OPIM 3207: Midterm (Week 1-6)

black hat

hacker who operates illegally & maliciously

white hat

hacker who operates legally & benevolently

gray hat

hacker who operates illegally & benevolently

control

anything an organization puts in place to manage risk to its information systems by preventing, detecting, or responding to security threats

• physical

• technical

• administrative

safeguard/countermeasure

designed to reduce risk by preventing, detecting, or correcting threats to information systems & data

social engineering

use of psychological manipulation to trick ppl into giving away confidential info, trnasferring money, or breaking security rules

information security

practice of preventing unauthorized access to data, falls under the risk management plan of a company

malware

software employed by a hacker that perform actions that cause harm to a computer system or network

CIA

• confidentiality

• integrity

• availability

confidentiality

practice of keeping secret info secret

integrity

assurance that data has not been corrupted or purposefully tampered w/

availability

system should remain up & running to ensure that valid users have access to data when needed

threat actors

individual or group that intentionally causes harm, steals data, or disrupts digital systems & networks

• hacktivists- threat actors that attack to further social or political ends

• script kiddies- neophytes/noobs making use of automated tools that they may not fully understand

• organized crime

• governments & nations

tools employed by security professionals

1. user awareness

2. anti-malware software

3. backups

4. encryption

physical controls

locking doors, cameras, security guards

technical controls

intrusion detection systems (IDS), firewalls, anti-malware software

administrative controls

human resources policies, classifying & limiting access to data, & separating duties

backups

maintaining a copy of the data used by a system can allow for a quick recovery

encryption

obfuscates data & requires a key to make it useful, can be employed to make copies of data obtained through unauthorized access useless to attackers that do not have a key

motives of hackers (threat vectors)

• financial

• extortion (power/influence)

• cover for other crimes

• illicit/private materials

• future info

• showing off/prestige

• intellectual property

• espionage

• personal cause

targets for hackers & cyber attacks

• finance companies

• “wealthy” companies ($ or data)

• governments/nations

• unprepared targets (ex: schools, libraries, hospitals)

• tech/software companies

• social media

• gambling companies

• supply chain & shipping companies

data breach investigation report (DBIR)

• actors: mostly external, organized crime

• action: mostly hacking & malware

• targets: mostly servers, sometimes people

ransomware

software installed onto someone’s computer that locks it, installer demands a ransom to remove it

APT

Advanced Persistent Threats

risk

risk=impact*likelihood

• impact & likelihood are comprised of the vulnerability of a system, the importance of said system, & the types of threats to the system

3 states of data

1. data in use

2. data in transit

3. data at rest

worm

self-propagating programs that spread w/ out user interaction

• code is typically stored within an independent object, such as a hidden executable file, often do not severely damage their host, they are concerned w/ rapid exponential spreading 

virus

typically require user interaction, such as copying an infected file from one machine to another, & store their code inside another file on a machine; can be quite damaging to the host as they may take significant resources to spread locally 

trojan

form of malware that disguises itself as legitimate software, it exploits users into installing, running, or giving extra privileges to the malicious code

cryptojacking

type of malware that mines cryptocurrency in the background on a user’s machine; creates a simpler path to monetization for malicious actors who may already have control of many compromised machines

potentially unwanted programs (PUP)

typically downloaded as part of the install of another program (ex: browser tool bars, PDF readers, compression utilities, or browser extensions)& may have spyware/adware components in them & can also slow down a system 

zero days

new/undocumented exploits or vulnerabilities used in order to perform privilege escalation w/ out requiring user interaction (these are incredibly powerful)

spyware

malware specifically designed for espionage/data theft, can have monetary payoff for the threat actor, actors, may use extortion to demand payment or the data will be leaked

rootkit

secret program designed to give back door access to a system, may even actively disable or circumvent security software

indicator of compromise (IoC)

artifact w/ high confidence that indicates an intrusion, a way to tell if a machine has been a victim of malware

IoC types

• hash: hash of files that are known to be malicious can help identify trojans & worms

• IP addresses: tracking IP addresses which malware connects to can be used to determine if a machine is infected

• URLs/domains: tracking URLs that malware uses can be used to determine if a machine is infected

