Security-Plus-Notes

KO | EN

gitlite — search

#ai #typescript #llm #go #rust #linux #nodejs #windows #awesome #cli #vue #pytorch #security #open-source

Security-Plus-Notes

(★ 11)

Security+ notes

Security-Plus-Notes 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Security+ Notes
My notes for the CompTIA Security+ 601 exam 
## 1.0 Threats, attacks and Vulnerbilities (24% of the exam)
* 1.1 [Phishing](https://github.com/HiroNewf/Security-notes/blob/main/README.md#phishing)
* 1.1 [Impersonation](https://github.com/HiroNewf/Security-notes/blob/main/README.md#impersonation)
* 1.1 [Dumpster Diving](https://github.com/HiroNewf/Security-notes/blob/main/README.md#dumpster-diving)
* 1.1 [Shoulder Surfing](https://github.com/HiroNewf/Security-notes/blob/main/README.md#shoulder-surfing)
* 1.1 [Hoaxes](https://github.com/HiroNewf/Security-notes/blob/main/README.md#hoaxes)
* 1.1 [Watering Hole Attacks](https://github.com/HiroNewf/Security-notes/blob/main/README.md#watering-hole-attacks)
* 1.1 [Spam](https://github.com/HiroNewf/Security-notes/blob/main/README.md#spam)
* 1.1 [Influence Campaigns](https://github.com/HiroNewf/Security-notes/blob/main/README.md#influence-campaigns)
* 1.1 [Other Social Engineering Attacks](https://github.com/HiroNewf/Security-notes/blob/main/README.md#other-social-engineering-attacks)
* 1.1 [Principles of Social Engineering](https://github.com/HiroNewf/Security-notes/blob/main/README.md#principles-of-social-engineering)
* 1.2 [An Overview of Malware](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#an-overview-of-malware)
* 1.2 [Viruses and Worms](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#viruses-and-worms)
* 1.2 [Ransomware and Crypto-malware](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#ransomware-and-crypto-malware)
* 1.2 [Trojan and RATs](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#trojan-and-rats)
* 1.2 [Rootkits](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#rootkits)
* 1.2 [Spyware](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#spyware)
* 1.2 [Bots and Botnets](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#bots-and-botnets)
* 1.2 [Logic Bombs](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#logic-bombs)
* 1.2 [Password Attacks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#password-attacks)
* 1.2 [Physical Attacks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#physical-attacks)
* 1.2 [Adversarial Artificial Intelligence](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#adversarial-artificial-intelligence)
* 1.2 [Supply Chain Attacks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#supply-chain-attacks)
* 1.2 [Cloud-based vs On-premises Attacks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#cloud-based-vs-on-premises-attacks)
* 1.2 [Cryptographic Attacks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#cryptographic-attacks)
* 1.3 [Privilege Escalation](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#privilege-escalation)
* 1.3 [Cross-site Scripting](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#cross-site-scripting)
* 1.3 [Injection Attacks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#injection-attacks)
* 1.3 [Buffer Overflows](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#buffer-overflows)
* 1.3 [Replay Attacks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#replay-attacks)
* 1.3 [Request Forgeries](https://github.com/HiroNewf/Security-Plus-Notes#request-forgeries)
* 1.3 [Driver Manipulation](https://github.com/HiroNewf/Security-Plus-Notes#driver-manipulation)
* 1.3 [SSL Stripping](https://github.com/HiroNewf/Security-Plus-Notes#ssl-stripping-http-downgrade)
* 1.3 [Race Conditions](https://github.com/HiroNewf/Security-Plus-Notes#race-conditions)
* 1.3 [Other Application Attacks](https://github.com/HiroNewf/Security-Plus-Notes#other-application-attacks)
* 1.4 [Rogue Access Points and Evil Twins](https://github.com/HiroNewf/Security-Plus-Notes#rogue-access-points-and-evil-twins)
* 1.4 [Bluejacking and Bluesnarfing](https://github.com/HiroNewf/Security-Plus-Notes#bluejacking-and-bluesnarfing)
* 1.4 [Wireless Disassociation Attacks](https://github.com/HiroNewf/Security-Plus-Notes#wireless-disassociation-attacks)
* 1.4 [Wireless Jamming](https://github.com/HiroNewf/Security-Plus-Notes#wireless-jamming)
* 1.4 [RFID and NFC Attacks](https://github.com/HiroNewf/Security-Plus-Notes#rfid-and-nfc-attacks)
* 1.4 [Randomizing Cryptography](https://github.com/HiroNewf/Security-Plus-Notes#randomizing-cryptography)
* 1.4 [On-Path Attacks](https://github.com/HiroNewf/Security-Plus-Notes#on-path-attacks)
* 1.4 [MAC Flooding and Cloning](https://github.com/HiroNewf/Security-Plus-Notes#mac-flooding-and-cloning)
* 1.4 [DNS Attacks](https://github.com/HiroNewf/Security-Plus-Notes#dns-attacks)
* 1.4 [Denial of Service](https://github.com/HiroNewf/Security-Plus-Notes#denial-of-service)
* 1.4 [Malicious Scripts](https://github.com/HiroNewf/Security-Plus-Notes#malicious-scripts)
* 1.5 [Threat Actors](https://github.com/HiroNewf/Security-Plus-Notes#threat-actors)
* 1.5 [Attack Vectors](https://github.com/HiroNewf/Security-Plus-Notes#attack-vectors)
* 1.5 [Threat Intelligence](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#threat-intelligence)
* 1.5 [Threat Research](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#threat-research)
* 1.6 [Vulnerability Types](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#vulnerability-types)
* 1.6 [Third-Party Risks](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#third-party-risks)
* 1.6 [Vulnerability Impacts](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#vulnerability-impacts)
* 1.7 [Threat Hunting](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#threat-hunting)
* 1.7 [Vulnerability Scans](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#vulnerability-scans)
* 1.7 [Security Information and Event Management](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#security-information-and-event-management)
* 1.8 [Penetration Testing](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#penetration-testing)
* 1.8 [Reconnaissance](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#reconnaissance)
* 1.8 [Security Teams](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#security-teams)
## 2.0 Architecture and Design (21% of the exam)
* 2.1 [Configuration Management](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#configuration-management)
* 2.1 [Protecting Data](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#protecting-data)
* 2.1 [Data Loss Prevention](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#data-loss-prevention)
* 2.1 [Managing Security](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#managing-security)
* 2.1 [Site Resiliency](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#site-resiliency)
* 2.1 [Honeypots and Deception](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#honeypots-and-deception)
* 2.2 [Cloud Models](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#cloud-models)
* 2.2 [Edge and Fog Computing](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#edge-and-fog-computing)
* 2.2 [Desiging The Cloud](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#designing-the-cloud)
* 2.2 [Infrastucture as Code](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#infrastructure-as-code)
* 2.2 [Virtualization Security](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#virtualization-security)
* 2.3 [Secure Deployments](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#secure-deployments)
* 2.3 [Provisioning and Deprovisioning](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#provisioning-and-deprovisioning)
* 2.3 [Secure Coding Techniques](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#secure-coding-techniques)
* 2.3 [Software Diversity](https://github.com/HiroNewf/Security-Plus-Notes/blob/main/README.md#software-diversity)
* 2.3 [Automation and Scripting](https://github.com/HiroNewf/Security-Plus-Notes#automation-and-scripting)
* 2.4 [Authentication Methods](https://github.com/HiroNewf/Security-Plus-Notes#authentication-methods)
* 2.4 [Biometrics](https://github.com/HiroNewf/Security-Plus-Notes#biometrics)
* 2.4 [MUlti-factor Authentication](https://github.com/HiroNewf/Security-Plus-Notes#multi-factor-authentication)
* 2.5 [Disk Redundancy](https://github.com/HiroNewf/Security-Plus-Notes#disk-redundancy)
* 2.5 [Network Redundancy](https://github.com/HiroNewf/Security-Plus-Notes#network-redundancy)
* 2.5 [Power Redundancy](https://github.com/HiroNewf/Security-Plus-Notes#power-redundancy)
* 2.5 [Replication](https://github.com/HiroNewf/Security-Plus-Notes#replication)
* 2.5 [Backup Types](https://github.com/HiroNewf/Security-Plus-Notes#backup-types)
* 2.5 [Resiliency](https://github.com/HiroNewf/Security-Plus-Notes#resiliency)
* 2.6 [Embedded Systems](https://github.com/HiroNewf/Security-Plus-Notes#embedded-systems)
* 2.6 [Embedded Systems Communication](https://github.com/HiroNewf/Security-Plus-Notes#embedded-systems-communication)
* 2.6 [Embedded Systems Constraints](https://github.com/HiroNewf/Security-Plus-Notes#embedded-systems-constraints)
* 2.7 [Physical Security Controls](https://github.com/HiroNewf/Security-Plus-Notes#physical-security-controls)
* 2.7 [Secure Areas](https://github.com/HiroNewf/Security-Plus-Notes#secure-areas)
* 2.7 [Secure Data Destruction](https://github.com/HiroNewf/Security-Plus-Notes#secure-data-destruction)
* 2.8 [Cryptography Concepts](https://github.com/HiroNewf/Security-Plus-Notes#cryptography-concepts)
* 2.8 [Symmetric and Asymmetric](https://github.com/HiroNewf/Security-Plus-Notes#symmetric-and-asymmetric-cryptography)
* 2.8 [Hashing and Digital Signatures](https://github.com/HiroNewf/Security-Plus-Notes#hashing-and-digital-signatures)
* 2.8 [Cryptographic Keys](https://github.com/HiroNewf/Security-Plus-Notes#cryptographic-keys)
* 2.8 [Steganography](https://github.com/HiroNewf/Security-Plus-Notes#steganography)
* 2.8 [Quantum Computing](https://github.com/HiroNewf/Security-Plus-Notes#quantum-computing)
* 2.8 [Stream and Block Ciphers](https://github.com/HiroNewf/Security-Plus-Notes#stream-and-block-ciphers)
* 2.8 [Blockchain Technology](https://github.com/HiroNewf/Security-Plus-Notes#blockchain-technology)
* 2.8 [Crptography Use Cases](https://github.com/HiroNewf/Security-Plus-Notes#cryptography-use-cases)
* 2.8 [Cryptography Limitations](https://github.com/HiroNewf/Security-Plus-Notes#cryptography-limitations)
## 3.0 Implementation (25% of the exam)
* 3.1 [Secure Protcols](https://github.com/HiroNewf/Security-Plus-Notes#secure-protocols)
* 3.2 [Endpoint Protection](https://github.com/HiroNewf/Security-Plus-Notes#endpoint-protection)
* 3.2 [Boot Integrity](https://github.com/HiroNewf/Security-Plus-Notes#boot-integrity)
* 3.2 [Database Security](https://github.com/HiroNewf/Security-Plus-Notes#database-security)
* 3.2 [Application Security](https://github.com/HiroNewf/Security-Plus-Notes#application-security)
* 3.2 [Application Hardening](https://github.com/HiroNewf/Security-Plus-Notes#application-hardening)
* 3.3 [Load Balancing](https://github.com/HiroNewf/Security-Plus-Notes#load-balancing)
* 3.3 [Network Segmentation](https://github.com/HiroNewf/Security-Plus-Notes#network-segmentation)
* 3.3 [Virtual Private Networks](https://github.com/HiroNewf/Security-Plus-Notes#virtual-private-networks)
* 3.3 [Port Security](https://github.com/HiroNewf/Security-Plus-Notes#port-security)
* 3.3 [Secure Networking](https://github.com/HiroNewf/Security-Plus-Notes#secure-networking)
* 3.3 [Firewalls](https://github.com/HiroNewf/Security-Plus-Notes#firewalls)
* 3.3 [Network Access Control](https://github.com/HiroNewf/Security-Plus-Notes#network-access-control)
* 3.3 [Proxy Servers](https://github.com/HiroNewf/Security-Plus-Notes#proxy-servers)
* 3.3 [Intrusion Prevention](https://github.com/HiroNewf/Security-Plus-Notes#intrusion-prevention)
* 3.3 [Other Network Appliances](https://github.com/HiroNewf/Security-Plus-Notes#other-network-appliances)
* 3.4 [Wireless Cryptography](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#wireless-cryptography)
* 3.4 [Wireless Authentication Methods](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#wireless-authentication-methods)
* 3.4 [Wireless Authentication Protocols](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#wireless-authentication-protocols)
* 3.4 [Installing Wireless Networks](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#installing-wireless-networks)
* 3.5 [Mobile Networks](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#mobile-networks)
* 3.5 [Mobile Device Management](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#mobile-device-management)
* 3.5 [Mobile Device Security](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#mobile-device-security)
* 3.5 [Mobile Device Enforcement](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#mobile-device-enforcement)
* 3.5 [Mobile Deployment Models](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#mobile-deployment-models)
* 3.6 [Cloud Security Controls](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#cloud-security-controls)
* 3.6 [Securing Cloud Storage](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#securing-cloud-storage)
* 3.6 [Securing Cloud Networks](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#securing-cloud-networks)
* 3.6 [Securing Compute Clouds](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#securing-compute-clouds)
* 3.6 [Cloud Security Solutions](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#cloud-security-solutions)
* 3.7 [Identity Controls](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#identity-controls)
* 3.7 [Account Types](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#account-types)
* 3.7 [Account Policies](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#account-policies)
* 3.8 [Authentication Management](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#authentication-management)
* 3.8 [PAP and CHAP](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#pap-and-chap)
* 3.8 [Identity and Access Services](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#identity-and-access-services)
* 3.8 [Federated Identities](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#federated-identities)
* 3.8 [Access Control](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#access-control)
* 3.9 [Public Key Infrastructure](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#public-key-infrastructure)
* 3.9 [Certificate Formats](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#certificate-formats)
* 3.9 [Certificate Concepts](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#certificate-concepts)
## 4.0 Operations and Incident Response (16% of the exam)
* 4.1 [Reconnaissance Tools – Part 1](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#reconnaissance-tools---part-1)
* 4.1 [Reconnaissance Tools – Part 2](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#reconnaissance-tools---part-2)
* 4.1 [File Manipulation Tools](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#file-manipulation-tools)
* 4.1 [Shell and Script Environments](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#shell-and-script-environments)
* 4.1 [Packet Tools](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#packet-tools)
* 4.1 [Forensic Tools](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#forensic-tools)
* 4.2 [Incident Response Process](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#incident-response-process)
* 4.2 [Incident Response Planning](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#incident-response-planning)
* 4.2 [Attack Frameworks](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#attack-frameworks)
* 4.3 [Vulnerability Scan Output](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#vulnerability-scan-output)
* 4.3 [SIEM Dashboards](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#siem-dashboards)
* 4.3 [Log Files](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#log-files)
* 4.3 [Log Management](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#log-management)
* 4.4 [Endpoint Security Configuration](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#endpoint-security-configuration)
* 4.4 [Security Configurations](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#security-configurations)
* 4.5 [Digital Forensics](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#digital-forensics)
* 4.5 [Forensics Data Acquisition](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#forensics-data-acquisition)
* 4.5 [On-Premises vs. Cloud Forensics](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#on-premises-vs-cloud-forensics)
* 4.5 [Managing Evidence](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#managing-evidence)
## 5.0 Governance, Risk, and Compliance (14% of the exam) 
* 5.1 [Security Controls](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#security-controls)
* 5.2 [Security Regulations and Standards](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#security-regulations-and-standards)
* 5.2 [Security Frameworks](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#security-frameworks)
* 5.2 [Secure Configurations](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#security-configurations-1)
* 5.3 [Personnel Security](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#personnel-security)
* 5.3 [Third-party Risk Management](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#third-party-risk-management)
* 5.3 [Managing Data](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#managing-data)
* 5.3 [Credential Policies](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#credential-policies)
* 5.3 [Organizational Policies](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#organizational-policies)
* 5.4 [Risk Management Types](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#risk-management-types)
* 5.4 [Risk Analysis](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#risk-analysis)
* 5.4 [Business Impact Analysis](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#business-impact-analysis)
* 5.5 [Privacy and Data Breaches](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#privacy-and-data-breaches)
* 5.5 [Data Classifications](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#data-classifications)
* 5.5 [Enhancing Privacy](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#enhancing-privacy)
* 5.5 [Data Roles and Responsibilities](https://github.com/HiroNewf/Security-Plus-Notes?tab=readme-ov-file#data-roles-and-responsibilities)
# 1.0 
## [Phishing](https://www.youtube.com/watch?v=0Tr8avVrzLA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=2&ab_channel=ProfessorMesser)
- Trying to get you to click an email link
    - Social engineering and spoofing
- Pretending to be someone they are not
- Check the URL, it’s going to be different than the official site (Probably only a one character difference though)
    - The screen presented is also likely to be a bit off, wrong font, messed up graphics, incorrect spelling, ect
- Try to get you to react to a fake situation (need to change password, need to pay a bill, got hacked and need to resolve the issue, ect)
- Pharming is attacking a whole group of people at once
    - Usually when they are able to take control of a whole DNS server or fine vulnerable websites
    - Redirect you from the official website to the fake one
    - Hard to prevent this from happening and notice that something is wrong
        - Even anti-malware has trouble recognizing this
- Vishing
    - Phishing over a voice call
    - Often spoof a caller ID to act like they are someone trust worthy
    - Try to get you to give up personal information
- Smishing
    - Phishing over SMS / text message
- Find the best way to Phish
    - Reconnaissance
        - Social media
    - Make a believable pretext off of this information
- Very directed attacks like this are called Spear phishing
    - When the attack goes after someone who has a lot of money or a lot of information (like a CEO) is called Whaling
## [Impersonation](https://www.youtube.com/watch?v=hIUr86pysb4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=3&ab_channel=ProfessorMesser)
- Often starts with a pretext
    - An actor and a story that is trying to be as believable as possible
- Pretending to be someone you are not
    - Usually picks who to impersonate based on info they gathered from reconnaissance
    - Try to get you to trust them
    - Try to get you to to act on what they say (make you think they are of higher rank than you)
    - Act friendly to try and make you feel conformable
- Now it is time to elicit information
    - Email addresses, passwords, ect
    - Commonly done with Vishing
- Identity fraud
    - They may be after your personal information
    - Credit Card fraud
    - Bank fraud
    - Loan fraud (opens loans in your name)
    - Governance benefits or Tax fraud
- Avoiding this
    - Never volunteer your information to people
        - They tech support does not need to know your password
    - Dont over give information, they probably dont need to know that much information
    - Verify who you are talking too and that they can have access to sensitive data
## [Dumpster Diving](https://www.youtube.com/watch?v=h0UfLMy_Fq0&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=4&ab_channel=ProfessorMesser)

- A way of gathering important information about a target (reconnaissance)
    - Phone numbers, addresses, names, ect
- Generally legal in the US but that varies from place to place
- To prevent this use a fence and lock
    - Shred important documents and destroy used tech products

## [Shoulder Surfing](https://www.youtube.com/watch?v=mQH5x559kD4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=5&ab_channel=ProfessorMesser)

- You may have important things on your computer
    - Attackers can look over your shoulder and get some of this information
- Can do this from afar with binoculars
- Be aware of your surroundings to try and prevent this
    - Could use privacy filters
        - Blocks the view of anyone that is not right in front of the computer
    - Keep your monitor out of the site of others if possible

## [Hoaxes](https://www.youtube.com/watch?v=9fXbXQ-pnsY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=6&ab_channel=ProfessorMesser)

