog/third-party-credentials-vendor-risk
https://www.iso.org/standard/54533.html
https://london.ac.uk/about-us/how-university-run/policies/information-security-andacceptable-use-policy
https://it.brown.edu/computing-policies/acceptable-use-policy
https://www.cisecurity.org/
https://cloudsecurityalliance.org/research/cloud-controls-matrix/
https://cloudsecurityalliance.org/blog/2020/10/16/what-is-the-cloud-controls-matrixccm/
https://cloudsecurityalliance.org/
https://ccsk.cloudsecurityalliance.org/en?gclid=EAIaIQobChMIzMP1o9at8QIVibh3Ch1
RDAVrEAAYASAAEgIYCPD_BwE
https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/usa
https://www.iso.org/iso-31000-risk-management.html
https://www.pluralsight.com/courses/nist-rmfimplementing?aid=7010a000002LUv7AAG&promo=&utm_source=non_branded&utm_
medium=digital_paid_search_google&utm_campaign=XYZ_APAC_Dynamic&utm_con
550
Appendix C: References
tent=&cq_cmp=1576650374&gclid=EAIaIQobChMIxbmv1vGs8QIV5ejtCh0i1QDXEAAY
ASAAEgK3sfD_BwE
https://www.iso.org/standard/71670.html
https://www.nqa.com/en-me/certification/standards/iso-27701
https://www.nist.gov/cyberframework
https://www.nist.gov/industry-impacts/cybersecurity-framework
https://csrc.nist.gov/Projects/risk-management
https://www.cengage.com/resource_uploads/downloads/1111138214_259146.pdf
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf
http://bok.ahima.org/doc?oid=300244#.WkzPTN-WaM8
http://www.iaps.com/security-overview.html
https://trustsds.com/downloads/white-papers/Governance-Risk-Compliance.pdf
file:///C:/Users/ad/Downloads/White%20Paper%20RSA%20Archer%207%20Steps%20
to%20Build%20a%20GRC%20Framework%20H16083%204-2017.pdf
file:///C:/Users/ad/Downloads/White%20Paper%20RSA%20Archer%207%20Steps%20
to%20Build%20a%20GRC%20Framework%20H16083%204-2017.pdf
https://www.zurichna.com/-/media/project/zwp/zna/docs/kh/tech/site-securityassessment-guide.pdf
https://www.beyondtrust.com/blog/entry/vulnerability-remediation-5-steps-towardbuilding-effective-process
https://www.sciencedirect.com/topics/computer-science/organizational-security
https://www.osibeyond.com/blog/it-security-policies-every-organization-must-havethem/
https://threatresearch.ext.hp.com/application-containment-endpoint-security/
https://www.varonis.com/blog/network-segmentation/
https://www.sciencedirect.com/topics/computer-science/security-configuration
https://www.tripwire.com/state-of-security/security-data-protection/securitycontrols/security-configuration-management/
https://docs.mcafee.com/bundle/endpoint-security-10.6.0-adaptive-threat-protectionclient-product-guide-windows/page/GUID-F8CE8A74-826D-41BB-9D6A9CC70C434070.html
https://www.fireeye.com/products/helix/what-is-soar.html
551
Appendix C: References
https://www.toppr.com/guides/computer-science/computer-fundamentals/utilitysoftware/file-managementtools/#:~:text=File%20management%20tools%20are%20utility,is%20stored%20in%20t
he%20files.&text=Windows%20Explorer%20is%20a%20default%20file%20managemen
t%20tool%20present%20in%20the%20system.
https://logrhythm.com/uk-uws-using-mitre-attack-in-threat-hunting-and-detectionwhite-paper/?utm_source=google&utm_medium=cpc&utm_campaign=LogRhythm__META_-_T1_-_Generics__Mitre_Att&ck&utm_term=mitre%20att%26ck&matchtype=e&utm_region=EMEA&ut
m_language=en&utm_program=EMEAcpc1&gclid=EAIaIQobChMIuYHWs9jh8QIV0IB
QBh3VTALQEAAYASAAEgLmqfD_BwE
risk#:~:text=Data%20governance%20is%20the%20capability,security%2C%20availabili
ty%2C%20and%20consistency.
https://www.varonis.com/blog/incident-response-plan/
https://www.cisa.gov/cybersecurityinsurance#:~:text=Cybersecurity%20insurance%20is%20designed%20to,business%20i
nterruption%2C%20and%20network%20damage.&text=In%20recent%20years%2C%2
0the%20Cybersecurity,this%20emerging%20cyber%20risk%20area.
