CS 3710: Introduction to Cybersecurity - Midterm Review (Weeks 5-8)

Comprehensive review flashcard deck covering Weeks 5 through 8 of CS 3710: Introduction to Cybersecurity, including Cloud Security, IoT Security, Web and API Security, Operating System & Endpoint Security, Hardware Security Tools, Physical/Sensor Exploitation, Memory Safety, the SQL Slammer case study, and real-world breach analyses.

According to the NIST definition, what are the five essential characteristics of cloud computing?

On-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.

How does NIST define cloud computing?

A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

What is multi-tenancy in cloud computing, and what fundamental characteristic enables it?

Multi-tenancy is where multiple customers share the same physical infrastructure while remaining logically isolated, enabled by resource pooling.

How do customer control and provider responsibility change as an organization transitions from IaaS to PaaS to SaaS?

Customer control decreases while provider responsibility increases.

In an Infrastructure as a Service (IaaS) model, what components does the customer manage versus what the provider manages?

The customer manages the Operating System, Applications, and Data (along with Runtime/Middleware). The provider manages Virtualization, Servers, Storage, Networking, and the Physical Data Center.

In a Platform as a Service (PaaS) model, what components are the customer's responsibility?

Applications and Data. The cloud provider manages the underlying infrastructure, operating system, runtime/middleware, and platform.

In a Software as a Service (SaaS) model, what remaining security responsibilities fall on the customer?

Identity management, access configuration, protecting user accounts/credentials, avoiding phishing, and data governance.

What are the benefits and drawbacks of a Public Cloud deployment model?

Benefits include low cost and fast scaling. Drawbacks include less control and shared safety.

What are the benefits and drawbacks of a Private Cloud deployment model?

Benefits include high security and full control. Drawbacks include high upfront cost and maintenance overhead.

Why is the Hybrid Cloud deployment model considered the most complex from a security perspective?

Because organizations must secure on-premises infrastructure, cloud resources, and the network connections and trust relationships bridging them.

What defines a Community Cloud deployment model, and what is an example?

Shared infrastructure among specific organizations with common requirements or compliance needs; examples include AWS GovCloud for U.S. government agencies and shared environments among universities.

What are the main benefits and drawbacks of a Multi-cloud deployment model?

Benefits include avoiding vendor lock-in and selecting the best tools/services. The main drawback is high management complexity.

What are the four primary cloud-native technologies discussed in class?

Virtual Machines (VMs), Containers, Kubernetes, and Serverless computing.

What architectural component enforces isolation between Virtual Machines (VMs) running on shared hardware, and what is the primary escape vulnerability?

The hypervisor acts as the security boundary. The primary threat is a VM escape, where an attacker breaks out of the VM to interact with the hypervisor or host OS.

How do containers achieve isolation compared to virtual machines?

Containers share the host operating system kernel and achieve isolation using OS-level mechanisms like namespaces and control groups (cgroups), making them lighter and faster than VMs.

What is serverless computing, and why is the name considered a misnomer?

An execution model where developers focus solely on code and event handling while the provider manages execution; servers are still involved, but the developer does not configure or manage them.

What is universally recognized as the single most prevalent and defining security failure in cloud environments?

Cloud misconfiguration.

What are the common forms of cloud misconfigurations outlined in class?

Publicly exposed storage buckets, excessive permissions, exposed administrative interfaces, publicly accessible databases, open security groups, hard-coded credentials/API keys, unused credentials, insecure default configurations, and missing logging.

Why is hard-coding credentials and API keys in application code particularly dangerous even if later deleted from the codebase?

They persist in git version control history, commit logs, backups, and public repositories where automated scanners can discover them.

In cloud environments, what security function do security groups perform?

They act as virtual firewalls controlling inbound and outbound network traffic to instances and resources according to configured rules (violating default-deny when left open).

What occurs during an IAM Privilege Escalation cloud attack?

Attackers abuse excessive or misconfigured permissions assigned to compromised roles or accounts to grant themselves higher, unauthorized privileges.

What happens during a Metadata Service / SSRF attack in the cloud?