- Situation that seems real, but does not really exist
    - Can take many different forms
        - Fake viruses
        - Email
        - Phone
        - ect
- Wastes time and resources
- Tend to try and get money from you (through gift cards mostly often)
- De-hoaxing
    - Trust no one
    - Cross reference
    - Use a spam filter
    - If it is too good to be true, then it probably is

## [Watering Hole Attacks](https://www.youtube.com/watch?v=uBoVWqkfZjk&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=7&ab_channel=ProfessorMesser)

- Instead of attacking your target directly, you attack a third party and hope to use that third party to then infect your real target
    - Usually done when your target has too high of security for you to directly breech
    - This third party is the watering hole
- Takes a bit of research in order to find the right third party to attack
- Often effects everyone who goes to this third party site or service even though the attacker is only looking to effect one organization
- Make sure your systems are well secured to protect against this
    - A layered defense / defense in depth
    - Firewalls and IPS
## [Spam](https://www.youtube.com/watch?v=5zYJwdEOQ0M&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=8&ab_channel=ProfessorMesser)

- Unsolicited Messages
- SPIM = Span over Instant Messaging
- Many types of spam both malicious and non malicious, both cause issues
    - Security concerns, resource utilization, storage costs, ect
- Blocking spam
    - Mail gateways
        - Your spam filtering that is on site or cloud based
        - Has an allowed list
            - Requires a lot of maintenance
        - Block anythings that doesn’t comply with the RFC’s
        - Can perform a reverse DNS to check IP’s
        - Tarpitting
            - Slows down the mail server to make the process of sending and receiving mail take time
            - Can deter spam
        - Filtering based on the recipient and filter out invalid recipient

## [Influence Campaigns](https://www.youtube.com/watch?v=nH-qEY9h83E&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=9&ab_channel=ProfessorMesser)

- Hacking public opinion
    - Influence campaigns and opinions
    - Spend a lot of advertising money
- Usually starts with fake accounts
    - They make content on many different sites
    - Then the message gets amplified the message
    - Real people start to talk about it
    - The media picks it up and the story gets even bigger
- The military could sometimes do this to effect other countries and how they work and think
    - Cyber-warfare
    - Influence elections, news and more

## [Other Social Engineering Attacks](https://www.youtube.com/watch?v=trAs7C5h1BU&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=10&ab_channel=ProfessorMesser)

- Tailgating
    - Gain access to a building that you should not have access too by following an official person in
    - Pretend to be a third party with a legitimate reason
    - Maybe carry something with you so your hands are not free and often someone will hold the door open for you
    - Make sure you have a policy for visitors
    - Make it so only one person can enter at a time
        - Mantrap or other
- Invoice scams
    - Starts with a bit of spear phishing
        - Attacker knows who pays the bills and sends a bill to that person in attempts to get money
        - Often for products that you are in fact using and the email can look pretty legit
        - Might also have a link to pay so they can get even more info
- Credential harvesting
    - Gain access to usernames and passwords on your local PC
    - Trying to find everyplace where these login credentials are stored and get them so they can use them for themselves
        - Runs a script on the computer (usually sent via an email)
        - User can be none the wiser

## [Principles of Social engineering](https://www.youtube.com/watch?v=ndwCR1kYz5M&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=11&ab_channel=ProfessorMesser)

- Constantly changing attack
- May involve many people and organizations to make things more believable
- More automated and using open source intelligence
- Authority
    - Act like they are in charge and have a high rank
- Intimation
    - If you dont help things will go bad
- Social proof
    - Convince someone this is what is normally happens
- Scarcity
    - Limited amount of time so it must happen now
- Urgency
    - Needs to happens quickly
    - dont think, just act
- Familiarity / liking
    - Someone you know, act all friendly and talk as if they know you
    - We have common friends (could name drop)
- Trust
    - Say they are from IT
    - Say there are here to help, ect
## [An Overview of Malware](https://www.youtube.com/watch?v=GrdOpFFGxD0&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=12&ab_channel=ProfessorMesser)

- Malicious software
- Gathering information
    - Keystrokes
    - Passwords
    - ect
- Make your computer controlled by someone else
    - Become a bot likely as part of a botnet
- Show advertisement to make tons of money
- Viruses and worms
    - Encrypt your data and demand payment
- The malware can keep growing and installing more and more
- Preventing this
    - Dont click links in emails
    - Dont click web page pop ups
    - Dont go to un-trusted sites
    - Patch vulnerabilities

## [Viruses and Worms](https://www.youtube.com/watch?v=L7cwUYl8gYo&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=13&ab_channel=ProfessorMesser)

- Virus
    - Malware that can reproduce itself
        - Via the file system or network
    - Needs the user to execute a program to run
    - Can delete files, encrypt data, advertise and more
    - Anti-virus software is decent at preventing this
        - Make sure to keep it up to date
    - Program Viruses
        - Part of the application
        - Opening the application launches the virus as well
    - Boot sector viruses
        - In the boot sector of the storage device
        - Launches when you launch the OS
    - Script viruses
        - In the OS or browser
    - Macro viruses
        - Common in Microsoft Windows
        - A lot like script viruses
    - File-less virus
        - Never installs or saves itself as a file
        - Good at avoiding detection via anti-virus software
        - Operates in the memory (RAM)
        - Commonly starts via a link
            - Downloads and runs a flash or java file (or other)
            - Launches Powershell and downloads payload into the RAM
- Worms
    - Malware the self replicates
        - Launches and moves from system to system without users doing anything
    - Takes advantage of vulnerabilities in networking and computer systems
        - Can infect millions of systems
    - Firewalls and IPS can help to stop this from happening and spreading

## [Ransomware and Crypto-malware](https://www.youtube.com/watch?v=HszU4nEAlFc&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=14&ab_channel=ProfessorMesser)

- Ransomware
    - Your data is valuable to you
        - Company data is even more valuable and important
    - How much would you pay to regain access to it?
    - Claiming they encrypted/took your data and requiring you to pay to get it back is ransomware
        - Payment often in bitcoin
    - They could claim to be someone they are not, like the CIA
- Cyrpto-malware
    - New gen of ransomware
    - Actually locking your data behind an encryption
        - Send them money and you will get the key to decrypt the data
- Protecting yourself against it
    - Have a good backup
    - Offline backup or offsite backup is best
    - Keep patches up to date
        - Keep applications up to date as well
        - Everything up to date
## [Trojan and RATs](https://www.youtube.com/watch?v=yhhEOseCOzg&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=15&ab_channel=ProfessorMesser)

- Trojan
    - Software pretends to be something else (something normal and safe)
        - Looks nonthreatening to you and your anti virus software
            - Can even disable your anti virus software at times
    - Doesn’t really try to duplicate
    - Now it has free reign
        - Can install more malware or install backdoors
- PUP (Potentially Unwanted Program)
    - Could be downloaded by the Trojan
    - May cause performance issues but not necessarily malicious
        - Displays adds, redirecting your web searches, ect
    - Can be identified by anti virus software quite easily
- Backdoors
    - Why go through normal authentication methods when you can go through the backdoor?
        - An easy way to get into your system
    - Often placed on your systems via malware
        - Malware can use the backdoors that other malware created to make it easier to get into your system
    - Some “trusted” software have backdoors as well as part of the app (this is not good)
- RATs (Remote Access Trojans)
    - The ultimate backdoor
        - Admin/root control over a device and OS
            - Things like key logging
            - Screen recording
            - Copying files
            - Installing more malware
            - ect
    - Malware installs it
- Preventing these
    - Dont click unknown links
    - Keep an anti virus software running
    - Keep backups of files

## [Rootkits](https://www.youtube.com/watch?v=X9x2UzzXP8w&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=16&ab_channel=ProfessorMesser)

- Originated from Unix/Linux
- Modifies the core system files
    - The kernel files
- Can be invisible to the OS and anti virus software
- Zeus/Zbot
    - Combined rootkit and other malware
    - Famous for cleaning out bank accounts
    - Almost impossible to delete the malware
- Some software programs can look for and remove certain types of rootkits
    - Secure Boot with UEFI prevents rootkits on modern systems

## [Spyware](https://www.youtube.com/watch?v=jaZZaghcNOs&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=17&ab_channel=ProfessorMesser)

- Adware
    - Ads everywhere on your computer
    - Causes performance issues on your device and network
    - Sometimes installed accidentally
    - Watch out for software that claims it can remove adware
        - But it itself might be adware or other malware
- Spyware
    - Malware that spies on you
        - Advertising, identity theft, affiliate fraud, ect
        - Browser monitoring, keyloggers, ect
    - Often installed via a Trojan horse
- Adware and spyware can make the attacker a ton of money
- Protecting against it
    - Have an up to date anti virus software
    - Know what you are installing and make sure you trust it
    - Keep file backups as the adware and spyware is hard to remove from a system

## [Bots and Botnets](https://www.youtube.com/watch?v=CHrES3Swpw4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=18&ab_channel=ProfessorMesser)

- Bots
    - An infected computer that is a bot for someone else
        - Installed via a Trojan horse, vulnerability, alongside a another software program, ect
- Botnet
    - A group of bots
    - Just sits around until the Command and Control (C&C) server tells them to do something
    - All of systems can cause many problems like DDoS attacks
        - Can proxy spam, network traffic, be rented out, ect
- Stopping them
    - Prevent them from installed in the first place
        - OS and application patches
        - Anti virus software
    - Using an on demand network scan can find existing infections
    - C&C Can be block at the firewall if you know what to look for

## [Logic Bombs](https://www.youtube.com/watch?v=javj1IqXKW0&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=19&ab_channel=ProfessorMesser)

- Waits for a certain event to be triggered and then activates
    - Occurs when a date and time is reached
    - Occurs when a certain user event takes place
- Hard to identify and hard to recover
    - Many delete themselves once they execute
- Preventing them
    - Formal change control process
        - Know when things are being modified
    - Automated monitoring
        - Host based intrusion detection, Tripwire, ect
    - Constant auditing
        - Admins can go around other systems so auditing is good to keep track of what they and other users are doing
## [Password attacks](https://www.youtube.com/watch?v=hNhak8IilrA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=20&ab_channel=ProfessorMesser)

- Plaintext passwords
    - Stored in a readable format
    - This is a terrible idea (dont use apps that do this)
- Hashing a password
    - Input your password and pick which hash type to use
        - Get a random series of numbers and letters in return
        - Inputting this password will always give you the same hash but it is very hard to get the password from the hash itself (other than brute force)
- Spraying attacks
    - Avoids locking the account by trying so many passwords
    - Use the most common passwords and moves on if this does not work
        - No alarms, alerts, or lockouts
- Brute Force
    - Trying every single possible password (or hash)
    - Takes a lot of time and a lot of compute power
    - Hard to do online as their is often delays and lockouts
        - But it is possible offline with hashes
- Dictionary attacks
    - Use the most common words to try and find the correct password
    - There are many different wordlists that can be broken down by native language, line of work, hobbies, etc that can be useful if you know things about your target and their life
    - Can substitute letters like replacing 0 with O and replacing 2 with @
    - Takes some time but not nearly as long as brute force attacks
- Rainbow tables
    - An optimized pre-built set of hashes
    - Easy and quick to search through
        - Almost instantly
    - Need different tables for different hashing methods
- Adding salt
    - Random data added to a password BEFORE it is hashed
    - Every user gets their own random salt data
    - Rainbow tables will not work against this
        - Slows down the brute force process

## [Physical Attacks](https://www.youtube.com/watch?v=efOGCvcfJl4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=21&ab_channel=ProfessorMesser)

- Malicious USB cable
    - Looks like normal but has additional electronics inside
    - Could tell OS that it is a HID and be able to type things
        - Gain control of your system and install malware and the likes
    - Dont plug in random cables
- Malicious Flash Drive
    - Like the USB cable it has additional electronics inside that cause issues to your PC
    - Could act as a HID like the USB cable
        - Like in USB drop attacks with the Rubber Ducky
    - Files in the drive could also infect your system
        - If you open this picture a program runs, etc
    - Could act as a boot device or Ethernet adapter
- Skimming
    - Stealing credit card information usually during a normal transaction
        - Copying magnetic stripe or the info written on the card
    - Requires extra hardware on the scanners
        - Could also have a camera to learn your PIN
- Card Cloning
    - Get card details from a skimmer and then make an exact duplicate
    - Commonly used with magnetic stripe cards
        - The chips cant be cloned
    - Can also happen with gift cards

## [Adversarial Artificial Intelligence](https://www.youtube.com/watch?v=aXZ-BF8Ot-o&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=22&ab_channel=ProfessorMesser)

- Machine Learning
    - Computers are getting smarter
        - Find data patterns and improve predictions
    - Requires and ton of data and compute power
    - It is used everyday
        - Spam filter that recognizes spam
        - Ads recommended based on your search history and other data
        - etc
- Poisoning the training data
    - Confuses the AI with fake info
    - Make the AI act how you want based on the info you sent to it
- Evasion attacks
    - AI is only as good as the training
    - Attackers can change their approach to try and get around the machine learning
    - An attacker may be able to extract the data from a AI that used real world information to be trained
- Securing the learning algorithms
    - Make sure learning data is legitimate
    - Keep it up to date with the latest information
    - Use the attackers methods to make sure your system is no vulnerable

## [Supply Chain Attacks](https://www.youtube.com/watch?v=cOnjqpw5rXM&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=23&ab_channel=ProfessorMesser)

- Many moving parts in the supply chain
    - If one is attacked it can effect the others (the entire chain in some cases)
- People tend to trust the supplies even though they could have been attacked
- Supply chain security
    - Make sure what you are installing is trust worthy
    - Limit the number of vendors you work with
    - Have good policies and procedures (make sure your suppliers do the same)

## [Cloud-based vs On-premises attacks](https://www.youtube.com/watch?v=u_Ta0rVTL_g&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=25&ab_channel=ProfessorMesser)

- Attacks can happen anywhere
- Cloud security
    - Everything is centralized
    - Cheaper
    - No physical access
    - Third party does have access though
    - Large scale security that may be better than what you can do
    - Need to make sure your users are following the best practices
    - Limited downtime due to more redundancy and high quality products
    - Easy to change and update things
        - May be limited on what you can do with the data though
- On-premises security
    - On site and more costly
    - Full control of everything
    - On site team makes things more secure (hire the right people)
    - No need to call out to a third party
    - Take be time consuming and not instantaneous

## [Cryptographic Attacks](https://www.youtube.com/watch?v=u_Ta0rVTL_g&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=25&ab_channel=ProfessorMesser)

- Encrypted data sent to another person may not be secure the whole way to its destination
- Finding ways to undo security during the transfer process
    - implementation is often the problem
- Birthday attack
    - Hash collision is when you have two very different plaintexts that both create the same hash
        - Should not happen
    - Attacker tries to find the other plaintexts the matches a certain hash
        - Can be prevented by increasing the has output size
- Collisions
    - Hashes are supposed to be a unique value and it is quite bad when they are not
- Downgrade attack
    - Instead of using a good encryption you use something that is not that great
        - Force system to downgrade security
    - Sit in the middle and influence the encryption choice between two systems
        - Man in the middle attack may be used for this
## [Privilege Escalation](https://www.youtube.com/watch?v=ksjU3Iu195Q&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=26&ab_channel=ProfessorMesser)

- Gain high access to a system
    - Admin or root access from a normal users access
- Or just gaining access another user of the same level account
- Tend to be patch quickly
    - Keep anti virus up to date
- Data Execution prevention
    - Only allows applications to run in certain areas of memory
- Randomize where stuff is stored in memory to keep people from find the same data over multiple systems

## [Cross-site Scripting](https://www.youtube.com/watch?v=CyI0XF2xFg8&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=27&ab_channel=ProfessorMesser)

- aka XSS
    - Originally a browser vulnerability that allowed info from on site to be shared with another
- Common web app vulnerabilities
    - Takes advantage of the trust a user has for a site
- Uses JavaScript
- Non-persistent XSS attack
    - A site that allows scripts to run in user input
    - Attacker needs the user to click a link to start this attack (usually an email link)
    - Can get a lot of useful information from the victims machine
- Persistent XSS attack
    - Attacker posts a message to a social network (or other) that has the malicious payload
    - Everyone who reads the post gets the script
    - Many different targets, can spread quickly
- Tokens should have a limited amount of time and should NOT last forever
    - If they last forever you can get around the need to login
- Protecting against it
    - Be careful when clicking links
    - Could disable JavaScript entirely (but not very practical)
    - Keep your browser up to date
    - Devs should make sure that their input fields are validated

## [Injection Attacks](https://www.youtube.com/watch?v=e4KUdwh8rGo&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=28&ab_channel=ProfessorMesser)

- Code Injection
    - Attacker puts their own code into a data stream
    - HTML, SQL, XML, ect
- SQL injection
    - The most common relational database management system language
    - Your site should not allow this, but some do
- XML Injection
    - XML is common for transferring data between devices
    - Modifying the XML requests
        - This should not be possible
- LDAP injection
    - Has useful information stored in it
    - Modify the requests to get what you want
- DLL Injection
    - Inject code into an application and make the application execute the code
    - Runs as part of the normal process by attaching itself to a normal process

## [Buffer Overflows](https://www.youtube.com/watch?v=szTG9w3jImA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=29&ab_channel=ProfessorMesser)

- When one section of memory can overwrite another section of memory
    - Takes advantage of poor programming
- Hard to find and take advantage of
- A good buffer overflow for an attacker is one that can be replicated and is easy to control

## [Replay Attacks](https://www.youtube.com/watch?v=jHydDY7wQJg&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=30&ab_channel=ProfessorMesser)

- Useful information is often transmitted over the network
    - Hackers can take advantage of this
- Needs to gather the data
    - Network tap, ARP poisoning, malware victim, etc
    - Get session IDs, credentials, etc
- If an attacker takes this gathered information and replays it through the network like it was coming from you than this is a replay attack
    - Replay attack can happen a long time after the gathering of the data
        - Does not involve the original user
    - Pretend you are the normal user sending normal data
- Session Hijack
    - The attacker gains access to the session ID
    - Can pose as the victim without login details needed
    - Get the session ID from wireshark or kismet
        - Or cross-site scripting
    - These headers or cookies need to then be modified
- Preventing them
    - Encrypting the information can stop this from being and issue as even if the attackers receives the data they cannot unencrypt it
        - Salting and peppering the data also helps
    - Make sure to secure the cookies!
        - They hold information like session management, session IDs, personalization, etc
## [Request Forgeries](https://www.youtube.com/watch?v=fmtqMzP7aXI&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=31&ab_channel=ProfessorMesser)

- Cross-site requests
    - Common and legitimate
    - Loading information from other sites (YouTube, twitter, etc)
    - Browser directs the page to find the right data
        - Most of these requests are unauthenticated
        - Client side code
            - Graphics and texts
                - HTML JavaScript
            - Server side code
                - Performs requests
                    - HTML PHP
    - One-click attack / session riding / client side request forgery (XSRF. CSRF)
        - Takes advantages of the trust a site has for the browser
            - Attacker gets access to your accounts via your browser which already has all the info needed
        - Web servers need to put techniques to prevent this
            - Cryptographic tokens or the likes
    - Server side request forgery (SSRF)
        - Sends requests to a web server and the web server performs the request on the behalf of the attacker
            - Allows lots of access that they should not have
        - Needs a vulnerable application running on the web server
            - Caused by bad programming
            - Rare but critical vulnerabilities

