Security+ Overview: Controls & Threats
Uploaded by
khanmazen739Security+ Overview: Controls & Threats
Uploaded by
khanmazen739Common questions
Powered by AISymmetrical encryption uses a single key for both encrypting and decrypting data, making it efficient for bulk data encryption due to its lower computational requirements. It is commonly used for securing data at rest and in transit in environments where both parties can securely share the same key . In contrast, asymmetrical encryption requires a pair of cryptographic keys (public and private) for encryption and decryption. This method excels in situations where secure key exchange is needed over unsecured channels, like digital certificates and SSL/TLS communications, providing mechanisms for secure identity verification and digital signatures .
Non-repudiation is crucial in cybersecurity as it verifies the authenticity of communications and actions, ensuring accountability by preventing entities from denying previous commitments or actions. Digital signatures play a key role in achieving non-repudiation by providing a verifiable and secure means of verifying the identity of the sender and ensuring that the message transmitted has not been altered. They use asymmetrical encryption, wherein a private key generates the signature, and a public key is used for verification, providing assurance of the sender's identity and the message's integrity .
Classifying threat actors, such as script kiddies, hacktivists, organized crime groups, and nation-state actors, allows organizations to tailor and prioritize their security measures based on the specific types of threats they face. Recognizing the capabilities and motivations of each threat actor type enables organizations to allocate resources efficiently, emphasizing higher security investments on protecting against sophisticated threats like nation-state actors or organized crime, which employ advanced tools and methods . Tailored defenses help in mitigating specific risks, enhancing resilience against potential attacks, and conserving resources by focusing on the most critical and plausible threats .
A Certificate Signing Request (CSR) is a formal request sent to a Certificate Authority (CA) for the issuance of a digital certificate. It includes crucial information such as the organization's name, domain name, locality, and public key, which will be included in the digital certificate to authenticate the certificate owner . The CSR is critical to ensure the certificate is appropriately linked to the correct entity, and only the public key is provided to the CA to protect the private key while allowing others to verify the identity and integrity of signed communications .
Hacktivists are motivated primarily by the desire to promote social or political causes. They use hacking as a form of activism to target organizations or entities they believe oppose their beliefs, often employing methods such as website defacement or data leaks to raise awareness and protest against issues they find objectionable . In contrast, nation-state hackers operate under the sponsorship or direction of a government and focus on strategic objectives such as cyber espionage to gather intelligence or steal sensitive information to serve national interests. Nation-state actors are known for using sophisticated techniques and may target government agencies, businesses, or critical infrastructure .
The zero-trust model assumes that threats can come from both inside and outside the network, unlike traditional models which often rely on trusted network zones. In zero-trust, every user and system must be validated and authenticated regardless of their location within the network . This model enhances security by limiting access to resources strictly to verified and authorized users, thereby reducing the risk of internal and external breaches. However, challenges include increased complexity in managing and maintaining constant authentication and authorization processes, as well as potential impacts on user experience and system performance due to continuous validation .
Deception technologies like honeypots are employed as decoy systems to attract attackers, providing early detection of unauthorized access attempts and insights into attacker behavior and tactics . By identifying attackers, honeypots can help in formulating defensive strategies and preventing attacks on actual systems by diverting them. However, risks include potential exposure of false vulnerabilities to attackers, which may reveal network configurations or vulnerabilities if not adequately isolated. There's also a risk of attackers using honeypots to practice or develop more advanced techniques that could be applied elsewhere .
A Certificate Authority (CA) is a trusted entity in PKI responsible for issuing digital certificates that authenticate the identity of entities such as individuals or websites. The CA verifies the identity of the entity requesting a certificate and then issues the certificate, which contains the public key and other identity-related information, ensuring trust in digital communications . By digitally signing the certificates, CAs provide a tamper-proof means of establishing and maintaining trust between parties in electronic transactions, as other systems and users can verify this signature .
Self-signed certificates can be beneficial in environments requiring immediate deployment without waiting for a CA-issued certificate, offering cost savings as no third-party verification is required. Moreover, they are handy for internal communications within controlled environments . However, the downsides include a lack of inherent trust from browsers and operating systems, which often show warning messages when self-signed certificates are used. This can lead to security risks, as users may not trust the connection, and attackers could potentially exploit these warnings to conduct man-in-the-middle attacks. CA-issued certificates provide a higher trust level as they are verified by a trusted entity, thus enhancing security in web communications .
The CIA triad is a cornerstone of cybersecurity principles. Confidentiality ensures that sensitive information is accessible only to authorized users, thus protecting against unauthorized access . Integrity involves maintaining the accuracy and reliability of data over its lifecycle, protecting it from unauthorized alterations. Availability ensures that information and critical resources are accessible to authorized users when needed, preventing disruptions in service availability. These principles guide the design and implementation of security measures by highlighting the need to protect data from unauthorized access, tampering, or loss, shaping policies and technologies that maintain security and business continuity .