Security+ Study Guide Part 4

Chapter 11 : Access Control Methods and Models Access Control Models : How admission to physical areas and computer systems are managed 1. Discretionary Access Control (DAC) - Determined by owner of file/folder - Owner decides how each user/group accesses his file 2. Mandatory Access Control (MAC) - Strictest form of access control, need to know basis - Each user is given clearance level and can only access files within level Eg) FOUO, Confidential, Secret, Top Secret - Rule based access control Access determined by comparing label to clearance level - Lattice based access control More complex, involves set mathematics 3. Role Based Access Control (RBAC) - Access controlled by a central authority - Various roles that have overlapping privileges are assigned to users 4. Attribute Based Access Control (ABAC) - Dynamic and context aware access control Basic Access Control Practices 1. Implicit Deny 2. Least Privilege 3. Separation of Duties 4. Job Rotation Rights, Permissions and Policies Users, Groups and Permissions Windows Active Directory - Users can be added to specific OUs or Users folder - Logon times and valid login dates can also be configured - Consolidate multiple accounts with Federated Identity Management/SSO - Group users with similar permissions together - NTFS Permissions 1) Full Control 2) Modify 3) Read & Execute 4) List Folder Contents 5) Read 6) Write Permission Inheritance and Propagation - Default behavior is child folder inherits parent folder permissions - Cannot change without disabling permission inheritance - Moving vs Copying data Copy : Inherits permission of destination folder Move : Retains original permission Username and Passwords - Weak and old pw is common avenue for data exfiltration - Never use default username/pw for admin (or anything) - Disable guest and unnecessary accounts - Ctrl + Alt + Delete to log in, ensures users are using keyboard Vs network connection - Use policy management Policies - Enforced rules configured either on individual machine or network - Password Policies 1. Enforce password history 2. Min – Max password age 3. Minimum pw length 4. Complexity requirements - Most are configured on OS level with AD domain controller UAC (User Account Control) - By default keeps all non-admin users without full admin rights Chapter 12 : Vulnerability and Risk Assessment Conducting Risk Assessment General Risk Management Strategies 1. Transfer risk to third party 2. Avoid the risk by not using specific tech/equipment 3. Reduce risk by minimizing damage and attack surface, implement defense 4. Accept the consequence Risk Assessment 1. Identify company assets 2. Identify vulnerabilities 3. Identify threats and likelihood 4. Identify monetary impact * Risk Register : Record of risk assessment, often referenced and updated Qualitative vs Quantitative Risk Assessment Qualitative Risk Assessment Assigns numeric values to probability of risk and impact Difficult to estimate exact values, must rely on history and survey Quantitative Risk Assessment Attempts to measure risk using exact monetary losses 1) Single Loss Expectancy (SLE) 2) Annual Rate of Occurrence (ARO) 3) Annual Loss Expectancy (ALE) = SLE X ARO 4) Mean time between failures (MTBF) Average # of failures in a million hours of operations Active vs Passive Security Analysis (Active vs Passive Reconnaissance) Active Security Analysis Employs actual testing (may interfere with regular operations) Active Scanning Passive Security Analysis Analyzing network documentation Passive fingerprinting Security Controls Categorical 1. Management : Focus on executive level decisions and risk management 2. Operational : Focus on individuals User awareness, incident handling, fault tolerance 3. Technical : Focus on the system, firewall configurations, IPS/IDS Definitive 4. Preventative : Employed before an event, designed to prevent 5. Detective : Employed during an event to find malicious activity 6. Corrective : Employed after an event to minimize damage Vulnerability Management Five step process 1. Define a desired state of security 2. Create a baseline 3. Vulnerability prioritization 4. Mitigate vulnerability 5. Monitor environment Penetration Testing A demonstration of vulnerabilities found in step 3 through exploits Black box (no knowledge), Gray box(limited knowledge), Glass box Pivot – Launching additional exploits after gaining network foothold Persistence and Backdoors Race Conditions Basic Methodologies 1. OSSTMM 2. NIST Pen Testing Standard OVAL – Standardized secure transfer of information on security Assessing Vulnerabilities with Security Tools Network Mapping Draw out the physical and logical connections of the network Use Network Topology Mapper AirMagnet(WiFi) Things to include in the diagram - Devices - IP Address - Role - Connections Vulnerability Scanning Nessus – Basic vulnerability scanner Nmap – Basic port scanner Network Enumeration and Banner Grabbing Network Sniffing Process of capturing and analyzing packets on a network Wireshark – Basic packet analyzer Fluke Networks – Hardware based network tester Password Analysis Use password crackers to test strength of passwords Cain and Abel – Basic password