## [Driver Manipulation](https://www.youtube.com/watch?v=0EI0Rs1QAes&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=32&ab_channel=ProfessorMesser)

- Traditional anti virus software is good a stopping know vulnerabilities
- There are still ways to get into the system though
    - Unknown attacks (zero-day attacks), new and different attacks
- Attack with the drivers for your system
    - The drivers are trusted by the system already
        - So you can get a lot of information by infecting them
            - Keyloggers, video footage, audio, etc
- Shimming
    - Fit between two objects
    - OS have shims as well
        - Run applications as if they are running in a different OS
            - has a cache to store this information
        - This can be taken advantage of by hackers and place malware here
- Refactoring
    - A different program each time its downloaded
        - Will not match any signatures as it is always different
    - Make the malware look different than it is
    - Hard to detect with signature based detection

## [SSL Stripping (HTTP downgrade)](https://www.youtube.com/watch?v=H1QM6G4Zmos&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=33&ab_channel=ProfessorMesser)

- Combines an on-path attack with a downgrade attack
    - Hard to implement but has big rewards
    - See all of the data flow
    - A man in the middle attack
        - Proxy server
        - Arp spoofing
        - Rogue hotspot
        - etc
    - Looks normal from the victims machine
- SSL is depreciated
    - TSL 1.0 and 1.1 are also depreciated
    - TSL 1.2 and 1.3 are the latest standards
- Avoiding this
    - Use HTTPS and dont allow downgrades

## [Race Conditions](https://www.youtube.com/watch?v=zg_kTCOcinQ&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=34&ab_channel=ProfessorMesser)

- Problems can occur if multiple things happens at the exact same time and you were ready for that
- Time-of-check to time-of-use attack (TOCTOU)
    - Checking for things to occur on the system and making changing while knowing that other things may be going on behind the system
    - Like performing two bank transactions at nearly the same time
        - Could lead to duplicating some of the money and causing issues

## [Other Application Attacks](https://www.youtube.com/watch?v=Qobt7mkZk2A&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=35&ab_channel=ProfessorMesser)

- Memory vulnerabilities
    - Memory Leaks
        - Unused memory is not properly released
        - Application continues to use more and more of the memory until it is all gone
            - System or application crashes | DoS
    - NULL pointer dereference
        - Make a system direct to a null portion of memory where nothing exists instead of the correct data
            - Applications crash, debug info, DoS
    - Integer overflow
        - Large number is placed into a smaller section of memory making said memory overflow
            - Can be repeatable
- Directory transversal
    - Read areas of a server that they should not have access to
        - Bad OS or bad software program
        - May be able to backwards through the file systems to the C drive
- Improper Error handling
    - Errors happens
    - Massages should have just enough information
        - Some tell you too much and this is bad
    - Easy to fix as long as you have control of the application
- Improper input handling
    - All input could be malicious so check it all
    - Dont allow code input like SQL injections
    - Hard for attackers to find these but once they do it can be very bad
- API attacks
    - Manipulating the application programming interference
    - Look for vulnerabilities in the new communication path
        - Exposing data, intercepting communications, more access, DoS, etc
- Resource exhaustion
    - Specialized DoS
    - May use a very small compressed file and that is a HUGE uncompressed file (zip bomb)
        - Anti viruses can detect these
    - DHCP starvation
        - Flooding the network with many new fake devices
        - Make the DHCP server run out of addresses
            - Switch configs can limit the number of requests allowed
## [Rogue Access Points and Evil Twins](https://www.youtube.com/watch?v=fdoHB08VZQU&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=36&ab_channel=ProfessorMesser)

- WAP
    - Unauthorized wireless access points
        - Not always malicious but always a security issue
    - Quite easy to do
    - Survey the area every so often to stop this
        - WiFi pineapple or other tools help to stop this
    - Why it is good to use 802.1X
- Wireless Evil Twin
    - Always malicious
    - Designed to look exactly like all of your other WAPs
    - Try to overpower your existing APs (make itself the primary AP)
        - A big issue for already open networks
    - Make sure to encrypt the communication

## [Bluejacking and Bluesnarfing](https://www.youtube.com/watch?v=sP-PYNfOK5g&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=37&ab_channel=ProfessorMesser)

- Bluejacking
    - Unsolicited message over Bluetooth
    - Typically limited to a 10 meter distance
        - Attacker needs to be close
    - Can write a message to send to the victim including things like contact card, video, etc
    - Low priority security concern as it is just send a message nothing more
        - As long as the users know how to handle it, it is not that bad
- Bluensarfing
    - Higher security risk
    - Able to access data on your mobile device via the Bluetooth communication channel
    - Was patched quickly and is not an issue on updating modern devices
## [Wireless Disassociation Attacks](https://www.youtube.com/watch?v=qJzhe1r_bK4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=38&ab_channel=ProfessorMesser)

- Things are working normally, until everything disconnects (and this keeps happening)
    - May not be able to stop this
- A significant DoS attack
- Takes advantage of 802.11 management frames
    - These frames make sure everything works
        - Conversations that you never see but always are happening
    - The original standard did not protect these frames so they could be messed with easily
        - An attacker could cause problems by sending their own management frames and messing with existing ones
- Protecting against it
    - Updates/patches were made a while ago to fix this
    - Made the frames encrypted
        - Not all but some of them (the important ones that can be)
    - 802.11ac requires these protections to be in place

## [Wireless Jamming](https://www.youtube.com/watch?v=XKQWbwIAm3U&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=39&ab_channel=ProfessorMesser)

- Radio Frequency jamming (RF)
    - DoS
    - Transmit interfering signals to lower the signal to noise ratio
- Sometimes this inference is not intentional
    - But it could be
- Wireless jamming
    - Constant random bits may be sent
    - Constant legitimate traffic may be sent
    - Can happen intermittently as well
    - Only send jamming signal when someone else is also trying to communicate
        - Limited a signal device from communicating
- Interference needs to overwhelm the actual data so it needs to be close to the physical network
    - Hard to hunt down the source
    - May use a fox hunt to find it
        - Find the strongest signal

## [RFID and NFC Attacks](https://www.youtube.com/watch?v=PSyFGFIprQU&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=40&ab_channel=ProfessorMesser)

- Radio Frequency Identification
    - Access cards, tracking, animal identification, etc
    - Uses radar technologies
        - No battery needed (although some can have batteries)
        - The signal is what powers it
    - Unidirectional or bidirectional
- RFID attacks
    - Data capture
        - Viewing the communication
        - Replay attacks
    - Spoofing the reader
        - Write your own data to the tag
    - DoS
        - Jamming
    - Decrypt communication
        - Many default keys are viewable on google
- NFC
    - Two way wireless communication
        - Builds on RFID which was mostly one way
    - Payment systems, Bluetooth pairing, access tokens
- NFC security issues
    - Remote capture
    - Jamming (DoS)
    - Relay / Replay attack
    - Loss of control of the device

## [Randomizing Cryptography](https://www.youtube.com/watch?v=ooOnVzbpXVA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=41&ab_channel=ProfessorMesser)

- Encrypted data should look nothing like the plain text
    - If it does look like the plain text it may be able to be reverse engineered
- Nonce
    - An arbitrary number that is used one time
    - A random number
        - Something that cannot be guessed
    - Often used during a login process
    - Combining the data with the nonce and then sending it across the network
        - Sending the same data will look different every time because the nonce will be different
    - IV (Initialization vector) is a common type of nonce
- Salt
    - Nonce being included in passwords as well
    - Passwords should always be salted

## [On-Path Attacks](https://www.youtube.com/watch?v=pY20_7l8AKc&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=42&ab_channel=ProfessorMesser)

- Formally known as **man in the middle attack**
- The victim does not know it is happening
- Originally data is intercepted and then passed on to where it needs to go
    - Attack and read and change anything that goes through the communication
- ARP poisoning is a common example of this
    - ARP does not have security so this is easy to do
        - Change the ARP table in a device to redirect traffic to the attacker
        - Requires the attacker to be on the local network
- On-path browser attack
    - Attacker is on the same computer as the victim
    - Malware that is the relay between the victim and the other devices is on the victims browser
        - Usually an automated process that handles all of this
    - Can read the plain text data unlike with ARP poisoning

## [MAC Flooding and Cloning](https://www.youtube.com/watch?v=54kfAXpQtWo&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=43&ab_channel=ProfessorMesser)

- I’m not going to write all of this because I already know it and I am too lazy to do it again
- MAC Flooding
    - There is only so much room in the MAC table
    - Attackers could try and fill up the table
        - Force out the legitimate MAC addresses
        - When the table is full it sends every frame to every device
            - Now acts like a hub
            - Could easily overload the network
            - Also good for the attacker to get all of the data
    - Most switches protect against this
        - Flood Guard
- MAC cloning / MAC spoofing
    - Modify their MAC to match the MAC of a legit device on the network
    - Circumvent the filters on the firewalls
    - Could create a DoS attack
        - Disrupt communication to the legitimate MAC
    - Easily to modify this address
    - Many built in features try to prevent this

## [DNS Attacks](https://www.youtube.com/watch?v=TVwH0ki_k2s&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=44&ab_channel=ProfessorMesser)

- DNS Poisoning
    - Modify the DNS server or the client host file (on the local device)
    - Send a fake response to a valid DNS request
- Domain Hijacking
    - Get access to the domain registration and control where the traffic flows
        - Via brute force, social engineering or other ways
- URL Hijacking
    - Making a domain name that is close to the legitimate one
        - Could sell the fake URL to the real owner to “get rid of the problem” while making money
        - Could redirect the traffic to the competitor use it a phishing opportunity, installing malware and more
    - Typosquatting / brandjacking
        - Takes advantage of poor spelling by making a site slightly off from the real one
        - Could also use a different top level domain like .org
- Domain reputation
    - Internet is always tracking your security posture
    - Email reputation
        - Company is infected with malware and sends spam
        - Can cause an email service to fail
        - Sites can check your reputation and help you monitor this
    - Domain reputation
        - Infect systems are noticed by the search engines
        - The search engine will no longer trust your site
## [Denial of Service](https://www.youtube.com/watch?v=dpgGMMHa-lU&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=45&ab_channel=ProfessorMesser)

- Force a service to fail
    - Take advantage of a design failure or vulnerability
- Done for many reasons
    - Could be a smoke screen for something else they want to do
- Could just turn off the power
    - Doesn’t need to be complicated
- Could be done unintentionally
- DDoS
    - Use many systems to attack a single service
    - Often use botnets for this
        - Can have thousands of millions of computers
- DDoS amplification
    - A small attack arrives to the victim as a much larger attack
    - Have a small request be a huge response
        - Be able to shutdown services with much more resources than the attacker has
        - Could be done with a DNS server or other things
- Application DoS
    - Make the application work harder or break
    - Fill up all of the disk space
        - Use a small uncompressed file that turns out to be a VERY larger uncompressed file
            - A Zip Bomb
- Cloud Based DoS
    - Overuse a measured cloud resource
        - Get the application to add more and more resources and spend more money
    - Slow down the response times
- Operational Technology (OT) DoS
    - Electrical grids, traffic lights, manufacturing plants, etc
    - Much more catastrophic than a normal DoS

## [Malicious Scripts](https://www.youtube.com/watch?v=VWORqn4swmY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=46&ab_channel=ProfessorMesser)

- Automate attacks
    - You dont need to be there
    - A lot quicker than normal humans can do things
- Windows PowerShell
    - Command line for sys admins
    - More functionality than the normal command line
    - Can run almost anything
- Python
    - General purpose scripting language
    - Works in most OS (also common for cloud)
    - Attack the infrastructure as well
- Shell script
    - Automate and extend the command line in Unix/linux
    - Bash, Korn, C, etc
    - Good for attacking the linux/unix environment
- Macros
    - Scripts specific to certain applications or OS
    - Makes things easier
        - Could be used in attacks though
        - Get the user to run a malicious macro
- Visual Basic for Applications (VBA)
    - Automates processes within Windows applications
    - A very powerful scripting language
    - Good for the attackers as well

## [Threat Actors](https://www.youtube.com/watch?v=JeYTS3RtLGE&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=47&ab_channel=ProfessorMesser)

- An entity responsible for an event that has an impact on the safety of another entity
- Many different types of them
- Advance Persistent Threat (APT)
    - Attackers are in the network and undetected
- Insiders
    - Employees, contractors or other
    - Often the attacks are not as sophisticated as most hackers could do as this person is likely not a full time hacker
    - Has a lot of information that outsiders would not
    - Lots of resources at their disposal
- Nation States
    - Usually a government
    - Highest level of sophistication
    - The US and Israel destroyed around 1,000 nuclear centrifuges with the Stuxnet worm that was sent to Iran
    - Constant attacks with massive amount of resources
- Hacktivist
    - A hacker and an activist
    - Social change or push a political agenda
    - Could be sophisticated
        - Very focused on a certain thing
    - Funding is often limited as this type of hacking does not tend to make money in any way
- Script Kiddies
    - Run scripts pre-made by other people
    - Dont really understand hacking or scripting well at all
    - Can be external or internal
        - Usually external
    - Not sophisticated at all
    - No funding and financial gain most of the time
- Organized Crime
    - Professional criminals
    - Motivated by money
    - Quite sophisticated
    - Lots of funds and resources
- Hackers
    - Expert with technology
        - Good or bad
    - Authorized
        - Ethical hackers
        - Penetration testers
        - Has permission to do the hacking
    - Unauthorized
        - Malicious
        - In it for personal gain
    - Semi-authorized
        - Looking for vulnerabilities but dont really act on them
        - Maybe a gray hat hacker
- Shadow IT
    - Working around the IT department
        - Do it yourself
    - IT can put up roadblocks and some people dont like this
        - Can buy their own equipment and setup their own services
    - Not always a good thing
        - Wasted time and money
        - Security risks
        - Dysfunctional organization
        - etc
- Competitors
    - Love to see you out of the market
        - DoS, espionage, harm reputation
    - High level of sophistication and funding
    - Could have a big impact and cause many issues

## [Attack Vectors](https://www.youtube.com/watch?v=6CTl2CSS2oI&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=48&ab_channel=ProfessorMesser)

- Method the attackers uses to gain access
- Lots of work goes into this
- IT needs to patch and close these vectors
- Direct access
    - Physical access
    - A significant vector attack
    - Could modify the OS
        - Change the password and gain full access
    - Attach a keylogger
    - Transfer files and take it with you
    - DoS
        - Destroy the system or pull the power
- Wireless access
    - Default login credentials are an issue
    - Keep an eye out for Rogue access points
        - Evil twins as well
    - Make sure you are using the latest secure protocols to protect against vulnerabilities
- Email attack vectors
    - One of the biggest and most success attack vectors
    - Phishing attacks
    - Deliver the malware to the user
    - Social Engineering attacks
    - Hard to manage this attack vector
- Supply chain attack vectors
    - Tamper with the underlying infrastructure or manufacturing process
    - Gain access to a network using a third party vendor
    - Malware can modify the manufacturing process
- Social media attack vectors
    - A lot of information can be gathered via social media
    - Could help break 2FA as well
        - Knowing a ton about you and be able to reset your password
    - Fake friends trying to get more access to your data
- Removable media attack vectors
    - Get around the firewalls
    - USB interface
        - Transfer data to your device
    - Infect the systems with malware on the USB device
    - USB drive that acts as if it was a keyboard
        - USB Rubber Ducky
    - Data exfiltration
        - Terabytes of data could find on a small drive
- Cloud attack vectors
    - Publicly facing applications and services
    - Security misconfigurations
        - Data permissions and public data storage can be attacked
    - Brute force attacks
        - Or phishing attacks
    - Orchestration attacks
        - Causing the cloud to build more instances and add more resources by increasing the load on the servers
    - DoS attacks
## [Threat Intelligence](https://www.youtube.com/watch?v=5LMDN3Yl8mI&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=49&ab_channel=ProfessorMesser)

- Researching threats happens all the time
    - Data is everywhere
    - Decisions are based on this intelligence that you gather
- Open-Source intelligence (OSINT)
    - Publicly available sources
    - Internet
    - Government data
    - Commercial data
- Closed/proprietary intelligence
    - Someone else compiled information and sells it to you
    - Threat analytics
    - Correlation across different sources
    - Constant threat monitoring
        - Identify new threats
        - Automate prevention
- Vulnerability databases
    - Researchers find vulnerabilities
    - CVEs are these databases
        - NVD combines the CVEs together into one massive database
    - Info on how to patch these vulnerabilities is also available
- Public/private information-sharing centers
    - Often this info is classified
        - But public threat intelligence sometimes makes this info available
    - Private threat intelligence
        - Info that came from private companies
    - CTA | Cyber Threat Alliance
        - Threats are uploaded, evaluated and validated
- Automated indicator sharing (AIS)
    - A standard way to share important threat data
    - Structured Threat Information eXpression (STIX)
        - motivation, abilities, capabilities and response information
    - Trusted Automated eXchange of Indicator information (TAXII)
        - Securely share STIX data
- Dark Web intelligence
    - Private sites
    - Hacking groups and services
        - Figure out their ways and find sites selling the data they find
    - Monitor forums for activity
- Indicators of compromise (IOC)
    - Indicates that you have been breached
        - Unusual amount of network traffic
        - Change to file hash values
        - Irregular international traffic
        - etc
- Predictive analysis
    - Analyze large amounts of data to try and predict attackers may strike next
        - Identify behaviors
    - Create a forecast for potential attacks
        - Add additional security based on this information
    - Often combined with machine learning
        - Doesn’t really se signatures
- Threat maps
    - Identify threats and trends
        - Often real time
- File/code repositories
    - See what the hackers are building
    - Github
    - Data is often accidentally released publicly

## [Threat Research](https://www.youtube.com/watch?v=khByS17euzY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=50&ab_channel=ProfessorMesser)

- You need to know your enemy
- A never ending process
    - Everything is always changing
- Needs tons of information from many different sources
- Vendor websites
    - They wrote the application, they should know the most right?
    - You should be able to view all of the known vulnerabilities of an application
- Vulnerabilities feeds
    - National Vulnerability database
    - Third party feeds
- Conferences
    - What and learn
    - Many researchers present
        - New and latest information
    - Lessons from others
    - Building relationships with experts in the field
- Academic journals
    - Cutting edge security analysis
        - Very specific
    - Evaluating existing technologies and how good they are
    - Detailed information on the latest malware and attacks
- RFC Request for comments
    - A way to track and formalize standards
        - Or other documents like experimental, best current practices, historic, etc
    - Some also analyze threats
        - Very detailed
- Local Industry Groups
    - A gathering of local peers
    - Local associations
    - Industry user groups
        - Microsoft, Cisco, etc
- Social Media
    - Hacking group conversation
    - Honeypot monitoring on twitter
        - New vulnerabilities and attacks that are being attempting against certain honeypots
    - Can see other professional talk about these threats
- Threat feeds
    - Monitoring threat announcements
        - Automated
    - Many different sources of these threat feeds
- TTP
    - Tactics, techniques, and procedures
        - Understand what the attackers are doing and how they are doing it
    - Proactively look for threats
    - Many different types of TTP
        - Depends on who the target is

## [Vulnerability Types](https://www.youtube.com/watch?v=a--UeD93508&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=51&ab_channel=ProfessorMesser)