A compromised application is forced to query the cloud provider's internal instance metadata service to obtain temporary workload credentials or IAM role tokens.

What is Cloud Resource Hijacking?

When compromised cloud compute or storage resources are unauthorizedly repurposed by an attacker for cryptomining, sending spam, or botnet operations.

What are the six sequential phases of the Cloud Attack Chain?

1. Initial Access, 2. Privilege Escalation, 3. Discovery, 4. Lateral Movement, 5. Actions on Objectives, 6. Persistence.

What activities typically occur during the Discovery phase of the Cloud Attack Chain?

Listing storage buckets, enumerating IAM identities, discovering databases, mapping network topology, and identifying exposed services/APIs.

How does lateral movement in a cloud environment differ from traditional on-premises lateral movement?

Instead of pivoting between physical or local subnet workstations, attackers move between cloud services, abuse cloud trust relationships, and pivot across different cloud accounts or projects via APIs.

What persistence mechanisms do attackers establish in compromised cloud environments?

Creating new IAM users or roles, generating new access keys, dropping backdoors/web shells, and configuring scheduled tasks or cloud functions.

What major financial institution was featured as a landmark cloud misconfiguration case study involving SSRF and IAM role abuse?

Capital One.

How does IBM define the Internet of Things (IoT)?

A network of physical devices, vehicles, appliances, and other physical objects that are embedded with sensors, software, and network connectivity, allowing them to collect and share data.

What are the five sectors into which IoT devices were classified in class?

Consumer (cameras, thermostats, locks), Enterprise (sensors, printers, building controls), Healthcare (monitors, connected medical devices), Industrial (PLCs, sensors, actuators), and Transportation (connected vehicles, infrastructure).

Identify this specific delivery robot featured as an example of an autonomous consumer/commercial IoT endpoint.

Coco delivery robot.

What type of IoT infrastructure device is depicted in this image?

PG&E GE SmartMeter (electrical smart utility meter).

What smart consumer IoT device is shown in this image?

Nest Learning Thermostat.

What connected smart home access device is displayed in this figure?

Smart door lock (August / August-style smart lock).

What critical healthcare IoT device is shown in this figure?

Connected continuous glucose monitor / insulin pump.

What agricultural/environmental IoT sensor device is displayed here?

NCD (ncd.io) wireless soil moisture, temperature, and electrical conductivity (EC) sensor.

What are the six structural layers in the IoT Architecture & Ecosystem diagram?

1. Physical Devices, 2. Gateway / Network, 3. Cloud Platform, 4. API Layer, 5. Applications, 6. Users.

What network connectivity protocols are commonly utilized in Layer 2 (Gateway/Network) of an IoT ecosystem?

Wi-Fi, Bluetooth, Zigbee, Thread, Cellular, and Ethernet.

What are the core components that operate inside Layer 3 (Cloud Platform) of an IoT ecosystem?

Device Management, Data Ingestion, Storage, Analytics, Rules & Automation, and Identity & Access.

List all 10 vulnerabilities in the OWASP IoT Top 10.

1. Weak, Guessable, or Hardcoded Passwords; 2. Insecure Network Services; 3. Insecure Ecosystem Interfaces; 4. Lack of Secure Update Mechanism; 5. Use of Insecure or Outdated Components; 6. Insufficient Privacy Protection; 7. Insecure Data Transfer and Storage; 8. Lack of Device Management; 9. Insecure Default Settings; 10. Lack of Physical Hardening.

What hardware and operational constraints create distinct security challenges for IoT devices compared to standard computers?

Resource constraints (limited CPU, memory, storage, power), long deployment lifetimes (years/decades), limited patching/update capability, physical accessibility, massive scale, device diversity, legacy systems, cost pressures, and lack of user interfaces.

What real-world physical and human risks distinguish IoT security failures from standard IT system compromises?

Widespread physical damage, destabilization of major infrastructure systems, direct physical impact on human health and safety, financial harm, and severe privacy violations.

In municipal traffic signal systems, what fail-safe safety hardware device prevents dangerous conflicting signal states (such as green lights in all intersecting directions)?

The Malfunction Management Unit (MMU) or conflict monitor.

