Instructor-Led Course

Cybersecurity Fundamentals

Name

Background

Contact Information

Facilitator Introduction

2

What is your involvement in cybersecurity?

A. Personal interest

B. Consulting

C. Full-time position

D. Dual role

Audience Poll Question

3

How many years of experience do you have

performing cybersecurity?

A. No experience

B. Less than 2 years

C. 2 – 5 years

D. 5+ years

Audience Poll Question

4

Have you ever been personally involved in a

cybersecurity incident?

A. Yes

B. No

Audience Poll Question

5

After completing this course you will be able to:

• Identify key concepts and terminology in

cybersecurity.

• Define the key concepts, roles and domains of

cybersecurity.

• Identify the various types of cybersecurity

architecture.

• Identify the key components of securing networks,

systems and applications and data.

• Identify and incident and outline the phases of

incident response.

• Identify the implications for adaption of evolving

technology.

Course Objectives

6

Topics Covered in This Course

7

Cybersecurity introduction and overview

Cybersecurity concepts

Security architecture principles

Security of networks, systems, applications and data

Incident response

Security implications of the adoption of emerging technologies

Section 1:Cybersecurity Introduction and Overview

1. Introduction and definition of cybersecurity

2. Comparison of cybersecurity and information

security

3. The objectives of cybersecurity

4. Cybersecurity roles and governance

5. Domains of cybersecurity

Topics Covered in This Section

9

Upon completing this section you will be able to:

• Define the key concepts, roles and domains

of cybersecurity.

Section Objectives

10

Topic 1:Introduction to Cybersecurity

“The protection of information assets by addressing threats to information

processed, stored and transported by internetworked information systems.”

What Is Cybersecurity?

12Source: ISACA, Cybersecurity Fundamentals Glossary, ISACA, USA, 2016

Cybersecurity and Other Security Domains

1313

Cyber Crime Cyber Safety

Situational Awareness

14

Knowledge of

information

threats

Understanding

of organizational

environment

Cybersecurity professionals

Level of IT complexity

Network connectivity (internal, third party, public)

Specialist industry devices/instrumentation

Platforms, applications and tools used

On-premise, cloud or hybrid systems

Operational support for security

User community and capabilities

New or emerging security tools

Technological Factors Impacting Security

15

Nature of the business

Risk tolerance and appetite

Security mission, vision and strategy

Industry alignment and security trends

Compliance requirements and regulations

Mergers, acquisitions and partnerships

Outsourcing of services or providers

Business-related Factors Impacting Security

16

Topic 2:Difference Between Information Security and Cybersecurity

Information Security

Focus: Protection of information,

regardless of format, including:

• Paper documents

• Digital and intellectual property

• Verbal or visual communications

Cybersecurity

Focus: Protection of digital assets,

including:

• Network hardware

• Software

• Information processed and stored in

isolated or networked systems

Information Security vs. Cybersecurity

18

RecoverPlan for resilience and the timely repair of compromised capabilities and services.

RespondTake appropriate action after learning of a security event.

DetectImplement activities to identify the occurrence of a cybersecurity event.

ProtectDesign safeguards to limit the impact of potential events on critical services and infrastructure.

IdentifyUse organizational understanding to minimize risk to systems, assets, data and capabilities.

Protecting Digital Assets

19

Topic 3:Cybersecurity Objectives

CONFIDENTIALITYThe protection of information

from unauthorized disclosure

INTEGRITYThe accuracy and completeness of

information in accordance with

business values and expectations

AVAILABILITYThe ability to access information

and resources required by the

business process

Key Information Security Concepts

21

CONFIDENTIALITYThe protection of information from

unauthorized disclosure

Loss Consequences and Preservation Methods

22

LOSS CONSEQUENCES INCLUDE:

• Disclosure of information protected

by privacy laws

• Loss of public confidence

• Loss of competitive advantage

• Legal action against the enterprise

• Interference with national security

• Loss of compliance

PRESERVATION METHODS INCLUDE:

• Access controls

• File permissions

• Encryption

INTEGRITYThe accuracy and completeness of

information in accordance with business

values and expectations

Loss Consequences and Preservation Methods

23

LOSS CONSEQUENCES INCLUDE:

• Inaccuracy

• Erroneous decisions

• Fraud

• Failure of hardware

• Loss of compliance

PRESERVATION METHODS INCLUDE:

• Access controls

• Logging

• Digital signatures

• Hashes

• Backups

• Encryption

Loss Consequences and Preservation Methods

24

AVAILABILITYThe ability to access information and

resources required by the business process

LOSS CONSEQUENCES INCLUDE:

• Loss of functionality and operational

effectiveness

• Loss of productive time

• Fines from regulators or a lawsuit

• Interference with enterprise’s

objectives

• Loss of compliance

PRESERVATION METHODS INCLUDE:

• Redundancy of network, system, data

• Highly available system architectures

• Data replication

• Backups

• Access controls

• A well-designed disaster recovery

plan or business continuity plan

Non-repudiation refers to the concept of ensuring that a message or other

information is genuine.

In cybersecurity, information received must be verified as coming from the actual

sending source indicated.

It is also important that neither sender nor receiver can later deny that they sent or

received the information.

Non-repudiation is implemented through digital signatures and transactional logs.

Non-repudiation

25

Topic 4:Cybersecurity Roles

BOARD OF DIRECTORS

Identifies key assets and verifies that protection levels

and priorities are appropriate

EXECUTIVE COMMITTEE

Sets the tone for cybersecurity management and ensure that

necessary functions, resources and infrastructure are available

and properly utilized

SECURITY MANAGEMENT

Develops security and risk mitigation strategies,

implements security programs and manages incidents

and remediation

CYBERSECURITY PRACTITIONERS

Design, implement and manage processes

and technical controls and respond to

events and incidents

Cybersecurity Roles

27

Topic 5:Cybersecurity Domains

Cybersecurity Concepts

Security Architecture Principles

Security of Networks, Systems,

Applications and Data

Incident ResponseSecurity Implications

and Adoption of Evolving Technology

Cybersecurity Domains

29

Section 1: Cybersecurity Introduction and OverviewReview Question

?

Who is responsible to design, implement and

manage processes and technical controls and

respond to events and incidents?

A. Board of Directors

B. Security Management

C. Executive Committee

D. Cybersecurity Practitioners

Review Question

31

?

Which of the following are the parts of the NIST

framework?

A. Identify, Control, Respond, Recover, Report

B. Identify, Mitigate, Protect, Respond, Recover

C. Control, Mitigate, Deter, Respond, Report

D. Identify, Protect, Detect, Respond, Recover

Review Question

32

?

Which of the following best defines

cybersecurity?

A. The protection of information assets by

addressing threats to information processed,

stored and transported by internetworked

information systems.

B. A device, such as a firewall, used to protect

organization for cyber attacks.

Review Question

33

?

Which of the following statements about

confidentiality is true?

A. Confidentiality is the protection of information

from unauthorized access or disclosure.

B. Confidentiality is the protection of information

from unauthorized modification.

C. Confidentiality ensures the timely and reliable

access to and use of information and systems.

Review Question

34

?

Which of the following is (are) skill(s) that

cybersecurity professionals should have?

A. Critical electronic data processes

B. Signal processing

C. Risk analytics

D. Information system security

E. All the above

Review Question

35

You should now be able to:

• Define the key concepts, roles and domains

of cybersecurity.

Section Summary

36

Section 2:Cybersecurity Concepts

1. Risk management terms, concepts and

frameworks

2. Common attack types and vectors

3. General process and attributes of

cyberattacks

4. Malware

5. Framework and guidance for policies and

procedures

6. Cybersecurity control processes

Topics Covered in this Section

38

Upon completing this section you will be able to:

• Define risk management terms, concepts and

frameworks.

• Identify common attack types and vectors.

• Define the framework and guidance for

policies and procedures.

• Identify cybersecurity control processes.

Section Objectives

39

Topic 1:Risk

Assessing risk is one of the most critical functions of a cybersecurity organization.

Using a risk-based approach to cybersecurity allows informed decision-making,

better protection, and effective application of budgets and resources.

Why a Risk-oriented Approach?

41

This approach simply implements security with no particular rationale or criteria.

It may be driven by vendor marketing, or reflect insufficient subject matter expertise, knowledge or training when designing and implementing safeguards.

Ad hoc

Also known as standards-based security, this approach relies on regulations or standards to determine security implementations.

Controls are implemented regardless of their applicability or necessity, which often leads to a “checklist” attitude toward security.

Compliance-based

This approach relies on identifying the unique risk a particular organization faces and designing and implementing security controls to address that risk above and beyond the entity’s risk tolerance and business needs.

The risk-based approach is usually scenario-based.

Risk-based

Approaches to Cybersecurity Risk

42

To understand risk and a risk-oriented approach, these key concepts are

important:

• Asset

• Threat Event

• Threat Source

• Vulnerability

• Inherent Risk

• Residual Risk

Key Terms and Definitions

43

Likelihood (or “probability”) measures of frequency of an event’s occurrence.

Calculations of likelihood:

• Depend on whether there is a potential threat and the extent to which the particular

type of event can affect its target (vulnerability).

• Take into account any controls or countermeasures that the organization has put in

place to reduce its vulnerability.

• Are used to calculate the risk that an organization faces based on the number of

events that may occur within a given time period.

Understanding Likelihood

44

Source: “Generic Risk Model with Key Risk Factors,” National Institute of Standards and Technology (NIST), Special Publication 800-30, Revision 1, Guide for

Conducting Risk Assessments, USA, September 2012

Framing Risk Management

45

A risk scenario is a description of a possible event whose occurrence will have an

uncertain impact on the achievement of the enterprise’s objectives, which may be

positive or negative.

Risk Scenario

46

Influencing Risk Factors

47

Cybersecurity can be more difficult to control when third parties are involved,

because different entities have different security cultures and risk tolerances.

Outsourcing and mergers and acquisitions can introduce security challenges

These arrangements can present risk that may be difficult to quantify and

potentially difficult to mitigate

Security strategy should consider all third-party arrangements with care to ensure

alignment with internal cybersecurity standards.

Third-party Risk

48

Topic 2:Common Attack Types and Vectors

Source: Marinos, Louis, A. Belmonte, E. Rekleitis, “ENISA Threat Landscape 2015,” ENISA, January 2016, Greece

Common Threat Agents

50

An attack is an activity by a threat agent (or adversary) against an asset.

There are two attack vectors: ingress and egress.

• Ingress attacks focus on intrusion or hacking into systems.

• Egress attacks are designed to remove data from systems and networks.

It is important to consider both attack vectors.

Attack Attributes

51

Threat Process

52

Some threat events are not the result of adversarial activity.

Common non-adversarial threat events include:

• Mishandling of critical or sensitive information by authorized users

• Incorrect privilege settings

• Fire, flood, hurricane, windstorm or earthquake at primary or backup facilities

• Introduction of vulnerabilities into software products

• Pervasive disk errors or other problems caused by aging equipment

Non-adversarial Threat Events

53

Virus

Worm

Trojan horse

Botnet

Spyware

Adware

Ransomware

Keylogger

Rootkit

APT

Backdoor

Brute force

XSS

DoS

Man-in-the-middle

Phishing

Spoofing

SQL injection

Zero-day exploit

Malware and Attack Types

54

Buffer overflow

Social engineering

?