https://www.cisecurity.org/blog/end-of-support-software-report-list/
https://www.wwt.com/article/the-risk-of-end-of-support-eos-infrastructure-in-yourdata-center
https://startacybercareer.com/what-is-a-cybersecurity-capture-the-flag/
https://www.mass.gov/files/documents/2016/07/uo/hsn-business-partner-securityagreement.pdf
https://ctf101.org/#:~:text=Capture%20The%20Flags%2C%20or%20CTFs,building%20
nature%20and%20competetive%20aspect.
https://onlinedegrees.sandiego.edu/bringing-gamification-to-cyber-security-training/
https://www.synthesio.com/glossary/social-media-analysis/
https://www.skillsoft.com/course/comptia-security-analyzing-application-networkattacks-cf202d2d-86a1-4a7f-8d64-6fed4db6997e
https://www.securitymagazine.com/articles/93509-the-importance-of-acybersecurity-framework
https://suppliers.rollsroyce.com/GSPWeb/ShowProperty?nodePath=/BEA%20Repository/Global%20Supplie
r%20Portal/Section%20DocLink%20Lists/SABRe_2/Main/Column%201/Briefs%20and
552
Appendix C: References
%20Guidance/B3.7:%20Measurement%20Systems%20Analysis/Documents/MSA%20h
andbook//file
https://hrdqstore.com/blogs/hrdq-blog/effective-diversity-training-methods
https://www.edgepointlearning.com/blog/types-of-diversity-training/
https://terranovasecurity.com/phishing-simulation/
https://www.e-ir.info/2020/03/14/international-law-on-cyber-security-in-the-age-ofdigital-sovereignty/
https://www.upguard.com/blog/third-party-credentials-vendor-risk
https://www.iso.org/standard/54533.html
https://london.ac.uk/about-us/how-university-run/policies/information-security-andacceptable-use-policy
https://it.brown.edu/computing-policies/acceptable-use-policy
https://www.cisecurity.org/
https://cloudsecurityalliance.org/research/cloud-controls-matrix/
https://cloudsecurityalliance.org/blog/2020/10/16/what-is-the-cloud-controls-matrixccm/
https://cloudsecurityalliance.org/
https://ccsk.cloudsecurityalliance.org/en?gclid=EAIaIQobChMIzMP1o9at8QIVibh3Ch1
RDAVrEAAYASAAEgIYCPD_BwE
https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/usa
https://www.iso.org/iso-31000-risk-management.html
https://www.pluralsight.com/courses/nist-rmfimplementing?aid=7010a000002LUv7AAG&promo=&utm_source=non_branded&utm_
medium=digital_paid_search_google&utm_campaign=XYZ_APAC_Dynamic&utm_con
tent=&cq_cmp=1576650374&gclid=EAIaIQobChMIxbmv1vGs8QIV5ejtCh0i1QDXEAAY
ASAAEgK3sfD_BwE
https://www.iso.org/standard/71670.html
https://www.nqa.com/en-me/certification/standards/iso-27701
https://www.nist.gov/cyberframework
https://www.nist.gov/industry-impacts/cybersecurity-framework
https://www.guidepointsecurity.com/incident-response-services/
https://niccs.cisa.gov/workforce-development/cyber-security-workforceframework/digital553
Appendix C: References
forensics#:~:text=Collects%2C%20processes%2C%20preserves%2C%20analyzes,count
erintelligence%2C%20or%20law%20enforcement%20investigations.