- Zero-day attacks
    - Vulnerabilities that have not been found yet
    - Attackers find some of these vulnerabilities and use them for themselves
        - This is a zero day attack
    - Hard to mitigate
        - Probably not a patch available
- Open Permissions
    - You leave the door open and they walk in
    - No security present
        - Common with cloud storage
    - Make sure to secure your permissions
- Unsecured root accounts
    - Allow the attacker to have full control
        - Bad password, misconfig, etc
    - You could disable direct login to root
    - Make sure to protect these accounts very well
- Errors
    - Error messages can provide too much information to the hackers
- Weak encryption
    - Encrypted data could still be not that well protected
    - Follow best practices
        - Have a good length of encrypted key
        - Use a good hash
        - Use WPA2
        - Use the best Ciphers
        - Keep TLS up to date
    - There are documents to help you pick the right security
- Insecure protocols
    - Data send in the clear
        - Telnet, FTP, IMAP, etc
    - Verify everything is encrypted with a packet capture
    - Use the encrypted version of protocols
- Default settings
    - Not everyone changes these
        - Allows attackers to easily gain admin access to a system
    - Mirai botnet
        - Takes control of these systems
        - Cameras, routers, doorbells, etc
        - Now open source
- Open ports and services
    - Ports need to be open for traffic to flow
        - Needs to properly secured
        - Firewalls help with this
            - Mistakes can be made with these though
            - Allow access you should not of
    - Any unused ports should be closed
- Improper patch management
    - Often managed centrally
    - Firmware, OS, Application, etc
- Legacy Platforms
    - Some devices remain installed for a long time
        - May have old OS, applications and other
    - May be running end of life software
        - Security risks
        - May require additional security protections if you really need to keep the device
## [Third Party Risks](https://www.youtube.com/watch?v=0xEuncIHgv0&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=52)

- Third parties may have access to your data
- Always plan for the worse
    - Malicious intent, human error, etc
    - Put good security in place
- System Integration risk
    - They have access because they need it to do their jobs
        - Physical or virtual access
        - Can run software on the internal network
            - Past the firewalls and other security features
- Lack of vendor support
    - Security requires diligence
    - Vendors need to know a problem exists
        - And fix it in a timely manner
            - They may not even want to or care to fix the issue
- Supply Chain risk
    - You cant always control security at a third party
    - There might have been a security issue high up the chain
        - Hardware and software from a vendor can have malware in it
    - Counterfeit hardware is possible
    - Monitor the supply chain
- Outsourced code development
    - Accessing the code base needs to be secure
        - Where is it stored and how will it be accessed?
    - Verify security to other systems
        - Should be isolated from the rest of the network
    - Always test the code for security issues
- Data storage
    - Data is often stored by a third party
    - Need to make sure the right security is in place
        - Encryption
        - Authorization
        - etc
    - Security adds complexity

## [Vulnerability Impacts](https://www.youtube.com/watch?v=z4JAAjn9d4o&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=53)

- Attacks can costs so much money
    - 57-109 billion dollars in 2016 was the cost of cyber activity in the US
- Many other non economical issues are caused as well
- Data loss
    - Could be more damaging then losing money
    - Always have a backup
- Identity theft
    - Take the data for themselves
- Financial loss
    - Loss of money and assets
- Reputation impact
    - Getting hacked isn't a good look
    - Some country require you to disclose the hacks
        - Companies want to keep it a secret if they can though
    - Can harm the stock value
- Availability loss
    - Outages and downtime
    - Could be very bad for certain services
        - Banks
        - Electric grid
        - Other important things

## [Threat Hunting](https://www.youtube.com/watch?v=M-Q3c6xboa4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=54)

- Attackers are always looking for a way in
- Intelligence data is reactive
    - You can see the attack until it happens
    - Speed up the reaction time
    - Or prevent it completely
- Intelligence fusion
    - Lots of data to shift through to figure out if an attack is coming
        - Many different types of data from many different sources
        - Many different teams that may need to work together
    - This data needs to put into a single database and analyzed
- Fusing the data
    - Collect the data
        - Internal and external data
    - Correlate with big data analytics
        - Try to find where potential problems may come from
- Cybersecurity maneuvers
    - Move firewalls, OS, physical devices and more to try and protect against these potential threats
    - Automated maneuvers
        - Computers reacts instantly
        - Combine with fused intelligence
## [Vulnerability Scans](https://www.youtube.com/watch?v=j9BdMP8Buq8&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=55&ab_channel=ProfessorMesser)

- Not that invasive
    - Unlike a penetration test
    - They dont exploit anything
- Port scan
    - See what ports are open
    - Nmap
- Identify devices
    - From the inside and the outside
- Gather as much info as you can
- Intrusive scans
    - Try to see if that vulnerability really exists
    - Exploit it
- Non-credentialed scan
    - Scan as someone who does not have access to the network
- Credentialed scan
    - You are a normal user
    - Like a insider attack
- Identify vulnerabilities
    - The scanners will look for everything it can
    - Application scans
    - Web application scans
    - Network scans
        - Misconfigs, open ports, and other
- Vulnerability research
    - Need to cross reference to make decision on these vulnerabilities
    - NVD is a good spot to go
        - All of the CVEs
    - Microsoft Security Bulletins
        - Or other vendors
    - Some vulnerability are not tied to a CVE and you may need to figure things out on your own
    - CVSS (Common Vulnerability scoring system)
        - Tell you how severe the vulnerability is
- Vulnerability scan log review
    - Lack of security controls
        - Anti virus
        - firewalls
        - etc
    - Misconfigs
        - Open shares
        - Guest access
    - Real vulnerabilities
        - Especially newer ones
- Dealing with false positives
    - It doesn’t really exist
- False negative
    - Something is there but you dont pick up on it
    - Keep the scanner up to date to prevent this
- Configuration review
    - Make sure everything look good at first glance
    - Security settings and other
    - Account configurations
    - Access controls
    - Firewall rules

## [Security Information and Event Management](https://www.youtube.com/watch?v=JEcETdy5WxU&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=56&ab_channel=ProfessorMesser)

- SIEM
    - Centralized management of all of logs from all of your devices
    - Long term storage of said logs
    - Good for reporting and viewing the data in correlation with each other
- Syslog
    - Standard for message logging
        - Work with nearly any device
    - A lot of disk space is needed
- SIEM data
    - data inputs
        - Authentication attempts
        - Firewall session logs
        - Network consultation
        - etc
    - Packet captures
        - Network packets
- Security monitoring
    - A constant flow of information
    - Security operations center (SOC)
        - Look over and evaluate all of the security information
    - Tracking is important
    - Alerts are also important
        - Could be automated
- SIEM dashboard
    - Wrap up the logs in a way the easy to see and understand
    - Lots of graphs
- Security reports
    - SIEMs also tend to have reporting functions
- Analyzing the data
    - Tons of data
    - Big data analytics
        - Identify patterns
    - User and entity behavior analytics (UEBA)
        - See how things are behaving (even if they are not directly attacking)
        - Detect insider threats
        - Catches what the SIEM and DLP might miss
    - Sentiment analysis
        - See how the public view an org
- SOAR (Security orchestration automation and response)
    - Automate routine, tedious tasks
    - Connect many different tools together
    - Saves tons of time
    - Response
        - Make changes immediately

## [Penetration Testing](https://www.youtube.com/watch?v=RdKaXcoFMcI&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=57&ab_channel=ProfessorMesser)

- Simulate an attack
    - Actively trying to gain access
- Often mandated
    - A third party often does it
- Rules of engagement
    - Defines the purpose and scope of the test
    - Type of test and a schedule
    - List of devices you can attack
        - And those that you cannot touch
    - In scope and out of scope devices and applications
    - How to handle sensitive information
- Working knowledge
    - Unknown environment
        - The Pen tester knows nothing
    - Known environment
        - They know everything
    - A mix of the two
- Exploiting vulnerabilities
    - Make sure you have permission to do this
        - This can cause some issue with the devices you are attacking
    - You need to try many different vulnerability types
    - If you can get through so can the real attackers
- Process
    - Initial exploitation
    - Lateral movement
        - Moving from device to device
    - Persistence
        - Make sure you can return
        - A backdoor, build user accounts, etc
    - The pivot
        - Gain access to system that would normally not be accessible
            - Use said system as a proxy or relay to get to other systems
- Pentest aftermath
    - Cleanup the mess that was made
        - Revert back to how they were
    - Bug bounty
        - A reward for discovering vulnerabilities
        - Usually found be researchers

## [Reconnaissance](https://www.youtube.com/watch?v=PK4gZLXj5Hk&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=58&ab_channel=ProfessorMesser)

- You need information before doing a pentest
    - Learn everything that you can
        - Security posture
        - Minimize the attack area
    - Create a full network map
- Passive footprinting
    - Learning from open sources
    - Social media
    - Corporate web site
    - Online forums
    - Social engineering
    - Dumpster diving
    - Open Source Intelligence (OSINT)
        - Lots of data available
        - Automated gathering will save you a lot of time
    - Wardrving or warflying
        - WiFi monitoring with GPS
        - Finding all the wireless networks in the area
        - A vehicle or in a drone
        - All of this is free
            - Can see the results of other people wardriving
- Active footprinting
    - Actively send information into the network
    - Visible via the network logs
    - Pings, port scans, OS scans, Service scans, etc

## [Security Teams](https://www.youtube.com/watch?v=l-4FoCmBYZg&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=59&ab_channel=ProfessorMesser)

- This is a broad field so you need to divide it up
    - Become a expert in your niche
- Red Team
    - Offensive security team
    - The hired hackers
- Blue Team
    - The defensive team
    - Building up the security measures
    - Day to day operational tasks
    - Responding to incidents
    - Threat hunting
    - Forensics
- Purple team
    - Red and Blue teams working together
    - They are sharing all of the information with each other
        - Create a feedback loop
- White Team
    - Manages the interactions between the red team and blue team
    - Manages the post event assessments
        - The results of pentests
# 2.0
## [Configuration Management](https://www.youtube.com/watch?v=_4QaNzjO9pE&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=60&ab_channel=ProfessorMesser)

- Changes are always happening
    - OS, patches, upgrades, changes, etc
- Identify and document hardware and software changes
    - Should be able to rebuild the entire systems based only on the information in your documentation
- Diagrams
    - The physical wire and devices
    - Sever racks
    - Patch cables and panels
- Baseline configuration
    - The security of an application should be well defined
    - Firewall settings, patch levels, software versions
    - Integrity measurements check for the security baseline
- standard naming conventions
    - Needs to be easily understood by everyone
    - Asset names and numbers
    - Port labeling
    - Domain configurations
        - Standard for usernames and emails
    - IP shema
        - A standard for what IP addresses are assigned to what
        - Subnet standards
        - Reserved IP addresses

## [Protecting Data](https://www.youtube.com/watch?v=maggnNPkKJM&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=61&ab_channel=ProfessorMesser)

- Data is stored everywhere
    - This data needs to be protected
    - Permissions to the data need to be properly managed
- Data sovereignty
    - There are rules on how data is protected in different countries
    - Laws may prohibit where data is stored
        - data collected on EU residents must be stored on EU servers
    - These laws are complex
- Data masking
    - Hide the original data
    - Censor the private information from being viewed
        - many different techniques to do this
- Data encryption
    - Encode information into unreadable data
    - The encrypted data should be very different from the plaintext version
    - Diffusion
        - If you change one piece of information in the plaintext then the cypher tevt should be very different
- Data at rest
    - When the data is on a storage device
    - This data should be encrypted
    - Apply permissions to the data
- Data in transit
    - Data moving across the network
    - Not much protection as it travels
        - Firewalls, IPS, encryption is good to do
- Data in use
    - In the memory of the system
    - Almost always decrypted
    - Attackers can take this data out of the RAM
- Tokenization
    - Replace the sensitive data with non sensitive placeholder
    - Common for credit card processing
    - This isn’t hashing or encryption
        - The two numbers are not mathematically related
- Information rights management (IRM)
    - Control how data is used
    - Restrict data access to unauthorized persons
        - Prevent copy and paste
        - Changing the document
        - etc

## [Data Loss Prevention](https://www.youtube.com/watch?v=aaLShQrElXM&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=62&ab_channel=ProfessorMesser)

- Stop the data before the attackers get it
    - Tons of sources and destinations
- On your local computer
    - Endpoint DLP
    - Data in use
- On your network
    - For data in motion
- On your server
    - Data at rest
- USB blocking
    - Can block access to hardware (USB drives)
- Cloud based
    - Located between the users and the internet
    - Block custom defined data strings
    - Manage access to URLs
    - Block viruses and malware
- DLP and email
    - Check inbound and outbound emails and block sensitive information
    - Check keywords, imposters, fake wire transfer, employee information, etc
## [Managing Security](https://www.youtube.com/watch?v=3uhmllxdNDg&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=63&ab_channel=ProfessorMesser)

- Geographical considerations
    - Legal implications
        - Laws of other states or countries
    - Having to get to another country for maintenance or other
    - Offsite backups
        - Make sure you have good access to your data
        - What access does third parties have?
    - Offsite recovery
        - Travel considerations for support staff
- Response and recovery controls
    - Attacks are often and complex
    - A incident response plan needs to be established
    - Limit the impact of the an attacker
- SSL/TLS inspection
    - Commonly used to examine outgoing SSL/TLS
    - SSL is much older and not often used
    - If the data is encrypted how can you read and filter it?
        - Is not done easily
        - Relies on trust
        - Put yourself in the middle of the conversation
            - Like a man in the middle (but not malicious)
    - Trust me I’m SSL
        - You browser has a list of trusted CAs
        - The CA has performed some checks to make sure the site can be trusted
- Hashing
    - Represent data as a short string of text
    - One-way trip
        - Once you hash the data there is no way to unhash the data
    - Good for verifying integrity (like lots of software downloads provide)
    - Can also be a digital signatures
    - Two messages should not have the same hash
        - No collisions
- API considerations
    - Application programming interfaces
        - Control software or hardware with programmatically
    - Secure and harden the API (Login page or other)
    - On path attack (Man in the middle attack)
        - Intercept and modify API messages
        - API injection
            - Inject data into an API message
    - DDoS via API calls
- API security
    - Authentication
        - Limit API access to users
    - Authorization
        - Not allow external access
        - Read only should not be able to make change
        - etc
    - WAR (Web Application Firewall)
        - Apply rules to API communication

## [Site Resiliency](https://www.youtube.com/watch?v=K9ZU-ZW-SOU&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=64&ab_channel=ProfessorMesser)

- Recovery site is prepped
    - Business process fail over to the alternate site
    - Can be at the recovery site for a long time
- Need process for returning to the original location
- Hot site
    - An exact replicate of your data center/network
    - Automatically synced all of your data
- Cold site
    - No hardware, just an empty building
    - You need to bring the data and equipment with you
    - Bring your own people as well
- Warm site
    - Between a hot site and cold site
    - Just enough to get going
        - Has some equipment
        - You bring the data

## [Honeypots and Deception](https://www.youtube.com/watch?v=gpa9QFuou5k&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=65&ab_channel=ProfessorMesser)

- Honeypots look like the real network
    - But they are fake and a trap for the attackers
    - Can see what methods that attackers are doing
    - Should look as real as possible
- Honeyfiles and Honeynets
    - Honeynet is a bunch of honeypots together
        - A group of servers and other devices
    - Honeyfiles
        - Attractive files to attract the attackers
        - Alerts if someone does something with these files
- Fake telemetry
    - Machine learning to take all of this data and find patterns
        - Train the machine with real data
    - Based on actions not signatures
    - Attackers will try and add fake telemetry into the machine
        - Make you think the malware is good via the training
- DNS sinkhole
    - A DNS that hands out incorrect IP addresses
    - An attacker can redirect user to a malicious site
        - Or do a DoS attack
    - Can also be good though
        - Watch for users going to certain malicious IP addresses and know they are infected with malware
            - Block that connection
    - Can be integrated with a firewall
## [Cloud Models](https://www.youtube.com/watch?v=xoZs8YUMbI8&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=66&ab_channel=ProfessorMesser)

- IaaS
    - Infrastructure as a service
    - Outsource your equipment
        - You still manage it and handle security
    - Your data is out there but more within your control
- SaaS
    - Software as a service
    - On demand software
        - You do pretty much nothing
    - Email, payroll, etc
    - Your data is out there
- PaaS
    - Platform as a service
    - Someone else handles the platform you handle the development
        - They provide the hardware, OS, team, and the building blocks you need
    - Your data is out there
    - Develop your app from what is available
        - Speeds up the development process
- XaaS
    - Anything as a service
    - Everything else (all cloud models)
    - Things like public clouds, flexible pricing model
- Cloud service providers
    - Flat fee or based on use
    - You still manage your processes
        - Still need some internal staff
- Managed service providers
    - MSP
    - Handle many process for their clients
        - Network management
        - Backups and recovery
        - Planning
    - May also be a cloud service provider
    - Managed security service provider
        - Focuses on IT security
        - Patches, firewalls, emergency response, etc
- On-premises vs off-premises
    - On-premises
        - In your local data center
    - Off-premises
        - Not in your building
        - In a third party building
            - You often dont own the hardware
- Cloud development models
    - Public
        - Anyone can access it
    - Community
        - A group of organizations share the same resources
    - Private
        - Just for you in your local data center
    - Hybrid
        - Mix of private and public

## [Edge and Fog Computing](https://www.youtube.com/watch?v=8KfBFVoA3JA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=67&ab_channel=ProfessorMesser)

- Cloud computing
    - On demand computing
    - Fast implementation
    - Tons of resources
    - Cheaper than making your own data center
    - Not always the best option for some situations
- Edge computing
    - IoT devices are everywhere
    - A lot of the processes and application data is on the device itself
        - This is edge computing
- Fog computing
    - IoT devices may also take some of the data and put it in the cloud
    - Cloud computing but not everything need to be in one single place
        - Data could be local or on the cloud
    - Your private data can stay local and safe

## [Designing the Cloud](https://www.youtube.com/watch?v=QNoQCZdWEOE&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=68&ab_channel=ProfessorMesser)

- On demand computing power
    - Scale up and down easily
    - Access everywhere
- Thin client
    - Basic application usage in the cloud
    - Just enough computing power to connect to the cloud devices
    - Needs a good network connection
- Virtualization
    - Many OS on one single piece of hardware
    - Uses a hypervisor to make this all possible
        - Manages everything
    - Can be expensive
- Application containerization
    - Contains everything you need to run an application
    - A single host OS needed
        - Uses a docker to run each application in its own sandbox
        - All apps are self contained
    - Lightweight, portable (standardized), secure separation
- Microservices and APIs
    - Monolithic application
        - One big application that does everything
        - Self contained
        - Complex
    - Microservices
        - APIs to break up the application into small services
        - API is the glue for the microservices
        - Very scalable
        - Resilient
            - Outages are contained
        - Better security and compliance
- Serverless architecture
    - Function as a service (FaaS)
    - Remove the OS from the equation
    - Runs in a stateless compute containers
        - Responds to the API requests
        - Only available as you need them
    - Managed by a third part often
        - They security is their problem
- Transit gateway
    - Virtual Private Cloud (VPC)
        - A pool of resources created in a public cloud
        - Only used by you though
    - Access VPCs through a transit gateway
        - Need to make sure it is secure
            - On different subnets
            - Via a VPN
- Resource policies
    - Assigning permission to cloud resources
        - Limit how different users can use the resources
- Service Integration
    - Service integration and management (SIAM)
        - Consolidating the different cloud services
    - Every provider works different
        - SIAM helps you mesh all of these providers together
        - Manage and monitor them in one place