• virus definition/signature: executables & other files can be scanned for specific sequences of bytes which are unique to a particular virus, this way, even of malware is hiding in another file it can still be detected

spear phishing

sending phishing emails or other communications that are targeted towards a particular business or environment, focused, tailored, & custom campaign

whaling

targeting high-ranking individuals at an organization, often used in conjunction w/ spear phishing

smishing

using SMS messages when phishing

vishing

using voice messages when phishing

business email compromise (BEC)

cybercrime in which attackers compromise or spoof business email accounts to defraud organizations, typically by requesting wire transfers or sensitive data

pretexting

type of attack in which the attacker fabricates a scenario or pretext to trick an individual into revealing confidential information

phishing sites

threat actors can attempt to gain unauthorized access through info obtained from non-business related communication channels (ex: thru social media, or online forums) 

dumpster diving

old, improperly disposed of records or hard drives may contain corporate secrets or credentials that give someone unauthorized access  

reverse social engineering

sophisticated attack where the attacker convinces the target to reach out for help, allowing the attacker to manipulate the victim into providing sensitive information

shoulder surfing

stealing info by looking over someone’s shoulder at their device (could be passwords, PINs, accounts, credentials) 

tailgating

following behind someone who is entering a secure location w/ a credential 

piggybacking

Similar to tailgating, but the authorized individual is aware and intentionally allows the unauthorized person to enter the restricted area 

scareware

form of malware that tricks users into believing their system is infected, prompting them to download fake antivirus software or provide financial details

cyber killchain

military method of analysis of malware attacks

1. recon

2. weaponization

3. delivery

4. exploitation

5. installation

6. command & control (C&C, C2)

7. exfiltration

recon (cyber killchain)

phase of gaining info 

• Passive recon- involves gathering info w/ out sending anything to the target, involves using publicly available info 

• Active recon- involves interaction w/ the target 

weaponization (cyber killchain)

phase where actor begins readying exploits for the vulnerabilities that were assessed during recon (may include: tailoring malware, creating phishing emails, customizing tools, etc)

delivery (cyber killchain)

may involve sending of emails linked to malware or the exploitation of vulnerable servers to then run malware 

exploitation (cyber killchain)

occurs once malware is successfully executed, involves almost no interaction from the attacker, once malware is activated, victim has completed the step 

installation (cyber killchain)

malware installs itself, hides itself, & sets up persistence (ability to restart after being stopped), may escalate privilege or move laterally 

command & control (C&C, C2) (cyber killchain)

will reach out to its C&C channel for more instructions, attacker may interact w/ the malware giving additional commands, C2 traffic is designed to blend w/ existing traffic

exfiltration (cyber killchain)

involves getting data from exploited systems or disabling/misusing the systems in another way, attacker can us C2 channel to pull sensitive info from the system (note: exfiltration of data may not be the goal of the attack) they can also disable the system, commit fraud w/ the system, mine crypto currencies, etc 

watering hole attack

targeted cyberattack in which the attacker compromises a website frequently visited by a specific group, infecting it w/ malware to gain access to their systems 

quid pro quo attack

a type of social engineering attack in which the attacker offers something valuable in exchange for sensitive info 

honey trap

attacker poses as an attractive individual online to lure victims into sharing confidential info or engaging in activities that can be used for blackmail 

deepfake

use of AI-generated audio or video to impersonate individuals, often used in fraud, blackmail, or disinformation campaigns 

evil twin attack

cyberattack where a fraudulent Wi-Fi access point is set up to mimic a legitimate on, tricking users into connecting & exposing their sensitive data. 

how to influence & persuade

1. reciprocity

2. scarcity

3. authority

4. consistency

5. liking

6. consensus

reciprocity

the obligation to give back what you have received from others 

• Ex: birthday gifts, complements, saying “I love you” 

scarcity

ppl want more of those things there are less of 

• Ex: Amazon (“one 1 left!”), diamond industry (manufactured scarcity, on purpose) time scarcity (black friday sales), tickets 

authority

ppl will follow the lead of credible & knowledgeable experts 

• Ex: “voted #1 by [someone/something]!”, influencer recommendations 

consistency

activated by looking for & asking for small initial commitments that can be made 

• Ex: streaming services (charging more per month & making “ad free” more expensive) 

liking

ppl say yes to those they like

consensus

ppl will look to the actions of others to determine their own  

• Ex: hotels (sign in the bathroom saying “75% of guests reuses towels”)

operant conditioning

defense in depth

multiple controls covering the same risk

surface area/attack surface

all areas you-re exposed from

types of security controls chart

controls=protocols+risk mitigation

protocol

rule that dictates communication, may include info abt syntax used, error correction, synchronization, or any other aspect of how communication occurs int he context of the situation

transmission control protocol (TCP)

provides for reliable communication via a 3-way hand shake, breaks large data segments into packets, ensures data integrity & provides flow control for those packets, often targeted for attacks 