https://www.ibm.com/security/intelligentorchestration?p1=Search&p4=43700063537908444&p5=e&gclid=EAIaIQobChMIsYWigJ
T58QIVZRoGAB37AAawEAAYASAAEgKI2_D_BwE&gclsrc=aw.ds
https://info-savvy.com/evidence-collection/
https://www.bitsight.com/blog/7-cybersecurity-frameworks-to-reduce-cyber-risk
https://www.imperva.com/learn/application-security/vulnerability-assessment/
http://www.brighthub.com/computing/smb-security/articles/31234.aspx
https://www.kaspersky.com/resource-center/threats/top-seven-mobile-securitythreats-smart-phones-tablets-and-mobile-internet-devices-what-the-future-has-instore
https://www.safaribooksonline.com/library/view/mike-meyerscomptia/9781260026559/
https://www.safaribooksonline.com/library/view/comptia-security-all-inone/9781260019292/
https://www.safaribooksonline.com/library/view/comptia-securityreview/9781118922903/
https://www.cengage.com/resource_uploads/downloads/1111138214_259146.pdf
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf
http://bok.ahima.org/doc?oid=300244#.WkzPTN-WaM8
http://www.iaps.com/security-overview.html
http://www.brighthub.com/computing/smb-security/articles/31234.aspx
https://www.kaspersky.com/resource-center/threats/top-seven-mobile-securitythreats-smart-phones-tablets-and-mobile-internet-devices-what-the-future-has-instore
https://us.norton.com/internetsecurity-malware-what-is-a-botnet.html
https://www.safaribooksonline.com/library/view/improving-webapplication/9780735651128/ch02s07.html
https://msdn.microsoft.com/en-us/library/ff648641.aspx
https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur
_c/scfdenl.html
https://www.ietf.org/rfc/rfc3704.txt
554
Appendix C: References
www.cisco.com
https://msdn.microsoft.com
www.intel.com
https://meraki.cisco.com
https://en.wikipedia.org/wiki/Computer_network
http://www.computerhistory.org/timeline/networking-the-web/
http://www.computerhistory.org/timeline/networking-the-web/
http://www.thetechnicalstuff.com/types-of-networks-osi-layersrefernce-table/
http://www.utilizewindows.com/data-encapsulation-in-the-osi-model/
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/campover.html
#wp737141
http://www.cisco.com/web/services/downloads/smart-solutions-maximize-federalcapabilities-for-mission-success.pdf
http://www.diffen.com/difference/TCP_vs_UDP
http://www.cisco.com/c/en/us/support/docs/availability/high-availability/15114-NMSbestpractice.html
http://www.wi.fh-flensburg.de/fileadmin/dozenten/Riggert/IP-Design-Guide.pdf
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact
=8&ved=0ahUKEwihpKO8lozQAhVDkRQKHeAzA_IQFggnMAA&url=https%3A%2F%
2Fwww.cisco.com%2Fc%2Fdam%2Fen%2Fus%2Ftd%2Fdocs%2Fsolutions%2FCVD%2
FOct2016%2FCVD-Campus-LAN-WLAN-Design2016OCT.pdf&usg=AFQjCNHwUZXUr3QCKIzXFtBEfVHJ7OiVw&sig2=lSO526GEgDoomeEfiSFolA&bvm=bv.137132246,d.d24
http://www.ciscopress.com/articles/article.asp?p=2180210&seqNum=5
http://www.routeralley.com/guides/static_dynamic_routing.pdf
http://www.comptechdoc.org/independent/networking/guide/netdynamicroute.html
http://www.pearsonitcertification.com/articles/article.aspx?p=2168927&seqNum=7
http://www.cisco.com/c/en/us/td/docs/wireless/prime_infrastructure/13/configuration/guide/pi_13_cg/ovr.pdf
http://www.cisco.com/c/en/us/products/security/security-manager/index.html
http://www.cisco.com/c/en/us/about/security-center/dnssec-best-practices.html
https://en.wikipedia.org/wiki/Malware
555
Appendix C: References
https://en.wikipedia.org/wiki/Security_information_and_event_management
https://en.wikipedia.org/wiki/Malware
https://ikrami.net/2014/05/19/siem-soc/
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_ssh/configuration/15s/sec-usr-ssh-15-s-book/sec-secure-copy.html
https://en.wikipedia.org/wiki/IEEE_802.1X
http://www.ciscopress.com/articles/article.asp?p=25477&seqNum=3
https://www.paessler.com/info/snmp_mibs_and_oids_an_overview
http://www.firewall.cx/downloads.html
https://en.wikipedia.org/wiki/Threat_(computer)#Threat_classification
http://www.cisco.com/c/en/us/products/security/ids-4215-sensor/index.html
https://en.wikipedia.org/wiki/Brain_(computer_virus)
Badawi, A.M.: Hand vein biometric verification prototype: A testing performance and
