CIS120B Lecture 1-2 (double check)

CompTIA Certification Paths and Professional Development

• CompTIA Certification Roadmap: The standard progression for most cybersecurity professionals follows a specific hierarchy:

  • A+ (Foundational/Entry-level).

  • Network+ (Networking fundamentals).

  • Security+ (Intermediary security concepts).

• Advanced and Specialty Certifications:

  • PenTest+: Focuses on offensive security (Red Team), which involves attacking environments in an ethical and legal manner.

  • CYSA+ (Cybersecurity Analyst): Focuses on defensive security (Blue Team).

  • Security X (formerly known as CASP+): The most advanced cybersecurity certification offered by CompTIA.

• Exam Logic and Preparation:

  • There is no mandatory order to take these exams, but taking them sequentially builds a necessary foundation of knowledge.

  • The cost of vouchers can be significant (approximately $200+ USD out of pocket), making high-stakes preparation essential.

• Renewal Policies:

  • CompTIA provides a renewals mechanism where renewing a higher-level certification (e.g., PenTest+ or CYSA+) automatically renews all lower-level or parallel certifications underneath it.

  • If an individual achieves the Security X certification, any subsequent renewal of that specific certification will refresh all certifications below it in the hierarchy.

Penetration Testing Fundamentals and Methodology

• Definition: Penetration testing (or Pentesting) is a controlled and authorized process of simulating cyberattacks to identify security weaknesses before malicious actors can exploit them.

• The Metaphor of the Ethical Burglar: Hiring a pentester is like hiring an ethical burglar to test a home's security. Instead of stealing, they identify weak doors, windows, and locks, and provide a guide on how to fix them.

• Scope of Testing: Pentesting aims to uncover vulnerabilities across:

  • Systems: Servers and computers.

  • Networks: Connections between devices.

  • Applications: Websites, mobile apps, and software.

• The Level Five Methodical Pentesting Process:

  1. Planning: Defining the scope and objectives. This phase answers questions regarding which systems can be tested, the goals of the test, and specific rules of engagement (e.g., "You can only test the public-facing website, not the critical database servers").

  2. Reconnaissance (Recon): Gathering information about the target. This can be:

     • Passive Reconnaissance: Gathering publicly available information via Google, LinkedIn, or domain/IP identification without interacting with the target.

     • Active Reconnaissance: Interacting with systems to discover technologies.

  3. Exploitation: Safely attempting to use discovered vulnerabilities to demonstrate risk. This verifies if a weakness is actually exploitable and determines the potential impact (e.g., showing how a weak password policy allows unauthorized access).

  4. Post-Exploitation: Evaluating what an attacker could do after gaining entry. This includes checking if sensitive data can be reached, if permissions can be escalated (e.g., user to admin), and identifying business impacts.

  5. Reporting: Documenting findings for stakeholders. A high-quality report must include all discovered vulnerabilities, risk levels, evidence of findings, and recommended remediations.

Vulnerability Disclosure and Bug Bounty Programs

• Responsible Disclosure Program: A set of guidelines instructing security researchers on how to report a vulnerability privately once discovered.

  • Goal: To improve security while protecting both the bank/organization and the researcher.

  • Procedure: Typically involves specific steps such as a dedicated email, a web form, or an encrypted communication channel.

• Bug Bounty Program: An initiative where organizations offer financial rewards (money) and "street cred" (public recognition or Hall of Fame listing) for finding and reporting vulnerabilities.

  • Incentives: Google has been known to pay up to $1,000,000$ USD for a single severe Chrome vulnerability.

  • Benefits for Organizations: Crowdsourcing security allows millions of researchers to find bugs faster than an internal team, gaining diverse perspectives at a lower cost than a breach.

System Auditing, Compliance, and Tools

• Audit Definition: A comprehensive examination and assessment of an organization's processes, controls, policies, and system configurations to ensure adherence to standards.

  • Metaphor: A vehicle inspection checking brakes, tires, and lights to ensure safety.

• Audit Targets:

  • Policies and Procedures: Ensuring employees follow password policies and documentation standards.

  • Security Controls: Assessing the effectiveness of firewalls, MFA, encryption, and backup procedures.

  • Regulatory Compliance: Verifying adherence to standards such as PCI DSS (Payment Cards), HIPAA (Healthcare), or SOC 2.

• Analytical Tools:

  • Nessus: A vulnerability scanning tool that acts as a security inspector to automatically check for missing patches and misconfigurations.

  • Wireshark: A network traffic analyzer described as a "microscope for network traffic" used to capture and analyze communication packets.

• Audit vs. Pentest: An audit asks, "Is Multi-factor Authentication (MFA) required by policy?" whereas a pentest asks, "Can I bypass the MFA to gain access?"

Vulnerability Analysis and Scoring Systems

• Vulnerability Analysis: The process of taking raw data and turning it into prioritized information by determining seriousness, impact, and which systems are affected.

• CVSS (Common Vulnerability Scoring System): An industry-standard framework used to measure severity on a scale of $0$ to $10$.

  • $0$: None.

  • Low Risk: (e.g., $2.5$).

  • Medium/High Risk: Intermediary scores.