Kaptoxa it was an example of what type of

attack?

A. SQL Injection

B. APT

C. Malware

D. Buffer overflow

E. DoS

Cyber Question

55

Topic 3:Policies and Procedures

Information security policies are a primary element of cybersecurity and overall

security governance. These policies:

• Specify requirements

• Define the roles and responsibilities within the organization

• Outline expected behaviors in various situations

Because of their importance, these policies must be properly created, accepted

and validated by the board and senior management before being communicated

throughout the organization.

Information Security Policies

57

Create

Review

Update

Approve

Each information security policy should be part of a formal policy life cycle

process.

Policy Life Cycle

58

Annual cycle

Compliance Document Types

59

Type Description

PoliciesCommunicate required and prohibited activities and

behaviors

Standards Interpret policies in specific situations

ProceduresProvide details on how to comply with policies and

standards

Guidelines

Provide general guidance on issues such as “what to do in

particular circumstances.” These are not requirements to

be met, but are strongly recommended.

COBIT 5 Information Security Policy Set

60

Access Control Policy

Personnel Information

Security Policy

Security Incident Response Policy

Types of Security Policies

61

The access control policy provides proper access to internal and external

stakeholders to accomplish business goals.

It should ensure that emergency access is appropriately permitted and revoked in

a timely manner.

The policy is meant for all business units, vendors and third parties, and should

cover at least the following topics:

• Physical and logical access provisioning life cycle

• Least privilege/need to know

• Segregation of duties

• Emergency access

Access Control Policy

62

The personnel information security policy objective incorporates, but is not limited

to, the following actions:

• Regular background checks of all employees and people at key positions

• Acquisition of information about key personnel in information security positions

• Development of a succession plan for all key information security positions

• Definition and implementation of appropriate procedures for termination, including

procedures for revoking account privileges and access

Personnel Information Security Policy

63

This policy addresses the need to respond to cybersecurity incidents in a timely

manner in order to recover business activities. The policy should include:

• Information security incident definitions

• Statement of how incidents will be handled

• Requirements for the establishment of the incident response team, with organizational

roles and responsibilities

• Requirements for the creation of a tested incident response plan

Security Incident Response Policy

64

?

MyDoom is an example of what type of attack?

A. Virus

B. Trojan horse

C. APT

D. Phishing

E. Social engineering

Cyber Question

65

Topic 4:Cybersecurity Controls

Identity Management

Provisioning and Deprovisioning

Authorization and Access Restrictions

Access Control Lists

Access Lists

Change Management

Privileged User Management

Configuration Management

Patch Management

Controls

67

Identity management includes many components, such as:

• Directory services

• Authentication services

• Authorization services

• User-management capabilities

Identity Management

68

User-management requires the provisioning and deprovisioning of passwords and

access control rights.

Provisioning occurs when a new user is created either through hiring or based on

shifting job requirements.

Deprovisioning occurs when a user leaves the organization.

This can be complicated, as users may need access to a variety of resources,

each of which has its own unique access controls.

Provisioning and Deprovisioning

69

The authorization process used for access control requires that the system be

able to identify and differentiate among users.

Access should be granted on a least privilege basis and can be set at various

levels, including:

• Read, inquire or copy only

• Write, create, update or delete only

• Execute only

• A combination of the above

Authorization and Access Restrictions

70

To provide security authorizations for files and facilities, logical access control

mechanisms use access authorization tables, referred to as access control lists

(ACL) or access control tables.

ACLs refer to a register of:

• Users (including groups, machines, processes) who have permission to use a

particular system resource

• The types of access permitted

• ACLs vary in their capability and flexibility, and care is required to ensure that user

access is appropriate for their current role.

Access Control Lists

71

Access lists filter traffic at network interfaces based on specified criteria, providing

basic network security.

When access lists are not present, network devices pass all packets.

After an access list is created and applied to an interface, it passes only traffic

permitted by rules.

Understanding the placement and impact of an access list is essential for the

cybersecurity practitioner as errors may stop network traffic.

Access Lists

72

Change Management

73

People

ProcessesTools

Assess

Design

Implement

Manage Change

Evaluate

Common controls for privileged user management include:

Privileged User Management

74

Background checks for

elevated access

Additional activity logging

Use of stronger passwords

Regular review and/or removal

of privileges

Configuration management focuses on maintaining the security of IT resources.

The security benefits of implementing a configuration management process

include:

• Verification of the impact on related items

• Assessment of risk related to a proposed change

• Ability to inspect different lines of defense for potential weaknesses

• Tracking of configuration items against approved secure baselines

• Insights into investigations after a security breach or operations disruption

• Version control and production authorization of hardware and software components

Configuration Management

75

Software patches are solutions to programming errors, some of which may introduce security

vulnerabilities.

Software vendors release regular software updates and patches as vulnerabilities are identified

and repaired.

As such, patching is an important part of vulnerability management.

Organizations must set up processes to identify patches that are relevant to their IT infrastructure.

Once a necessary patch is identified, it should be tested to ensure it does not negatively impact

operations.

After this verification, patching can be scheduled and the update installed where appropriate.

Patch Management

76

Section 2:Cybersecurity ConceptsReview Question

?

Which is a description of a possible event

whose occurrence will have an uncertain impact

on the achievement of the enterprise’s

objectives, which may be positive or negative.

A. Malicious

B. Risk Scenario

C. Advanced persistent threat

D. Brute force attack

Review Question

78

?

Patches are solutions to software programming

and coding errors.

A. True

B. False

Review Question

79

?

Access should be granted on a least privilege

basis and can be set at various levels, including

which of the following?

A. Read, inquire or copy only

B. Write, create, update or delete only

C. Execute only

D. A combination of the above

E. All the above

Review Question

80

?

Background checks for elevated access.

Additional activity login, the use of stronger

passwords, and regular review and/or removal

of privileges, best describes which of the

following.

A. Patch Management

B. Privileged User Management

C. Access Controls

D. Configuration Management

Review Question

81

You should now be able to:

• Define risk management terms, concepts and

frameworks.

• Identify common attack types and vectors.

• Define the framework and guidance for

policies and procedures.

• Identify cybersecurity control processes.

Section Summary

82

83

Section 3:Security Architecture

1. Overview of security architecture

2. The OSI model

3. Defense in depth

4. Information flow control

5. Isolation and segmentation

6. Logging, monitoring and detection

7. Encryption fundamentals, techniques and

applications

Topics Covered in This Section

84

Upon completing this section you will be able to:

• Identify the various types of cybersecurity

architecture.

• Define the OSI Model.

• Explain how various defense strategies work

to control flow, segment the network and log,

monitor and detect attacks.

• Outline encryption fundamentals, techniques

and applications.

Section Objectives

85

Topic 1:Overview of Security Architecture

Security architecture describes the structure, components, connections and layout

of security controls within an organization’s IT infrastructure.

An organization’s security architectures determine the particulars of various

subsystems, products and applications.

These particulars will, in turn, influence an organization’s approach to defense in

depth, or the practice of layering defenses to provide added protection.

Security architecture shows:

• How defense in depth is implemented

• How layers of control are linked

Security Architecture

87

• Focus on placing controls at the network and system levels

• Protect information stored within the perimeter of the network or system

System- or network-centric models

• Focuses on protecting data regardless of where it is stored

• Allows for application of controls without a clearly defined border

Data-centric model

Models of Cybersecurity

88

Many current security controls and architectures were developed with the concept

of a perimeter.

This perimeter is a well-defined, mostly virtual boundary between the organization

and the outside world.

With the advent of the Internet, outsourcing, mobile devices, cloud and other

hosted services, the security perimeter has expanded.

This means significant new risk and vulnerabilities are present in the environment.

The Security Perimeter

89

The Internet perimeter is an important component of the security perimeter.

This ensures secure access to the Internet for enterprise employees and guest

users, both in face-to-face and remote locations.

The Internet Perimeter

90

To provide security of email, front-end mobile and web apps, and domain name

system (DNS), the Internet perimeter should:

• Route traffic between the enterprise and the Internet

• Prevent executable files from being transferred through email attachments or web

browsing

• Monitor internal and external network ports for rogue activity

• Detect and block traffic from infected internal end point

• Control user traffic bound toward the Internet

• Identify and block anomalous traffic and malicious packets recognized as potential

attacks

• Eliminate threats such as email spam, viruses and worms

• Enforce filtering policies to block access to web sites containing malware or

questionable content

Internet Perimeter Functions

91

The perimeter should also provide protection for virtual private networks (VPNs),

wide area networks (WANs) and wireless local area networks (WLANs).

For VPNs, the protection must:

• Terminate encrypted VPN traffic initiated by remote users

• Provide a hub for terminating encrypted VPN traffic from remote sites, organizations

• Provide a hub for terminating traditional dial-in users

Network Security

92

Modern IT architectures are usually decentralized and deperimeterized,

increasing security risk across several fronts, including:

• Cloud-based platforms and services

• Smart and mobile devices

• Third-party products and services

• Weak and unsecured parts of the IT architecture

This interdependent environment means control has been reduced—a change

with important impacts on security architecture.

Interdependencies

93

Models of security architecture typically fall into two categories, as follows:

Models of Security Architecture

94

Process Model

• More directive in its approach

• Describes elements in terms of the processes used for them

Framework Model

• Allows flexibility in how each element of the architecture is developed

• Describes these elements, and how they relate to one another

The Zachman framework, shared by the Sherwood Applied Business Security

Architecture (SABSA), is one approach to security architecture.

This framework develops a who, what, where, when and how matrix that:

• Shows aspects of the enterprise that can be described or modeled

• Analyzes these from various viewpoints

Zachman and SABSA Framework

95

?

Stuxnet is a computer worm used to target?

A. SCADA systems

B. Government and financial institutions

C. Cloud data centers

D. Mobile devices

Cyber Question

96

Topic 2:The OSI Model

The OSI model defines groups of functionality required for network computers into

layers, described as follows:

1. Physical layer—Manages signals among network systems

2. Data link layer—Divides data into frames that can be transmitted by the physical layer

3. Network layer—Translates network addresses and routes data from sender to

receiver

4. Transport layer—Ensures that data are transferred reliably in the correct sequence

5. Session layer—Coordinates and manages user connections

6. Presentation layer—Formats, encrypts and compresses data

7. Application layer—Mediates between software applications and other layers of

network services

The Open Systems Interconnection (OSI) Model

98

The TCP/IP suite is used as the de facto standard for the Internet. This protocol:

• Includes both network-oriented protocols and application support protocols

• Operates at Layer 3 and Layer 4 of the OSI model

• Currently, there are two versions of IP that operate at Layer 3:o IPv4—The fourth revision of IP and the most commonly used to connect devices to the Internet

o IPv6—The newest version of IP, designed to allow for Internet growth

TCP/IP Protocol Suite

99

Topic 3:Defense in Depth

The layering of defenses is known as defense in depth, protection in depth or

security in depth.