## [Infrastructure as code](https://www.youtube.com/watch?v=GIgp6BGr4C8&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=69&ab_channel=ProfessorMesser)

- Describe the infrastructure in code
    - Create different versions/instances of applications and other things
    - Use the code to make sure the instances are deployed the same way every time
    - Very important in cloud computing
- SDN (Software Defined Networking)
    - Separating the management of a device and the data of a device
        - Centrally managed
    - Directly programmable
    - Agile
        - Changes are made dynamically
    - Vendor neutral
- SNV (Software defined visibility)
    - You must see the traffic to secure the data
    - Deploy NGFW and other security devices while understanding what data is flowing between all of the systems
        - SIEM for monitoring is very important for this
    - New technologies are always being added so the SNV has to be ready for this

## [Virtualization security](https://www.youtube.com/watch?v=pIilYOy0PEQ&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=70&ab_channel=ProfessorMesser)

- VM sprawl avoidance
    - Click a button and you have built a server
        - It can become too easy to do this
    - VMs are everywhere and you are not tearing them down when they are no longer needed
        - You need a formal process and detailed documentation for this
- VM escape protection
    - The VM is self contained
        - Or is it?
        - VMs can escape
            - An attacker on VM may be able to access another VM
            - Gives you great control that you should not have
- Escaping the VM
    - It is very rare but it can be very bad when it happens

## [Secure Deployments](https://www.youtube.com/watch?v=upSfrqMEztE&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=71&ab_channel=ProfessorMesser)

- Development, deployment, patches and more all needed to be carefully monitored and manged
- Sandboxing
    - Isolated testing environment
        - Test aspects of applications
    - Try lots of ideas with the code with disrupting the production environment
- Building the application
    - Development
        - Writing and testing the code
    - Test
        - Put all of the pieces together and see how they work
- Verifying the application
    - Quality Assurance (QA)
    - Make sure things are working as they should
        - Test new features and new applications
    - Staging
        - Almost read to roll out
        - Test the application in a real world environment
            - Use production data and other things to test
- Using the application
    - Application is live
    - Impacts the users
        - Need to learn how to use the application
    - New servers, new software and other things may be needed
- Secure baselines
    - The security of an application should be well defined
    - Define things like settings, patches, OS versions, etc
    - Integrity checks are also good
        - Make sure production environment matches the security baseline

## [Provisioning and Deprovisioning](https://www.youtube.com/watch?v=PWhKVehWxbo&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=72&ab_channel=ProfessorMesser)

- Provisioning
    - Process of making something available
    - Deploying application instances or other things
        - Make sure it is operational and secure
- Scalability and elasticity
    - Can it scale to demand?
        - Make sure you can handled the load you need with some room for future growth
    - Change easily?
        - If you need to go higher than the scalability you had in place can you change the application to be able to accommodate the new demand?
        - Increase or decrease the available resources
- Orchestration
    - Automate the provisioning and deprovisioning of instances
    - Can change where these instances are as well
    - Security polices should also be a part of this process
- Deprovisioning
    - Dismantling and removing an application instance
        - Remove all traces of it
            - The actual things, security settings, physical devices, etc
        - Make sure to handle the data properly
            - Dont just leave it out there

## [Secure Coding Techniques](https://www.youtube.com/watch?v=IEIGEjy-W4Q&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=73&ab_channel=ProfessorMesser)

- Secure coding concepts
    - A balance between time and quality (Security is also something to think of)
    - Testing process also takes time
- Stored procedures
    - For database calls
    - Clients should not be able to modify requests/calls that happen between the application and the database
        - Stored procedures help to prevent this
            - stops the client from modifying the parameters of the queries
    - Make an application that doesn’t use and SQL queries
- Obfuscation/camouflage
    - Make something normally understandable hard to understand
    - Make code look like nonsense to most humans
        - The computer can still understand it perfectly
    - Helps to prevent people from finding security vulnerabilities in the code
- Code reuse/dead code
    - Use old code to build new applications
        - Common to do as it saves time
    - If the old code is vulnerable to attacks than now more applications are vulnerable
    - Dead code
        - The results aren’t used / the code is unnecessary
        - Remove this as it leave more room for a security issue to be present
- Input validation
    - Validate actual vs expected input
        - Document all input methods
    - Make sure data is in the right format and fix it the data if it is not in the right format
        - If it invalid send an error message and dont accept the input
- Validation points
    - Server side validation
        - All check occur at the server
        - Prevents the use from making changes to the data between the validation and reaching the server
    - Client side validation
        - End users application does the validation
        - Can be faster
    - Both
        - A lot of places use both types
        - Server side is a must though
- Memory management
    - Be mindful of how memory is used
    - Never trust data input
        - Try to stop attackers from circumventing the code
    - Buffer overflows
        - Send more data than what is expected and overflow a section of memory
        - Can cause crash or give the user more access than they should have
    - Good for devs to right their own logic to try and prevent this
- Third-party libraries and SDKs
    - Programming languages do everything
        - Almost
    - Libraries and SDKs
        - Extend the functionality of programming
        - Saves you time
        - Can cause security issues as they are written by someone else
            - Make sure to check and see if it is secure
- Data exposure
    - Lots of sensitive data is being handled
        - Make sure it is secure
            - Encrypted
    - Monitor all input and outputs to make sure data is not being exposed
- Version control
    - Track the changes and be able to update and rollback versions
    - Commonly used for software development and other
    - Good for security as well
        - Keep track of changes
        - Historical reference is a good security tool as well

## [Software Diversity](https://www.youtube.com/watch?v=07Dk5-F7SEU&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=74&ab_channel=ProfessorMesser)

- Exploiting an application
    - Once you exploit one binary you can exploit them all
        - Patches are needed for everything when there is an issue
    - Make computers all run different software
        - They could all run windows 10 but have unique binaries
- Software diversity
    - Alternative compiler paths that result in a different binary each time
    - Functionally is the same, but to the hackers they are quite different
        - If a vulnerability is found for a binary it will likely only work with one machine
    - Adds additional work and complexity
## [Automation and Scripting](https://www.youtube.com/watch?v=f4ciE3zjKe4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=75&ab_channel=ProfessorMesser)

- Always need to plan for changes
    - Automatically
- Continuous monitoring
    - Check for a certain even and then automatically react
- Configuration validation
    - Automatically validate configs before going live
- Continuous integration (CI)
    - Code is constantly written and often deployed
    - So many changes can cause security issues
        - Basic sets of security during development should be done automatically
        - large scale checks after development
- Continuous delivery (CD)
    - Automating the testing and release process
    - Continuous deployment does not even need you to click a button to deploy
        - No human needed

## [Authentication Methods](https://www.youtube.com/watch?v=cPvgt-Bo3k0&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=76&ab_channel=ProfessorMesser)

- Directory services
    - Central database for usernames passwords, devices and more
    - Across multiple devices and always up to date
    - One set of credentials for authentication to everything
    - Like Kerberos or LDAP
- Federations
    - Use authentication information from a different site
        - Credentials stored with a third party to authenticate to your network
    - Third parties must establish a trust relationship for this
- Attestation
    - Prove the hardware is really yours
        - A system you know you can trust
    - Becomes more difficult the more devices on the network
        - With large amounts it needs to be automated
    - Remote attestation
        - Checks happen with a verification server and then are digitally signed
            - Allow or prevent access
- Short Message Service (SMS)
    - Text message or other
    - Can be used for 2FA
    - Not the most secure
        - Phone numbers can reassigned or intercepted
- Push notifications
    - Similar to SMS
    - An app to receive the push notification and display it
        - Some security issues
            - Could be sent in the clear
            - The application could be weak
            - etc
    - Still more secure than SMS
- Authentication apps
    - Uses a pseudo random token generation
        - Could be a physical device or an app
- TOTP Time based one time password algorithm
    - Use a key and time of day
    - Keys only last for a short amount of time
        - Uses NTP for synchronization
- HOTP
    - One time passwords
        - Doesn’t expire until you use it and then it is no longer valid
    - Token based authentication
        - Hardware and software based
            - Hash is different every time
    - Could be stored in an app or physically
- Phone call
    - A voice call could provide you a token
    - Similar disadvantages to SMS
        - Modified messages or forwarding
        - Intercept the call
- Static codes
    - Authentication methods that never change
        - PIN or password
- Smart cards
    - Integrated circuit card for authentication
        - Contact or contactless
    - No one else has the card
    - Multiple factors are always a good idea

## [Biometrics](https://www.youtube.com/watch?v=L2kZKIRpRlc&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=77&ab_channel=ProfessorMesser)

- Something you are
    - Fingerprint scanner
    - Retinal scanner
    - Iris scanner
    - Voice recognition
    - Facial recognition
    - Gait analysis
        - Characteristics when walking
    - Veins
        - Match the blood vessels visible from the surface of the skin
- False Acceptance rates (FAR)
    - The likelihood that an unauthorized user will be accepted
        - Increase the sensitivity of the reader to prevent this
- False Rejection rate (FRR)
    - Likelihood that an authorized user will be rejected
        - Decrease the sensitivity when this happens
- Crossover Error Rate (CRR)
    - The middle ground between FAR and FRR

## [Multi-factor Authentication](https://www.youtube.com/watch?v=yCJyPPvM-xg&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=78&ab_channel=ProfessorMesser)

- AAA framework
    - Identification
        - Username
    - Authentication
        - Password or other
    - Authorization
        - What access do you have?
    - Accounting
        - Logging and monitoring
- Cloud cs on premises authentication
    - Cloud is usually via a third party
        - May have additional options
    - On premises
        - In your local center
        - Needs internal expertise
- Multi factor authentication
    - Factors
        - Something you know
            - Password, pin, etc
        - Something you have
            - Phone, key fob, card, etc
        - Something you are
            - Fingerprint, iris, etc
    - Attributes
        - Somewhere you are
            - Location, IP address, GPS
        - Something you can do
            - Signature/handwritting
        - Something you exhibit
            - Gait, typing, etc
        - Someone you know
            - A web of trust, digital signature, etc

## [Disk Redundancy](https://www.youtube.com/watch?v=nLT482wdxB4&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=79&ab_channel=ProfessorMesser)

- Redundancy
    - Duplicate parts of the system
        - If something failed everything is still up and no data was lost
- Geographical dispersal
    - Bad things can happen in an area
        - Tornadoes, flooding, etc
    - Spread out your servers to keep you from going down when his happens
- Disk Redundancy
    - Multipath I/O (Input/output)
        - Multiple switches, multiple fiber runs, etc
    - RAID
        - Redundant array of independent disks
        - RAID 0
            - Striping with parity
            - No redundancy
            - High performance
        - RAID 1
            - Mirroring
            - Duplicates data for fault tolerance
            - Needs twice the disk space
        - RAID 5
            - Striping with parity
            - Fault tolerant
            - Only needs one extra drive for redundancy
        - RAID 0+1, RAID 1+0, RAID 5+1, etc
            - Multiple raid types combined

## [Network Redundancy](https://www.youtube.com/watch?v=zThMTBNW_8w&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=80&ab_channel=ProfessorMesser)

- Load balancing
    - Split the load between many servers
    - Automatically reconfigures itself when a server goes down
- NIC teaming
    - Aggregate bandwidth and redundant paths with NICs
    - Multiple physical devices
    - Port aggregation

## [Power Redundancy](https://www.youtube.com/watch?v=94atGy4t3I0&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=81&ab_channel=ProfessorMesser)

- UPS
    - Short term backup power
    - Battery powered
    - Types
        - Offline/standby
        - Line-interactive
        - On-line/double conversion
- Generators
    - Gas long term power backup
    - Can run for days or even weeks
        - An entire building if you want
- Dual power supplies
    - Redundancy power supplies
        - Each can handle 100% of the load
        - But run normally at 50% load
    - Hot swappable most often
- PDU (Power distribution unit)
    - Provides many power outlets
    - Often in a rack

## [Replication](https://www.youtube.com/watch?v=7dE2NboVM3I&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=82&ab_channel=ProfessorMesser)

- SAN replication
    - Share data between different devices
    - A storage area network
        - Build in redundancy
    - Duplicate the data from the sans
        - SAN to SAN replication
    - SAN snapshot
        - Not realtime
        - Still a copy
- VM replication
    - Maintain one VM and replicate to the others
        - Also can act as a backup
- On premise vs cloud redundancy
    - Speed can be different between the two
        - Local connects are faster
    - Local can cost a lot of money though
    - Local is often better for security
        - Gives you more control

## [Backup types](https://www.youtube.com/watch?v=CkSmo9WIjfA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=83&ab_channel=ProfessorMesser)

- File backups
    - Full
    - Incremental
    - Differential
- Backup media
    - Magnetic tape
        - Easy to ship and store
    - Disk
        - Faster than magnetic tape
        - Faster
    - Copy
        - Usefull
        - May not include versioning though
- NAS
    - File level access
- SAN
    - Block level access
- Other
    - Cloud
        - Remote backups
        - May have limited bandwidth
    - Image
        - An exact replica of everything on a device
        - Restore everything on a partition including OS and other things
- Backup location
    - Offline backup
        - Must be protected and maintained
        - Often offsite
        - Not always up and accessible
    - Online
        - Always accessible and updated
        - Often cloud based

## [Resiliency](https://www.youtube.com/watch?v=mfQEX06uays&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=84&ab_channel=ProfessorMesser)

- Non-persistence
    - Cloud is always changing
    - Snapshots can capture the current config to allow you to recover things later
        - Revert to a known state
    - Can separate the data from the config
        - Only rollback one of them if you want
- High availability
    - Maintain uptime as much as possible
    - Always on and always available backups
    - Costly
        - Buying two of pretty much everything
- Order of restoration
    - Certain components should be restored first
        - Need to follow the right order
    - Need to understand the originally backups and what you need to restore everything
- Diversity
    - Many different technologies
        - What are the odd they would all have an issue?
    - Many different vendors even
    - Cryptographic
        - Diverse certificate authorities can provide additional protection
    - Controls
        - Many types of controls and access methods to keep everything secure

## [Embedded Systems](https://www.youtube.com/watch?v=guPeDcG2WiI&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=85&ab_channel=ProfessorMesser)

- Computer and software build for a very specific purpose
    - Only one task in mind
    - Traffic lights, watches, etc
- SoC (System on a chip)
    - Multiple components on a single ship
    - Small form factor
    - Like a Raspberry Pi
    - Security considerations are important when dealing with SoCs
        - Hardware is often hard to change
- Field programmable gate array (FPGA)
    - Integrated circuit that con be configs after manufacturing
    - Flexibility
    - Common in many types of infrastructure
        - Routers
- SCADA/ICS
    - For production line networks
    - Many lots of industrial equipment
        - Controlled in a central point
    - Needs lots of segmentation
- IoT devices
    - Sensors, wearable tech, health monitor systems, smart device, etc
    - Change default passwords
- Specialized
    - A device with a single goal in mind
        - Often use older OS
    - Vehicles
        - Tons of embedded systems
        - Similar for aircrafts as well
            - Though more complicated
    - Smart meter
        - Measure power and water
- VoIP
    - Instead of analog phones POTS
    - Pretty complex
    - Each device is a computer
        - Very different from each other
- HVAC
    - Heating ventilation and AC
    - Complex
    - PC often manages all of this equipment
    - Often not built with security in mind
        - Make sure everything is secure as it will be very bad if they do
- Drones
    - Flying vehicles
    - Manually or automatically controlled
    - May need a license to be able to fly them
- Printers scanners and FAX
    - Multi function devices (MFD)
        - All in one
    - Becoming more and more complex due to them being built into one
    - Logs can also be stored on the device
- Real time operating system (RTOS)
    - An OS that works on a deterministic schedule
        - No process that would take control of the system
    - Adds some complexity, especially when it comes to security
        - Dont let the security get in the way
- Surveillance systems
    - Video or audio
        - More and more functionality keeps getting added
    - Make sure it is secure
        - Dont let people tap into them
    - May be hard to physically access the devices
        - Remote management is important

## [Embedded Systems Communication](https://www.youtube.com/watch?v=rVirqAVXB3U&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=86&ab_channel=ProfessorMesser)

- 5G
    - Fifth gen cellular networking
    - Lots of performance improvements
    - Significant impact on the IoT devices
        - Lots more bandwidth to work with
- Subscriber Identity module (SIM)
    - Common for phones or other things
    - Provides the connections between the IoT and the cellular network
        - Helps the network provider deal with the device
- Narrowband
    - Communicate analog signals over a narrow range of frequencies
    - Long distance
    - SCADA, sensors, or others might use this
- Baseband
    - A single cable with a digital signal
        - Copper or fiber
    - Anything going over the link takes up all of the bandwidth
    - Can be bidirectional
        - A bit different from normal though
        - 
    - Common on Ethernet (BASE in the standards names refers to baseband)
- Zigbee
    - IoT networking
    - Open standard (IEEE 802.15.4 PAN)
        - Or Zigbee for people that dont hate themselves
    - Alternative to WiFi and Bluetooth
        - Communication with less power requirements
    - Makes a mesh network with the IoT devices
    - Uses the ISM band

## [Embedded Systems Constraints](https://www.youtube.com/watch?v=ShRJy5BLLJ8&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=87&ab_channel=ProfessorMesser)

- Not a fully functioning computer
    - Low cost device often for a certain purpose
    - Some constraints
    - Hard to upgrade
- Constraints
    - Power
        - Batteries are often needed and need to be replaced or maintained
    - Compute
        - Lower power CPUs
        - Cost and heat considerations
    - Network
        - May not be able to be wired
        - Wireless may not have tons of range
    - Crypto
        - Limited hardware options
        - Hard to change cryptography features
    - Inability to patch
        - Some devices have no field upgrade options
        - Upgrades can be limited and difficult to install
    - Authentication
        - Security is often an after thought
        - Limited authentication or basic authentication
        - Limited options and integration
    - Range
        - Does not often have additional abilities than what it is meant to do
    - Cost
        - Low cost
        - Can affect product quality
        - Lifespan
    - Implied trust
        - You may have limited access to the hardware and software
        - Hard to verify if the security is any good

## [Physical Security Controls](https://www.youtube.com/watch?v=sacbNzDaYCY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=88&ab_channel=ProfessorMesser)

