Mitigation of Cyberattacks

ITSecurityPolicyFramework

Collection of policies standards procedures and guidelines to reduce risk

RFC1087

Statement defining unethical Internet activities unauthorized access disruption resource waste data destruction privacy compromise

Policy

High-level management directive applies organization-wide

Standard

Detailed mandatory technical requirements for hardware and software

Procedure

Step-by-step instructions to implement policies and standards

Guideline

Recommended best practice flexible guidance

PolicyHierarchy

Policies at top standards under policies procedures and guidelines support them

PolicyImpactDomains

Policies should consider impact across seven IT infrastructure domains

SecurityPolicyGoal

Reduce exposure to risks threats and vulnerabilities

AcceptableUsePolicy

AUP defines allowed and prohibited use of IT assets

SecurityAwarenessPolicy

Ensures users understand security expectations and behaviors

AssetClassificationPolicy

Defines data sensitivity levels and asset priorities

AssetProtectionPolicy

Prioritizes mission-critical systems aligned with BIA

AssetManagementPolicy

Manages lifecycle and security of IT assets

VulnerabilityManagementPolicy

Defines vulnerability window and remediation standards

ThreatAssessmentPolicy

Defines monitoring and threat response authority

WarDriving

Driving around to find open WiFi networks

WarDrivingMitigation

Reduce range hide SSID use strong encryption

WarChalking

Marking physical locations with discovered SSID and credentials

WarChalkingMitigation

Use WPA2 WPA3 strong passwords MAC filtering

WEPWeakness

WEP easily cracked obsolete encryption

WPACracking

Attacker determines pre-shared key

WEPWPAMitigation

Use WPA2 WPA3 strong complex passphrase

EvilTwin

Rogue AP with same SSID to capture credentials

EvilTwinMitigation

Implement Wireless Intrusion Prevention System WIPS

RogueAccessPoint

Unauthorized AP connected to internal network

RogueAPMitigation

Switch port tracing scanning rogue detection tools

ICMPFlood

Excess ICMP packets exhaust system resources

ICMPMitigation

Block ICMP at firewall

DoS

Single source flooding target to deny service

DDoS

Multiple systems flood single target

DDoSMitigation

Baseline traffic monitor anomalies use anti-DDoS devices

FraggleAttack

Spoofed UDP broadcast flooding

FraggleMitigation

Disable IP broadcast block ICMP

BufferOverflow

Excess data overwrites buffer causes crash or code execution

BufferOverflowMitigation

Code review patch vulnerabilities input validation

InjectionAttack

Malicious code injected into application input fields

InjectionMitigation

Server-side validation input sanitization

BrokenAuthentication

Brute force credential attacks

BrokenAuthMitigation

MFA complex password policy account lockout

SensitiveDataExposure

Data exposed via weak encryption MITM misconfigured access

SensitiveDataMitigation

Encrypt in transit restrict access disable caching secure storage

SecurityMisconfiguration

Default accounts unnecessary services open ports

MisconfigMitigation

Harden OS disable unused services close unused ports

Hardening

Process of removing unnecessary services and locking down systems

HardeningBalance

Security versus usability tradeoff

DefenseInDepth

Layered security controls to slow and stop attackers

DefenseInDepthLayers

Policies physical network host application data

DefenseInDepthPurpose

Multiple controls prevent single point failure