cracker John the Ripper, Hydra, Aircrack-ng suite etc Password Storage locations Windows – SAM hive, encrypted binary Linux - /etc/passwd or /etc/shadow, encrypted Chapter 13 : Monitoring and Auditing Monitoring Methodologies Focus on Automated Monitoring 1. Signature based monitoring Matches predetermined attack patterns and packets/frames Vulnerable to false negatives, need constant updates 2. Anomaly based monitoring Establishes a baseline and detects deviations from this baseline Inaccurate baseline leads to false positives 3. Behaviour based monitoring Compare previous application behavior and detects current anomalies Prone to false positive due to application diversity Using Tools to Monitor Systems and Networks Performance Baselining Baseline vs Baseline reporting Security posture vs Security Poster Assessment Protocol Analyzer Promiscuous vs Non-promiscuous mode for network adapters Broadcast Storm Analysis Header Manipulation Detection TCP Handshake Analysis Wireshark : Promiscuous mode capturing vs port mirroring vs network tap Tcpdump for Unix/Linux SNMP (Simple Network Management Protocol) TCP/IP, helps monitor network attached machines Typical usage scenarios a) Managed Devices b) Agents c) Network Management System Inbound vs Outbound management Analytical Tools compmgmt.msc & openfiles, net file & suite/netstat (Windows) lsof(list openfiles) & netstat (Linux) Static and Dynamic Tools Static : openfiles, netstat that takes snapshot of network Dynamic : Task Monitor, wireshark that captures packets over time Conducting Audits Manual Assessment Review of security logs, ACLs, user rights, permissions, group policy Vulnerability scans Personnel Interviews Overall Process 1. Define audit target 2. Create backups 3. Scan, analyze and create a list of vulnerabilities/issues 4. Calculate risk 5. Develop a plan to minimize risk and fix issues Auditing Files Able to set auditing and logging for file, folder and user Review logs to ensure non-repudiation & beware of permission hierarchy Logging compmgmt.msc in Windows allows viewing of security logs Also pay attention to system and application logs Syslog centralized log monitoring Log File Maintenance and Security Logfile size, configuration and encryption Backups and manually clear log files Auditing System Security Settings Manage shared folders and user privileges in compmgmt.msc Chapter 14 : Encryption and Hashing Concepts Types of Data a) Data in Use b) Data at Rest c) Data in Transit Symmetric vs Asymmetric Algorithms Symmetric : Uses same key for encryption/decryption ex) DES, AES, RC, Kerberos (Key distribution center) Stream vs Block Cipher modes Suited for large volumes of data, fast and efficient Asymmetric : Uses different keys for encryption/decryption ex)RSA, Diffie-Hellman, Elliptic curve Public and private keys are created for asymmetric key scheme Key Management : Generation and secure storage of strong passwords Steganography : Art of hiding information in various file formats, usually image files Encryption Algorithms DES/3DES DES – 64 bit block cipher with 56 bit key 3DES – 64 bit block cipher with 168 bit key AES 128 bit block size, variable key length (128, 192, 256 bit) Current standard, fast and suited for hardware acceleration RC Widely used stream cipher, but vulnerable Currently up to RC6 Blowfish/Twofish 128 bit block size with ~256 bit key size RSA 1024/2048 bit key size Slow, suited for signing or specific encryption Vulnerable to MitM attacks, reliant on PKI and digital certificates Diffie-Hellman Secure key exchange algorithm Also vulnerable to MitM attack, reliant on authentication methods Used in TLS Can also employ Ephemeral keys (EDH) for perfect forward secrecy Elliptic Curve Crypto (ECC) Used in similar fashion to DH but faster and more compact Can be adopted into other algorithms Used in VoIP, IPSec Vulnerable to side channel and fault injection Other Encryption Algorithms One time pads Fast, theoretically pefect information secrecy Practically dependent on security of PRNG PGP Uses various ciphers but mainly employs RSA Requires same versions to communicate properly, limitation PRNG Written in C or Java for efficiency Serves as a foundation for many cryptosystems Weak PRNGs are often a vulnerability Emerging : AI, Genetic algorithms and stylometry Hashing Basics Provides message integrity Cryptographic Hash Functions MD5 Used commonly for file integrity Prone to MD5 hash collision attacks SHA Current standard is 256/512 bit SHA-2 RIPEMD & HMAC LANMAN, NTLM, NTLMv2 Series of password hashing algorithms LANMAN Old Windows password hash based on DES Deprecated and now considered a liability Disable on either registry or local security policy NTLM/NTLMv2 NTLM : Based on RC4, now broken NTLMv2 : Based on HMAC-MD5 However, most Windows opt to use Kerberos instead Hashing Attacks Pass the Hash Uses the saved password hash value to create an authenticated session Mostly targets Windows/Kerberos for SSO function abuse Use unique session tokens, multifactor, least privilege Birthday Attack Attempt to create a message with hash collision to original message Targets hashes with weak hash collision resistance Additional hashing concepts Key Stretching / Salting