What traffic signal controller was shown in the smart city exploitation case study?

Econolite ASC/3-2100 controller.

What are three attack scenarios demonstrated against smart traffic light systems?

Traffic congestion (manipulating signal cycle timings), light control (forcing green lights along an escape route or red in coordination with another attack), and Denial of Service (attempting all-green to trigger the MMU into all-red fail-safe flashing mode).

What are the five steps illustrating how the Mirai Botnet operates?

1. Scan & Infect, 2. Compromised Devices, 3. Botnet Network, 4. Launch DDoS Attack, 5. Target Impact.

What initial vector did the Mirai malware utilize to locate and compromise hundreds of thousands of IoT devices?

Scanning the internet for exposed IoT devices on common ports using default or factory-preset username and password credentials.

What types of IoT devices were predominantly hijacked into the Mirai botnet?

IP cameras, routers, DVRs/NVRs, smart devices, and Network Attached Storage (NAS) devices.

What is Shodan, and what distinguishing characteristics set it apart from search engines like Google?

Shodan is a search engine for Internet-connected devices that indexes device metadata, open network ports, running services, banners, and vulnerabilities rather than web page text.

What query did Angela Orebaugh demonstrate on Shodan to highlight insecure and unpatched video devices worldwide?

"webcam XP"

What is the legal and ethical boundary regarding discovering vulnerable devices on Shodan?

Browsing and gathering passive reconnaissance on Shodan is legal; logging into or interacting with any discovered device without explicit written authorization is unauthorized access and illegal.

How can weaponized drones be utilized to breach corporate enterprise networks?

By flying payloads (e.g., Raspberry Pi, Wi-Fi hacking dongles, batteries) onto building roofs or near upper-floor windows to intercept internal wireless networks, establish rogue access points, or connect to vulnerable corporate IoT devices.

In Angela Orebaugh's military base VoIP security audit, what denial-of-service attack crashed the PBX/VoIP phone system?

A LAND (Local Area Network Denial) attack.

How is a LAND (Local Area Network Denial) attack packet constructed?

A single packet is sent where both the source and destination IP addresses are set to the target's IP address, and the source and destination ports match the target's open listening port, causing the system to loop continuously replying to itself.

What underlying software component caused both the military base VoIP crash and the 2020 Ripple20 vulnerability cluster?

An outdated, unmaintained 1990s embedded TCP/IP software stack (the Treck TCP/IP stack).

What are the four architectural tiers depicted in the Web Application Architecture model?

1. Client (Browsers, Mobile Apps, IoT), 2. Web Front End / Reverse Proxy, 3. Application / API, 4. Database / Storage.

What roles does the Web Front End / Reverse Proxy tier serve in a web architecture?

Handles HTTP(S) traffic, TLS termination, URL routing, load balancing, and serving static content.

What are the two most common open-source web server/reverse proxy platforms in production today?

NGINX and Apache HTTP Server.

What constitutes the attack surface of a modern web application?

URLs and query parameters, input forms, HTTP headers, cookies, API endpoints, file upload interfaces, authentication workflows, and third-party integrations/plugins.

List the top 5 vulnerabilities in the OWASP Top 10 Web Application Security Risks (2025 Draft).

1. A01:2025 - Broken Access Control; 2. A02:2025 - Security Misconfiguration; 3. A03:2025 - Software Supply Chain Failures; 4. A04:2025 - Cryptographic Failures; 5. A05:2025 - Injection.

List items 6 through 10 in the OWASP Top 10 Web Application Security Risks (2025 Draft).

6. A06:2025 - Insecure Design; 7. A07:2025 - Authentication Failures; 8. A08:2025 - Software or Data Integrity Failures; 9. A09:2025 - Security Logging and Alerting Failures; 10. A10:2025 - Mishandling of Exceptional Conditions.

Because HTTP and HTTPS are stateless protocols, how do web servers maintain authenticated user sessions?

Through session identifiers stored in client-side cookies or bearer authentication tokens (such as JSON Web Tokens - JWT) transmitted with subsequent requests.

What is the structural difference between a session ID and an authentication token (JWT)?