Multiple control layers provide:

• Multiple opportunities for monitoring to detect the attack

• Additional controls the attacker must overcome, which creates a delay that may be

interrupt or prevent the attack

• It is often important to use several controls to protect an asset and the number and

types of layers needed is a function of such things as:

• Asset value and criticality

• The reliability of each control

• The degree of exposure

Defense in Depth

101

Defense in depth may also be viewed in terms of architecture:

• HORIZONTAL DEFENSE IN DEPTHo Controls are placed in various places in the path of access for an asset

• VERTICAL DEFENSE IN DEPTHo Controls are placed at different system layers

o These layers include hardware, operating system, application, database or user levels

An Architectural Perspective

102

When developing defense-in-depth implementations, consider the following

questions:

• What vulnerabilities are addressed by each layer or control?

• How does each layer mitigate the vulnerability?

• How does each control interact with or depend on the other controls?

Defense in Depth Implementations

103

Topic 4:Information Flow Control

A firewall is a system or combination of systems that enforces a boundary

between two or more networks.

Typically forms a barrier between a secure and an open environment such as the

Internet, apply rules to control the type of networking traffic flowing in and out.

Most commercial firewalls are built to handle commonly used Internet protocols.

Firewalls

105

• Packet Filters

• Stateful Inspection

• Application Proxy

• Next Generation Firewall

Firewall Technologies

106

A web application firewall (WAF) is a server plug-in, appliance or additional filter

that can be used to apply rules to a specific web application (usually to an HTTP

conversation).

The WAF operates at higher levels in the OSI model, generally at level 7.

In contrast, network firewalls operate at level 3 or level 4.

A WAF may be customized to identify and block many types of attacks, but

customization requires effort.

When changes to the application are made, the WAF rules need changes as well.

Web Application Firewalls (WAF)

107

Topic 5:Isolation and Segmentation

A common technique for implementing network security is to segment an

organization’s network.

Each segment may then be separately controlled, monitored and protected.

Virtual local area networks (VLANs) are groups of devices on one or more

logically segmented LAN. VLAN configuration usually has these features:

• No additional encryption

• Set up by configuring ports on a switch

• Set up based on logical rather than physical connections

Isolation and Segmentation

109

Separate zones allows the application of controls at a more granular level,

supporting defense in depth.

Isolation and Segmentation

110

Topic 6:Logging, Monitoring and Detection

Monitoring, detection and logging are integral parts of cybersecurity.

Attacks and data loss represent potential issues on both sides, so it is necessary

to monitor data and information flowing into and out of an organization.

A number of methods and tools can be used to detect and log potential problems.

Most of these methods revolve around the central concepts of ingress, egress

and data loss prevention.

Integral Components of Cybersecurity

112

A log is a record of events that occur within the systems and networks of an organization.

• One of the most valuable tools to monitor controls and detect risk, but often underutilized.

A log should contain a record of all important events that occur on a system, such as:

• Time of the event

• Changes to permissions

• System startup or shutdown

• Login or logout

• Changes to data

• Errors or violations

• Job failures

A failure to review the logs can result in the organization not being aware of an ongoing attack.

Logging

113

The use of a variety of security tools and platforms can create a high volume of

incoming security-related data, which must be analyzed and interpreted in order

to be useful.

Security event management (SEM) systems aid in reducing the resulting

overload.

The SEM automatically aggregates and correlates security event log data across

multiple security devices.

Security information and event management (SIEM) systems combine SEM

capabilities with the historical analysis and reporting features of security

information management (SIM) systems.

SEM and SIEM Systems

114

There are two types of attack vectors: ingress and egress.

Ingress and Egress

115

Internet

Traffic Flow

EgressIngress

Strong Data Loss Prevention (DLP) solutions cover three primary states of

information:

• Data at rest refers to stored data. DLP solutions must be able to log where various file

types are stored.

• Data in transit refers to data traveling through the network. Deep packet inspection

(DPI) is used to analyze the data for sensitive content.

• Data in use refers to data movement at the user workstation level. This includes

information sent to printers, thumb drives and the copy-and-paste clipboard.

Data Loss Prevention Software

116

?

NASA was hacked in 1999 using what method?

A. SQL Injection

B. APT

C. Back door

D. Buffer overflow

E. DoS

Cyber Question

117

Malicious software is one of the most common attack vectors used by adversaries

to compromise systems.

Controls are required for its detection and prevention.

Virus and malware intrusions can be controlled through a variety of mechanisms.

These include:

• Restriction of outbound traffic

• Policies and awareness training

• Multiple layers of anti-malware software

Antivirus and Anti-malware

118

An intrusion detection system (IDS) complements a firewall implementation by

working in conjunction with routers and firewalls to monitor anomalies in network

usage.

An IDS operates continuously on the system.

It runs in the background and notifies administrators when a perceived threat is

detected.

Intrusion Detection Systems

119

• Identifies attacks within the monitored network and issues a warning to the operator

• Detects attack attempts

• Not a substitute for a firewall, but rather a complement

Network-based IDS

• Configured for a specific environment

• Monitors internal operating system resources to warn of attacks

• Can detect the modification of executable programs and deletion of files

• Issues a warning if a privileged command is attempted

Host-based IDS

IDS Categories

120

An intrusion prevention system (IPS) is similar to IDS, but detects attacks and

prevents damage to the intended victim/host.

An IPS is active; in contrast, an IDS is passive.

The presence of an IPS:

• Limits damage or disruption to systems that are attacked

• Must be properly configured to be effective

Intrusion Prevention Systems

121

Topic 7:Encryption Fundamentals, Techniques and Applications

Encryption is the process of converting a plaintext message into a secure-coded

form of text called ciphertext.

A ciphertext cannot be understood without being converted back to plaintext.

The decryption process is the reverse of encryption.

It is done via a mathematical function and a special encryption/decryption

password called the key.

Encryption

123

Key elements of cryptographic systems include:

• Encryption algorithm – A mathematically-based function or calculation that encrypts or

decrypts data

• Encryption key – A piece of information similar to a password that makes the

encryption or decryption process unique

Key length – A predetermined length for the key

• The longer the key, the more difficult it is to compromise

Key Elements of Cryptographic Systems

124

• Use single, secret bidirectional keys that encrypt and decrypt

• Include DES, AES and Triple DES/DES3

Symmetric Key Systems

• Use pairs of unidirectional, complementary keys that only encrypt or decrypt

• One key is secret; the other is publicly known

• Include RSA, ECC

Asymmetric Key Systems

Types of Cryptographic Systems

125

Symmetric Cryptography

126

Symmetric Cryptography Advantages and Disadvantages

127

Advantages

• One key is used for both encryption and decryption

• Less complicated and use less processing power than asymmetric techniques

• Ideally suited for bulk data encryption

Disadvantages

• Difficult to distribute keys, particularly in e-commerce environments where customers are unknown, untrusted entities

• Carry the limitations of shared secret; for example, a symmetric key cannot be used to sign electronic documents

In asymmetric encryption process, two keys work together as a pair.

One key is used to encrypt data; the other is used to decrypt data.

Either key can be used to encrypt or decrypt, but once the key has been used to

encrypt data, only its partner can be used to decrypt the data.

This process solves the problem of delivering single symmetric keys to two people

who do not know each other but who want to exchange information securely.

Asymmetric Key Encryption

128

With asymmetric encryption, one key—the secret or private key—is known only to

one person.

The other key—the public key—is known by many people.

A message that has been sent encrypted by the secret (private) key of the sender

can be deciphered by anyone with the corresponding public key.

This forms the basis of authentication and non-repudiation because the sender

cannot later claim that he or she did not generate the message.

If the public key deciphers the message satisfactorily, one can be sure of the

origin of the message because only the sender (owner of the correspondent

private key) could have encrypted the message.

Authentication and Non-repudiation

129

A message that has been sent encrypted using the public key of the receiver may

be generated by anyone, but it can only be read by the receiver.

This is one basis of confidentiality.

In theory, a message that has been encrypted twice, first by the sender’s secret

key, and second by the receiver’s public key, achieves both authentication and

confidentiality objectives.

This is not commonly used because it could generate performance issues due to

being computationally-intensive and slower than symmetric algorithm solutions.

Authentication and Confidentiality

130

Asymmetric Algorithms for Symmetric Cryptography

131

A digital signature is an electronic identification of a person or entity created by using a public key

algorithm. This cryptographic method ensures:

• Data integrity—Any change to the plaintext message would result in the recipient failing to

compute the same message hash.

• Authentication—The recipient can ensure that the message has been sent by the claimed

sender since only the claimed sender has the secret key.

• Non-repudiation—The claimed sender cannot later deny generating and sending the message.

• A cryptographic hashing algorithm, called a checksum, is computed against the entire message

or electronic document, generating a small fixed-string message.

• This process creates a message digest, which is a smaller extrapolated version of the original

message.

• Common types of message digest algorithms are SHA-256 and SHA-512.

• These are one-way functions, and the process of creating message digests cannot be reversed.

Digital Signature

132

The next step verifies the identity of the sender by encrypting the message digest

using the sender’s private key.

The document is then “signed” with the sender’s digital signature for message

authenticity.

To decipher, the receiver would use the sender’s public key, proving that the

message could only have come from the sender.

The sender cannot later claim that they did not generate the message.

Once decrypted, the receiver will compute the hash again, using the same

hashing algorithm on the electronic document.

Comparing the results with what was sent ensures the integrity of the message.

Message Integrity

133

?

Password cracking it was an example of what

type of attack?

A. SQL Injection

B. Worm

C. Malware

D. Brute force attack

E. DoS

Cyber Question

134

The use of cryptosystems by applications, for example in email and Internet

transactions, generally involves a combination of private/public key pairs, secret

keys, hash functions and digital certificates.

The purpose of applying these combinations is to achieve confidentiality,

message integrity or non-repudiation by either the sender or recipient.

The process generally involves the sender hashing the message into a message

digest or pre-hash code for message integrity, which is encrypted using the

sender’s private key for authenticity, integrity and non-repudiation.

Applications of Cryptographic Systems

135

Digital Certificates

Registration Authority (RA)

Certificate Authority (CA)

ELEMENTS OF PKI

Public key infrastructure (PKI) allows a trusted third party to issue, maintain and

revoke public key certificates.

Public Key Infrastructure

136

A digital certificate is composed

of a public key and identifying

information about the owner of

the public key.

An RA is an authority in a

network that verifies user

requests for a digital

certificate and tells the CA to

issue it.

The CA is an authority in a

network that issues and

manages security

credentials and public keys

for message signature

verification or encryption.

PROTOCOL LAYER FUNCTION

HTTPS Application layer • Transmits messages securely by establishing an TLS-type

connection

• Directs messages to secure port numbers instead of default

web port address

IPSec Network layer • Establishes VPNs via transport and tunnel mode encryption

methods

• Establishes security associations to define security

parameters between communicating parties

SSH Application layer • A client-server program that opens a secure, encrypted

command-line shell session for remote logon

• Validates both parties’ credentials via digital certificates

S/MIME • A standard secure email protocol

• Authenticates identity of sender and receiver to ensure

privacy of message contents (including attachments)

SET Application layer • Secures payment transactions using third parties and digital

signatures

• As an open system specification, requires a PKI infrastructure

Other Protocols

137

Encryption is an effective and increasingly practical way to restrict access to

confidential information while in storage.