patterns similarity. In: International Conference on Image Processing, Computer Vision,
and Pattern Recognition, pp. 3–9 (2006)Google Scholar
Chen, Q., Defrise, M., Deconinck, F.: Symmetric phase-only matched filtering of fouriermellin transforms for image registration and recognition. IEEE Transactions on Pattern
Analysis and Machine Intelligence 16(12), 1156–1168 (1994)CrossRefGoogle Scholar
https://www.sciencedirect.com/topics/computer-science/false-acceptance-rate
https://us.norton.com/internetsecurity-malware-what-is-a-botnet.html
https://www.safaribooksonline.com/library/view/improving-webapplication/9780735651128/ch02s07.html
https://msdn.microsoft.com/en-us/library/ff648641.aspx
https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur
_c/scfdenl.html
https://www.ietf.org/rfc/rfc3704.txt
www.cisco.com
https://msdn.microsoft.com
www.intel.com
https://meraki.cisco.com
https://en.wikipedia.org/wiki/Computer_network
http://www.computerhistory.org/timeline/networking-the-web/
556
Appendix C: References
http://www.computerhistory.org/timeline/networking-the-web/
http://www.thetechnicalstuff.com/types-of-networks-osi-layersrefernce-table/
http://www.utilizewindows.com/data-encapsulation-in-the-osi-model/
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/campover.html
#wp737141
http://www.cisco.com/web/services/downloads/smart-solutions-maximize-federalcapabilities-for-mission-success.pdf
http://www.diffen.com/difference/TCP_vs_UDP
http://www.cisco.com/c/en/us/support/docs/availability/high-availability/15114-NMSbestpractice.html
http://www.wi.fh-flensburg.de/fileadmin/dozenten/Riggert/IP-Design-Guide.pdf
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact
=8&ved=0ahUKEwihpKO8lozQAhVDkRQKHeAzA_IQFggnMAA&url=https%3A%2F%
2Fwww.cisco.com%2Fc%2Fdam%2Fen%2Fus%2Ftd%2Fdocs%2Fsolutions%2FCVD%2
FOct2016%2FCVD-Campus-LAN-WLAN-Design2016OCT.pdf&usg=AFQjCNHwUZXUr3QCKIzXFtBEfVHJ7OiVw&sig2=lSO526GEgDoomeEfiSFolA&bvm=bv.137132246,d.d24
http://www.ciscopress.com/articles/article.asp?p=2180210&seqNum=5
http://www.routeralley.com/guides/static_dynamic_routing.pdf
http://www.comptechdoc.org/independent/networking/guide/netdynamicroute.html
http://www.pearsonitcertification.com/articles/article.aspx?p=2168927&seqNum=7
http://www.cisco.com/c/en/us/td/docs/wireless/prime_infrastructure/13/configuration/guide/pi_13_cg/ovr.pdf
http://www.cisco.com/c/en/us/products/security/security-manager/index.html
http://www.cisco.com/c/en/us/about/security-center/dnssec-best-practices.html
https://en.wikipedia.org/wiki/Malware
https://en.wikipedia.org/wiki/Security_information_and_event_management
https://en.wikipedia.org/wiki/Malware
https://ikrami.net/2014/05/19/siem-soc/
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_ssh/configuration/15s/sec-usr-ssh-15-s-book/sec-secure-copy.html
https://en.wikipedia.org/wiki/IEEE_802.1X
http://www.ciscopress.com/articles/article.asp?p=25477&seqNum=3
557
Appendix C: References
https://www.paessler.com/info/snmp_mibs_and_oids_an_overview
http://www.firewall.cx/downloads.html
https://en.wikipedia.org/wiki/Threat_(computer)#Threat_classification
http://www.cisco.com/c/en/us/products/security/ids-4215-sensor/index.html
https://en.wikipedia.org/wiki/Brain_(computer_virus)
https://www.safaribooksonline.com/library/view/mike-meyerscomptia/9781260026559/
https://www.safaribooksonline.com/library/view/comptia-security-all-inone/9781260019292/
https://www.safaribooksonline.com/library/view/comptia-securityreview/9781118922903/
https://www.cengage.com/resource_uploads/downloads/1111138214_259146.pdf
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf
http://bok.ahima.org/doc?oid=300244#.WkzPTN-WaM8
http://www.iaps.com/security-overview.html
http://www.brighthub.com/computing/smb-security/articles/31234.aspx
https://www.kaspersky.com/resource-center/threats/top-seven-mobile-securitythreats-smart-phones-tablets-and-mobile-internet-devices-what-the-future-has-instore
https://us.norton.com/internetsecurity-malware-what-is-a-botnet.html
https://www.safaribooksonline.com/library/view/improving-webapplication/9780735651128/ch02s07.html