A session ID is an opaque pointer stored on the client that refers to session state stored on the server; an authentication token is a self-contained, cryptographically signed payload stored on the client containing user claims and expiration data.

What security protection is enforced by setting the 'HttpOnly' flag on a session cookie?

It blocks client-side scripts (JavaScript) from accessing the cookie via document.cookie, mitigating credential theft via Cross-Site Scripting (XSS).

What security protection is enforced by setting the 'Secure' flag on a web cookie?

It directs the browser to only transmit the cookie over encrypted HTTPS connections, preventing plaintext transmission over HTTP.

What protection does the 'SameSite' cookie attribute provide?

It controls whether cookies are sent with cross-site requests, protecting web applications against Cross-Site Request Forgery (CSRF).

What are the five core validation checks that must be performed on untrusted server input?

Data type, length (min/max size), range (allowed boundaries), format (regex/pattern), and allowed values (allow listing).

Why is allow listing preferred over deny listing (blocklisting) in input validation?

Allow listing strictly defines known acceptable input and denies everything else (default-deny), whereas deny listing is ineffective because the space of possible malicious payloads and encodings is virtually infinite.

What is the fundamental root cause of all injection vulnerabilities (SQLi, Command Injection, NoSQLi, LDAPi)?

The application accepts untrusted data and concatenates it directly into a command or query string such that the interpreter cannot distinguish instructions from data.

Explain how entering ' OR 1=1 -- into a login form bypasses database authentication.

The single quote closes the original SQL string literal, OR 1=1 forces the WHERE condition to evaluate to true for all rows, and -- comments out the remainder of the query (including password verification).

What is the industry-standard software defense against SQL Injection?

Parameterized statements (prepared statements), which compile the SQL query template first and treat user input strictly as data parameters rather than executable commands.

How do parameter placeholders differ in syntax between MySQL/SQLite, PostgreSQL, and Microsoft SQL Server?

MySQL/SQLite uses question marks (?); PostgreSQL uses positional dollar numbers ($1, $2); SQL Server uses named variables (@Email, @param).

What is Cross-Site Scripting (XSS)?

An attack where malicious scripts (typically JavaScript) are injected into trusted websites, executing in victim browsers to steal session cookies, capture keystrokes, or redirect users.

What is Cross-Site Request Forgery (CSRF)?

An attack that tricks an authenticated victim's browser into submitting unauthorized requests and state-changing actions to a vulnerable web application where the user is logged in.

What is Server-Side Request Forgery (SSRF)?

An exploit where an attacker abuses a vulnerable server's functionality to construct and forge arbitrary HTTP requests to internal, non-public resources or cloud metadata services.

How does a Path Traversal (Directory Traversal) attack operate, and what sequence is characteristically used?

An attacker manipulates file paths using dot-dot-slash (../) sequences to traverse outside the intended public web root directory and access restricted system files like /etc/passwd.

What are four critical risks associated with unrestricted File Upload functionality?

Remote Code Execution (RCE via uploaded web shells like .php), Path Traversal via malicious filenames, Denial of Service (large files/zip bombs), and embedded exploits (malicious scripts inside SVG or PDF files).

What essential server-side controls must be implemented to secure file upload processing?

Validate actual file MIME/content type (not just extension), store uploads outside the web root in non-executable storage, rename files with server-generated UUIDs, and enforce strict file size caps.

What is Broken Object-Level Authorization (BOLA) in API security?

A flaw where an API endpoint fails to verify if the requesting authenticated user has permission to access the specific object ID provided in the URI (e.g., changing /api/orders/427 to /428).

What is Broken Function-Level Authorization (BFLA) in API security?

A vulnerability where administrative or privileged API endpoints (e.g., DELETE /api/admin/users/427) are hidden from user interfaces but lack server-side authorization checks when called directly.

What is Excessive Data Exposure in REST APIs?

When an API returns full database objects containing sensitive fields (e.g., SSNs, salaries) relying on client-side frontend code to filter the data, allowing attackers to view raw responses.

What is Content Security Policy (CSP)?

An HTTP response header that restricts the resources (scripts, stylesheets, images) the browser is allowed to load and execute for a given page, serving as a primary defense against XSS.

