Intro to Cyber Security

What does the CIA model in cybersecurity stand for?

Confidentiality, Integrity, Availability.

What is confidentiality in the CIA model?

It ensures that data is accessible only to authorized individuals.

What is the difference between threats, vulnerabilities, and exploits?

Threats are potential dangers, vulnerabilities are weaknesses that can be exploited, and exploits are methods to take advantage of vulnerabilities.

What are the four motivations for cybercrime according to the AMO framework?

Profit, Political, Fun/Fame, Bragging rights.

What is integrity in the CIA model?

Ensuring data is accurate and has not been tampered with.

Why is the "people" aspect critical in cybersecurity?

People are often the weakest link, vulnerable to social engineering and errors.

How does the "technology" aspect help in cybersecurity?

Technology provides tools like encryption, firewalls, and IDS/IPS to protect systems and data.

What role does policy play in cybersecurity?

Policies establish rules and guidelines to ensure the secure use and management of systems and data.

What is a common example of an exploit?

A hacker using malware to take advantage of an unpatched software vulnerability.

What is a worm in cybersecurity?

A self-replicating malware that spreads across networks without needing human interaction.

What is the key difference between a virus and a trojan?

A virus attaches itself to files and spreads when they are executed, while a trojan disguises itself as legitimate software but contains malicious code.

What is ransomware?

Malware that encrypts a victim's files, demanding a ransom for their release.

What does a Cross-Site Scripting (XSS) attack do?

It injects malicious scripts into websites, allowing attackers to steal data from users' browsers.

How does an SQL injection attack work?

It exploits vulnerabilities in web applications by injecting malicious SQL queries to manipulate databases.

What is Cross-Site Request Forgery (CSRF)?

An attack that tricks a user's browser into making unwanted actions on a trusted website where the user is authenticated.

What is a Denial of Service (DoS) attack?

An attack that floods a server or network with excessive requests, making it unavailable to legitimate users.

What is the difference between a DoS and a Distributed Denial of Service (DDoS) attack?

A DoS attack is launched from a single source, while a DDoS attack is carried out from multiple sources simultaneously.

What is a botnet in the context of network attacks?

A network of compromised computers (bots) controlled by an attacker to launch large-scale attacks like DDoS.

How does a trojan horse differ from other malware?

Unlike other malware, a trojan horse pretends to be legitimate software to trick users into installing it.

What is symmetric key cryptography?

A type of encryption where the same key is used for both encryption and decryption.

What are the main symmetric encryption algorithms?

DES (Data Encryption Standard), 3-DES (Triple DES), and AES (Advanced Encryption Standard).

What is the key difference between DES and AES?

AES is more secure and faster than DES, using longer key lengths (128, 192, or 256 bits) compared to DES's 56-bit key.

What is asymmetric key cryptography?

A type of encryption where different keys are used for encryption (public key) and decryption (private key).

What is RSA used for in cryptography?

RSA is an asymmetric algorithm used for secure data transmission, such as encrypting messages and digital signatures.

What does the Diffie-Hellman (DH) algorithm do?

It allows two parties to securely exchange cryptographic keys over an insecure channel.

What is the main advantage of asymmetric key cryptography over symmetric key cryptography?

It eliminates the need to share a secret key beforehand, improving security for key exchange.

What are digital signatures used for?

They are used to verify the authenticity and integrity of a message or document.

What is the role of Public Key Infrastructure (PKI)?

PKI manages the creation, distribution, and revocation of digital certificates to verify identities and enable secure communications.

What is an example of an application that uses asymmetric cryptography?

Secure communications like SSL/TLS in HTTPS for encrypting web traffic and verifying the identity of websites.

What is a hash algorithm used for in authentication?

A hash algorithm converts data into a fixed-size hash value, ensuring data integrity by detecting changes.

What is MD5, and why is it considered insecure?

MD5 is a widely used hash algorithm, but it is vulnerable to collision attacks, where different inputs produce the same hash.

What is SHA-256?

SHA-256 is a cryptographic hash function that produces a 256-bit hash, offering stronger security than MD5.

How does hashing contribute to password security?

Passwords are hashed to protect them from being stored in plain text, making it difficult for attackers to retrieve the original password.

What is multifactor authentication (MFA)?

MFA is an authentication method that requires at least two forms of verification, combining something you know, something you have, and something you are.

What is an example of "something you know" in MFA?