https://msdn.microsoft.com/en-us/library/ff648641.aspx
https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur
_c/scfdenl.html
https://www.ietf.org/rfc/rfc3704.txt
www.cisco.com
https://msdn.microsoft.com
www.intel.com
https://meraki.cisco.com
https://en.wikipedia.org/wiki/Computer_network
http://www.computerhistory.org/timeline/networking-the-web/
558
Appendix C: References
http://www.computerhistory.org/timeline/networking-the-web/
http://www.thetechnicalstuff.com/types-of-networks-osi-layersrefernce-table/
http://www.utilizewindows.com/data-encapsulation-in-the-osi-model/
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/campover.html
#wp737141
http://www.cisco.com/web/services/downloads/smart-solutions-maximize-federalcapabilities-for-mission-success.pdf
http://www.diffen.com/difference/TCP_vs_UDP
http://www.cisco.com/c/en/us/support/docs/availability/high-availability/15114-NMSbestpractice.html
http://www.wi.fh-flensburg.de/fileadmin/dozenten/Riggert/IP-Design-Guide.pdf
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact
=8&ved=0ahUKEwihpKO8lozQAhVDkRQKHeAzA_IQFggnMAA&url=https%3A%2F%
2Fwww.cisco.com%2Fc%2Fdam%2Fen%2Fus%2Ftd%2Fdocs%2Fsolutions%2FCVD%2
FOct2016%2FCVD-Campus-LAN-WLAN-Design2016OCT.pdf&usg=AFQjCNHwUZXUr3QCKIzXFtBEfVHJ7OiVw&sig2=lSO526GEgDoomeEfiSFolA&bvm=bv.137132246,d.d24
http://www.ciscopress.com/articles/article.asp?p=2180210&seqNum=5
http://www.routeralley.com/guides/static_dynamic_routing.pdf
http://www.comptechdoc.org/independent/networking/guide/netdynamicroute.html
http://www.pearsonitcertification.com/articles/article.aspx?p=2168927&seqNum=7
http://www.cisco.com/c/en/us/td/docs/wireless/prime_infrastructure/13/configuration/guide/pi_13_cg/ovr.pdf
http://www.cisco.com/c/en/us/products/security/security-manager/index.html
http://www.cisco.com/c/en/us/about/security-center/dnssec-best-practices.html
https://en.wikipedia.org/wiki/Malware
https://en.wikipedia.org/wiki/Security_information_and_event_management
https://en.wikipedia.org/wiki/Malware
https://ikrami.net/2014/05/19/siem-soc/
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_ssh/configuration/15s/sec-usr-ssh-15-s-book/sec-secure-copy.html
https://en.wikipedia.org/wiki/IEEE_802.1X
http://www.ciscopress.com/articles/article.asp?p=25477&seqNum=3
559
Appendix C: References
https://www.paessler.com/info/snmp_mibs_and_oids_an_overview
http://www.firewall.cx/downloads.html
https://en.wikipedia.org/wiki/Threat_(computer)#Threat_classification
http://www.cisco.com/c/en/us/products/security/ids-4215-sensor/index.html
https://en.wikipedia.org/wiki/Brain_(computer_virus)
560
About Our Products
About Our Products
Other products from IPSpecialist LTD regarding CSP technology are:
AWS Certified Cloud Practitioner Study guide
AWS Certified SysOps Admin - Associate Study guide
AWS Certified Solution Architect - Associate Study guide
AWS Certified Developer Associate Study guide
AWS Certified Advanced Networking – Specialty Study guide
AWS Certified Security – Specialty Study guide
AWS Certified Big Data – Specialty Study guide
Microsoft Certified: Azure Fundamentals
Microsoft Certified: Azure Administrator
561
About Our Products
Microsoft Certified: Azure Solution Architect
Microsoft Certified: Azure DevOps Engineer
Microsoft Certified: Azure Developer Associate
Microsoft Certified: Azure Security Engineer
Microsoft Certified: Azure Data Fundamentals
Microsoft Certified: Azure AI Fundamentals
Microsoft Certified: Azure Data Engineer Associate
Microsoft Certified: Azure Data Scientist
Other Network & Security related products from IPSpecialist LTD are:

CCNA Routing & Switching Study Guide
562
About Our Products















CCNA Security Second Edition Study Guide
CCNA Service Provider Study Guide
CCDA Study Guide
CCDP Study Guide
CCNP Route Study Guide
CCNP Switch Study Guide
CCNP Troubleshoot Study Guide
CCNP Security SENSS Study Guide
CCNP Security SIMOS Study Guide
CCNP Security SITCS Study Guide
CCNP Security SISAS Study Guide
CompTIA Network+ Study Guide
Certified Blockchain Expert (CBEv2) Study Guide
EC-Council CEH v10 Second Edition Study Guide
Certified Blockchain Expert v2 Study Guide
563