What is HTTP Strict Transport Security (HSTS)?

A security response header that informs web browsers that the site must only be accessed using HTTPS, blocking downgrade attacks and insecure HTTP connections.

What defines an endpoint in modern enterprise IT?

Any user device or computing system that connects to the network, including workstations, laptops, physical servers, virtual machines, and mobile or IoT devices.

In modern operating system architecture, what is dual-mode operation and the security boundary between them?

The CPU enforces privilege separation between User Mode (restricted, unprivileged application processes) and Kernel Mode (fully privileged OS kernel execution), mediated strictly by system calls.

What core services are managed exclusively by the operating system kernel in privileged mode?

Process management, memory management, file system management, device drivers/hardware management, network stack, and security & access control enforcement.

Compare the access control mechanisms between Windows and Linux for privilege escalation and user identity.

Windows uses Access Tokens, Security Groups, NTFS ACLs, and User Account Control (UAC). Linux uses UID/GID, Groups, RWX permissions/ACLs, and the sudo command for just-in-time privilege elevation.

What unique kernel security mechanism does macOS implement to protect critical system locations even from the root user?

System Integrity Protection (SIP).

What is the difference between an operating system process and a service/daemon?

A process is an active running instance of a user-initiated program; a service (Windows) or daemon (Linux) is a background process running independently of user login to provide persistent functionality.

What are common persistence locations exploited by attackers on Windows and Linux endpoints?

Windows: Services, Scheduled Tasks, Registry startup keys (Run/RunOnce), and Startup folder items. Linux: System services (systemd), cron jobs, and shell rc profile scripts.

What are the 10 categories that comprise the Endpoint Attack Surface?

1. Operating System; 2. Installed Applications; 3. Services & Open Ports; 4. Drivers; 5. User Accounts; 6. Files & Data; 7. Removable Media; 8. Network Interfaces; 9. Management Tools; 10. Configuration.

What is a rootkit, and why is it exceptionally difficult to detect and remove?

Malware that embeds itself directly inside the OS kernel, allowing it to modify kernel memory, hook system calls, subvert diagnostic tools (like ps or ls), and hide its presence from security software.

What does the technique 'Living off the Land' (LOLbins) mean in modern endpoint exploitation?

Attackers leverage legitimate, pre-installed administrative utilities already present on the OS (such as PowerShell, WMI, CertUtil, or Bash) rather than executing custom malware binaries to evade detection.

What is the distinction between a zero-day exploit and an n-day exploit?

A zero-day exploits a vulnerability unknown to the software vendor before a patch exists; an n-day exploits a known vulnerability for which a patch has been publicly released but has not yet been applied to the target system.

What is a Drive-By Download attack?

The unintentional download and execution of malicious code onto a user's endpoint caused simply by visiting an infected or compromised website, requiring no explicit user consent or download click.

What organization publishes standardized security benchmarks and hardening configuration guides for over 100 device and OS types?

Center for Internet Security (CIS).

What key operational practices comprise System Hardening?

Removing unnecessary software, disabling unused services, closing open network ports, removing default accounts, restricting admin privileges, applying security baselines/patches, encrypting data, and enabling secure boot.

Differentiate between Antivirus (AV), Endpoint Detection and Response (EDR), and Extended Detection and Response (XDR).

AV relies primarily on file signatures to block known malicious files; EDR continuously monitors endpoint process behaviors, file modifications, and commands; XDR correlates telemetry across endpoints, identities, cloud workloads, email, and networks.

What are the four phases of the Endpoint Defense in Depth lifecycle?

1. Prevent (Hardening, Patching, Least Privilege, Application Control); 2. Detect (EDR, Logs, Behavioral Monitoring); 3. Contain (Isolate Endpoint, Disable Account, Stop Processes); 4. Recover (Restore, Reimage, Patch, Rotate Credentials, Learn).

What hardware multi-tool device is shown here, and what communication protocols does it support?

Flipper Zero; supports Sub-1 GHz RF, 125 kHz RFID, 13.56 MHz NFC, Infrared (IR), GPIO pins, Bluetooth Low Energy (BLE), and BadUSB emulation.