- what is security and types
. state of being secure - free from danger
. It is the protection of items you have called the assets of the computer
. there are many types of assets hardware software data people processes etc
Types of security (PPOC IN)
. Physical
. Personnel
. operation
. communication
. Information
. Network
- Assest threat vulnerabilities (read pdf)
- CIA (confidentiality, Integrity, Availibility)
. Imp set of goals when aiming for security
> Confidentiality
. privacy of information - measures taken to prevent disclosure of info or data to
unauthorized individuals/systems
. confidentiality of an individual is a must - loss of which can cause identity
theft, fraud, loss of money
. safeguarding of info and keeping it away from those not authorized to possess it.
. for business and government confidentiality concerns can be even worse
. Use of password for authentication is the most common measure to ensure
confidentiality
. and attacks against password is the most common confidentiality attacks - other
options(pdf)
> Integrity
. Integrity is the correctness of info
. Integrity refers to the protection of information from unauthorized alteration
and revision
. The data can be at rest or in transit
. In other words, integrity ensures the message is sent from sender to receiver
with no alteration
. Integrity deals with keeping info in a format that is true and correct to its
original purpose
. The most common protective measure is the use of hash
. hash(read pdf)
> Availability
. it is the communication system and data being ready to use when the legitimate
user needs them
. Important items you can perform
. Availability deals with the resources to users when they need them
. info and resources no matter how safe and sound are only useful if they are
available when called upon
. Attacks against availability fall against denial of service(DoS).
- Attack (read pdf)
. operating system
. application
. shrink wrap code
. misconfiguration
. passive
. active
- Attack Surface
. Total number of vulnerabilities on a network or a system that are accessible to
the hacker
. Anyone try to break into the system targets the attack surface first
. Attack surface can be divided into 3 categories
- network
- software
- physical attack
. Every point of network interaction is a source of network surface attack - NSA
can be reduced by closing unnecessary open ports - and limiting the resource to
untrusted users - methods like MAC address filters
. Limiting network surface attacks can also limit the exposure of existing software
vulnerabilities
. One of the simplest way to reduce the software attack surface is to reduce the
number of software codes
. Physical access also constitutes an attack surface - this surface can be
exploited by inside vectors like rogue employees and hired workers.
- Malware and Types
. Software designed to harm or access user information without the owner's informed
consent
. Malware cause a number of problems over years
. the term malware is short form of malicious software
Types
> Worms
. Worm is a self replicating malware
. it uses computer network to send copies of it self to other system without human
intervention
. A worm is a type of virus but it is self-replicating.
. worm spread from system to system automatically, whereas a virus needs program in
order to spread
. Both execute without the knowledge of end user
. Most common use of worm in the field of hacking is to create bot nets ( eg -
Conficker)
> Viruses
. Virus is defined as self replicating program that reproduces its code by
attaching copies into other executable code
. a virus infects other executable and use this carrier to spread itself
. Eg of virus carrier programs are macros, games, email attachments, animation
. classified into what they infect and how they infect
Types (FASTN)
-> Fast and slow infectors
-> Armoured virus
-> Sparse infector
-> tunneling viruses
-> NTFS
> Trojans
. Trojan means a method to gain and maintain access on devices we have paid to
target
. first send an innocent-looking file to your target, inviting them to open it
. they open it and unaware install your software making your job easier
. this software is designed to steal some type of information
> Spyware
> Rootkits
. A rootkit is a type of program often used to hide utilities
. a rootkit include so called backdoors to help attackers access the system more
easily.
. if a rootkit is installed properly the user and security monitors won't even know
there is a problem
. A rootkit may hide an application that spawns a shell when the attackers connect
to a particular network port
- Three types
> application level
> kernel level
> Library level
- Types of Attacks and countermeasure
> KeyStroke Logging
. keystroke logging often referred to as keylogging or keycapturing
. It is the action of recording the key struck on the keyboard
. the person is unaware that their actions are being monitored
. A keylogger can be either software or hardware
. Keyloggers are most often used for the purpose of stealing password or
confidential info
. Most common is software based installed as malware such are trojan or rootkit -
doesn't require physical access
. hardware based keyloggers are less common
- Countermeasure
. Antiloggers
. Antivirus/antispyware
. automatic form fillers
. on screen keyboards
> Denial of service attack
. in DoS attack the attacker makes the network or resource unable to its user
temporarily or permanently
. Dos is typically established by flooding the targeted machine or resource with
superfluous requests some or all
- Countermeasure
. Application frontend hardware
. ips based prevention
. Firewalls
. router
> Eavesdropping attack
. Also known as sniffing or snooping attack
. Where someone tries to steal info that computers, mobiles, or other devices
transmit over the network
. It takes advantage of unsecured network communication in order to access data
being sent or received
. Eavesdropping is difficult to detect as they do not cause network transmission to
appear to be operating abnormally
- Countermeasure
. Awareness
. Encryption
. network segmentation
. network access control
. Physical security
> Man-in-the-middle attack
. In cryptography and computer security, a MITM attack is an attack where the
attacker secretly relays and possibly alters the communication between two parties
. The parties believe they are communicating with each other
. One eg of MITM attack in active eavesdropping in which the attacker makes
independent connection with the victims
- Countermeasure
. Authentication
. tamper detection
. forensic analysis
> Session hijacking
. Also called as session key
. In comp sci session hijacking also known as cookie hijacking is the exploitation
of a valid computer session
. unauthorized access to service or info in a comp system.
. it is used to refer to the theft of a magic cookie used to authenticate a user to
a remote server
- countermeasure
. encryption of data
. use of long random numbers as session key
. regenerating session id after login
---
- NDA (unit 2 pg 4)
. a non-disclosure agreement is also known as confidentiality agreement
- Types of scanning (SPNV) (Unit 2 pg 27)
. scanning type purpose
. Port scanning
. Network scanning
. Vulnerability scanning
- Compare VA (Vulnerability Assessment) and PT (Penetration Testing)
unit 2 pg 19 pg 8
- List and explain different types of PT. (unit 2 pg 13) also difference (pg 6)
. blackbox
. whitebox
. greybox
- Types of vulnerabilities (unit 1 pg 34 link)
- Difference between XSS and CSRF (unit 1 pg 35)
- Comparison between vulnerability and exposures
- cve (unit 1 pg 39)
- types of hacker (unit 2 pg 2)
- difference between Dos and DDoS