CompTIA Security+ SY0-701 - 1.0 General Security Concepts

Security Control Categories (4)

Technical

Managerial

Operational

Physical

Security Control Types (6)

Preventative

Deterrent

Detective

Corrective

Compensating

Directive

Technical

Controls implemented using systems

Operating systems controls

Firewalls, anti-virus

Managerial

Administrative controls associated with security design and implementation.

Security policies, standard operating procedures

Operational

Controls that people implement instead of systems

Security Guards, Awareness Programs

Physical (examples)

Limit Physical Access

- Guard Shack

- Fences, locks

- Badge reader

Preventive (examples)

Physically control access - Block Access to a resource

-Firewall Rules (Technical)

-Follow the Security Policy (Managerial)

-Guard Shack Checks all identification (Operational)

-Enable door locks (Physical)

Deterrent (examples)

Discourage an intrusion attempt - Does not DIRECTLY prevent access

- Application Splash Screens (Technical)

- Threat of Demotion (Managerial)

- Front Reception Desk (Operational)

- Posted Warning Signs (Physical)

Detective (examples)

It may not prevent access - Identify and Log an Intrusion Attempt.

-Collect and review system logs (Technical)

-Review login reports (Managerial)

-Regularly Patrol the property (Operational)

-Enable Motion Detectors (Physical)

Corrective (examples)

Apply a Control after an event has been detected - Reverse the impact of an event.

- Restoring from backups can mitigate a ransomware infection (Technical)

- Create Policies for reporting security issues (Managerial)

-Contact Law enforcement to manage criminal activity (Operational)

-Use a fire extinguisher (Physical)

Compensating (examples)

Control using other means - Existing controls aren't sufficient and may be temporary

- Firewall blocks a specific application instead of patching the app (Technical)

- Implement a separation of duties (Managerial)

- Require simultaneous guard duties (Operational)

- Generator used after power outage. (Physical)

Directive (examples)

Direct a subject towards security compliance - A relatively weak security control

- Store all sensitive files in a protected folder (Technical)

- Create compliance Policies and Procedures (Managerial)

- Train Users on Proper Security Policy (Operational)

- Post a sign for "Authorized Personnel Only" (Physical)

CIA Triad - Confidentiality, Integrity, Availability

The Fundamentals of Security - also referred to as the AIC Triad.

Confidentiality

Prevent disclosure of information to unauthorized individuals or systems.

prevent unauthorized information disclosure

- Encryption

- Access Controls

- Two-factor authentication

Integrity

Messages can't be modified without detection

-Data is stored and transferred as intended

- Modifications to data would be identified

- Hashing (fixed length)

- Digital Signatures (Verify Data Integrity)

- Certificates (Verify an Individual)

- Non- Repudiation (Proof of Integrity)

Availability

Systems and networks must be up and running.

- Information is accessible to authorized users

- Redundancy

- Fault Tolerances

- Patching

Non-repudiation

You cannot deny what you've said

- Signature adds non-repudiations

- Others can see your signature

- Proof of integrity

- Proof of origin (Assurance of Authenticity)

- Only tells you if the data has changed

AAA Framework

Authentication, Authorization, and Accounting

Authentication

Proves you are who you say you are

- Password and other authentication factors

Authorization

Based on your identification and authentication, what access do you have?

Accounting

Resources used: Login time, data sent and received, and logout time.

Authenticating People

Client -> Internet -> Firewall/VPN Concentrator -> AAA Server -> Firewall/VPN Concentrator -> Internal File Server

Authenticating Systems

Put a Digitally Signed Certificate on the device.

-Access to the VPN from authorized devices

- Management software can validate the end device

Certificate Authentication

Certificate Authority (CA)

- Most organizations maintain their CAs

- The organization creates a certificate for a device

- CA's digital signature is used to validate the certificate

Authorization Models

Users and Services -> Data and applications

Defined by Roles, Organization, Attributes, etc.

- Add an abstraction (Reduce Complexity and Clear relationship between the user and the resource)

- Administration is streamlined (Easy to understand and supports any number of users or resources)

No Authorization Model

A Simple Relationship

User -> Resource

Does not scale

Gap Analysis

"Where you are compared with where you want to be."

