CIS120B Lecture 1-2 (need to double check too)
CompTIA Cybersecurity Career Pathways and Certification Lifecycle
Penetration testing is a favorite topic within the Security+ curriculum, often serving as a foundation for higher-level certifications.
CompTIA Certification Path:
Core Series: A+ $\rightarrow$ Network+ $\rightarrow$ Security+.
Intermediate/Specialized: PenTest+ (Offensive/Red Team focus) and CySA+ (Defensive/Blue Team focus).
Advanced: CASP+ (now rebranded as SecurityX), which is the most advanced CompTIA security certification.
Renewal Mechanics:
Certifications do not need to be taken in a specific order, though they build upon one another.
Renewing a higher-level certification automatically renews all lower-level certifications associated with it (e.g., renewing PenTest+ or CySA+ refreshes A+, Network+, and Security+).
Obtaining SecurityX (formerly CASP+) will refresh any and all certifications beneath it.
Voucher Costs: Entry-level and intermediate vouchers can cost roughly "200 something" dollars, emphasizing the high stakes of passing exams on the first attempt.
Fundamental Concepts and Methodology of Penetration Testing
Definition of Penetration Testing (Pentesting): A controlled and authorized process of simulating cyberattacks to identify security weaknesses in systems, networks, and applications before malicious attackers can exploit them.
The Ethical Burglar Metaphor: Pentesting is akin to hiring an ethical burglar to check a home's security; they identify weak doors, windows, and locks to provide the homeowner with instructions on how to fix them rather than stealing items.
The Methodical Pentesting Process:
Planning: Defining the scope and objectives. This determines what systems can be tested, the goals of the test, and the specific rules of engagement (e.g., only testing public-facing websites or specific databases while avoiding critical servers).
Reconnaissance (Recon): Background research and gathering information about the target. This can be passive (gathering public info) or active (interacting with the system).
Activities include identifying domains, IP addresses, and technologies used (via Google, LinkedIn, or public records).
Exploitation: Safely using discovered vulnerabilities to demonstrate actual risk. This validates if a weakness can be realistically exploited and determines the potential impact (e.g., demonstrating that a weak password policy allows unauthorized access).
Post-Exploitation: Evaluating what an attacker could do next once access is gained. This includes searching for sensitive data, attempting privilege escalation (moving from a regular user to an admin), and determining business impacts.
Reporting: The final and most critical phase. The tester documents all discovered vulnerabilities, assigned risk levels, evidence of findings, and recommended remediations. This report helps organizations strengthen their security posture.
Vulnerability Disclosure and Reward Frameworks
Responsible Disclosure Program: A specific set of guidelines instructing security researchers on how to report vulnerabilities privately. It defines who to contact, what information to provide, and allowed testing actions.
Example: A bank advising that if a researcher finds a door that does not lock properly, they should report it through a private process rather than airing it publicly on Reddit or the Internet.
Incentives: Participation may be encouraged through monetary rewards, "street cred" (public hall of fame recognition), or certificates.
Bug Bounty Program: An initiative where organizations offer financial rewards and recognition to researchers who discover and responsibly report software flaws. This is often framed as a "find and fix" reward system.
Crowdsourcing Security: Organizations use these programs to gain the skills of thousands of researchers globally. It is often faster and cheaper than dealing with a real data breach.
Google Chrome Example: Google offers a generous bug bounty program; a highly severe and detailed vulnerability finding previously paid out nearly (pre-tax).
Auditing, Compliance, and Administrative Controls
Audit Definition: A formal, comprehensive examination and assessment of an organization's processes, security controls, policies, procedures, and system configurations.
Vehicle Inspection Analogy: Like a mechanic checking brakes, tires, and lights, an auditor checks systems to ensure they are secure and compliant with standards.
Audit Scope and Targets:
Policies and Procedures: Verification that employees follow documented rules (e.g., password policies and incident documentation).
Security Controls: Assessing technical and administrative controls like firewalls, Multi-Factor Authentication (MFA), backups, and encryption (checking if encryption is effective rather than just present).
System Configurations: Checking for unnecessary open ports, missing patches, or the use of default passwords.
Regulatory Compliance: Verifying adherence to standards such as PCI DSS (Payment Card Industry), HIPAA (Healthcare), or SOC 2.
Audit Tools:
Nessus: A vulnerability scanner that identifies missing patches, misconfigurations, and known weaknesses.
Wireshark: A "microscope for network traffic" used to capture and analyze communication to detect unusual activity or troubleshoot issues.
Technical Vulnerability Analysis and Scoring Systems
Vulnerability Analysis: The process of examining raw threat data to prioritize risks and determine which vulnerabilities to fix first based on severity and potential impact.
Common Vulnerability Scoring System (CVSS): An industry-standard framework for measuring vulnerability severity on a scale of to .
CVSS Score Ranges:
: None.
: Low.
: Medium.
: High.
: Critical (e.g., a score of requires immediate addressing).
Scoring Factors: Ease of exploit, required privileges (admin vs. regular user), access requirements (physical vs. remote), and impact on Confidentiality and Integrity.
