Security+ Study Guide Part 5

Chapter 15 : PKI and Encryption Protocols PKI (Public Key Infrastructure) A system of trust that uses public key crypto to bind a certificate to an identity Certificates Digitally signed electronic documents that binds a public key with an entity Mostly based on X.509 format to facilitate SSO Contains the following a) User information and public key b) Certificate authority information - Name, digital signature, serial number, issue/expiration date Mostly used for HTTPS connections, but can also be used for local encryption Types of SSL Certificates - Domain Validation - Organizational Validation - Extended Validation - Wildcard Certificates Single sided vs Double sided certificates Single sided – validates the server to its user/clients Double sided – Both server and user validates to each other Certificate Chain of Trust Used to validate different pieces of hardware & software Also provides scalability and flexibility Certificate Formats Identifying certificate formats by extension and encoding X.609 Encoding Rules a) BER (Basic Encoding Rule) b) CER (Canonical Encoding Rule) c) DER (Distinguished Encoding Rule) Certificate Formats and Extensions 1. PEM ASCII encoded, contains “Begin/End Certificate” stmts .pem/.crt/.cer/.key extensions Uses DER, .der is in pure binary 2. P12/PFX Pure binary encoding .pfx/.p12 extensions Used to import/export certificates and private keys Certificate Authorities Entity : Server that issues certificates to users Trust third party, often used in HTTPS connections Clicking on HTTPS padlock allows one to view cert details Invalid certs are placed on certification revocation list SSL pinning – attempts to prevent MitM Online certificate status protocol Key escrow Key recovery agent CA hierarchy w/ offline root CA Web of Trust Decentralized, self sign/publishing certificate system Used by PGP Security Protocols Overview Email Web Login : S/MIME, PGP : SSL, TLS Direct Conn. : SSH Virtual Conn. : PPTP, L2TP S/MIME Used for authentication, message integrity and non-repudiation Requires a digital ID certificate in MS Outlook to use SSL/TLS Used for secure internet communication such as browser, VoIP, email etc Relies on PKI for obtaining and validating certificates Asymmetric encryption (public key) ฀ Symmetric encryption (session key) Can employ SSL/TLS accelerator Also heavily used in E-commerce in HTTPS Downgrade attack (FREAK & DROWN) SSH Uses public key crypto to establish remote authenticated connections Also serves as basis for SFTP, SCP PPTP, L2TP, IPSec PPTP Protocol used for VPNs Supports PPP packets, designed for dial up but no security Considered insecure in most cases L2TP By default has no encryption or security, but powerful when combined - with IPSec Uses PKI when installed on Windows servers IPSec Authenticates and encrypts IP packets Operates on lower levels of OSI (Network) Made of 3 different protocols 1. Security Association (SA) 2. Authentication header 3. Encapsulating Security Payload 2 Modes of Implementation 1. Transport mode Secure transfer of data, encrypted packet payload Used within LAN or private network 2. Tunnel mode Entire packet is encrypted Facilitates VPN through internet Chapter 16 : Redundancy and Disaster Recovery Redundancy Planning Redundancy is key to avoiding single points of failure Redundant Power Keep servers and networks alive in failures Keep accessibility and minimize damage Common electrical problems 1. Power Surges & Spikes 2. Sags, brownouts and blackouts 3. Power supply failure Redundant Power Supplies Enclosure that contains two or more power supplies Common Vendors : HP, Cisco, Termaltake, Enlight UPS(Uninterruptable Power Supplies) Combined surge protector and backup battery (decoupling capacitors) Cleans up dirty/noisy power like line conditioners Considered temporary 5-30 min solution to resupply main or backup power SPS(Standby power supply) vs UPS(Uninterruptable power supply) Backup Generators Serves as emergency power supply for an entire system Standby Generators – automatically operates in a power outage Types of Generators a) Portable Gas Engine b) Permanently Installed c) Battery Inverter Considerations 1. Price 2. Manual vs Automatic Operation 3. Uptime / Capacity, Power Output 4. Fuel Source Common Vendors : Generac, Gillette, Kohler Redundant Data RAID Arrays RAID 0 – Data Striping RAID 1 – Data Mirroring RAID 5 – Striping with parity RAID 6 – Striping with double parity RAID 10 – 2 RAID 1 mirrors striped RAID Classification a) Failure Resistant b) Failure Tolerant c) Disaster tolerant * a < b < c in terms of protection scope Redundant Networking Server Network Adapters Plan to install multiple redundant adapters Consider centralized network adapter management software Main switch/router connection Always have spare switches/routers Avoid pure star topologies and single points of failures Internet Connection Dual and redundant ISP internet connections Consider mirror sites for web content Redundant Servers Goal : Minimize server downtime in failure and maximize throughput Failover clusters Designed so that secondary server takes over when primary fails Provides high availability Load balancing clusters Several servers share CPU, RAM, hard disk resources Commonly used in DNS, IRC and FTP servers Can also employ failover measures by replicating data between servers Redundant Sites (Physical locations) Hot site – Complete replication of entire network, servers & phone lines Warm site – Partial replication with some data recovery Cold site – Minimal equipment replication Redundant people Employ role takeover & primary/secondary personnel protocols Disaster Recovery Plans and Procedures Data Backup Tape Backup 1. Full backup 2. Incremental backup 3. Differential backup Backup Schemes 1. 10 tape rotation 2. Grandfather-father-son scheme (Daily, weekly, monthly) 3. Tower of Hanos scheme Snapshot backups DR Planning Types of Disasters 1. Fire 2. Flood 3. Long term power loss 4. Theft and attack 5. Loss of building access Disaster Recovery Plans Only include necessary information Things to Include - Contact Info - Impact Evaluation : Asset loss and replacement costs - Recovery Plan - Business continuity plan - Copies of various agreements - Disaster recovery drills - Critical system and data list Chapter 17 : Social Engineering, User Education and Facilities Security Social Engineering Scenarios 1. Pretexting 2. Malicious Insider 3. Diversion Theft 4. Phishing - Spearphishing - Whaling 5. Hoax 6. Shoulder Surfing 7. Eavesdropping 8. Dumpster Diving 9. Baiting 10. Piggybacking/tailgating - employ mantraps 11. Watering Hole attack Facilities Security Fire Suppression a) Fire extinguishers Fires are classified according to their source Most fire extinguishers will also cause damage to electronics 1. Class A : Solid combustibles 2. Class B : Flammable liquid and gas 3. Class C : Electrical (use CO2 extinguisher) Green Triangle Red Square Blue Circle 4. Class D : Metals (Magnesium, lithium etc) Yellow Decagon 5. Class K : Cooking oil Black Hexagon Currently most electronics friendly extinguisher use FE-36 Halotron b) Sprinkler Wet pipe : Most common type Dry pipe : Supply water only when needed Pre-Action : Prevents accidental water discharges c) Special Hazard Protection Systems Uses special liquid FM-200 Electronics safe d) HVAC (Heating, Ventilation and Air Conditioning) Manages temperature and humidity Hot and cold aisles SCADA Industrial Control Systems e) Shielding STP wires to prevent cable interference HVAC shielding Faraday cages TEMPEST guidelines Vehicles Disable mobile tethering in vehicles CAN (Control Area Network, vehicle’s onboard network) vulnerabilities GPS systems vulnerabilities Airgapped Control Systems Drones