• transport layer protocol

hypertext transfer protocol (HTTP)

text based protocol that governs how web traffic moves, is built on the concept of a request & a response (request: GET / index.html, which would get the landing page of a website) 

• application layer protocol

hypertext transfer protocol secure (HTTPS)

solves the problem of unencrypted traffic by wrapping HTTP requests in TLS 

• used for websites

• application layer protocol

secure sockets layer (SSL)/transport layer security (TLS)

protocol that allows cleartext protocols used on the web to be encrypted, designed as a layer thru which other protocols communicate 

• application layer protocol

secure shell (SSH)

most widely deployed remote administration tool. SSH provides access to a shell via an encrypted connection

• supports many options: port forwarding & usage of multiple authentications schemes (password, key, etc)

domain name system (DNS)

used to resolve domain names to IP addresses

file transfer protocol (FTP)

simple, text-based protocol for sending files between machines

internet protocol (IP)

devised to create a network of networks

• 2 main versions: IPv4 & IPv6

  • IPv4: supports 32 bit addresses (less of the, addresses need to be shared)

  • IPv6: supports 128 bit addresses (more of them, still unused addresses)

ip address

unique number given to a host participating on an IP network

open system interconnection (OSI) model

framework that divides computer network communication into seven distinct, sequential layers

software surface area:

7)application

6)presentation

5)session

4)transport

hardware surface area:

3)network

2)data link

1)physical

OSI layer 1: physical

everything from physical network devices, cabling, to how the cables hook up to the devices

OSI layer 2: data link

defines how data is formatted for transmission, how much data can flow between nodes, for how long, and what to do when errors are detected in this flow

OSI layer 3: network

where we send information between and across networks through the use of routers, network-to-network communication

OSI layer 4: transport

the connection between two nodes and how information is transmitted between them, responsible for data packet segmentation

• builds on functions of layer 2

OSI layer 5: session

mutually agreed upon connection that is established between two network applications

OSI layer 6: presentation

responsible for data formatting, such as character encoding and conversions, and data encryption.

• end-user application is involved in this layer

OSI layer 7: application

responsible for supporting services used by end-user applications. Applications include software programs that are installed on the operating system, like Internet browsers or word processing programs

hashing

process of turning any size of data into a unique, fixed-length string of characters using a mathematical formula called a hash function

• what makes it good: no collisions

collision

2 different inputs, 1 output

Diffie-Hellman algorithm

goals: 1) prove sender 2) ensure only recipient can read the message

• Every machine/user has a public key & a private key: if cipher text is encrypted w/ one it can be decrypted w/ the other (this proves the sender of the message) 

• Recipient to prove they are who they say they are sends message back encrypted w/ their private key & can be decrypted w/ their public key 

• Ex: Alice & bob are sending messages to each other & want no one else to be able to read them: 

• Alice encrypted her message w/ her private key & then encrypts w/ bob’s public key  

• This makes it only possible for bob to read bc hes the only one w/ his private key 

public key infrastructure (PKI)

framework for managing digital certificates and encryption keys

• is crucial for secure digital communications in business

nonrepudiation

a security & legal guarantee that prevents a person from falsely denying they performed an action (such as sending a message or signing a contract)

vulnerability management

the process of identifying, classifying, and remediating vulnerabilities

• ways to do this:

1. CVE

2. CVSS

3. GDPR

IT general controls (ITGCs)

a set of foundational policies, procedures, & practices that govern an organization’s IT infrastructure & application 

• These + unique controls (per application/process/algorithm) support applications, processes, & algorithms 

general data protection regulation (GDPR)

far-reaching EU law requiring that customers be notified if they are being tracked 

common vulnerabilities & exposures (CVE)

publicly available catalog of standardized ID numbers for known cybersecurity flaws & security exposures