- Barricades
    - Prevent access
    - Channel people through a certain point
- Access control vestibules
    - Many different ways to configure door access and how they are locked / unlocked
- Alarms
    - Alert you when something happens
        - Automated
    - Motion detection, triggered by a person or other
- Signs
    - Clear and specific instructions
    - Personal safety signs and informational signs
- Video Surveillance
    - CCTV
    - Make sure you get the right cameras with the right features
- Industrial camouflage
    - Conceal an important facility in plain sight
    - Blends in
- Guards and access lists
    - A physical security guard
    - Validation and authentication for people
    - Maintains visitor lists and access lists
- Guards
    - Two person integrity
        - No single person has access to a physical asset
    - Could be robot sentries
- Biometrics
    - Fingerprint, retina, etc
    - Difficult to change and duplicate
    - Not foolproof and only good for certain situations
        - Use 2FA
- Door Access controls
    - Lock and key
    - Deadbolt
    - Electronic
    - Token based
    - Biometric
    - Multi factor
- Cable locks
    - Keeps things from being stolen
    - Usually temporary
        - Not for long term
    - A standard connector
- USE data blocker
    - Dont connect to unknown usb devices
    - Blocks the data from flowing (only allows power)
- Proper lighting
    - Attackers try to avoid the light
    - Easier to see when lit
    - Specialized design
        - Right for your area
    - Avoid shadows and glare
- Fencing
    - A perimeter
    - Can be obvious that something valuable is behind the fence
        - Get the right kind of fence for your needs
    - A decent security barrier
        - Prevent climbing and see through if needed
- Fire suppression
    - Electronics require unique responses to fire
        - No water
    - Need a detector
    - Suppress with water or chemicals
- Sensors
    - Motion detection
    - Noise detection
    - Proximity reader
    - Moisture detection
        - Locate leaks
    - Temperature
- Drones
    - Quickly cover large areas for monitoring
    - Site surveys, damage assessments and more
    - On board sensors and video is often included in the drone
- Faraday cage
    - Blocks electromagnetic fields
    - A mesh of conductive material
        - Prevents signals
        - Doesn’t block everything but it helps
    - Can restrict mobile access as well
- Screened subnet
    - A DMZ is the better name
        - Changing the names of these things is dumb
    - I’m not taking notes on this
- Protected distributions
    - Protected distribution system (PDS)
    - Physically secure cabled network
        - In conduits or hard to access in other ways
    - Prevent taps and cuts

## [Secure Areas](https://www.youtube.com/watch?v=7nX3vI5I-Qc&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=89&ab_channel=ProfessorMesser)

- Physically secure the data is just as important as digital security
- Prevent physical access to the devices and systems
- Secure the data
    - Offline and online (backups)
- Air gap
    - Physical separation between networks
    - Most environments are shared
        - Has security issues
        - Prevent people from moving from network to network
- Vaults and safes
    - Store the data backups and other valuable things
    - Often on site
    - A safe is good for smaller environments
- Hot and cold aisles
    - Lots of equipment that generates heat
    - Large energy costs
    - Needs to optimize cooling
        - Only cool the sections of the room that need cooling
        - Heat blows in a certain direction and the heat remains contained and cooled again for reuse
## [Secure Data Destruction](https://www.youtube.com/watch?v=WkRt5jHasSM&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=90&ab_channel=ProfessorMesser)

- Disposal of data can be a legal issue
- You don't want to take important information and throw it in the trash
    - Physically destroying them as best you can is better
    - Keep people away from your garbage
    - Shred the documents
        - Or burn them
    - Pulp the paper
        - Remove the ink
- Physical destruction for digital devices
    - Shredder or pulverizer
    - Drill or hammer
    - Electromagnetic
        - Remove the magnetic field of the drive
    - Incineration
        - Fire hot
- Certificate of destruction
    - Have it done by a third party
    - Need evidence to make sure it is actually destroyed
- Sanitizing media
    - Purge the data off the drive without destroying the drive
    - Can just delete some of the data and not all of it
    - Wipe the drive
        - So it cannot be resorted
        - Unrecoverable
- Data security
    - The third parties could not actually destroy the drives and cause major issues
    - Don’t allow people to recover the data
        - Physical destruction is best

## [Cryptography Concepts](https://www.youtube.com/watch?v=A6HNd1EGfIc&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=91&ab_channel=ProfessorMesser)

- Confidentiality
- Authentication and access control
- Non-repudiation
    - verify who sends what data
- Integrity
- Terms
    - Plaintext
        - Unencrypted
    - Ciphertext
        - Encrypted
    - Cryptanalysis
        - Trying to crack encryption
- Keys
    - Larger keys are often more secure
    - Could use many keys
    - Make a weak key stronger
        - Hashing hashes and other methods
- Key stretching libraries
    - Hashing hashes without you having to make sure your code
- Lightweights cryptography
    - For IoT devices that have little CPU power
    - New standards and research is being done on this
- Homomorphic encryption (HE)
    - Encrypted data is hard to work with
    - Perform calculations on the encrypted data
        - No need to decrypt the data
    - Quite secure

## [Symmetric and Asymmetric Cryptography](https://www.youtube.com/watch?v=6uRI4o5EUkI&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=92&ab_channel=ProfessorMesser)

- Symmetric encryption
    - A single shared key for encryption and decryption
    - Doesn’t scale well
    - Hard to share the key with other devices
    - Fast to use and little system requirements
- Asymmetric encryption
    - Often used to share the key for the Symmetric encryption
    - Public keys and private keys
    - Private key
        - Only you have it
    - Public key
        - Mathematically related to the private key
        - Give it to other people
    - The private key can encrypt and decrypt but the public key can only encrypt (most of the time)
    - Can derive one key from the other
- Key pair
    - Both built at the same time
    - A large random number plus a key generation program and LOTS of math
        - Makes the two keys
- Elliptic curve cryptography (ECC)
    - Asymmetric encryption requires lots of CPU overhead
    - Instead of numbers use curves instead!
        - Good for mobile devices and IoT devices
    - Smaller keys with still good security

## [Hashing and Digital Signatures](https://www.youtube.com/watch?v=VUI89yBDcdk&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=93&ab_channel=ProfessorMesser)

- Hashes
    - Represent data as a short string of text
    - Can’t recreate an entire file from the hash
        - Good for storing passwords
    - Good for integrity checks
    - Can be a digital signature
    - Two hashes should not be the same
- Collision
    - When two different inputs create the same hash
    - Should never happen
        - But did in stuff like MD5
- Practical hashing
    - Verify a downloaded file
        - Done with things like Linux distros
    - Password storage
- Salt
    - Random characters added to the plaintext before hashing
    - Slows down the brute force process
- Digital signatures
    - Prove the message was not changed
        - Integrity
        - Authentication

## [Cryptographic Keys](https://www.youtube.com/watch?v=h-9QKN4a7Oo&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=94&ab_channel=ProfessorMesser)

- Very little is unknown about the cryptographic process
    - The key is only thing you dont know
- Larger keys are better
    - Symmetric keys are around 128 bits
    - Asymmetric keys tend to be around 3,072 bits or more
- Key exchange
    - Use Asymmetric keys to share Symmetric keys
    - Share the keys via telephone or other communication forms
- Real time encryption and decryption
    - Fast security is important
    - Use Asymmetric keys to share Symmetric keys
    - Keys needs to be changed often and be unpredictable
- Traditional web server encryption
    - SSL TLS uses encryption keys to protect communication
        - Has a public and private key
        - Used to encrypt the symmetric keys
    - This private key needs to kept secure
        - It is a single point of failure for the encryption
- Perfect Forward Secrecy (PFS)
    - Change the method of key exchange
        - Not using the same private key every time
    - Keys are just for a single session and then they are done
        - Cant decrypt everything with a single server key
    - More compute power needed

## [Steganography](https://www.youtube.com/watch?v=I9WwX3EHdyY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=95&ab_channel=ProfessorMesser)

- Obfuscation
    - Making something unclear or hard to understand
    - Often done with code
        - Make it hard to read
- Stenography
    - Hide information within an image
    - Not necessarily more secure just hidden
    - The covertext
        - The container document or file
    - Common techniques
        - Network based
            - In the TCP packets
        - In an image
        - Invisible watermarks
            - Yellow dots on printers
        - Audio files
        - Video files

## [Quantum Computing](https://www.youtube.com/watch?v=UNcXp6dIUNw&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=96&ab_channel=ProfessorMesser)

- Computers based on quantum physics
    - Completely new technology
- Classical mechanics
    - 1s and 0s
- Quantum mechanics
    - Bits are 0s 1s and in between, at the same time?
        - That totally seems possible
    - qubits
- Can represent many different binary values at once?
- Very scalable
    - Can search through large amounts of data quickly
- Post-quantum cryptography
    - Breaks our existing encryption
    - Causes lots of issues
        - Can brute force it quickly
    - Cryptography is getting upgraded to work with quantum computing
        - NTRU and others
- Quantum communication
    - Looking at the bits changes them???
        - Quantum Key distribution (QKD) to prevent this
        - An unbreakable encryption key???

## [Stream and Block Ciphers](https://www.youtube.com/watch?v=bEOrdqLB1Io&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=97&ab_channel=ProfessorMesser)

- Stream ciphers
    - Encryption done one bit or one byte at a time
        - High speed and low complexity
    - Often used with symmetric encryption
    - Randomization can be challenging
        - Identical bytes on both the plaintext and encrypted side
        - IV helps to mitigate this
- Block ciphers
    - Does 64 or 128 bit blocks at a time
    - Common for symmetric encryption
- Modes of operation
    - Block cipher modes
    - Block of data as the input
    - Mode operation is the encryption method
    - ECB (electronic codebook)
        - Simplest encryption mode
        - Each block uses the same key
        - Can look similar to the original plaintext
    - CBC (Cipher block chaining)
        - Popular
        - Adds randomization
            - Each block is different than the previous
    - CTR (Counter)
        - Uses a counter to add randomization
        - Increment the counter after each block
    - GCM (Galois counter mode)
        - Combines counter mode with galois authentication
        - Minimum latency and overhead

## [Blockchain Technology](https://www.youtube.com/watch?v=0uv1WaLIhBA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=98&ab_channel=ProfessorMesser)

- A distributed ledger
    - Keep track of transactions
    - Many people access it
- Many uses
    - Payment
    - Digital voting
    - Supply chain
- A copy of the transaction goes to every device
    - Lots of checks and integrity
    - Any of these node could try to change the data
    - This just we use hashes
- Hashes keeps things secure
    - Hashed data is stored in the block

## [Cryptography Use Cases](https://www.youtube.com/watch?v=mmzg20M-dGY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=99&ab_channel=ProfessorMesser)

- Finding the balance
    - Low power devices (Limited CPU, battery and other)
    - Encryption keeps it secure, but you likely need a smaller key
    - Low latency
        - Symmetric encryption
    - High resiliency
        - Larger keys
        - Good quality algorithms
- Use cases
    - Confidentiality
        - Encryption
    - Integrity
        - Hashing
    - Obfuscation
        - Hard to read and find certain data
        - Hides itself
            - Often used for malware
    - Authentication
        - Hashing the passwords
    - Non repudiation
        - Asymmetric encryption
        - Confirm the authenticity of the data
## [Cryptography Limitations](https://www.youtube.com/watch?v=m9DA0k0Ctz8&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=100)

- Finding balance
    - It is not a perfect solution
    - Not all implementations are the same
        - Every situation is different
        - Do your research
    - Cryptography can’t fix a bad techniques
- Limitations
    - Speed
        - Cryptography adds overhead
    - Size
        - For block ciphers we need to think of the size of the blocks
        - IF you are encrypting less then the size of the block you have to add in data to encrypt
            - Adding storage requirements that would otherwise be unneeded
    - Weak keys
        - Short keys tends to be weaker
    - Time
        - How long can you wait for encryption and decryption to take?
        - Larger files take longer and certain encryption types also take longer
    - Longevity
        - Smaller keys keep getting easier to brute force
            - Key retirement is a good best practice
        - Try and extend the life of the method
    - Predictability and entropy
        - If you know what is happening next you may be able to crack the encryption
            - Need random numbers to stop this
    - Key reuses
        - Using the same key over and over reduces complexity but it also decreases security
            - If someone gets the key they can decrypt everything tied to that key
        - IoT devices often have keys embedded in the firmware
    - Resources and security constraints
        - Limited compute power can limit your options for encryption
        - Real time applications cant be delayed
        - Hard to update and keep certain things secure
            - Need to find a middle ground between security and functionality
# 3.0
## [Secure Protocols](https://www.youtube.com/watch?v=yuXK_Jyosus&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=101)

- SRTP (Secure teal time transport protocol)
    - Secure version of RTP
    - Keeps conversations private via encryption
    - Authentication, integrity and replay protection is also added
- Classic NTP has no security features (many other basic protocols are also security less)
    - NTPsec adds security and fixed vulnerabilities
- S/MIME (Secure multipurpose internet mail extensions)
    - Mail exchange with encryption
    - Uses public/private key encryption
    - Secure POP and secure IMAP
        - Use them with SSL
- Web
    - SSL/TLS encryption
        - TLS is the new and more used encryption
    - HTTPS
        - Secure web
        - Uses public and private keys
            - Then a session key
- IPsec
    - Security for OSI layer 3
    - Authentication and encryption for every packet
        - Confidentiality and integrity
    - Very standardized
    - Uses AH and ESP
- FTPS
    - File transfer protocol Secure
    - SSL
- SFTP
    - Secure file transfer protocol
    - SSH
- LDAP
    - Directory access protocol
    - LDAPS is more secure
        - Non standard but adds more security
        - Uses SSL
    - SASL
        - Used for secure directory access
- SSH
    - Encrypted terminal communication
    - Replaces telnet
- DNS had no security at first
    - DNSSEC adds more security features
    - Validates the information
    - Uses public key cryptography
- SNMPv3
    - Network management that is encrypted
- HTTPS
    - Can be used for browser based management of devices
- DHCP
    - There is no secure version of DHCP
    - Additional controls have been added though
        - AD prevents rouge DHCP servers
        - Many switches also have DHCP snooping
    - DHCP starvation attack
        - An user keeps changing their IP taking up the entire pool
        - Switches can limit the number of MAC address they can see
- Automated subscriptions
    - Anti viruses
    - Firewalls
    - Constant updates through many methods
        - Try to use encryption and integrity

## [Endpoint Protection](https://www.youtube.com/watch?v=eEdD30nYm_k&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=102)

- The endpoint
    - The users access
- Inbound and outbound attacks
    - Many different security techniques
    - Defense in Depth
- Anti virus and anti malware
    - Protect the host system from malicious software
- Endpoint detection and response (EDR)
    - A different mode of threat protection
        - Different from signature based detection
    - Behavior analysis, machine learning
    - Pretty lightweight
    - Can often find the cause of a behavior
        - And respond to the threat
- Data Loss Prevention
    - Keep sensitive data from leaving the network (Or sent in the clear)
    - Lots of devices to deal with
        - Many solutions
- NGFW
    - Application layer (7)
    - Can see and make decisions on all of the data in the packets
    - More advanced filtering
- Host based firewall
    - On the endpoints (machines)
    - Run on the OS
    - Allow or disallow incoming and outgoing traffic
        - Can see the in the clear traffic
    - Often managed centrally
- Host based intrusion detection systems (HIDS)
    - Looks through he logs to find intrusions
- Host based intrusion prevention system (HIPS)
    - Actually take action on threats and prevent them
    - Often built into antivirus software
    - Uses signatures, heuristics, and behavior detection

## [Boot Integrity](https://www.youtube.com/watch?v=XqtqbJ0nMVY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=103)

- The boot process is a great infection point
    - Good to be able to stay there for a long time
    - Root level
    - Protecting the boot process is very important
- Hardware root of trust
    - Security is based on trust
    - Trusted Platform Module (TPM)
    - Hardware Security Module (HSM)
    - Hard to change or avoid this trust
        - Needs to be physically changed
- TPM
    - A specification for cryptographic functions
    - Cryptographic processes
        - Generate numbers and keys
    - Memory
        - Store keys and other things
    - Password protected
        - Anti brute force technology
- Secure Boot
    - UEFI specification
    - Verifies the boot loader
        - Must be signed by a certificate or manually approved
    - Lots of built in BIOS protections to prevent unauthorized access
- Trusted Boot
    - After secure boot
    - Boot loader verifies the digital signature of the OS kernel
        - The Kernel than verifies other parts of the OS
    - Checks for malware in the drivers
- Measured boot
    - Allows you to measure if changes have occurred on the OS
    - Harder the more computers there are
        - Can be automated
    - Remote attestation
        - Provides a central management server with the gathered information
        - The server than compares the report to the normal state of the system

## [Database Security](https://www.youtube.com/watch?v=e0NKk-SSO2o&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=104)

- Protecting stored data
    - Compliance issues
    - Keep it secure and available
- Tokenization
    - Replace sensitive data with a non sensitive place holder
    - No relation to the real data
- Hashing a password
    - Store it securely
    - Know if the data is changed
- Salt
    - Okay how many times is this video series going to keep going over the same topics?
    - I am not writing this again

## [Application Security](https://www.youtube.com/watch?v=CwtHoL1CQ68&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=105)

- A balance between time and quality
    - Secure coding and quality applications
- Input validation
    - Validate actual vs expected
    - Dont allow input as code or other untrusted formats
- Dynamic Analysis (Fuzzing)
    - Where random data is being input into an application
    - Looking for something out the ordinary
- Fuzzing engines and frameworks
    - Many different fuzzing options
    - Very time and processor resource heavy
        - Almost always automated
- Secure cookies
    - Information in your browser
        - Like session IDs
    - Secure cookies will make sure the browser uses HTTPS for them
    - Sensitive data should not be in a cookie
- HTTP secure header
    - An additional layer of security
    - Can allow and disallow certain things
        - Force people to use HTTPS, only allow certain inputs, etc
- Code signing
    - So many security questions when it comes to applications
    - Confirm that what you are running is unchanged by a third party
        - Via digital signing
- Allow list / deny list
    - Some applications can be dangerous
        - Block them or just allow the certain ones you trust
    - Many OS have built in options for making these lists
        - Run certain applications and certain versions and dont allow others
- Static code analyzers
    - Static application security testing (SAST)
        - Helps to identify security issues (automated)
    - Many vulnerabilities can be easily found
        - Cant find everything though
        - You still need to verify the vulnerability found

## [Application Hardening](https://www.youtube.com/watch?v=KxiPfczekFA&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=106)

- Application hardening
    - Minimize the attack surface
    - Limit the ability of the attack to exploit an application
- Open ports and services
    - Every ports is an entry point
    - Only open the ones you need
    - NGFW is good for this
        - Can even go even more in depth
- Registry
    - The primary configuration database for Windows
        - Almost anything con be configed here
    - Useful to know an application is modifying in the registry
    - Important security settings can be here as well
- Disk encryption
    - Prevent access to files
    - Full Disk encryption (FDE)
        - The entire disk is encrypted
    - Self Encrypting drive (SED)
        - Built into the drive hardware
        - Opal is the standard for these
- OS hardening
    - Many OS that are quite different
    - Updates / patches
    - Harden the user accounts and passwords
    - Network access and security
        - Only have the access they need
    - Monitor and secure everything
- Patch management
    - Have a policy on how to test and deploy patches
        - Can be automatic on many OS
            - Like monthly updates
    - Third party updates
        - For applications and drivers
    - Auto update isn’t always the best option
        - Need to test the updates
    - Emergency updates
        - Deploy ASAP
- Sandboxing
    - Limits the scope of an applications
        - Commonly done during development or production
    - Like VMs

## [Load Balancing](https://www.youtube.com/watch?v=_YXKeTbdyhk&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=107)

- Distribute the load across multiple devices
- Large scale implementation
- Fault tolerance
- Scheduling
    - Each user is selected in turn
    - Or prioritize server use
    - Or put the load on the server with the lightest load
- Affinity
    - A likeness
    - Always communicate to the same server
        - Tracked using a session ID, IP addresses, Port numbers, etc
- Active/passive load balancing
    - Some servers are active and others are on standby
    - If an active one fails a standby one takes it place

## [Network Segmentation](https://www.youtube.com/watch?v=MiIzrykpaBk&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=108)