Encryption can protect data from hackers who, by means of malicious software,

obtain systems administration rights.

It also helps to protect data when a computer or a disk falls into the wrong hands.

Many email encryption programs can also be applied to stored data.

Encryption of Stored Data

138

The security of encryption methods relies mainly on the secrecy of keys.

In general, the more a key is used, the more vulnerable it will be to compromise.

The randomness of key generation is also a significant factor in the ability to

compromise a key.

When passwords are tied into key generation, the strength of the encryption

algorithm is diminished, particularly when common words are used.

It is essential that effective password syntax rules are applied and easily guessed

passwords are prohibited.

Encryption Risk and Key Protection

139

Section 3: Security ArchitectureReview Question

?

A web-server building block where it is exactly

specified how a web server should be deployed

and what process is and is not allowed within

that block is an example of which of the

following?

A. Process Model

B. Framework Model

Review Question

141

?

This layer of the OSI model manages signals

among network systems.

A. Physical layer

B. Data link layer

C. Network layer

D. Transport layer

E. Session layer

F. Presentation layer

G. Application layer

Review Question

142

?

The number of layers needed for defense in

depth are a function of which of the following?

A. Asset value, criticality, reliability of each control,

and degree of exposure.

B. Threat agents, governance, compliance and

mobile defense policy.

C. Network configuration, navigation controls, user

interface and VPN traffic.

D. Isolation, segmentation, internal controls and

external controls.

Review Question

143

?

Which of the following is (are) true about

VLANs?

A. Made up of groups of devices on one or more

logically segmented LAN.

B. No additional encryption

C. Set up by configuring ports on a switch

D. Set up based on logical rather than physical

connections

E. All the above

Review Question

144

?

Which of the following is (are) true about

encryption?

A. The more a key is used, the more vulnerable it will be

to compromise.

B. The randomness of key generation is also a

significant factor in the ability to compromise a key.

C. When passwords are tied into key generation, the

strength of the encryption algorithm is diminished,

particularly when common words are used.

D. It is essential that effective password syntax rules are

applied and easily guessed passwords are prohibited.

E. All the above

Review Question

145

You should now be able to:

• Identify the various types of cybersecurity

architecture.

• Define the OSI Model.

• Explain how various defense strategies work

to control flow, segment the network and log,

monitor and detect attacks.

• Outline encryption fundamentals, techniques

and applications.

Section Summary

146

Email ScenarioGroup Activity

Tricia who works for ACME Corp is

checking her email at work. While

checking her email she opens this from

a known sender.

She opens the attachment from the

cloud because it is a known and trusted

sender. Soon others in her department

are receiving an email from her

containing the same information.

Scenario

148

Eva

Eva

Eva

What type of attack did Tricia encounter?

Why doesn’t the email get marked as spam?

How can this type of attack be controlled?

Discussion

149

Section 4:Security of Networks, Systems, Applications and Data

1. Process controls, including:

• Risk assessments

• Vulnerability management

• Penetration testing

2. Network security

3. Operating system security

4. Application security

5. Data security

Topics Covered in this Section

151

Upon completing this section you will be able to:

• Determine, assess and respond to risk and

vulnerabilities on the network through

penetration testing.

• Identify key aspects and associated risks to

securing data, applications, operation

systems and the network.

Section Objectives

152

Topic 1:Process Controls – Risk Assessment

Risk assessment is a process used

to identify and evaluate risk and its

potential effects. It involves three

inputs:

• Asset assessment

• Threat assessment

• Vulnerability assessment

Risk Assessment

154Source: Encurve, LLC, Risk Management Concepts Presentation, 2013

Risk

Assets

Criticality

Value

Threats

Adversary

Characteristics

Likelihood

ImpactAttacks &

Exploits

Existing

Controls

Access

Vulnerability

Source: ISACA, COBIT 5 for Risk, 2013

Risk Management

155

ORIENTATION DESCRIPTION

Asset Important assets are defined first, and then potential threats

to those assets are analyzed. Vulnerabilities are identified

that may be exploited to access the asset.

Threat Potential threats are determined first, and then threat

scenarios are developed. Based on the scenarios,

vulnerabilities and assets of interest to the adversary are

determined in relation to the threat.

Vulnerability Vulnerabilities and deficiencies are identified first, then the

exposed assets and potential threat events are determined.

Risk Assessment Orientations

156

Choosing the exact method of analysis, including qualitative or quantitative

approaches, and determining the analysis orientation, takes considerable

planning and knowledge of specific risk assessment methodologies.

To be successful, the risk assessment process should:

• Fit the goals of the organization

• Adequately address the environment being assessed

• Use assessment methodologies that fit collected data

• It is important to remember that risk assessment is an ongoing process.

Risk Assessment Success Criteria

157

• Implementation of controls or countermeasures to reduce likelihood or impact of risk to acceptable levels

Risk Reduction

• Avoid risk by not participating in an activity or business

Risk Avoidance

• Transfer risk to third party (e.g., insurance) or share with a third party via contractual agreement

Risk Transfer or Sharing

• Assume the risk and absorb losses if risk is within tolerance or the cost of mitigation exceeds potential loss

Risk Acceptance

Risk Response Strategies

158

Risk assessment results are used for a variety of security management functions.

They should be evaluated in terms of the organization’s mission, risk tolerance,

budgets and other resources, and cost of mitigation.

• Based on this evaluation, a mitigation strategy can be chosen for each risk and

appropriate controls and countermeasures can be designed and implemented.

Results can be used to communicate the risk decisions and expectations of

management throughout the organization through policies and procedures.

They can also be used to identify areas in which incident response capabilities

need to be developed.

Using the Results of the Risk Assessment

159

Topic 2:Process Controls—Vulnerability Management

Organizations must identify and assess vulnerabilities to determine the threat and

potential impact they present.

Vulnerability assessment aids in determining the best course of action in

addressing each vulnerability.

Vulnerabilities may be identified by information provided by software vendors

(e.g., through the release of patches and updates) and by utilizing tools that

identify vulnerabilities in the organization’s specific environment.

Vulnerability management starts by understanding the IT assets and where they

reside—both physically and logically.

Vulnerability management also includes tracking vulnerabilities and the

remediation efforts to mitigate them.

Vulnerability Management

161

Vulnerability scans should be conducted regularly.

Vulnerability scanning is the process of using proprietary or open source tools to

search for known vulnerabilities.

Often the same tools used by adversaries to identify vulnerabilities are used

proactively by organizations to locate vulnerabilities.

There are many forms of vulnerability assessment tools.

Tools should be researched and selected based on corporate needs and return

on investment.

Note that combinations of tools often provide greater insight to your networks

security posture.

Vulnerability Scans

162

TYPE CAUSE CYBERSECURITY EXAMPLES

Technical Errors in design,

implementation,

placement or

configuration

• Coding errors

• Inadequate passwords

• Open network ports

• Lack of monitoring

Process Errors in operation • Failure to monitor logs

• Failure to patch software

Organizational Errors in management,

decision-making, planning

or ignorance

• Lack of policies

• Lack of awareness

• Failure to implement controls

Emergent Interactions between, or

changes in, environments

• Cross-organizational failures

• Interoperability errors

• Implementing new technology

The simplest definition of a vulnerability is “an exploitable weakness that results in

a loss.”

Common Types of Vulnerabilities

163

Vulnerabilities must be analyzed in the context of how they are exploited.

The method used to take advantage of a vulnerability is called an exploit.

Both vulnerabilities and exploits need to be considered in vulnerability

assessments.

Once vulnerabilities are identified and assessed, appropriate remediation can

take place to mitigate or eliminate the vulnerability.

Remediation may be through a patch management process or require

reconfiguration of existing controls or addition of new controls.

Vulnerability Assessment

164

?

Password cracking it was an example of what

type of attack?

A. SQL Injection

B. Worm

C. Malware

D. Brute force attack

E. DoS

Cyber Question

165

Topic 3:Process Controls – Penetration Testing

Penetration testing uses common exploit methods to:

• Confirm exposures

• Ensure compliance

• Assess the effectiveness and quality of existing security controls

• Identify how specific vulnerabilities expose IT resources and assets

Penetration Testing

167

Before conducting a penetration test:

• Clearly define the scope of the test.

• Provide explicit, written permission authorizing testing.

• Implement “do no harm” procedures to ensure no assets are harmed (e.g., deletions,

denial-of-service).

• Have communication and escalation plans.

Testing Guidelines

168

Penetration testing should use a framework to deliver repeatability, consistency

and high quality in various kinds of security tests. These frameworks include:

• PCI Penetration Testing Guide—Provides a good introduction to testing tools

• Penetration Testing Execution Standard—Provides hands-on technical guidance on

penetration testing

• Penetration Testing Framework—Provides a comprehensive guide to penetration

testing and testing tools

• Information Systems Security Assessment Framework (ISSAF) —Provides

comprehensive penetration technical guidance

• Open Source Security Testing Methodology Manual (OSSTMM) —Provides a

methodology for testing operational security and can support ISO 27001

Penetration Testing Frameworks

169

Phases of a Penetration Test

170

Attack Phase

171

Topic 4:Network Security

Network management is the process of assessing, monitoring and maintaining

network devices and connections.

The recommended functions of network management include:

• Fault management—Detection, isolation, notification and correction of faults

encountered in the network

• Configuration management—Configuration file management, inventory management

and software management

• Accounting management—Usage information regarding network resources

• Performance management—Monitoring and measurement pf various aspects of

performance metrics so that acceptable performance can be maintained

• Security management—Provision of access to network devices and corporate

resources to authorized individuals

Network Management

173

A local area network (LAN) covers a small, local area—from a few devices in a

single room to a network across a few buildings.

As LANs get larger and traffic increases, the requirement to carefully plan the

logical configuration of the network becomes more important.

Tracking traffic volumes, error rates and response times is as important on larger

LANs as it is on distributed servers and mainframes.

Local Area Networks

174

Components commonly associated with LANs include:

• Repeaters—Physical layer devices that extend the range of a network or connect two

separate network segments together.

• Hubs—Physical layer devices that serve as the center of a star-topology network or a

network concentrator.

• Layer 2 switches—Layer 2 switches are data link-level devices that can divide and

interconnect network segments and help to reduce collision domains in Ethernet-based

networks.

• Routers—OSI network layer devices that link two or more physically separated and

independent network segments.

LAN Components

175

Layer 3 and 4 switches—These switches act at the network layer.

• A Layer 3 switch looks at an incoming packet’s networking protocol, and compares the

destination IP address to the list of addresses in its tables, actively calculating the best

way to send a packet to its destination. This creates a “virtual circuit.”

• A Layer 4 switch allows for policy-based switching. With this functionality, the switch

can off-load a server by balancing traffic across a cluster of servers, based on

individual session information and status.

