Deck 16 - Network Security Concepts

What are the three components of the CIA Triad?

Confidentiality, Integrity, and Availability

Confidentiality (security)

Ensuring sensitive information is accessed only by authorized individuals and kept away from those not authorized to possess it

Integrity (security)

Assuring the accuracy, reliability, and trustworthiness of data and systems; checks if data or systems have been altered

Availability (security)

Ensuring that data, systems, and resources are accessible to authorized users when needed

Name two mechanisms used to protect confidentiality

Access controls (passwords, biometrics) and encryption

Name two mechanisms used to protect integrity

Checksums/cryptographic hash functions and digital signatures

Name three mechanisms used to ensure availability

Redundancy, fault tolerance, and backup systems (plus disaster recovery plans)

What attack is a major threat to availability?

Distributed Denial of Service (DDoS)

Risk (formula)

Risk = Threat x Vulnerability

Risk (definition)

The probability of a threat exploiting a vulnerability

Asset (security)

Anything within an environment that should be protected

Asset valuation

A dollar value assigned to an asset based on actual cost and nonmonetary expenses

Threat

Any potential occurrence that may harm an asset

Threat agent / threat actor

People, programs, or systems that use threats to cause harm

Threat event

An occurrence that leads to the exploitation of vulnerabilities

Threat vector (attack vector)

The path or means by which an attacker can gain access to a target in order to cause harm

Vulnerability

The weakness in an asset, or the absence/weakness of a safeguard or countermeasure, that could be exploited

Exposure (security)

Actual or anticipated damage from a threat

Safeguard

Anything that removes or reduces a vulnerability, thereby reducing risk

Attack (security)

The threat exploiting the vulnerability

Breach

The occurrence of a security mechanism being bypassed or thwarted by a threat agent

AAA stands for

Authentication, Authorization, and Accounting

Authentication

The process of verifying the identity of a user, device, or other entity; a prerequisite to granting access to resources

Authorization

Determines what an authenticated user is permitted to do by matching user/system credentials against an access control list

Accounting (AAA)

Also called auditing; ensured by keeping a track record (logging) and monitoring of user actions

"Something you know" (authentication factor)

Knowledge-based authentication such as a password, PIN, or answers to secret questions

"Something you have" (authentication factor)

Possession-based authentication such as a security token, smart card, or mobile phone (OTP/push notification)

"Something you are" (authentication factor)

Biometric authentication such as fingerprints, facial recognition, iris scans, or voice patterns

"Somewhere you are" (authentication factor)

Location-based authentication determined through IP address, GPS, or geolocation methods

"Something you do" (authentication factor)

Behavioral biometrics, such as keystroke dynamics or mouse-use patterns, used to authenticate a user

Multifactor Authentication (MFA)

A security process requiring more than one independent category (factor) of credentials to verify a user's identity

Why is "something you know" the weakest authentication factor?

It is commonly used but vulnerable to theft, guessing, or brute-force attacks

How can systems (not people) be authenticated?

Using certificates and cryptographic keys, IP allow lists, or MAC address filtering

What does authorization determine?

What an authenticated user is allowed to do, by establishing their rights and privileges

Access Control List (ACL)

A list of permissions attached to a resource, used to enforce access control

MAC

Mandatory Access Control: An access control model where access rights are regulated by a central authority based on levels of security clearance; common in government/military systems; users cannot change permissions

Discretionary Access Control (DAC)

An access control model where the resource owner decides access levels; the most flexible model, but risks users granting excessive access

Role-Based Access Control (RBAC)

Assigns permissions based on a user's role within an organization; common in corporate environments to streamline access management

Rule-Based Access Control

Access decisions are based on a set of rules defined by the system administrator, e.g. firewall rules based on source/destination IP

ABAC

Attribute-Based Access Control: Uses policies that evaluate attributes (characteristics) of users, the environment, and resources; provides fine-grained access control based on multiple factors

Principle of Least Privilege

Limiting the access rights of users, accounts, and processes to only the resources absolutely required to perform their functions or tasks

Single Sign-On (SSO)

A feature where users log in once and gain access to multiple systems without needing to re-authenticate

Two benefits of SSO

Reduces password fatigue (fewer passwords to manage) and centralizes authentication control for easier security policy enforcement

IAM

Identity and Access Management: A security framework that ensures the right individuals and systems get safe access to the correct technology resources.

LDAP

Lightweight Directory Access Protocol; a protocol for accessing and maintaining distributed directory information (users, groups) over an IP network; foundation of Microsoft Active Directory

Federation (identity)

The process of linking and managing the same identity or set of credentials across different systems and organizational boundaries to enable SSO

SAML

Security Assertion Markup Language; an open XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider

SAML: Identity Provider (IdP)

Security Assertion Markup Language: The service that authenticates users and provides identity information to service providers (e.g., Okta, Azure AD, Google Identity)

SAML: Service Provider (SP)

The application or service that relies on information from the IdP to provide access to the user

OAuth

An open standard for access delegation; grants applications limited access to a user's data on another website without exposing the user's password (authorization, not authentication)

OpenID Connect

An identity layer built on top of OAuth 2.0 that allows clients to verify the identity of the end-user based on authentication performed by an authorization server

RADIUS

Remote Authentication Dial-In User Service; a networking protocol providing centralized AAA management for users who connect to and use a network service

TACACS+

Terminal Access Controller Access-Control System Plus; a Cisco protocol providing centralized AAA services, similar to RADIUS

TOTP

Time-Based One-Time Password: Uses a time-limited code or token generated by an app/device that expires after a short duration, reducing the window for unauthorized access

Geofencing

A location-based service that uses GPS, RFID, Wi-Fi, or cellular data to trigger a pre-programmed action when a device enters or exits a virtual geographic boundary