- Physical, logical and virtual
    - Improved performance
    - Improved security
    - Compliance
- Physical segmentation
    - An air gap
    - Not connected in any way
- Logical segmentation
    - On the same hardware but different VLANs
        - Needs a router to communicate between these VLANs
- Screened subnet (DMZ)
    - Between the intranet and the internet
- Extranet
    - A private network for partners
    - Similar to a DMZ
        - Has additional authentication though
        - Limited access
- East west traffic
    - Its important to know how data is flowing in a data center
    - Traffic between devices in the same data center
    - North south traffic
        - In bound or outbound from the data center
- Zero trust
    - Not a lot of security controls once you are inside the network
        - Makes software be able to spread easily though
    - Now a days you trust nothing else on your network
        - Everything must be verified
        - Authentication, encryption and more is also required

## [Virtual Private Networks](https://www.youtube.com/watch?v=YFyt8aY8PfI&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=109)

- VPNs
    - A way to send data securely through a public network
    - Encrypted
- Concentrator
    - The device that is encrypting data and decrypting data
    - Could be stand alone or with a firewall
        - Hardware based or software based
- Remote Access VPN
    - On demand access from a remote device
- SSL VPN
    - SSL/TLS VPN
    - Almost no firewall issues
    - No big VPN clients needed
        - Often in a browser
    - Can authenticate users
- HTML5 VPNs
    - Includes API support
    - No need for an application
        - In a browser
- Full Tunnel
    - Everything that is being transmitted is going to the VPN concentrator and then goes to where it needs to go
- Split tunnel
    - Some info can go through the tunnel and other info will not go through the tunnel
- Site to site VPNs
    - Between to locations so they can communicate easily and securely
    - Always on
- L2TP
    - Layer 2 tunneling protocol
    - Common with IPsec
    - Two networks that act like they are on the same layer 2 network
        - Even though they are connected via a router
- IPsec
    - Security for OSI layer 3
    - Authentication and encryption
        - Confidentiality and integrity
    - Standardized
    - Uses AH and ESP
        - You can choose to just use AH for integrity without using the encryption of ESP
        - ESP encrypts and authenticates the tunneled data
    - Transport mode
        - Only protects the data not the headers
    - Tunnel mode
        - Protects both the header and the data

## [Port Security](https://www.youtube.com/watch?v=S_6ri7QM_Rc&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=110)

- Physical ports for this section
- Broadcasts
    - Send information to everyone
        - Stops at a router
    - Can be good or malicious traffic
    - Not in IPv6
- Broadcast storm control
    - A switch can control broadcasts
    - Managed by certain values
        - 100 per second, etc
    - Or remove ones that dont follow the normal traffic patterns
- Loop protection
    - STP or RSTP
- BPDU Guard
    - Speeds up STP by telling the device that it is not connected to a loop manually
    - Watches out for BPDU frames (management frames for STP) and then knows that there might be another switch and be a loop in the network
- DHCP snooping
    - Prevent unauthorized DHCP servers via a switch
    - DHCP servers can be added maliciously or accidentally
        - Routers often have DHCP built in
- MAC filtering
    - Filter based on the MAC address
    - Mac addresses can be spoofed though so this is not perfect

## [Secure Networking](https://www.youtube.com/watch?v=Nj_VF6tuBpw&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=111)

- DNS
    - Had no security originally
        - DNSSEC added security
    - DNS servers can also be additional security tools
        - Stop end users from visiting malicious sites
        - Assume that devices visiting these malicious addresses may be infected by malware
        - Acts like content filtering
- Out of band management
    - Management outside of the normal network
        - A separate management interface
    - Comm server
        - Out of band management for many devices
- QoS
    - Traffic shaping
        - Prioritize traffic
            - Real time has high priority
            - File transfers have low priority, etc
    - Many different methods
- IPv6 security
    - More IP address space (by a lot)
        - No need for NAT
    - Some attacks disappear
        - No arp spoofing because there is no arp
    - New attacks also appear
        - Neighbor Cache exhaustion and others
- Taps and port mirrors
    - Intercept network traffic
    - Port mirror
        - Often software based that is in a switch
        - Some limitations but can work well in certain situations
- Monitoring services
    - On going security checks
        - Identify and look into threats
    - Often managed by a SOC
    - Might be needed to maintain compliance
- FIM
    - File integrity monitoring
    - Some files should never change
        - Make sure they dont with FIM

## [Firewalls](https://www.youtube.com/watch?v=qLb2ioDBofg&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=112)

- Use everywhere
    - Control flow of traffic
    - Content filtering
- Network based firewalls
    - Filtering by IP and port numbers
    - Encrypt traffic as a VPN endpoint
    - Most firewalls can also be a layer 3 device (router)
    - Protects the whole network
    - Stateless firewall
        - Does not keep track of traffic flows
        - Does not look at the history of packets and IPs, just looks at the packet itself
    - Stateful firewall (almost all you will see today)
        - Does keep track of traffic flow
        - Can make decisions based on past history
            - Much more intelligent in its filtering
        - Uses a session table to keep track of things
- UTM (All in one security appliance) (Unified threat management)
    - Like everything in a single device
    - URL filter / content inspection
    - Spam filtering
    - CSU/DSU
    - Router and switching
    - Firewall
    - IDS and IPS
    - VPN endpoint
    - ett
- NGFW
    - Next gen firewalls
    - Application layer (7)
        - Can make decisions based on this application data
    - Commonly network connected devices
    - May also be IPS
    - Content filtering
- Web application firewall (WAF)
    - Applies rules to the HTTP and HTTPS conversations
    - Allow or deny based on expected input
        - Stops many web exploits like SQL injections
- Firewall rules
    - ACLs based on many things
        - Source IP, Destination IP, Ports, Time of day, application, etc
    - Top to bottom rule lists
        - More specific rules at the top
        - At the bottom is an implicit deny
- Firewall characteristics
    - Open source vs proprietary
        - Proprietary has application control and high speed hardware that open source firewalls often dont offer
    - Hardware vs software
        - Purpose built to be a fire wall
        - Or software firewalls that can be placed anywhere
    - Appliance vs host based vs virtual
        - Appliance is often the fastest
        - Host based firewalls run the OS and are good for single devices
        - Virtual firewalls will provide valuable East/West network security

## [Network Access Control](https://www.youtube.com/watch?v=hXeFJ05J4pQ&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=113)

- Edge control
    - Control at the edge
    - Managed using firewall rules
- Access control
    - Control from wherever you are
    - Access is based on many rules
        - Access can be easily revoked or changed
- Posture assessment
    - You can’t trust everyone's equipment
        - BOYD
    - Before allowing a device to connect to the network perform a health check
        - Is it trusted already?
        - Is it running an up to date antivirus software?
        - Are the corporate apps installed?
        - etc
    - Sometimes done via a persistent agents
        - Always on the device
        - Needs to be maintained
    - Dissolvable agent
        - Not permanent
        - Runs when you connect to the network
    - Agentless NAC
        - Integrated with AD
        - Check are made during login and logoff
- Failing your assessment
    - What happens if you dont meet the requirements?
    - Quarantine network and notify the admins
        - Then try again once the problems are fixed

## [Proxy Servers](https://www.youtube.com/watch?v=OdThHSACnQY&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=114)

- Proxies
    - Sits between the users and the rest of the network
    - Receives and sends requests on the users behalf
    - Good for caching information, access control, filtering and more
    - Sometimes the end users dont even know they are using a proxy
- Application proxies
    - One of the simplest proxies is a NAT
    - Most proxies are application level though
        - Understands the applications very well
    - May only know a single application
        - Like HTTP
    - Or may know many applications
- Forward proxy
    - Internal proxy
    - Commonly used to protect and control user access to the internet
- Reverse proxy
    - Inbound traffic from the internet to your internal service
    - Opposite of the forward proxy
- Open proxy
    - A third party uncontrolled proxy
    - A security concern
        - Often used to circumvent existing security controls
        - The proxy could also modify the traffic

## [Intrusion Prevention](https://www.youtube.com/watch?v=WPPSsFnWOYg&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=115)

- IDS and IPS
    - Or NIDS and NIPS for network based ones
- Try and alert or prevent intrusions and exploits from happening
    - Detection just alerts
    - Prevention actively tries to stop it
- Passive monitoring
    - Examine the traffic
        - Via a port mirror
    - No way to block or prevent said traffic
    - Out of band response
        - When malicious traffic is identified the IPS send TCP RST frames
            - Disable that traffic flow after the fact
- Active monitoring
    - Physically inline
        - Sees all of the traffic sent through it
    - Can actively block and prevent attacks
- Identification technologies
    - Signature based
    - Anomaly based
    - Behavior based
    - Heuristics
        - Used AI and machine learning to see if something is odd

## [Other Network Appliances](https://www.youtube.com/watch?v=th9ylCvgNi0&list=PLG49S3nxzAnkL2ulFS3132mOVKuzzBxA8&index=116)

- Jump server
    - Access secure network zones
    - A private connection to a single device on the inside
        - Then jump from there to the other devices in the network
        - Good for administration
    - Needs to be very protected as authorized access would be very bad
- Hardware security module (HSM)
    - Used in large environments
        - Helps you manage and control keys and encryption in your environment
    - High end cryptographic hardware
        - Offload the CPU overhead from other devices
    - Secure storage of keys
- Sensors and collectors
    - Aggregate information from network devices and put them in one place
    - Sensors
        - Goes on the device itself
        - Gather the logs and give them to the collector
    - Collectors
        - A console or series of consoles
        - A SIEM
## [Wireless Cryptography]()

- Traffic can be easily pulled out from the air
    - Authenticate users before given them access
    - Ensure that the data is encrypted
    - Verify integrity so files cannot be modified without you knowing
- Wireless encryption
    - Only people with the right key can transmit and listen
        - WPA2 and WPA3
- WPA2 and CCMP
    - Uses CCMP for encryption
    - And AES for confidentiality
    - MIC for integrity
- WPA3
    - GCMP for encryption (Stronger than WPA2)
    - Data confidential with AES
    - GMAC for integrity
- The WPA2 PSK problem
    - WPA2 has a PSK brute force problem
        - Can capture the hash and brute force it
- SAE (Simultaneous authentication of Equals)
    - WPA3 changes the PSK authentication process
        - The AP also authenticates to you
    - Key exchange changes
        - No more handshaking, no more hashes send across the network, no brute force attacks
        - Uses a session key without sending it across the network
            - This is what SAE does
            - The dragonfly handshake

## [Wireless Authentication Methods]()

- Credentials
    - Pre-shared key PSK
    - Or centralized authentication (802.1X like RADIUS)
- Wireless security modes
    - Open system
        - No password is required
    - WPA3 personal
        - A single pre-shared key
    - WPA Enterprise
        - 802.1X
- Captive portal
    - Authenticate to the network
        - Uses a login screen
    - Username and password (other authenticate factors)
    - Often have a timeout function
- WPS
    - Wifi protected setup
    - Allows easy setup of a mobile device
        - Many different methods
        - PIN, push a button on the AP, NFC, etc
- WPS attack
    - WPS has a very bad design flaw
        - Only around 10,000,000 possible combinations for a PIN
        - The WPS validates each half one its own
            - First half has 10,000 possibilities
            - Second half has 1,000 possibilities
    - Takes about 4 hours to brute force every password
        - Most newer devices have brute force protection

## [Wireless Authentication Protocols]()

- Many different authentication factors are used
- EAP (Extensible Authentication Protocol)
    - An authentication framework
    - Integrates with 802.1X
- 802.1X / NAC
    - Uses RADIUS, LDAP, or TACACS+ most often
    - Supplicant
        - The client connecting the network
    - Authenticator
        - The device the provides access
    - Authentication server
        - Validates the credentials
- Types of EAP
    - EAP Fast
        - Makes sure the Authentication server and the supplicant can talk to each other over a secure tunnel
        - TLS tunnel is used
        - Needs a RADIUS server or another authentication server
    - PEAP
        - Protected EAP
        - Encapsulates EAP in a TLS tunnel
            - Uses a digital certificate
        - MSCHAPv2 authentication
            - Or a GTC (generic token card)
    - EAP TLS
        - Strong security and quite popular
        - Requires digital certificates on all the Authentication servers (AS) and all other devices
            - Mutual authentication
        - Quite complex
            - Not all devices even support it
    - EAP TTLS
        - Other authentication protocols in a TLS tunnel
        - Requires a single digital certificate on the AS
- RADIUS Federation
    - When you link a users identity across many different systems
    - Uses 802.1X
        - EAP to authenticate

## [Installing Wireless Networks]()

- Site Surveys
    - Determine existing wireless landscape
    - Find the AP and existing frequencies
    - Perform more down the line to make sure nothing has changed
    - Heat maps can show you the wireless signal strengths
    - Tools
        - Show you signal coverage
        - Interference and in use frequencies
        - Built in tools or more software/hardware
- Wireless packet analysis
    - Very easy to monitor wireless traffic
        - Turn off your transmit and listen to everything
    - Some network drivers won't capture wireless information
        - May need certain drivers and adapters
    - See signal to noise ratio, channels, and other things
    - Wireshark or other tools
- Channels
    - Don't use overlapping channels
    - for 2.4 GHZ use 1, 6, and 11
        - For 5GHZ this is less of an issue because there are lots more channels
- AP placement
    - Minimal overlap with other AP
    - Maximize the coverage
        - Place them as close to possible as the users
    - Try to avoid interference from things like electronic devices, building materials and other things
- Wireless infrastructure security
    - Wireless controller for centralized management of WAPs
    - Securing the wireless controllers
        - HTTPS
        - Automatic logouts
        - Control access
    - Securing AP
        - Good passwords
        - Update firmware

## [Mobile Networks]()

- Point to point
    - Connecting two buildings together
    - Wifi repeaters
- Point to multipoint
    - One of the popular communication methods
        - 802.11 wireless
    - Not full connectivity between everything
- Cellular networks
    - For mobile devices
    - Separate the land into cells and have an antenna for that cell
    - Some security issues
        - Monitoring
        - Location tracking, etc
- WiFi
    - Local network access
    - Some security issues
        - Data capture
- Bluetooth
    - High speed communication over short distances
    - Connects to our mobile devices
- RFID
    - Used everywhere
        - Access badges, inventory tracking, pet identification, etc
    - Uses radar technology
        - Is powered by the signal (or locally at times)
- NFC
    - Two way wireless communication
    - Payment systems
    - Helps with Bluetooth pairing
    - Can act as an access token
    - Security issues
        - Remote capture
        - Frequency jamming (DoS)
        - Relay and replay attack (Man in the middle)
        - Loss of the device
- IR
    - On many smartphones and other devices
    - Control your entertainment centers
    - File transfers are also possible
        - Not all that common
    - Not tons of security controls
- USB
    - Physically connect to many devices
    - Physical access limits access at times
    - Always auto lock your device
- GPS
    - Created by the Department of defense
    - Precise navigation information
        - Need to see 4 satellites to use it
    - It is used often for maps and directions could also be used for other purposes

## [Mobile Device Management]()

- MDM
    - Manage company owned devices and user owned devices
        - Centralized management
    - Set policies for the devices
    - Manage access control
- Application management
    - Manage mobile apps and their versions
    - Not all applications are secure
        - Have a way to allow and disallow application installations via an allow list
    - Adds quite a lot of management overhead
- Content management (MCM)
    - Secure access to data
    - Policies for file sharing and viewing
        - For both onsite and cloud storage
    - Use DLP and other things to keep the data safe and secure
- Remote wipe
    - Remove all of the data from the device without physical access
        - Make sure you have a backup
    - Works as long as it connected to a network
    - Needs to be configured before the device is deployed
- Geolocation
    - Precise tracking details
    - Can be used for good and bad
        - It can be disabled on most phones
    - May be managed by the MDM
- Geofencing
    - Restrict or allow certain features based on the location data
- Screen Lock
    - All mobile devices can be locked
    - Use a strong passcode
        - Lock or delete everything when there is too many login attempts
- Push notification services
    - Sends you information without user intervention
    - Can be controlled via the MDM
- Passwords and PINs
    - Use secure authentication measures
    - Recovery process may be available via the MDM
- Biometrics
    - You are the authentication factor
    - Not the most secure authentication factor though
    - Can be managed through the MDM
        - Can be managed per app
- Context aware authentication
    - Combines different things together to build a profile of who is attempting to connect to a device
    - Things like IP, GPS, other paired devices, etc
    - Not the most common
- Containerization
    - Hard to separate personal from company data
    - Containerization helps to partition the data from each other
    - Makes it easy to manage offboarding
        - MDM can do it in the click of a button
- Full disk encryption
    - Even if you lose the device the data stays secure
    - Many ways to encrypt the data
        - Can use quite a lot of CPU and battery life
    - Don't lose your password as there is no recovery
        - Could be backup on the MDM though

## [Mobile Device Security]()

- MicroSD HSM (hardware security module)
    - Provides security services
        - Encryption, key generation, authentication, etc
    - Secure storage to protect the keys and other things
- Unified Endpoint management (EUM)
    - Manage mobile and non mobile devices
        - A newer version of MDM
    - Manage the end users and all of their different devices
        - Allow applications to work across different platforms
        - With security in place
    - All of these devices can be used from anywhere
- Mobile Application Management (MAM)
    - Provision, update and remove applications
        - MDM still manages the device itself but the MAM  will manage the applications
    - Create an enterprise app catalog
    - Monitor application use and any problems that are happening with the applications
    - Remotely wipe the application data and manage it in other ways
- SEAndroid (Security Enhancements for Android)
    - Supports access control security policies
    - A project from the NSA
    - Address a broad scope of system security
        - Kernel, userspace, policy configuration and more
    - Enabled by default on android
    - Protects privileged android system daemons
    - Change from Discretionary Access Control (DAC) to Mandatory access control (MAC)
        - The user cannot control what type of access someone has
            - That is up to the admin
        - Also makes sandboxes between the applications

## [Mobile Device Enforcement]()

- Third party app stores
    - Not all of these applications are secure
    - Not all of apps are appropriate for business use
    - MDM can allow or deny app use
- Rooting/jailbreaking
    - You don't need to access the OS of mobile devices
        - It is possible to gain access though
    - Install custom firmware in order to do this
        - Uncontrolled access
        - MDM becomes pretty much useless at this point
- Carrier unlocking
    - Most phones are locked to a certain carrier
    - Some phones can be unlocked if the carrier allows it
        - Some countries make carrier locks illegal
    - Moving to another carrier can circumvent the MDM
        - You need policies to either allow or deny people from doing this
- Firmware OTA updates
    - Updates over the air
    - Security patches or entire OS updates
    - These updates may need to be tested
        - Manage the updates with the MDM
- Camera use
    - Not always a good thing
    - Hard to control camera use on the device itself
        - The MDM can control the camera though
            - Could be based on the location or other factors
- SMS/MMS
    - Text, video, audio
    - Control of this data can be a concern
        - Outbound leaks
        - Inbound attacks and other things
    - MDM can also control this
- External media
    - SD flash, USB drivers, external HDD, etc
    - It is easy to write data to these
        - Prevent this from the MDM
- USB OTG
    - USB on the go
    - Connect two devices to each other to transfer files
    - Common on android devices
        - Convenient and easy to use
- Recording Mic
    - Audio recording
        - Good for meetings and note taking
    - Some legal issues though
        - Every state has its own laws
    - Controlled with MDM
- Geotagging / GPS tagging
    - Your phone knows where you are, this can be tagged to files
        - Stored as metadata
    - Can allow you to track the user pretty easy
        - Could be a security concern
        - Perhap disable it
- Wifi direct /ad hoc
    - A local wireless connection between two devices
        - No need for an AP or internet
    - WiFi direct makes this pretty simple
        - Can have vulnerabilities though
    - IoT starts with this for configuration
- Hotspot / tethering
    - Make your phone a wifi hotspot
        - Use that access the internet
    - Dependant on the carrier and phone type
    - Make sure you have good security and passwords
        - Could lead to information leaks and unauthorized access to internal networks
            - Could just turn it off
- Payment methods
    - NFC
    - Many payment apps
    - Uses some type of authentication
        - Make sure to have good security