Layer 4 – 7 switches—Also known as content-switches, content services

switches, web-switches or application-switches, these are typically used for load

balancing among groups of servers.

LAN Components (Cont’d)

176

Both local area and wide area networks are susceptible to people- and virus-related threats

because of the large number of individuals who have access rights.

Fortunately, newer versions of network software have significantly more control and administration

capabilities as software vendors have recognized the need to provide capabilities to identify the

cause network outages or dysfunction.

Network access control (NAC) aims to control the access to a network using policies describing

how devices can secure access to network nodes when they first try to access a network.

Some NAC features include:

• Integrating an automatic remediation process that fixes noncompliant nodes before access is

allowed

• Enabling network infrastructure to work with back office services and end-user computing to

ensure that the network is secure prior to allowing access

LAN and WAN Security

177

Loss of data through unauthorized

changes

Lack of current data protection through inability to maintain

version control

Exposure to external activity through

limited user verification

Virus and worm infection

Improper disclosure of data because of

general access

Violating software licenses

Illegal access by impersonating

legitimate users

Internal users sniffing

Internal users spoofing

Destruction of logging and auditing

data

Risk associated with the use of LANs includes:

LAN Risk

178

Commonly available network security administrative capabilities include:

• Declaring ownership of programs, files and storage

• Limiting access to a read-only basis

• Implementing record and file locking to prevent simultaneous update

• Enforcing user ID/password sign-on procedures, including rules relating to password

length, format and change frequency

• Using switches to implement port security policies

• Encrypting local traffic using IPSec (IP security) protocol

LAN Security Provisions

179

Wireless technologies use radio frequency transmissions or electromagnetic

signals through free space as the means for transmitting data.

Wireless technologies range from complex systems to simple devices and include

wireless local area networks (WLAN).

WLAN technologies conform to a variety of standards and offer varying levels of

security features.

The principal advantage of these standards is to encourage mass production and

allow products to interoperate across vendors.

The most useful standard used currently is the IEEE 802.11 standard.o 802.11 refers to a family of specifications for WLAN technology, defining an over-the-air interface

between a wireless client and a base station or between two wireless clients.

Wireless Technologies

180

Wireless data transmission is subject to a higher risk of interception than wired traffic.

There is no need to manually tap into the connection, but rather remote tools can be used to

intercept the connection covertly.

As a result, wireless transmission of confidential information should be protected with strong

encryption.

IEEE 802.11’s Wired Equivalent Privacy (WEP) encryption uses symmetric, private keys.

The end user’s radio-based network interface controller (NIC) and access point must have the

same key.

Most often, these keys remain unchanged on networks for extended times.

With static keys, several hacking tools easily break through the relatively weak WEP encryption

mechanisms.

Wireless Network Protections

181

?

Which of the following is good advice to prevent

socially engineered attacks?

A. Do not open any emails from untrusted sources

B. Install anti-virus software

C. Lock your laptop

D. All the above

Cyber Question

182

The most commonly used method for wireless local area networks is 802.11i

(WPA2) and Wi-Fi Protected Access (WPA).

These use dynamic keys and can use an authentication server with credentials to

increase protection against hackers.

WPA and WPA2 (preferred) are applicable to most wireless networks and

commonly used in networks that involve PCs.

Messages transmitted using portable wireless devices should also be protected

with encryption and, where possible, VPN methods can be used to provide

additional security.

Evolving Wireless Security Standards

183

When using the Internet communications protocol, Transmission Control Protocol/Internet Protocol

(TCP/IP), designating a port is the way a client program specifies a particular server program on a

computer in a network.

A port number is a way to identify the specific process to which an Internet or other network

message is to be forwarded when it arrives at a server.

These are assigned by the Internet Assigned Numbers Authority (IANA).

Allowable port numbers range from 0 to 65535. These are divided into three ranges, as follows:

• The well-known ports—0 through 1023: These can be used only by system (or root) processes

or by programs executed by privileged users.

• The registered ports—1024 through 49151: Can be used by ordinary user processes or

programs executed by ordinary users.

• The dynamic and/or private ports—49152 through 65535: Not listed by IANA because of their

dynamic nature.

Ports and Protocols

184

PORT # SERVICE PROTOCOL

110 POP3 (post office

protocol)

TCP

111/

2049

SunRPC (remote

procedure calls)

TCP/UDP

135-139 NBT (Net BIOS over

TCP/IP)

TCP/UDP

161, 162 SNMP (simple network

management protocol)

UDP

512 Exec UDP

513 Login TCP

514 Shell TCP/UDP

6000-xxx X-Windows TCP

8000 HTTP TCP/UDP

8080 HTTP TCP/UDP

31337 Back Orifice UDP

Commonly Exploited Ports and Services

185

PORT # SERVICE PROTOCOL

7 Echo TCP/UDP

19 chargen TCP

20-21 FTP (file transfer

protocol)

TCP

23 Telnet (remote login) TCP

25 SMTP (simple mail

transfer)

TCP

43 Whois TCP/UDP

53 DNS (domain name

system)

TCP

69 TFTP (trivial file transfer

protocol)

UDP

79 Finger TCP

80 HTTP-low TCP

107 Rtelnet TCP/UDP

In tunneling, malicious insiders or outside hackers use the protocol as an

established pathway, or tunnel, directing the exchange of information for malicious

purposes.

Examples of types of tunneling include:

• ICMP tunneling—Used to bypass firewalls rules through obfuscation of the actual

traffic.

• HTTP tunneling—A technique by which communications performed using various

network protocols are encapsulated using the HTTP protocol.

Tunneling

186

Tunneling transports higher-layer data over a VPN by Layer 2 protocols.

Common types of tunneling include:

• Point-to-point tunneling protocol (PPTP)—A Layer 2 protocol developed by Microsoft

that encapsulates point-to-point protocol data. It is simple, but less secure than other

tunneling protocols.

• Layer 2 tunneling protocol (L2TP)—A protocol that encapsulates point-to-point protocol

data and is compatible among different manufacturers’ equipment.

• Secure Sockets Layer VPN—A form of Layer 3 VPN that can be used with a standard

Web browser and uses transport layer security (TLS) protocols to encrypt traffic.

• IPSec VPN—IPSec VPNs protect Layer 2 and 3 IP packets between remote networks

or hosts and an IPSec gateway/node located at the edge of a private network.

VPN Tunneling

187

Users often expect that all voice communications are confidential.

Any Voice Over Internet Protocol (VoIP) device is an IP device; therefore, it is

vulnerable to the same types of attacks.

VoIP networks have a number of characteristics that make for special security

requirements.

There is no scheduled downtime in telephony, and outages may result in massive,

widespread customer panic or outrage.

There can also be disclosure of confidential information, leading to adverse

effects.

Voice Over Internet Protocol

188

Remote access connectivity to their information resources is required for many

organizations for different types of users.

A variety of methods and procedures are available to satisfy an organization’s

need for access, but these can introduce risk.

For example, using VPNs to allow remote access to their systems can create

holes in an organization’s security infrastructure, and encrypted traffic can hide

unauthorized actions or malicious software that can be transmitted through such

channels.

• To reduce VPN access risks, architectural controls can be implemented to restrict

remote access traffic to selected security hardened and virus-protected systems,

remote access portals and non-sensitive network segments.

Remote Access

189

Denial-of-service (DoS)

Malicious third parties

Misconfigured communications

software

Misconfigured devices on computing

infrastructure

Host systems not secured

appropriately

Physical security issues

Remote access risk includes:

Remote Access Risk

190

Remote access controls include:

• Policy and standards

• Proper authorizations

• Identification and authentication mechanisms

• Encryption tools and techniques, such as use of a VPN

• Restriction of access to controlled systems, networks and applications

Remote Access Controls

191

Topic 5:Operating System Security

System hardening is the process of implementing security controls on a computer system.

Most computer vendors to set the default controls to be open, allowing ease of use over security.

Significant vulnerabilities may be present unless the system is hardened.

Common controls for system hardening include:

• Authentication and authorization

• File system permissions

• Access privileges

• Logging and system monitoring

• System services

System Hardening Controls

193

A user’s credentials define who they are and what permissions they have to

access resources within the system.

Passwords are the standard mechanism to authenticate a user to the system.

In another form of access limitation, privileges may be assigned to a particular

user.

To prevent misuse or compromise, these must be carefully chosen and controlled.

User access may be also limited through logon constraints regarding time of day,

logged-in duration, source address and number of unsuccessful logon attempts.

Credentials and Privileges

194

Hardening is a process that reduces vulnerability by limiting the attack vectors

that might be used as points of compromise. A hardened system:

• Does not store sensitive data not immediately needed to support a business operation.

• Has all unnecessary functionality disabled, including ports, services and protocols that

are not required for the intended use.

• Uses only passwords and accounts that have been changed or disabled. No default

passwords or guest accounts are present.

Platform Hardening

195

ADVANTAGES DISADVANTAGES

Server hardware costs may decrease for server builds

and maintenance.

Inadequate configuration of the host could create

vulnerabilities that affect hosts and guests.

Multiple OSs can share processing capacity and

storage space, reducing operating costs.

Exploits of vulnerabilities or a denial of service attack

could affect all of the hosts guests.

The physical footprint of servers may decrease within

the data center.

A compromise of the management console could grant

guests unapproved administrative access.

A single host can have multiple versions of the same

OS, or even different OSs.

Data could leak between guests if memory is not

released and allocated properly by the host.

Creation of duplicate copies of guests in alternate

locations can support business continuity efforts.

Insecure remote access protocols could result in

exposure of administrative credentials.

A single machine can house a multitier network in an

educational lab environment.

Performance issues of the host’s own OS could

impact each of the host’s guests.

Virtualization provides an enterprise with a significant opportunity to increase

efficiency and decrease costs in its IT operations.

Virtualization

196

In a virtualized environment, the host represents a potential single point of failure

within the system.

A successful attack on the host could result in a compromise that is larger in both

scope and impact.

To address this risk, an enterprise can often implement and adapt the same

principles and best practices for a virtualized server environment that it would use

for a server farm. These include:

• Strong physical and logical access controls

• Sound configuration management practices and system hardening for the host

• Appropriate network segregation

• Strong change management practices

Virtualization Risk

197

Some computer systems and applications are very specialized and may have

unique threats and risk and require different types of controls.

Examples of specialized systems include supervisory control and data acquisition

(SCADA) systems or other real-time monitoring or control systems.

These operate in specialized environments controlling critical industrial and

manufacturing processes, power generation, air traffic control systems, and

emergency communications and defense systems.

Security was not considered in many existing deployments of SCADA systems,

and risk and threat assessment and appropriate mitigation is required.

Specialized Systems

198

?

WannaCry is an example of what type of

attack?

A. Trojan horse

B. APT

C. Ransomware

D. Phishing

E. Social engineering

Cyber Question

199

Topic 6: Application Security

The SDLC process guides the phases

of developing or acquiring a software

system. It includes:

• IT processes for managing and

controlling project activity

• An objective for each phase of the life

cycle, typically described with key

deliverables, a description of

recommended tasks and a summary of

related control objectives for effective

management

• Incremental steps or deliverables that lay

the foundation for the next phase

System Development Life Cycle (SDLC)

201

Not considering the security in the design of a system or application is a major

contributing factor to cybersecurity vulnerabilities.