  • Critical Risk: $9.0$ to $10.0$ (e.g., a score of $9.8$ is critical).

  • Factors: Exploitability (can a 12-year-old run the script?), privileges required (admin vs. regular user), and impact on CIA (Confidentiality, Integrity, Availability).

• CVE (Common Vulnerabilities and Exposures): A unique identifier naming system used for tracking publicly known vulnerabilities (e.g., CVE-2024-12345). It acts as a standardized catalog or "Wikipedia" of bugs.

Risk Management and Calculations

• Exposure Factor ($EF$): A percentage representing the total asset value that would be lost if a threat is successful.

  • Formula Example: If a database is worth $100,000$ USD and an incident causes $40,000$ USD in damage, the EF is $40\%$ or $0.40$.

• Environmental Variables: Specific conditions that change risk levels. A broken lock in a busy city (public web server) represents higher risk than a broken lock on a remote cabin (internal test server).

• Risk Tolerance: The amount of risk an organization is willing to accept.

  • Low Tolerance: Military, banks, healthcare (failure could lead to loss of life or massive financial impact).

  • High Tolerance: Startups (prioritizing growth over perfect security).

Remediation and Validation Strategies

• Remediation: The act of fixing the problem after a vulnerability is identified.

  • Patching: Installing software updates. The fastest and most cost-effective method.

  • Segmentation: Dividing a network into smaller, isolated sections (like watertight compartments on a ship). If one section is breached, the attacker is trapped.

  • Compensating Controls: Alternative security measures used when the ideal fix cannot be applied (e.g., for legacy systems that are too critical to reboot or no longer supported by vendors).

  • Risk Transfer: Purchasing Cyber Insurance to share the financial burden of a breach with a provider.

• Exceptions vs. Exemptions: Formal management approval to accept a risk due to business needs or technical constraints.

• Validation: Verifying that the remediation worked. This involves Rescanning (using a tool like Nessus to confirm the bug is gone) or Verification (auditing the documentation and patch status).

Security Alert Monitoring and SIEM

• Log Aggregation: The process of collecting logs from disparate sources (firewalls, routers, servers) into a central repository.

• SIEM (Security Information and Event Management): A centralized platform that collects, normalizes (translating different logs into one language), aggregates, and correlates data.

  • Correlation: Linking related events (e.g., failed login on server + port scan on firewall) to tell a cohesive story.

  • Splunk Enterprise: A well-known SIEM tool featuring customizable dashboards and widgets for triaging alerts.

• Monitoring Models:

  • Agent-based: Software installed directly on the device. Provides deep visibility but consumes CPU and memory.

  • Agentless: Uses remote protocols (SSH, SNMP). Easier to deploy and lightweight but offers less granular control.

• Protocols and Tools:

  • SNMP (Simple Network Management Protocol): Used to monitor network devices. SNMP Traps are automatic alerts sent when a device's status changes. Version 3 (v3) is preferred for its encryption and authentication.

  • NetFlow: A Cisco-developed protocol acting as a "traffic camera" for the network, recording source, destination, and volume without inspecting packet contents.

  • Syslog-NG / Rsyslog: High-performance log collection services used primarily in Linux/Unix environments.

Standardization and Benchmarks

• SCAP (Security Content Automation Protocol): A suite of standards that allow security tools to communicate in a universal language.

  • OVAL: Open Vulnerability and Assessment Language.

  • XCCDF: Extensible Configuration Checklist Description Format (the "checklist" language).

• Benchmarks: Standard points of reference (like CIS or DISA STIGs) used to establish a "gold standard" or baseline for system hardening.

• Alert Tuning: The process of refining alert sensitivity.

  • Too Strict: Causes Alert Fatigue (analysts ignore real threats due to too many false positives).

  • Too Lax: Causes False Negatives (real attacks missed).

Antivirus and Malware Detection

• Signature-based Detection: Recognizing malware via a known "fingerprint" or hash. Fast but easily bypassed by slight code changes.

• Heuristic/Behavior-based Detection: Looking for suspicious activity (e.g., a program suddenly trying to encrypt $10,000$ files per minute) rather than a specific file match.

• Malware Types:

  • Virus: Requires human interaction to execute/spread (clicking an attachment).

  • Worm: Self-replicating and self-spreading; no human interaction needed.

  • Trojan: Malware disguised as legitimate software (e.g., a free game).

  • Ransomware: Encrypts files and demands payment (usually in cryptocurrency like Bitcoins).

Questions & Discussion

• Question: When Canvas was down, was CIAT responsible?

• Answer: No, Canvas was down for many organizations due to a ransomware attack. This is an example of organizational impact where a weak link in a third-party service affects everyone using it.

• Question: What is the primary purpose of a responsible disclosure program?

• Answer: To provide a secure process for reporting vulnerabilities to organizations privately so they can fix them before they are exploited.

• Question: How long must medical records be kept under HIPAA?

• Answer: According to the discussion, providers must keep records for at least $7$ years, but for an active patient, the retention duration may be longer as records cannot be destroyed while care is ongoing.

• Question: What is the difference between a False Positive and a False Negative?

• Answer: A False Positive is a "false alarm" where no threat exists. A False Negative is a real threat that was missed by the monitoring system.