Physical security

Measures that protect assets, personnel, and data from physical actions and events that could cause serious loss or damage

Purpose of security cameras

Act as a deterrent to unauthorized actions and provide crucial evidence in the event of a security breach or incident

Modern electronic locks

Integrate locks with access control systems, allowing sophisticated management of entry permissions and tracking of access history

Deception and disruption technology

Cybersecurity strategies and tools designed to mislead, confuse, or disrupt malicious actors by creating traps or illusions to divert attackers away from real assets

Honeypot

A decoy security mechanism that imitates a real computer, network, or information system to detect, deflect, or study hacking attempts; it is isolated and monitored

Honeynet

A network of honeypots that simulates a full network environment to attract attackers and provide deeper insight into their tactics and lateral movement

Honeyfile

A decoy file placed within a network's file system, designed to appear legitimate and attractive; unauthorized access alerts security personnel

Honeytoken

A broader term for any decoy data or token (fake account, database record, etc.) inserted into a system, where interaction indicates a compromise or unauthorized access

Data locality

Refers to the geographical location where data is stored, processed, and managed, ensuring compliance with regional legal requirements

PCI DSS

Payment Card Industry Data Security Standard; a set of security standards ensuring companies that accept, process, store, or transmit credit card information maintain a secure environment

GDPR

General Data Protection Regulation; a comprehensive EU data protection regulation governing the processing and movement of personal data, giving individuals rights such as access, correction, and deletion

Network segmentation enforcement

Dividing a network into smaller segments or subnets to improve security and performance, limiting access to sensitive data and containing potential breaches

Guest network

Provides internet access to visitors without exposing the main network and its sensitive resources

BYOD segmentation

Placing Bring Your Own Device (personal) devices on a separate network segment to limit their access to sensitive data/systems while still allowing productivity

ICS

Industrial Control System: A general term encompassing several types of control systems (SCADA, DCS, PLCs) used in industrial production

SCADA

Supervisory Control and Data Acquisition; systems used to monitor and control industrial processes across distributed sites

Internet of Things (IoT)

The network of physical objects (embedded with electronics, software, sensors) that traditionally do not require internet access but connect to collect and exchange data

Encryption

The process of converting readable (plaintext) data into a secure, unreadable format (ciphertext) that can only be read or processed after it is decrypted

Encryption of data in transit

Encrypting data that is being transferred over a network to keep it secure and private while moving between endpoints; common protocols: HTTPS, SSL/TLS, VPN

Encryption of data at rest

Encrypting data stored on physical media (e.g., hard drives, USB drives) to prevent unauthorized access; techniques include full disk encryption (FDE) and encrypted file systems

Four goals of cryptography

Confidentiality, Integrity, Authentication, and Non-repudiation

Cryptography goal: Confidentiality

Ensuring information is accessible only to those authorized to have access, via encryption

Cryptography goal: Integrity

Guaranteeing that information is protected from unauthorized or accidental changes, verified using cryptographic hash functions

Cryptography goal: Authentication

Verifying the identity of a user, device, or entity in a communication process, e.g., via digital certificates

Cryptography goal: Non-repudiation

Preventing an entity from denying their involvement in a transaction or activity; digital signatures ensure a signer cannot later deny having signed

Symmetric encryption

A type of cryptographic algorithm that uses the same shared key for both encryption and decryption

Symmetric encryption: key sharing

The same key used for encrypting and decrypting data must be securely shared and kept secret between communicating parties

Symmetric encryption: speed

Symmetric algorithms are generally faster and more efficient than asymmetric algorithms, making them suitable for encrypting large amounts of data

Symmetric encryption: key management challenge

Securely distributing and managing the shared key is the biggest challenge; if a key is intercepted or leaked, the security of all data encrypted with it is compromised

Symmetric encryption: scalability formula

For N users to communicate securely with each other, N(N-1)/2 unique key pairs are needed, making key management impractical in large networks

Symmetric encryption: non-repudiation weakness

Symmetric key cryptography does not provide non-repudiation, since the same key is used by all parties and it cannot be determined who performed the encryption/decryption

Asymmetric encryption

Also known as public-key cryptography; a cryptographic system that uses a pair of keys, a public key and a private key, to encrypt and decrypt data

Asymmetric encryption: public key

Can be used to encrypt data and decrypt it; is shared with anyone

Asymmetric encryption: private key

Can be used to encrypt and decrypt data; is kept secret with the owner only

Asymmetric encryption process

A sender encrypts data using the recipient's public key; only the recipient's corresponding private key can decrypt it

Asymmetric encryption: advantages

Solves the key distribution problem of symmetric encryption (public keys can be shared openly) and provides a method for digital signatures, supporting authentication and non-repudiation

Asymmetric encryption: disadvantages

More computationally intensive/slower than symmetric encryption for large amounts of data, and requires careful management of the private key

Public Key Infrastructure (PKI)

A framework used to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption

PKI functions

Encryption/decryption of data, creation and verification of digital signatures, and certificate management (issuance and revocation by the CA)

X.509 digital certificate

A standard format for digital certificates containing attributes such as version number, subject name, issuer name, validity period, public key, and serial number

Certificate Authority (CA)

A trusted entity that issues, verifies, and revokes digital certificates

CA certificate

Certificate Authority: A digital document issued by a trusted organization that verifies identities and binds them to cryptographic keys to secure online communications.

End entity certificate

A digital document issued to a specific user, device, or server that authenticates identity and enables secure communication.

Domain Validation (DV) certificate

A certificate that verifies domain control only, offering a basic level of assurance

Extended Validation (EV) certificate

A certificate offering a higher level of assurance, verifying that the applicant is a legitimate business