Security is often an afterthought, with controls retrofitted only after security

weaknesses have been exposed.

Security and risk mitigation should be formal design criteria in any SDLC process,

including:

• Threat and risk assessment of the proposed system

• Identification and implementation of controls

• Vulnerability testing and review

Security Within SDLC

202

Injection

Broken Authentication

Sensitive Data Exposure

XML External Entities (XXE)

Broken Access Control

Security Misconfiguration

Cross-Site Scripting (XSS)

Insecure Deserialization

Using Components with Known

Vulnerabilities

Insufficient Logging & Monitoring

OWASP Top Ten Application Security Risks, 2017

203

The testing phase of SDLC includes:

• Verification and validation that programs, applications and controls perform the

functions for which they have been designed.

• Confirmation that the tested units operate without malfunction or adverse effect on

other components of the system.

• Vulnerability and control testing, taken from a security perspective.

• The review phase of SDLC includes:o Code review processes varying from informal processes to formal walk-throughs

o Team review or code inspections

Note that security should be an integrated part of any review process.

SDLC Testing and Review Phases

204

Separate development, testing and production environments should be used

during SDLC to minimize a compromise or misconfiguration being introduced or

cascading through the process.

Different access controls (credentials) should be used between these different

environments.

Note that if production data are used in the test environment, private or personally

identifiable information should be scrambled so that confidential information is not

inadvertently disclosed.

Development and Testing Environments

205

Agile allows software development projects to be built in a more flexible, iterative

fashion.

This allows a quicker response to changes that occur during a project.

It also facilitates security testing at earlier stages in the development process.

Development and IT Operations (DevOps) combines the concepts of agile

development, agile infrastructure and flexible operations.

DevOps breaks large projects into smaller and more manageable deliverables

and multiple deployments.

These smaller deployments may be more easily debugged during the

development process.

Agile and DevOps Development Approaches

206

Cybersecurity practitioners must be aware of a variety of security threats. In

addition to those already discussed, be aware of the following threats:

• Covert channel—Transfers information between systems illicitly, using existing

infrastructure

• Race condition—Accesses networks on an unauthorized basis, using operations

processing vulnerabilities

• Return-oriented programming attack—Exploits memory corruption vulnerabilities

• Steganography—Conceals messages, images or files within another similar file

Additional Threats

207

WAP protocols bring Internet content to wireless mobile devices.

WAP supports most wireless networks and is supported by all operating systems

specifically engineered for handheld devices and some mobile phones.

These devices use displays and access the Internet through micro-browsers.

Micro-browsers have small file sizes that can accommodate the low-memory

constraints of handheld devices and the low-bandwidth constraints of a wireless

handheld network.

Wireless Application Protocol (WAP)

208

Topic 7:Data Security

Data Classification Process

210

When classifying data, the following requirements should be met:

• Access and authentication

• Privacy

• Availability

• Ownership and distribution

• Integrity

• Data retention

• Auditability

• After data classification has been assigned, security controls can be established,

including encryption, authentication and logging.

• Security measures should increase as the level of data sensitivity or criticality

increases.

Data Classification Requirements

211

It is important for an organization to understand the sensitivity of the information it possesses.

Data should be classified based on its sensitivity and the impact of unintended release or loss.

Data classification should be defined in a policy that provides definition of different classes of

information and their handling and protection.

Keep levels to a minimum.

Keep level descriptions simple.

Define levels in policy.

Reclassify information as needed.

Data Classification

212

Databases can be individually protected with control that is similar to protections

applied at the system level. Specific controls that can be placed at the database

level include:

• Authentication and authorization access

• Access controls limiting or controlling the type of data that can be accessed and what

types of accesses are allowed (read-only, read-and-write or delete)

• Logging and other transactional monitoring

• Encryption and integrity controls

• Backups

Database Controls

213

Databases are vulnerable to many risks, including:

• Unauthorized activity by authorized users

• Malware infections or interactions

• Capacity issues

• Physical damage

• Design flaws

• Data corruption

Database Vulnerabilities

214

Database security may be increased through the following actions:

• Encryption of sensitive data in the database

• Use of database views to restrict information available to a user

• Secure protocols to communicate with the database

• Application of content-based access controls

• Restricting administrator-level access

• Efficient indexing to enhance data retrieval

• Backups of databases (shadowing, mirroring)

• Backups of transaction journals (remote journaling)

• Referential integrity

• Entity integrity

• Validation of input

• Defined data fields (schema)

• Layered network access restrictions or segregation

Database Security

215

Section 4: Security of Networks, Systems, Applications and DataReview Question

?

Any change, error or interruption within an IT

infrastructure is defined as:

A. A threat

B. An incident

C. An event

D. A vulnerability

Review Question

217

?

Which of the following is not a method of

controlling risk for remote access?

A. Denial of Service (DoS)

B. Policy and standards

C. Proper authorizations

D. Identification and authentication mechanisms

E. Encryption tools and techniques, such as use of

a VPN

F. Restriction of access to controlled systems,

networks and applications

Review Question

218

?

Which type of vulnerability is a failure to monitor

logs?

A. Process, related to errors in operation

B. Organizational, related to errors in decision-

making

C. Emergent, relating to interactions between or

changes in environments

D. Technical, related to errors in design,

implementation or configuration

Review Question

219

?

What phase of the SDLC comes after planning?

A. System testing

B. System design

C. System maintenance

D. System analysis

Review Question

220

?

Which following is not true about platform

hardening?

A. Does not store sensitive data not immediately

needed to support a business operation.

B. Has all unnecessary functionality disabled,

including ports, services and protocols that are

not required for the intended use.

C. Uses only passwords and accounts that have

been changed or disabled. No default

passwords or guest accounts are present.

D. Provides an enterprise with a significant

opportunity to increase efficiency and decrease

costs in its IT operations.

Review Question

221

You should now be able to:

• Determine, assess and respond to risk and

vulnerabilities on the network through

penetration testing.

• Identify key aspects and associated risks to

securing data, applications, operation

systems and the network.

Section Summary

222

223

Section 5:Incident Response

1. Distinctions between events and incidents

2. Incident categories and types

3. Security event management

4. Key elements of incident response plans

5. Legal requirements of investigation and

evidence preservation

6. Requirements for forensic investigations

7. Business continuity planning and disaster

recovery

Topics Covered in this Section

224

Upon completing this section you will be able to:

• Define event and incident.

• Define incident response and handling

methodologies.

• Identify the basic concepts, practices, tools,

tactics, techniques and procedures for

processing digital forensic data.

• Define business continuity plan.

Section Objectives

225

Topic 1:Event vs. Incident

A cybersecurity incident is an adverse event that negatively impacts the

confidentiality, integrity and availability of data.

The incident may be unintentional, such as someone forgetting to activate an

access list in a router.

Or it may be intentional, such as a targeted attack by a hacker.

Events may also be classified as technical or physical.

Technical incidents include viruses, malware, denial-of-service (DoS) and system

failure.

Physical incidents include social engineering and lost or stolen laptops or mobile

devices.

Types of Incidents

227

Topic 2: Security Incident Response

Incident response is a formal program that prepares an entity for an incident.

Incident response phases can be depicted as follows:

Incident Response Phases

229

Adequate incident response planning and implementation allows an organization

to respond to an incident in a systematic manner.

Development of an incidence response plan (IRP) aids in:

• Meeting compliance regulations (e.g., PCI, FDIC)

• Allowing the organization to respond to incidents in a systematic manner

• Improving response time and effectiveness

Incident Response Planning

230

The IRP is the first step in incident response. During the preparation phase, the

following should be completed:

• Establish an approach to handling incidents.

• Establish a policy and warning banners to deter intruders and allow information

collection.

• Establish a communication plan with stakeholders.

• Develop incident reporting criteria.

• Develop a process to activate the incident management team.

• Establish a secure location to execute the incident response plan.

• Ensure availability of needed equipment.

Preparing for an Incident

231

The next phase in incident response aims to verify if an incident has happened

and to find out more details about the incident. Steps in this phase include:

• Assign ownership to an incident handler.

• Verify reports or events qualifying as incidents.

• Establish the chain of custody.

• Determine incident severity and escalate as necessary.

Identifying an Incident

232

Actions taken in the containment phase of incident response work to limit

exposure. These include:

• Activate incident management/response team and notify appropriate stakeholders.

• Obtain agreement on actions taken that may affect availability.

• Get IT representative and relevant virtual team members to implement containment

procedures.

• Obtain and preserve evidence.

• Document actions.

• Control and manage communication to the public.

Containing an Incident

233

When containment measures have been deployed, it is time to determine the root

cause of the incident and eradicate it. Actions in this phase include:

• Determine signs and cause of incidents.

• Locate the most recent version of backups or alternative solutions.

• Remove the root cause.

• Improve defenses by implementing protection techniques.

• Perform a vulnerability analysis.

Eradicating the Root Cause

234

This phase of incident response ensures that affected systems or services are

restored to a condition specified in the service delivery objectives (SDO) or BCP.

Activities include:

• Restore operations to normal.

• Verify that actions taken on restored systems were successful.

• Involve system owners in testing the system.

• Aid system owners declare normal operation.

Recovering From an Incident

235

As a final step in the incident response process, a report should be developed to

share what has happened, what measures were taken and the results after the

plan was executed. Activities related to this include:

• Analyze issues encountered during incident response efforts.

• Propose improvements.

• Present report to relevant stakeholders.

Lessons Learned

236

?

CoolWeb Search is an example of what kind of

attack?

A. Trojan horse

B. Spyware

C. Ransomware

D. Phishing

E. Social engineering

Cyber Question

237

Topic 3:Forensics

Digital forensics can be defined as the “process of identifying, preserving,

analyzing and presenting digital evidence in a manner that is legally acceptable in

any legal proceedings (i.e., a court of law).”

Any electronic document or data can be used as digital evidence.

It must provide sufficient proof that the contents of digital evidence are in their

original state and have not been tampered with or modified during the process of

collection and analysis.

It is also important to demonstrate integrity and reliability of evidence for it to be

acceptable to law enforcement authorities.

Digital Forensics

239Source: McKemmish, D. Rodney. Computer and Intrusion Forensics, Artech House, USA, 2003

There are four phases in the chain of events related to evidence in digital

forensics.

Each phase and its primary focus are shown below.

Forensics Chain of Events

240

Consideration should be given to key

elements of forensics during planning

for audits and incidents.

Elements to be considered include:

• Data protection

• Data acquisition

• Imaging

• Extraction

• Ingestion or

normalization

• Interrogation

• Reporting

• Network traffic analysis

• Log file analysis

• Timelines

Forensics Key Elements

241

Forensics tools can be categorized as follows:

• Computer—Examines non-volatile digital media

• Memory—Acquires and analyzes volatile memory

• Mobile device—Observes both software and hardware components

• Network—Monitors and analyzes network traffic

• Other forensics tools include applications designed to automate analysis of large files,

such as those created by auditing software.