-Work towards a known baseline

-Determine the End Goal

-Evaluate people and processes

-Examine the current Process

Note: NIST Special Publication 800-171 Revision 2 and ISO/IEC 27001

Zero Trust

Holistic approach to network security

- Covers every device, every process, and every person

- Nothing is inherently trusted

Controlling Trust

Adaptive Identity

Threat Scope Reduction

Policy Driven access controls

Adaptive Identity

- Consider the source and the requested resources

- Multiple risk indicators - relationship to the organization, physical location, type of connection, IP address, etc.

- make the authentication stronger, if needed

Threat Scope Reduction

- Decrease the number of possible entry points

Policy Driven access controls

- Combine the adaptive identity with a predefined set of rules.

Planes of Operations

Split the Network into Functional Planes.

- Applies to physical, virtual, and cloud components

- Data Plane and Control Plane

- Extends to the physical architecture

Data Plane

Process the frames, packets, and network data

Processing, forwarding, trunking, encrypting, NAT

Control Plane

Manages the actions of the data plane

Define policies and rules.

Determines how packets should be forwarded

Routing tables, session tables, NAT tables

Security Zones

"Where are you coming from, and where are you going"

-Trusted, untrusted

-Internal network, external network

- VPN 1, VPN 5, VPN 11

-Marketing, IT, Accounting, Human Resources

- Can deny access (Untrusted to Trusted zone Traffic)

- Provide zone with implicit trust (Trusted to Internal zone Traffic)

Policy Enforcement Point (PEP)

The Gate Keeper

- Subjects and systems

- Allow, monitor, and terminate connection

Subject -> System -> (untrusted) -> PEP -> (trusted) -> Enterprise Resource

Subject/System

End Users, applications, non-human entities

PDP (Policy Decision Point)

Process for making an authentication decision

- Policy Engine + Policy Administrator

Policy Engine

Evaluates each access decision based on policy and other information sources

-Grant, Deny, or Revoke

Policy Administrator

Communicates with the Policy Enforcement Point (PEP)

- Generates access tokens or credentials

- Tells the PEP to allow or disallow access.

Physical Security

Prevents access

Channel people through a specific access point

Identify Safety Concerns

Examples:

Barricades/Bollards/Moats/Fence/Video Surveillance/Access Control Vestibules/Guards and Badges/lighting/Sensors/Pressure/Microwave/Infrared/Ultrasonic

Access Control Vestibules

All doors are normally unlocked

- opening one door causes others to lock

All doors are normally locked

- unlocking one door prevents others from being unlocked

One door open/other locked

- when one is open, the other cannot be unlocked

One at a time, controlled groups

- Managed control through an area

Deception and Disruption technology

Examples:

-Honeypots

-Honey Net

-Honey File

Honeypot

"Attract the Bad guys."

- The attacker is likely a machine

- Creates a virtual world to explore

- Open source and available for download

- Difficult to discern the real from the take

Honeynet

A real network includes more than a single device.

- Builds a larger deception network

- https://projecthoneyport.org

Honeyfile

Attract the attackers with more honey.

- Create files with fake information

- Bait for honeynet (passwords.txt)

- Add many honeyfiles to file shares

- A virtual bear trap

Honeytoken

Track the malicious actors.

- Add some traceable data to the honeypot

API Credentials

- Does not actually provide access

-Notifications are sent when used

Fake email Addresses

- Add it to a contact list

- Monitor the internet to see who posts it

Change Management

"How to make a change?"

- Upgrade software, change firewall configuration,

modify switch ports

- Occurs very frequently but is often overlooked or ignored

- Ensure Clear Policies - Frequency, duration, installation process, and rollback procedures.

Change Approval Process

A Formal Process for Managing Change

1. Complete the Request Forms

2. Determine the purpose of the Change

3. Identify the scope of the change

4. Schedule a date and time of the Change

5. Determine Affected Systems and the Impact

6. Analyze the Risk Associated with the Change

7. Get Approval form the Change Control Board

Ownership

An individual or entity needs to make a change. The Owner Manages the Process and Ensures the Process is followed.

- They own the process, responsible for ensuring change process is followed

- They don't usually perform the actual change

Stakeholders

The people whose interests are affected by an organization's activities

- They want to have input on the change management process

- can include one individual or the entire company

Impact Analysis

Identifying all work products affected by a change, including estimating the resources needed to accomplish the change.

- Risk Values: High, Medium, and Low

- Consider the Risks of not Making a Change:

Security Vulnerability, Application unavailability, and Unexpected downtime to Other services.