A password or PIN is an example of "something you know."

What is an example of "something you have" in MFA?

A token, smartphone app, or hardware key (e.g., YubiKey) is an example of "something you have."

What is an example of "something you are" in MFA?

Biometrics such as a fingerprint, facial recognition, or an iris scan.

Why is multifactor authentication more secure than single-factor authentication?

MFA requires multiple forms of verification, making it harder for attackers to gain access even if one factor is compromised.

How do hash algorithms like SHA-256 prevent password reuse attacks?

Hashing ensures that even if the same password is used multiple times, it produces different hashed values when combined with techniques like salting.

What is Role-Based Access Control (RBAC)?

RBAC assigns permissions based on the roles users have within an organization, with roles linked to specific privileges.

What is Attribute-Based Access Control (ABAC)?

ABAC grants access based on attributes (e.g., user age, department, resource sensitivity) and rules, allowing for more fine-grained control.

What is Discretionary Access Control (DAC)?

In DAC, data owners have control over their resources and can grant access to others at their discretion.

What is Mandatory Access Control (MAC)?

MAC enforces strict policies, with the system deciding access based on security labels and classifications (e.g., confidential, secret).

What is the primary difference between DAC and MAC?

In DAC, the data owner controls access, while in MAC, access is controlled by a central authority based on security classifications.

What is Set-UID in Unix-based systems?

Set-UID allows a program to run with the privileges of its owner (often root), elevating the user's privileges temporarily to perform specific tasks.

How does Set-UID enhance security in Unix-based systems?

Set-UID allows users to execute files with elevated privileges without granting full root access, limiting unnecessary privilege exposure.

What is a race condition in the context of security vulnerabilities?

A race condition occurs when two processes try to access shared resources concurrently, potentially leading to unexpected or insecure outcomes.

How can race conditions lead to security vulnerabilities?

Attackers can exploit race conditions to manipulate the timing of operations, gaining unauthorized access or altering sensitive data during execution.

What is an example of a vulnerability caused by race conditions?

The Dirty COW vulnerability in Linux allowed attackers to gain write access to read-only files by exploiting a race condition in the copy-on-write mechanism.

What is a common security issue in the Physical Layer?

Physical damage to network hardware (e.g., cables, servers) or unauthorized access to devices.

What is a security concern at the Data Link Layer?

MAC address spoofing and ARP poisoning are common attacks at the Data Link layer.

What is a key security issue at the Network Layer?

IP spoofing and routing attacks, such as manipulating IP addresses or exploiting routing protocols.

What is a common security issue in the Transport Layer?

DOS or SYN flood attacks and man-in-the-middle attacks, which exploit TCP/IP communications.

What security issue occurs at the Application Layer?

Vulnerabilities in application protocols like HTTP/HTTPS can lead to web attacks such as SQL injection and XSS.

What is the main function of TCP/IP?

TCP/IP provides end-to-end communication by defining how data is packaged, transmitted, and received over the internet.

What does SSL/TLS provide in network security?

SSL/TLS ensures encryption and authentication for secure communication over the internet, such as in HTTPS.

What is the function of a packet filtering firewall?

It inspects and filters network traffic based on predefined rules, such as source/destination IP addresses and port numbers.

What is the difference between an IDS and an IPS?

An IDS detects and alerts on suspicious network activity, while an IPS actively blocks and prevents those activities in real time.

How does a stateful firewall differ from a packet filtering firewall?

A stateful firewall tracks the state of active connections and makes filtering decisions based on the context of the traffic, rather than just inspecting individual packets.

What is the purpose of a Privacy Impact Assessment (PIA)?

A PIA identifies privacy risks in a project and recommends ways to manage or reduce those risks to protect personal data.

What is Privacy Preserving Computing (PPC)?

PPC refers to techniques like encryption or anonymization that allow data to be processed while protecting the privacy of individuals.

What is the General Data Protection Regulation (GDPR)?

GDPR is an EU regulation that enforces strict data protection and privacy rules, giving individuals control over their personal data and imposing penalties for non-compliance.

What are the Australian Privacy Principles (APPs)?

The APPs are a set of 13 principles that guide Australian organizations on how to handle personal information, covering its collection, use, storage, and disclosure.

How do GDPR and the Australian Privacy Principles (APPs) differ?

GDPR has global applicability for organizations handling EU residents' data, while APPs are specific to Australian entities and those operating in Australia.