Common Vulnerabilities and Exposures (CVE): A standardized naming system and unique identifier for publicly known vulnerabilities (e.g., ). It serves as a "Wikipedia of vulnerabilities," allowing organizations to track remediation and share references across the industry.
Risk Metrics and Quantitative Analysis
Exposure Factor (EF): The percentage of a total asset's value that would be lost if a specific threat is successfully realized.
Calculation Example: If a database is worth and a security incident causes in damage, the Exposure Factor is (or ).
Car Metaphor: A minor scratch has a low EF (e.g., damage to a car), while a major collision has a high EF (e.g., damage).
Environmental Variables: Organization-specific conditions that influence risk level.
Example: The same vulnerability is high-risk on a public-facing web server but low-risk on an isolated internal test server. This is like comparing a broken lock on a city house versus a cabin deep in the woods.
Organizational Impact: Vulnerabilities can lead to financial losses, reputational damage, legal penalties, and operational disruption. The "Canvas Ransomware" example highlights how a third-party failure can indirectly impact organizations (like CIAT) that rely on that service.
Risk Tolerance: The amount of risk an organization is willing to accept, which varies by sector.
Low Risk Tolerance: Military, banks, and healthcare (where human lives or massive assets are at stake).
High Risk Tolerance: Startups that prioritize rapid growth over strict security.
Remediation and Mitigation Strategies
Patching: The most cost-effective method; involves installing software updates to fix known security flaws.
Segmentation: Dividing a network into smaller, isolated sections to limit "lateral movement" by an attacker.
Ship Compartment Analogy: Like watertight compartments in a ship, if one network segment is flooded (compromised), the entire network (ship) does not sink.
Compensating Controls: Alternative security measures implemented when a primary fix (like a patch) is not immediately possible.
Scenarios: Zero-day exploits (no patch yet), mission-critical systems that cannot undergo downtime, or legacy applications from vendors out of business.
Examples: Restricting firewall access, adding extra MFA, or moving a vulnerable medical device to its own isolated segment.
Risk Treatment Options:
Insurance (Risk Transfer): Sharing the financial burden with a provider (covers legal fees, breach costs, and restoration).
Exceptions/Exemptions: Formal management approval to accept a risk due to specific business or technical constraints (e.g., a 15-year old manufacturing control system).
Security Intelligence and Event Management (SIEM)
SIEM Functions:
Collection: Gathering logs from routers, switches, firewalls, and servers.
Normalization: Translating disparate log formats into one common language so they can be compared.
Aggregation: Storing gathered logs in a central repository.
Correlation: Linking related events from different systems to detect complex attacks and create a coherent narrative.
Monitoring Types:
System Monitoring: Focus on specific devices (CPU, memory, malware).
Application Monitoring: Focus on software performance (response time, error rates like HTTP 500).
Infrastructure Monitoring: Watching the whole ecosystem (network health, bandwidth).
Alert Tuning and Fatigue:
Too Stringent: High sensitivity leads to "False Positives" and analyst "Alert Fatigue," where real threats are ignored due to excessive noise.
Too Lax: Low sensitivity leads to "False Negatives," where actual attacks go undetected.
Standards and Protocols for Monitoring
NetFlow: A traffic profiling protocol (originally Cisco) that records the source, destination, volume, and path of data without inspecting packet contents.
SNMP v3 (Simple Network Management Protocol): Used to manage and monitor network devices. Version 3 introduces authentication and encryption to verify trap sources (notifications sent by a device when something changes).
Security Content Automation Protocol (SCAP): A collection of standards to automate vulnerability identification and configuration checks.
OVAL (Open Vulnerability and Assessment Language): Used for automated vulnerability and configuration checking.
XCCDF (Extensible Configuration Checklist Description Format): A language for defining security configuration checklists and benchmarks.
Benchmarks: Gold standards for secure configuration (e.g., CIS Benchmarks or DISA STIGs). These ensure consistency across thousands of systems by establishing a baseline (the "new normal").
Agent-Based vs. Agentless Architectures
Agent-Based: Software is installed directly on the device.
Pros: Deep visibility, offline data collection, granular control.
Cons: Consumes system resources (CPU/RAM), complex deployment/management.
Agentless: Central system pulls data using existing protocols (SSH, SNMP, APIs).
Pros: Fast deployment, low resource footprint on endpoints.
Cons: Less granular detail, requires constant network connectivity to the target.
Questions & Discussion
The Difference Between a Virus and a Worm:
Virus: Requires a human to execute a file/interaction to spread.
Worm: Self-replicating and self-executing; it spreads across a network automatically without human interaction.
Heuristic vs. Signature Detection:
Signature-Based: Matches specific "fingerprints" (hashes) of known malware. Very fast and accurate for known threats but fails if the malware is slightly tweaked.
Heuristic (Behavior-Based): Monitors for suspicious activities (e.g., a program suddenly attempting to encrypt thousands of files). This helps detect zero-day or new malware based on its actions rather than its identity.
Quarantining Procedures: Moving suspicious files to a controlled environment for analysis, preventing them from harming the rest of the system while allowing admins to review if it is a true positive or false positive.