• Categories of these tools include audit reduction, trend or variance detection and

attack signature detection applications.

Digital Forensics Tools

242

Topic 4:Disaster Recovery and Business Continuity

Disasters are disruptions that cause critical information resources to be

inoperative for a period of time, adversely impacting organizational operations.

The disruption could be a few minutes to several months, depending on the extent

of damage to the information resource.

Disasters require recovery efforts to restore operational status.

What Is a Disaster?

244

The purpose of business continuity planning (BCP)/disaster recovery planning

(DRP) is to enable an enterprise to do the following:

• Continue offering critical services in the event of a disruption.

• Survive a disastrous interruption to activities.

• Rigorous planning and commitment of resources are necessary to adequately plan for

such a disaster event.

• BCP is primarily the responsibility of senior management.

Business Continuity Planning

245

Elements a successful BCP must take into consideration include the following:

• Critical operations necessary to the survival of the organization

• The human/material resources supporting these critical operations

• Pre-disaster readiness covering incident response management to address all relevant

incidents affecting business processes

• Evacuation procedures

• Circumstances under which a disaster should be declared.

• Procedures for declaring a disaster (escalation procedures)

• Identification of the persons responsible for each function in the plan

• Identification of contract information

• Step-by-step explanation of the recovery process

• Identification of the various resources required for recovery and continued operation of

the organization

Key BCP Considerations

246

The first step in preparing a new BCP is to identify the business processes of

strategic importance.

These are the key processes responsible for both the permanent growth of the

business and for the fulfillment of the business goals.

Based on this, a business impact analysis (BIA) process is used to determine the

time frames, priorities, resources and interdependencies that support the key

processes.

The BIA is the core source of data used in business continuity planning.

Business Impact Analysis

247

The BIA should answer three important questions:

• What are the different business processes?

• What are the critical information resources related to an organization’s critical business

processes?

• What is the critical recovery time period for information resources in which business

processing must be resumed before significant or unacceptable losses are suffered?

Key BIA Questions

248

?

Pegasus is the first known spyware on which of

the following?

A. iOS devices

B. Android devices

C. IoT devices

D. Cloud storage

Cyber Question

249Source: https://community.norton.com/en/blogs/security-covered-norton/internet-really-did-break-

today-and-heres-how-it-happened

The BIA also establishes the recovery point objective (RPO) and recovery time

objective (RTO) for each key process.

RPO is determined based on the acceptable data loss in case of a disruption of

operations.

It indicates the earliest point in time that is acceptable to recover the data, and

effectively quantifies the permissible amount of data loss in case of interruption.

RTO is the amount of time allowable for the recovery of a business function or

resource after a disaster occurs.

RPO and RTO

250

NIST defines the information and communications technology (ICT) supply chain

as “a complex, globally distributed and interconnected ecosystem that is long, has

geographically diverse routes, and consists of multiple tiers of outsourcing.”

This environment is interdependent on public and private entities for development,

integration and delivery of ICT products and services.

The complexity of supply chains and impact requires persistent awareness of risk

and consideration.

Factors such as economic, environmental, geopolitical and technological trends

and events must be incorporated into BIA and BCP analyses.

Supply Chain Considerations

251

The approach to IS BCP matches that of BCP for the greater organization, except

that its focus is on the continuity of IS processing.

The IS BCP should be aligned with the strategy of the organization.

If the IS plan is a separate plan, it must be consistent with and support the

corporate BCP.

Note that the criticality of the various application systems deployed in the

organization depends on the nature of the business as well as the value of each

application to the business.

IS BCP

252

In sum, the information system

BCP/DRP is a major component of an

organization’s overall business

continuity and disaster recovery

strategy.

The process of BCP is supported by

considered analysis of business

impacts.

Business Continuity Planning

253

Data recovery is the process of restoring data that has been lost, accidentally

deleted, corrupted or made inaccessible for any reason.

Recovery processes vary depending on the type and amount of data lost, the

backup method employed and the backup media.

Recovery

254

Backup procedures are used to copy files to a second medium such as a disk,

tape or the cloud.

Backup files should be kept at an offsite location.

There are three types of data backups: full, incremental and differential.

Backup

255

Full

• Copies every selected file on the system completely, regardless of recent backup status

• Slowest backup method, but fastest for restoring data

Incremental

• Copies all files that have changed since the last backup was made, regardless of whether the last backup was a full or incremental backup

• Fastest backup method, but slowest for restoring data

Differential

• Copies only the files that have changed since the last full backup

• The file grows until the next full backup is performed

Group Activity

Incident Response

Workmark is a benefits management company

with approximately 1,200 employees in a single

facility. The enterprise is highly dependent on

their internetworked systems to deliver services

to over 3,000 client organisations. Workmark’s

servers are virtualised in two data centres,

providing redundancy and geographic diversity.

Introduction

Benefits company, founded in 1997

Headquartered in Denver, Colorado with data centres in Denver and Texas

All employees work in the Denver facility. The data centre in Texas is operated by

a third party

Company Profile

Workmark primarily used Microsoft Windows for both server and desktop

operating systems. In each data centre, Workmark has 75 virtual Windows

servers. Each data centre also hosts five Linux servers and a small number of

specialised network appliances.

The Denver office has 800 desktop and laptop computers.

Technical Information

The data centres are connected via redundant virtual private network (VPN)

connections.

Each desktop and server runs an anti-malware solution that is managed from a

central server.

Most workstations use hard-wired Ethernet connections, but the laptop computers

and tablets used by the management team connect to a WPA2-secured Wi-Fi

network.

Technical Information

IT Organization

CIO

CISOVP IT

OperationsVP Development

Application

Development

Team

Security

Operations Team

Network

Operations

Server

Operations

Client Operations

Web

Development

Team

The Security Operations Team (SOT) consists of a manager and eight analysts.

This team operates a 24/7 Network Security Operations Centre (NSOC). The

NSOC monitors the alerts from the Security Event Information Management

system (SEIM). The NSOC is also the primary point of contact for any security

related events other teams may encounter.

Security Operations TEAM

You are the manager of the Security Operations Team (SOT). As manager, you

are the escalation point for the SOT. It is your responsibility to determine whether

an event is an incident and what the response should be.

Your Role

At 2:00 a.m., you receive a call from a junior security analyst who is assigned to

the network security operations centre. The network engineers have reported a

sudden increase in network traffic from a virtual machine, including what appears

to be port scans of the internal network and large amounts of egress traffic

blocked at the firewall.

You ask the junior analyst if he has declared an incident. He tells you that he was

not sure if it was an event or an incident and that he needs guidance.

Scenario

Detail the difference between an event and an incident for the junior analyst.

Describe ways to determine if this is, in fact, an incident or just an event.

Tasks

Based on the information from the junior analyst, you declare an incident.

Grudgingly, you drive to the office to begin incident response procedures.

Upon initial analysis, you find that a privileged account on the virtual server is

scanning the internal network and trying to connect to several external sites.

The server appears to be compromised by some sort of malware that was not

detected by your anti-malware system. Monitoring the network traffic reveals that

the system is scanning for hosts using 135 and 445, well-known Windows ports.

Scenario, continued

Scenario, continued

Source: ISACA, CSX Cybersecurity Fundamentals Study Guide, USA, 2014, p. 94

1. Describe the appropriate steps within each of the incident

response phases above. What should have been included in the

preparation phase to prepare for an incident like this?

2. Which information should be gathered in the detection and

analysis phase, and who should be contacted?

3. Describe the importance of the containment, eradication and

recovery steps.

4. What sort of post-incident activity should be conducted and who

should notified.

5. Referencing the iterative nature of incident response, what

information should be fed back into the preparation stage?

Discussion Questions

Section 6:Security Implications and Adoption of Evolving Technology

1. Trends in the current threat landscape

2. Characteristics and targets of advanced

persistent threats (APTs)

3. Mobile device vulnerabilities, threats and risk

4. The consumerization of IT and mobile

devices

5. Risk and benefits of cloud and digital

collaboration

Topics Covered in this Section

270

Upon completing this section you will be able to:

• Identify the possible cybersecurity

implications for adaption of evolving

technology.

Section Objectives

271

Topic 1: Current Threat Landscape

Increasing dependence on digital

technologies makes organizations more

susceptible to cybersecurity risk.

Cybersecurity Risk

273

A threat landscape, also referred to as a threat environment, is a collection of threats.

The cybersecurity threat landscape is constantly changing.

Recent trends in the cyberthreat landscape include:

• Threat agents are more sophisticated in their attacks and use of tools.

• Attack patterns are being applied to mobile devices.

• Nation states have the capabilities to infiltrate government and private targets (cyberwarfare).

• Cloud computing results in large concentrations of data within a small number of facilities,

creating attractive targets for attackers.

• Social networks have become a primary channel for communication, knowledge collection,

marketing and dissemination of information.

• The popularity of big data as an asset allows for the potential for large scale breaches.

Threat Landscape

274

Source: ENISA, ENISA Threat Landscape 2015, Greece, 2016

Information from ENISA (2015) shows the following trends in the threat

landscape:

Recent Trends in Cybersecurity

275

Increasing

• Malware

• Web-based attacks

• Web application attacks

• Denial of service

• Insider threats (malicious or accidental)

• Exploit kits

• Information leakage

• Ransomware

• Cyber espionage

Stable

• Physical damage/theft/ loss

• Phishing

• Data breaches

• Identity theft

Declining

• Botnets

• Spam

Topic 2: Advanced Persistent Threats

Evolution of the Threat Landscape

277

An advanced persistent threat (APT) is a targeted threat that is composed of

various complex attack vectors and can remain undetected for an extended

period of time.

Unlike many other types of criminal acts, it is not easily deflected by a determined,

defensive response.

In addition, APTs have the following characteristics:

• Unprecedented degree of planning, resources employed and techniques used

• Often follow a particular modus operandi

What is an Advanced Persistent Threat?

278

APTs target companies of all sizes across all sectors of industry and all

geographic regions that contain high-value assets.

No industry with valuable secrets or other sources of commercial advantage that

can be copied or undermined through espionage is safe from an APT attack.

APT attacks often encompass third-party organizations delivering services to

targeted enterprises.

APT Targets

279

THREAT WHAT THEY SEEK BUSINESS IMPACT

Intelligence agencies Political, defense or commercial

trade secrets

Loss of trade secrets or

commercial, competitive

advantage

Criminal groups Money transfers, extortion

opportunities, personal identify

information or secrets for potential

onward sale

Financial loss, large-scale

customer data breach or loss of

trade secrets

Terrorist groups Production of widespread terror

through death, destruction and

disruption

Loss of production and services,

stock market irregularities, and

potential risk to human life

Activist groups Confidential information or disruption

of services

Major data breach or loss of

service

Armed forces Intelligence or positioning to support

future attacks on critical national

infrastructure

Serious damage to facilities in the

event of a military conflict

APT Sources of Threat

280

Although no two APT attacks are

exactly alike, they often follow a similar

life cycle beginning with target selection

and research.