What is the difference between phishing, spear phishing, and whaling?

Phishing targets a broad audience with fake emails or websites, spear phishing targets specific individuals or organizations, and whaling targets high-level executives.

What is vishing and smishing?

Vishing involves phone or VoIP-based scams, while smishing uses SMS text messages to trick victims into providing sensitive information.

What is tailgating in social engineering?

Tailgating is when an unauthorized person gains physical access to a secure area by following an authorized person through an access point.

What is the purpose of a cyber awareness training program?

Cyber awareness training programs educate employees on recognizing and preventing security threats, such as social engineering attacks, to reduce the risk of breaches.

What are common social engineering techniques aside from phishing?

Techniques include dumpster diving (retrieving sensitive information from discarded items), shoulder surfing (watching someone enter sensitive info), and impersonation (pretending to be someone trustworthy)

What is the difference between qualitative and quantitative risk assessment?

Qualitative risk assessment uses subjective methods like interviews and expert opinions to evaluate risks, while quantitative risk assessment uses numerical values and metrics, such as Annualized Loss Expectancy (ALE), to assess risks.

What is ISO 27001?

ISO 27001 is an international standard for managing information security, defining requirements for establishing, implementing, and maintaining an Information Security Management System (ISMS).

How does ISO 27002 differ from ISO 27001?

ISO 27002 provides best practice guidelines for implementing security controls, while ISO 27001 outlines the requirements for an ISMS and is used for certification.

What is the purpose of an incident response plan?

An incident response plan outlines procedures for detecting, responding to, and recovering from security incidents to minimize damage and restore normal operations.

What are common risk mitigation strategies in cybersecurity?

Common strategies include risk avoidance, risk transfer (e.g., insurance), risk acceptance, and risk mitigation through implementing security controls like firewalls, encryption, and regular patching.

Block Cipher - Electronic Code Book Mode

Simple; can encrypt in PARALLEL (fast). It does not hide data patterns, so is unsuitable for long messages.

- Susceptible to replay attacks

Block Cipher - CBC Chaining Mode

It uses random initialisation vector (IV) to start off the first block. Repeated plaintext ≠ repeated ciphertext.

- Must be encrypted in SERIAL (slow).

Hashing - Salting

- Is not strictly kept secret, randomly generated for each user.

- Same password ≠ same hash

Hashing - Stretching

- To hash many times; makes it difficult to parallelise using GPU.

- No efficient way to create rainbow tables

Rainbow Table

Precomputed table of hashes paired with plaintext passwords. Used for "reversing" hashes to original plaintext.

Watering Hole Attacks

- Leverage a compromised web server to target specific groups

- Only members are attacked

- Difficult to identify using traffic analysis

Homomorphic Encryption

Directly computes on ciphertext without decryption by using an effective encryption function that achieves additive/multiplicative homomorphism.

- Addition: E(a+b) = E(b)

- Multiplication: E(ab) = E(a) E(b)

Anonymisation

A de-indentification technique involving the use of a one-way cryptographic function (hash) on the PII.

Has a confidentiality impact level of low as long as:

The re-identification algorithm, code or pseudonym is maintained in a different system, and data elements are not linkable.

Applications of PPC

1. Secure bidding: Publish no sensitive info

2. Intelligence sharing: Publish partial sensitive info

3. Info share in virtualised clouds: immunised to data mining

Delphi Technique

Allows to obtain expert opinions without being face-2-face. Each member gives an honest opinion and results are complied and distributed to members several times until a consensus is formed.

What is Non-repudiation?

Assures that the author/send cannot deny an action. This is accomplished through digital signatures.

Macro viruses

Written in macro language, infects docs, excels, PowerPoints etc. It exploits the fact that users sometimes enable macros in the documents they receive.

Sniffing

Capture & analyse the packets through traffic control devices. Helps identify potential network trouble spots or criminal activity, allows to monitor the info travelling over network.

- Also enables hackers to steal proprietary info: email, company files, etc.

Spoofing

An intruder imitates another legitimate device or user to launch an attack against the network. eg. ARP, IP, Email, and DNS spoofing attacks

Key Generation

Select two large prime numbers p,q

n = p x q

Select small odd integer e relatively prime to v & satisfies v mod e = 1

Public key is (e, n)

Compute d such that (dxe) mod v=1, e<>d

Private key is (d, n)