Test Results

- Use Sandbox Testing Environment

- Use before making a change to production

- Confirm the backout plan

Backout Plan

A plan for returning affected systems and hardware to their original state if a new implementation fails.

- Move Everything Back to the Original

- A Sandbox cannot consider every possibility

- Have a full and complete backup

Maintenance Window

The time period in which a change is expected to be implemented.

- When is the change happening

- During the workday may not be the best option

- Overnights are often a better choice

- The time of year may be a consideration

Standard Operating Procedure (SOP)

A set of rules is established that dictates how workers respond to different situations so that all workers respond the same way.

- The Process must be well documented

- Available of the Intranet

- A living Document

Technical Change Management

Puts the Change Management Process into Action

- Can have many moving parts

- Separate events may be required

- Is often Concerned with "what" needs to change

Allow Lists and Deny Lists

Security Policy that can Control App Execution

Allow List

- Nothing runs unless it is approved

- Very restrictive

Deny List

- Nothing on the "bad list" can be executed

- Anti-virus, Anti-Malware

Restricted Activities

- The Scope of a Change is important

- A change Approval is not permission to Make any Change

- The Scope may Need to be Expanded During the Change Window

- The Change Management Process Determines the Next Steps

Downtime

The time a system is unavailable.

Prevent any Downtime:

Switch to the secondary system, upgrade the primary, and then switch back

Minimize any Downtime Events:

Automate the Process

Switch back to secondary issues persist

Should be a part of the Backout Plan

Restarts

Two types: Service and Application Restarts

Reasons:

Implement New Configuration

Reboot the OS, power cycle the switch, and bounce the service.

Service Restart

Stop and restart the service or daemon

May take seconds or minutes

Application Restart

Close the applications completely

Launch a new application instance

Legacy Applications

"They will be here when you leave"

- Applications were here before you arrived

- Often no longer supported by the developer

Tips:

Document the system, create specific processes and procedures, and become the expert.

Dependencies

" To complete A, you must complete B"

- Service will not start without other active services

- An application requires a specific library version

Modifying one application may require changing or restarting other components.

Dependencies may occur across systems

- Upgrade the firewall code first

- Upgrade the firewall management software

Documentation

Required with the Change Management Process

Includes: Updating Diagrams and Updating Policies/Procedures

Updating Diagrams

Modifications to network configurations

Address updates

Updating Policies/Procedures

Adding new systems may require new procedures

Version Control

A process to keep track of what changes were made to what files so that a specific version can be referred to and improvements in multiple versions can be merged.

Managing Version Control Options:

Router configurations

Window OS patches

Application Registry Entries

PKI - Public Key Infrastructure

Enables users of a public network such as the Internet to securely and privately exchange data through the use of a pair of keys—a public one and a private one—that is obtained from a trusted authority and shared through that authority.

Policies, Procedures, Hardware, Software, and People

Digital Certificates:

Create, Distribute, Manage, Store, and Revoke

Symmetric Encryption

An encryption method whereby the same key is used to encode and decode the message

- A Single, Shared Key

- Referred to as a "Secret Key Algorithm"

- A Shared Secret

- Doesn't Scale well

- Very Fast to Use

Asymmetric Encryption

Two keys are used; one key encodes the message, and the other key decodes the message

- Mathematically Related Keys

- One Private Key (Keep this private) and One Public key (Anyone can see)

- You cannot derive the private key from the public key

The Key Pair

Public and private keys work together in a public encryption system.

Public Key Cryptography (Asymmetric)

Key Generation

Build both the public and private key at the same time

Lots of Randomization

Large Prime Numbers

Lots and Lots of Math

Public Key

One of the keys used in asymmetric encryption systems. It is widely distributed and available to everyone.

Private Key

The complementary key to a public key that is used to decrypt a message.

Key Escrow

A control procedure whereby a trusted party is given a copy of a key used to encrypt database data

- In the hands of a 3rd-party

- May be within your own organization

Encryption

Process of converting readable data into unreadable characters to prevent unauthorized access.

Encrypting Stored Data

Protect Data on Storage Device

- SSD, hard drive, USB drive, Cloud Storage, ETC.

- Data at rest

Full Disk Encryption (FDE)

A technology that encrypts everything stored on a storage medium automatically, without any user interaction

- BitLocker, FileVault, etc

Volume Encryption

Encrypts only a part of a hard drive instead of the entire disk.