Stages of an APT Attack

281

Topic 3: Mobile Technology - Vulnerabilities, Threats and Risk

Security for mobile technology is a

function of the risk associated with its

use.

Threats related to mobile technology

include those listed here.

1. Improper platform usage

2. Insecure data storage

3. Insecure communication

4. Insecure authentication

5. Insufficient cryptography

6. Insecure authorization

7. Client code quality

8. Code tampering

9. Reverse engineering

10. Extraneous functionality

Security for Mobile Technology

283

Activity Monitoring and Data Retrieval

Unauthorized Network Connectivity

Web View/User Interface (UI) Impersonation

Sensitive Data Leakage

Unsafe Sensitive Data Storage

Unsafe Sensitive Data Transmission

Drive-by Vulnerabilities

Mobile devices present a number technical risks, in addition to physical and

organizational risks.

Technical Risk

284

TARGET RISK

Messaging •Generic attacks on SMS text, MMS-enriched transmission of text and contents

•Retrieval of online and offline email contents

•Insertion of service commands by SMS cell broadcast texts

•Arbitrary code execution via SMS/MMS

•Redirect or phishing attacks by HTML-enabled SMS text or email

Audio •Covert call initiation or call recording

•Open microphone recording

Pictures/Video •Retrieval of pictures and videos by piggybacking the usual “share” functionality

in most apps

•Covert capture of video or pictures, including traceless wiping of such material

Geolocation Monitoring and retrieval of GPS positioning data, including date and time stamps

Static data Intelligence or positioning to support future attacks on critical national

infrastructure

History Monitoring and retrieval of all history files in the device or on SIM cards (calls,

SMS, browsing, input, stored passwords, etc.)

Storage Generic attacks on data and device storage (hard disk or solid state disk [SSD])

Activity Monitoring and Data Retrieval Risk

285

VECTOR RISK

Email Simple to complex data transmission (including large files)

SMS Simple data transmission, limited command and control (service

command) facility

HTTP get/post Generic attack vector for browser-based connectivity, command and

control

TCP/UDP

socket

Lower-level attack vector for simple to complex data transmission

DNS

exfiltration

Lower-level attack vector for simple to complex data transmission,

slow but difficult to detect

Bluetooth Simple to complex data transmission, profile-based command and

control facility, generic attack vector for close proximity

WLAN/WiMAX Generic attack vector for full command and control of target,

equivalent to wired network

Unauthorized Network Connectivity Risk

286

The amount of storage space found on many devices is growing and, on average,

almost any device will soon be capable of storing several gigabytes of data.

This increases the risk of data leakage, particularly when mobile devices store

replicated information from enterprise networks.

Sensitive data leakage can be inadvertent or can occur through side channel

attacks.

Side channel attacks over prolonged periods of time allow the building of a

detailed user profile in terms of movements, behavior and private/business habits.

Users who may be considered at risk may require additional physical protection.

Sensitive Data Leakage

287

The use of mobile devices often increases the risk associated with unsafe storage

and transmission.

Risk Associated With Mobile Data Storage and Transmission

288

Unsafe Sensitive Data Storage

• Applications may store sensitive data such as credentials or tokens as plaintext.

• Data stored by the user is often replicated without encryption.

• Standardized files such as presentations and spreadsheets are stored unencrypted for quick access and convenience.

• Mobile devices are often associated with cloud storage, which itself adds risk.

Unsafe Sensitive Data Transmission

• Mobile devices predominantly rely on wireless data transmission, creating a risk of unauthorized network connectivity, particularly when using a wireless LAN.

• Users are likely to use unsecured public networks for data transmission.

• Automatic network recognition, a common feature in mobile OSs, may link to WLANs available in the vicinity, memorizing Service Set Identifiers (SSIDs) and channels and paving the way for evil twin attacks.

Mobile device size restricts display and edit capabilities.

Word processing, spreadsheet and presentation software is optimized for opening and reading only, but the documents may contain active

hyperlinks, macros and embedded documents.

This is known as an attack vector for malware and other exploits. Mobile apps may not recognize malformed links or provide adequate warnings to users.

Users can be harmed by insertion of illegal material, inadvertent use of “premium” services via SMS/MMs or bypass of authentication mechanisms.

The restricted nature of mobile device applications leads to an increased risk of

drive-by attack.

Drive-by Vulnerabilities

289

?

In 2016, the Mirai botnet malware using a

Distributed Denial of Service (DDoS) attack

flooded a DNS server. It is the first known attack

on this type of device?

A. iOS devices

B. Android devices

C. IoT devices

D. Cloud storage

Cyber Question

290Source: https://community.norton.com/en/blogs/security-covered-norton/internet-really-did-break-

today-and-heres-how-it-happened

Topic 4:Consumerization of IT and Mobile Devices

Consumerization of IT is the reorientation of technologies and services designed

around the individual end user. Examples include:

• Smart devices such as smartphones and tablets

• BYOD strategies

• New, freely available applications and services

• Consumerization is not limited to devices.

• New, freely available applications and services provide better user experiences for

things like note-taking, video conferencing, email and cloud storage than their

respective corporate-approved counterparts.

• Instead of being provided with company-issued devices and software, employees are

increasingly using their own solutions that fit with their lifestyle, user needs and

preferences.

Consumerization of IT

292292

The use of privately owned mobile devices for work purposes has quickly taken

hold.

This trend is both positive and negative.

The downside is a proliferation of devices with known (or unknown) security risk,

and the formidable challenge of managing device security against several

unknowns.

In contrast, BYOD is becoming an important job motivation factor, because

employees are no longer willing to accept technology restrictions.

Bring Your Own Device

293

PROS

• Shifts costs to user

• Worker satisfaction

• More frequent hardware upgrades

• Cutting-edge technology with the latest features and capabilities

CONS

• IT loss of control

• Known or unknown security risk

• Acceptable Use Policy is more difficult to implement

• Unclear compliance and ownership of data

294

Pros and Cons of BYOD

294

The Internet of Things (IoT) refers to physical objects that possess embedded

network and computing elements and communicate with other objects over a

network.

Although specific risk depends on usage, IoT creates several types of risk.

Internet of Things

295

Business Risk

• Health and safety

• Regulatory compliance

• User privacy

• Unexpected costs

Operational Risk

• Inappropriate access to functionality

• Shadow usage

• Performance

Technical Risk

• Device vulnerabilities

• Device updates

• Device management

Big data is both a marketing and a technical term referring to a valuable

enterprise asset—information.

Big data relies on data sets that are too large or too fast-changing to be analyzed

using traditional database techniques or commonly used software tools.

The change in analytics capabilities dealing with big data can introduce technical

and operational risk, including:

• Amplified technical impact—Larger data sets are in jeopardy if attacked

• Privacy in data collection—Individuals may feel that revealed information is overly

intrusive

• Re-identification—During aggregation, semi-anonymous information may be converted

to identifiable information, compromising individual privacy

Big Data

296

Topic 5:Cloud and Digital Collaboration

NIST defines “cloud computing” as a “model for enabling convenient, on-demand

access to a shared pool of configurable computing resources (e.g., networks,

servers, storage, applications and services) that can be rapidly provisioned and

released with minimal management effort or service provider interaction.”

Cloud computing offers enterprises a way to save on the capital expenditure

associated with traditional methods of managing IT.

Common platforms offered in the cloud include:

• Software as a Service (SaaS)

• Platform as a Service (PaaS)

• Infrastructure as a Service (IaaS)

Cloud Computing

298

Cloud computing-related risk can lead to a number of different threat events. The

Cloud Security Alliance lists the following as top cloud computing threats:

• Data breaches

• Data loss

• Account hijacking

• Insecure application programming interfaces (APIs)

• Denial-of-service (DoS)

• Malicious insiders

• Abuse of cloud services

• Insufficient due diligence

• Shared technology issues

Top Cloud Computing Threats

299

Enterprises often use SaaS offerings, sometimes extending this use to critical

business processes and related applications.

These service offerings bring business advantages, but they also generate data-

in-flow vulnerabilities that may be exploited by cybercrime and cyberwarfare.

SaaS increases risk at the application layer, including these attack vectors:

• Zero-day exploits

• Primary malware

• Secondary malware

Web Applications

300

Social media technology involves the creation and dissemination of content

through social networks using the Internet.

The differences between traditional and social media are defined by the level of

interaction and interactivity available to the consumer.

Use of social media has created highly effective communication platforms where

any user, virtually anywhere in the world, can freely create content and

disseminate this information in real time to a global audience.

Enterprises are using social media to increase brand recognition, sales, revenue

and customer satisfaction; however, there is risk associated with its usage.

Social Media

301

Risks associated with a corporate social media presence include:

• Introduction of viruses/malware to the organizational network

• Misinformation or misleading information posted through a fraudulent or hijacked

corporate presence

• Unclear or undefined content rights to information posted to social media sites

• Customer dissatisfaction due an expected increase in customer service response

quality/timeliness

• Mismanagement of electronic communications that may be impacted by retention

regulations or e-discovery

Risks of Enterprise Use of Social Media

302

Risks associated with employee personal use of social media include:

• Use of personal accounts to communicate work-related information

• Employee posting of pictures or information that link them to the enterprise

• Excessive employee use of social media in the workplace

• Employee access to social media via enterprise-supplied mobile devices

(smartphones, tablets)

Risks of Employee Use of Social Media

303

Section 6: Security Implications and Adoption of Evolving TechnologyReview Question

?

Which of the following are cloud related threats?

A. Data breaches

B. Data loss

C. Account hijacking

D. Insecure application programming interfaces

(APIs)

E. Denial-of-service (DoS)

F. All the above

Review Question

305

?

All of the following are business risks for IoT

devices except for which of the following?

A. Health and safety

B. Performance

C. Regulatory compliance

D. User privacy

E. Unexpected costs

Review Question

306

?

Which of the following is an advantage for

BYOD?

A. Shifts costs to user

B. IT loss of control

C. Known or unknown security risk

D. Acceptable Use Policy is more difficult to

implement

E. Unclear compliance and ownership of data

Review Question

307

?

Which of the following are risks associated with

corporate social media?

A. Introduction of viruses/malware to the

organizational network

B. Misinformation or misleading information posted

through a fraudulent or hijacked corporate

presence

C. Unclear or undefined content rights to

information posted to social media sites

D. Customer dissatisfaction due an expected

increase in customer service response

quality/timeliness

E. All the above

Review Question

308

?

What is the APT threat type if the business

impact is the loss of trade secrets or

commercial, competitive advantage?

A. Intelligence agencies

B. Criminal groups

C. Terrorist groups

D. Activist groups

E. Armed forces

Review Question

309

You should now be able to:

• Identify the possible cybersecurity

implications for adaption of evolving

technology.

Section Summary

310

Now that you have completed this course you

should be able to:

• Identify key concepts and terminology in

cybersecurity.

• Define the key concepts, roles and domains of

cybersecurity.

• Identify the various types of cybersecurity

architecture.

• Identify the key components of securing networks,

systems and applications and data.

• Identify and incident and outline the phases of

incident response.

• Identify the possible cybersecurity implications for

adaption of evolving technology.

Course Summary

311

THANK YOU