- BitLocker, FileVault, etc

Partition Encryption

Encrypts specific partitions of a hard drive, leaving other partitions unencrypted

- BitLocker, FileVault, etc

File Encryption

Encrypting individual files on a storage medium and permitting access to the encrypted data only after proper authentication.

- Encrypting File System (EFS), third-party utilities

Database Encryption

An encryption method that targets databases and the data they contain rather than individual files or whole disks.

- Protecting Stored Data (Transmission)

-Transparent Encryption (Symmetric Key)

- Record- Level Encryption (Separate Symmetric Keys)

Transport Encryption

The technique of encrypting data that is in transit, usually over a network like the Internet.

- HHTPS (Browsers)

- Virtual Private Network (VPN) (Network)

- Client-based VPN using SSL/TSL

- Site-to-site VPN using IPsec

virutal private network (VPN)

Encrypts all Data transmitted over the Network

SSL/TLS

Secure Sockets layer / Transport Layer Security - An encryption layer of HTTP that uses public key cryptography to establish a secure connection.

IPSec (Internet Protocol Security)

A Layer 3 protocol that defines encryption, authentication, and key management for TCP/IP transmissions. IPSec is an enhancement to IPv4 and is native to IPv6. IPSec is unique among authentication methods in that it adds security information to the header of all IP packets.

Encryption Algorithms

A set of steps that can convert readable plaintext into unreadable ciphertext

The Proper "formula" must be used during encryption and encryption

- hidden from end-user

Examples:

DES Encryption Algorithms and AES Encryption Algorithms

DES Encryption

symmetric block cipher that uses 64-bit key sizes and operates on blocks 64-bit in size. 8-bits are used for parity checking, so the key length is really only 56 bits.

AES Encryption

Symmetric-key block cipher can use keys of 128, 192, and 256 bits and encrypts and decrypts data in blocks of 128 bits (16 bytes).

Used by WPA2

Key Length

The size of a key, usually measured in bits or bytes, is a cryptographic algorithm used in ciphering or deciphering protected information.

- Larger keys tend to be more secure

- Symmetric Encryption (128-bit or larger)

- Asymmetric Encryption (3,072 bits or larger)

key stretching

A technique used to increase the strength of stored passwords. It adds additional bits (called salts) to help thwart brute force and rainbow table attacks.

Key exchange

Any method by which cryptographic keys are transferred among users, thus enabling the use of a cryptographic algorithm.

Out-of-band key exchange

Sending an encryption key to someone through telephone, courier, or in person.

Not over the Net

In-Band Key Exchange

Sending a symmetric key using asymmetric encryption over a network.

- Protect the key with additional encryption

TPM - Trusted Platform Module

A hardware chip on the motherboard includes many Laptops and some mobile devices.

A specification for cryptographic functions

- Cryptography hardware on a device

Cryptographic processor

-Random number generator, key generators

Persistent Memory

- Unique keys burned in during manufacturing

Versatile Memory

- Storage keys, hardware configuration information

-Securely store BitLocker Keys

Password Protected

- No dictionary attacks

HSM - Hardware Security Module

An appliance for generating and storing cryptographic keys. This solution may be less susceptible to tampering and insider threats than software-based storage.

Used in large Environments

- Clusters, redundant power

- Securely store thousands of cryptographic keys

High-End Cryptographic Hardware

- Plug-in card or separate hardware device

Key Backup

- Secure Storage in hardware

Cryptographic accelerators

- Offload that CPU overhead from other Devices.

Key Management System

Integrated approach for generating, distributing and managing cryptographic keys for devices and applications

Services are everywhere

-On-premise, Cloud-based

- Many different Keys for many different services

Manage all keys from a centralized manager

- Often provided as third-party software

- Separate the encryption keys from the data

All key management from one console

- Create Keys for a specific service or cloud provider (SSL/TLS, SSH, etc.)

- Associate keys with specific users

- Rotate keys in regular intervals

- Log key use and important events

Secure Enclave

The extensions allow a trusted process to create an encrypted container for sensitive data.

Protected area for our secrets

-Often implemented as a hardware processor

-Isolated from the central processor

Provides extensive security features

-Own Boot ROM

-Monitors the system boot process

-True random number generator

-Real-time memory encryption

-Root cryptographic keys

-Performs AES encryption in hardware