## [Mobile Deployment Models]()

- BYOD
    - Your own device
    - Company needs to have policies for this
        - Hard to make it secure
    - Often managed through an MDM
- COPE
    - Owned by the corporation but you can take it home as a personal device
    - The corporation has full control of the device
    - Information is protected and managed by the MDM
- CYOD
    - Choose your own device
    - Unlike COPE where the device is picked for you
- Corporate owned
    - The company owns the device and you can use it for personal use
    - Very specific security requirements
- VDI / VMI
    - Virtual Desktop Infrastructure / Virtual Mobile Infrastructure
    - Separates the data and the applications from the device
        - Keeps things stored external and securely
        - Losing the device doesn’t matter much
    - Good for centralized app development
        - Can be deployed and managed on a single device

## [Cloud Security Controls]()

- HA Across zones
    - Availability zones (AZ)
    - Isolated locations within a cloud region
        - Pretty much self contained
    - Build applications to be highly available (HA)
        - Applications can recognize AZ outages and change zones
        - Could use load balancing
- Resource policies
    - Identity and access management (IAM(
        - Determine who gets access and what they get access too
    - Map groups and job functions
        - Provide access to cloud resources based on what they need access too
    - Centralized user accounts across many platforms
- Secrets management
    - Cloud computing includes many secrets
        - Can be hard to manage and protect
    - You can have a service to manage all of this for people in your org
        - Many sure people have authorized access
        - Manage an access control policy
    - Provide an audit trail and logging
- Integration and auditing
    - Integrate security across many platforms from all over
        - Can do this with a cloud based SIEM
    - Auditing and reports can be done with this SIEM as well

## [Securing Cloud Storage]()

- Cloud Storage
    - Could be on the public cloud
    - Access to this data needs to limited
        - Could be physically separate from other data
    - Availability is also important
- Permissions
    - A big concern for cloud storage
    - Public access may be thefeualt
        - This should not be the case but it is possible
    - Can be managed through IAM
        - Or bucket policies, globally block public access, etc
    - Don't put data in the cloud unless it really needs to be there
- Encryption
    - Server Side encryption
        - Encrypt the data in the cloud
    - Client-side encryption
        - Data is already encrypted when it is sent to the cloud
        - Not all applications can do this properly
        - Key management is critical when doing this
- Replication
    - Copy data from one place to another
        - Real time duplication
    - Good for maintaining update and availability
        - Backups are always good
    - Allows you to perform data analysis without messing with production hardware and data

## [Securing Cloud Networks]()

- You need a secure way for the users to communicate with the cloud server
- Virtual networks
    - A cloud can contain virtual devices
        - Switches, routers, etc
    - This network can changed on demand
        - Very flexible
- Public and private subnets
    - Private cloud
        - All internal IPs
        - No external access to the network
    - Public Cloud
        - External IPs access
        - Connect from anywhere
    - Hybrid cloud
        - A public facing part and a private part
- Segmentation
    - Separate applications, data, and services from each other
        - Decide how the data flows between everything
    - Can also have additional security with this
        - Web application firewall WAF
        - NGFW
        - IPS
        - etc
- API inspection and integration
    - Microservices architecture i the underlying application engine
        - Adds some security concerns
    - API calls can cause security issues
        - People intercepting them, modifying them, making their own, etc
    - Do some API monitoring to try and manage this and keep it secure

## [Securing Compute Clouds]()

- Compute cloud instances
    - Perform the cloud compute environment
    - Manage the resources with a VM or other containers
- Security groups
    - A firewall for each compute instance
    - Layer 4 or layer 3 for making the groups
- Dynamic resource allocation
    - Only have the resources you need
        - Automatically cover the load you need
        - Allows you to pay for just what you are using
    - Ongoing monitoring
        - Be able to know what the load is like you can make this resource changes
- Instance Awareness
    - Granular security controls
        - Manage very specific data flows per instance
    - Define and set policies
        - How files can be uploaded, read, written, stored and more
- Virtual private cloud endpoints
    - VPC gateway endpoint
        - Allow and restrict access how you want
    - Private clouds for a certain org
        - Quite useful for application dev
- Container security
    - Containers have similar security needs as any other application deployment
    - Use contain specific OS
    - Group the containers types as the same host
        - Limit the scope of any intrusion

## [Cloud Security Solutions]()

- Cloud Access security broker (CASB)
    - Manage security policies for data stored in the cloud
    - Could be located locally or in the cloud
    - Visibility
        - See what applications are in use
        - What users should use those applications
    - Compliance
        - Are users complying with regulations
    - Threat prevention
        - Disallow unauthorized used
    - Data Security
        - Ensure that data is encrypted, DLP and more
- Application Security
    - Misconfigurations could ruin everything
    - Authorization and access controls
    - API security
- Next Gen Secure Web Gateway (SWG)
    - Protect users and devices regardless of location
        - Examine the API of an application
            - Look at the code itself to do this
    - Make policy decisions based on this
    - Instance aware security
        - Different policies for different instances
- Firewalls in the cloud
    - Control the traffic flow
        - Layer 4 or layer 7 firewalls
    - Don't need a physical device so it can be quite cheap to do
    - Can provide segmentation for your network
- Security controls
    - May be built in features in the cloud already
        - Many options and it is likely no extra cost
    - There are third party solutions for this as well
        - Works with all service providers (Use many providers at once even)

## [Identity Controls]()

- Identity Provider (IdP)
    - Who are you?
        - Authentication as a service
    - Has a list of users and devices
    - Common for SSO applications or authentication process
    - Many standards help with this
- Attributes
    - An Identifier or property of an entity
        - Name, email, phone number, ID, etc
        - Department, job title, etc
    - One or many attributes can be used
- Certificates
    - Digital Certificate
        - Assigned to a person or device
    - Binds the identity of owner to a public and private key
    - Requires PKI for it to work
- Tokens and cards
    - Smart cards can provide identification and authorization as well
        - USB Tokens work the same way
- SSH keys
    - Use keys instead of username and password
        - Good for automation and other things
    - Key management is very important
        - Make sure it is centralized and secure
    - Open source and commercial options
    - SSH based authentication
        - Make a key pair via ssh-keygen
        - Copy the public key to SSH server via ssh-copy-id user@host
        - Then try it with ssh user@host to login

## [Account Types]()

- User accounts
    - An account on a computer for a certain person
    - Data can be private to a certain user
    - Not privileged access
- Shared and generic accounts
    - Shared accounts are used by more than one user
        - Like guest accounts
        - Hard to know who did what or give permissions to certain people
        - Password management is hard as well
    - Probably shouldn't use this
- Guest accounts
    - Shared accounts that used to be pretty normal to OS
    - No password needed
        - No much access due to this
    - Still has pretty bad security issues
        - Privilege escalation
    - Needs to be carefully controlled or just not used at all
- Service accounts
    - Used only by services running on the computer
    - Access can be defined for a certain service
        - They have just the rights they need
    - Commonly have username and password
- Privileged accounts
    - The admin or root type accounts
    - Complete access to the system
        - Should only be used when it is really needed
        - Don't use it as the normal user account
    - Needs to be very secure

## [Account Policies]()

- Control access to an account
    - Policies, authentication, and other
    - Permissions after login
- Perform routine audits
    - Does everything follow policy?
    - Certain actions should alert you automatically if something goes too wrong
- Auditing
    - Make sure everyone has the right permissions
    - Should occur regularly
    - Usage auditing
        - How are resources used and are things secure?
- Password complexity and length
    - Make your password strong (many ways to do this)
        - Strong against a brute force attack
    - Random set of letters, numbers, and characters
    - The longer the better
    - Prevent reuse
- Account lockout and disablement
    - If you enter too many passwords you get locked out
        - Prevents brute force attacks
        - Used almost everywhere
    - Disable unused accounts
        - From past employees
        - Keep the data though
            - Encryption keys and other things
- Location based policies
    - Network location or GPS location
    - Geofencing
        - Set of a policy based on where someone is located
    - Geotagging
        - Location information that is added to the metadata of files the user is sharing
    - Location based access rules
    - Time based access rules

## [Authentication Management]()

- Password Keys
    - Hardware based authentication
    - Helps to prevent unauthorized logins even if they had the password
    - Goes with other authentication for 2FA
- Password vaults
    - Don't use the same password for everything
        - Just use a password manager
    - Have a single master password
        - It should be a VERY strong master password and maybe even 2FA
    - Secure storage from anywhere
- Trusted Platform Module (TPM)
    - A specification for cryptographic functions
        - A cryptographic processor
    - Make keys, random numbers and store them
- Hardware Security Module (HSM)
    - High end cryptographic hardware
    - Key storage
    - Cryptographic accelerators to offload the load too
    - Used in large environments
- Knowledge based authentication (KBA)
    - Use knowledge as an authentication factor
    - Static KBA
        - A preconfigured shared secret
    - Dynamic KBA
        - For a similar purpose
        - Not a previous configured question though
            - Pull information from records in order to pose a question to you

## [PAP and CHAP]()

- PAP (Password Authentication Protocol)
    - A basic authentication method
        - Rare to see in modern stuff
    - PAP is sent in the clear so it is not very secure at all
        - Some applications may still use this and provide their own encryption though
- CHAP (Challenge Handshake Authentication Protocol)
    - Adds encryption
    - Has a three way handshake to authenticate
        - This challenge response progress happens to start up a session but it may also occur during an active session without the user knowing it
- MS-CHAP
    - For microsoft
    - Common with PPTP
    - Pretty old and has quite a lot of security issue
        - Bad encryption

## [Identity and Access Services]()

- RADIUS
    - One of the more common AAA protocols
    - Centralized authentication for users
    - Works on almost any device and OS
- TACACS
    - Alternative to RADIUS
    - XTACACS an updated version by CISCO
    - TACACS+ the latest version
- Kerberos
    - Uses single sign on (SSO)
    - Provides mutual authentication
    - Uses cryptographic tickets to know you are authenticated
- Which one to pick?
    - Three different things are quite similar to each other
    - Often depends on what you are connected to and what is supported by that device
    - TACACS is probably CISCO
    - Kerberos is probably Microsoft
- 802.1X
    - Port based network access control (NAC)
    - Common for wireless networks
    - Often used with EAP or one of its versions
    - Used with RADIUS, TACACS and LDAP

## [Federated Identities]()

- Federation
    - A way to provide access to network with credentials from a different service
    - Can be done with third parties
        - Like those login screens where you can login with social media accounts
    - There needs to be a trust relationship with the third parties
- Security assertion Markup Language (SAML)
    - Open standard for authentication and authorization for Federation
    - Not good for mobile apps
- OAuth
    - Authorization framework that is more common
        - Not for Authentication, that is done with OpenID
    - Determines what types of resources third parties can access
    - Broad support and very popular

## [Access Control]()

- Authorization
    - Giving the user the correct level of access
    - Users receive rights based on access control models
- Mandatory Access control (MAC)
    - Based on security clearance levels
        - Like in the government
    - Everything gets a level of what clearance is needed to access them
- Discretionary Access control (DAC)
    - As the owner of the file you decide who can access it
    - Very flexible
        - Quite weak security
- Role based access control (RBAC)
    - You have a role in your org and this decides what access you have
        - Admins configs this
    - In windows this is done through Groups
- Attribute based access control (ABAC)
    - Consider many parameters and then give access based on the set parameters
        - Aware of context and quite smart
    - IP address, time of day, relationship to the data, etc
- Rule based access control
    - Generic term for following rules
    - System admin set the rules
        - Rules are associated with objects
- File system security
    - Built into to most OS
    - Access control list to show what rights users have on a system
    - Encryption is often built in
- Conditional access
    - Difficult to use old authentication methods
        - So we use conditional access
    - Set conditions
        - And then allow or block, give different levels of access, require 2FA, etc
    - Can build pretty complex access rules
- Privileged access management (PAM)
    - Managing Admin and root accounts
    - Store these accounts in a digital vault
        - Make the privileges temporary things that have to be “checked out”
    - Centralized management of these accounts

## [Public Key Infrastructure]()

- PKI is the process of managing pretty much everything to do with digital certificates
    - Policies, procedures, hardware, software, people, etc
    - Lots of planning and data to deal with
    - Also deals with keys and binding them to devices and people
- The key management lifecycle
    - Key generation
    - Certificate generation
    - Distribution
    - Storage
    - Revocation
    - Expiration
- Digital certificates
    - A public key certificate
    - Adds trust via a CA or Web of Trust
    - Can be built into the OS
        - Part of Windows Domain services
    - Third party Linux options
- Commercial certificate authorities
    - Built into the browser
    - Can purchase a certificate that will be trusted by everyone's browser
        - Make a key pair and give the public key to the CA and then they sign it
    - Can have different levels of trust and features
- Private Certificate authorities
    - Become your own CA for local stuff
        - Easier and cheaper
    - Nearly every medium to large org has this
    - Many ways to do this for many OS
- PKI trust relationships
    - A single CA or
    - A hierarchical list of CAs
        - Root, intermediate, and leaf CAs
- Registration authority (RA)
    - Identifies and authenticates the requester
    - Approves or rejects a certificate
        - Very important because everything is built on trust
    - Can also revoke certificates
    - Manages renewals and recreations of certificates
- Important certificate attributes
    - Common Name (CN) aka the domain name
    - Subject alternative name
        - Additional host names
    - Expiration
        - Tends to last about 13 months (or less)
- Key revocation
    - Certificate revocation list (CRL)
        - A list of revoked certificates
    - Many reasons to do this
        - Compromise, changing attributes, flaws, etc
- Getting revocation details to the browser
    - OCSP (Online certificate status protocol)
        - Allows the browsers to check is a certificate is revoked
    - Tends to be done via HTTP
    - Not all browser support this but most modern ones do

## [Certificate Formats]()

- Createfile file formats
    - X.509 format
    - Many ways to transfer these certs
    - And many different file formats
        - OpenSSL helps with this
- DER (Distinguished Encoding Rules)
    - A type of format for encoding
        - Binary format
    - Quite common for java applications
- PEM (Privacy enhanced Mail)
    - A very common format in Base64
        - Supported by many platforms including email
    - ASCII format so it is all letters and numbers
- PKCS #12
    - Good for sending many certificates at once
    - A standard for RFC
    - A container format
        - Usually sent as a .p12 or .pfx
        - Can be password protected
- CER (Certificate)
    - Primarily for Windows
        - Support Binary DER format or the ASCII PEM format
    - Usually contains the public key
        - The private is often better protected
    - Us Uses the .cer file
- PKCS #7
    - .p7b file
    - Stored in ASCII format
    - Contains certificates and certificates chains in this format
    - Wide support for it

## [Certificate Concepts]()

- Online and offline CAs
    - A compromised CA is VERY bad
    - Use load balancing via online and offline CAs
        - No one has access to the offline CA so that is can’t be breached
- OCSP stapling
    - Provides scalability for OCSP checks
        - See if a certificate is revoked or not
    - Is done locally
- Pinning
    - Put the certificate inside the application you are using and then compare that to what you see when the application connects to the server
        - A way to know if a server is legitimate
    - If the server is not legit than you decide what to do, showdown, show a message, etc
- PKI trust relationships
    - May only need one CA
    - More common to have a hierarchical system though for CAs
        - Limit the scope of an compromise
    - Mesh CA where they are all connected to and trust each other
        - Not good for scaling
    - Could also use a Web of Trust
        - Alternative to PKI where you sign certificates of people you know
    - Mutual authentication is another option
- Key escrow
    - Someone else hold unto the decryption keys
    - This can be a legitimate business arrangement
- Need a good process
    - It is all about processes and procedures when dealing with this sensitive data
    - You need to be able to trust the third party
        - They need to use good security
        - Carefully control access
- Certificate chaining
    - Chain of trust
        - List of all certs between the server and the root CA
    - Starts with your SSL certificate and ends with the Root CA
        - Anything between these two is a chain certificate
# 4.0
## [Reconnaissance Tools - Part 1]()

- Traceroute or tracert
    - Some systems may not reply to traceroute messages
    - Each OS may do this slightly differently
- NSlookup and Dig
    - Lookup information from DNS servers
    - dig is a newer command with many more features
- Ping
    - See if a device is online and working
- ifconfig and ipconfig
    - See ipv4 and ipv6 information for your device
    - ipconfig /all for more detail on Windows
- pathping
    - traceroute and ping in one command (for windows)
- netstat
    - Network stats
    - netstat -a shows all active connections
    - netstat -b for windows to show binaries
    - netstat -n just IP address, do not resolve names
- arp -a
    - Address resolution protocol to see the mac to IP address table
- Route
    - View the devices routing table
    - route print for windows
    - netstat -r for linux and mac

## [Reconnaissance Tools - Part 2]()

- curl
    - Client URL
    - Grab the raw data from a site (the source code in HTML)
        - Search through it, automate based on the data, etc
- IP scanners
    - Search a network for IP address and see what ports are open
    - Uses things like arp, ICMP requisitions, TCP ACK, ICMP timestamps, etc
    - Like nmap or hping
- hping
    - A ping command that send almost anything
        - hping3 —destpot 80 10.1.1.10
            - An example command
            - —scan to scan a certain port or port range
            - -v for verbose
    - Send crafted frames to your target
    - Can perform a DoS accidently so be careful
- nmap
    - A network mapper
    - Port scan, OS scan, service scan and more
    - Additional script via the NSE
- theHarvester
    - Gather OSINT or open source intelligence
        - Pretty automated
    - Scrap information from google and bing and websites
    - Can also do things like a DNS brute force
        - To find other running services
    - Can find things like IPs emails and hosts
- sn1per
    - Combine many recon tools into a single framework
    - Has both intrusive and non intrusive options
        - Can cause problems so be careful
- scanless
    - Run port scans from a different host so that it can't be traced back to you (done via a proxy)
    - Support for many different services and proxies
- dnsenum
    - Enumeration DNS information
        - Hosts and services can be found from doing this
    - Hosts may also be able to found from other searches like google index
    - Very intrusive
- Nessus
    - A leader in vulnerability scanning
        - Free and paid for options
    - A huge database of known vulnerabilities
    - Very good reporting and information that it can provide you
- Cuckoo
    - A sandbox for malware to test a file in a safe environment
    - A virtualized environment that be many different OS
    - Has lots of tracking and tracing features to show you what is happening

## [File Manipulation Tools]()

- cat
    - Read the file or link files together
    - cat file.txt
        - Read the file
    - cat file.txt 2file.txt > both.txt
        - Combine the two files into one that is called both.txt
- head
    - View the first part of a file
        - head [option] [file]
    - -n to tell it how many lines to show you
        - head -n 5 syslog
            - To see the first 5 lines of a file named syslog
- tail
    - View the last part of a file
    - The command works in the same way as the head command
- grep
    - Find text in a file
    - grep dragon passwords.txt
        - Find the word dragon in the file passwords.txt
- chmod
    - Change the mode of a file system object
    - r=read, w=write, x=execute
        - The first set of letter is for the user, the middle set is for the group and the final set if for others
        - so -rwx-r—r— would mean the user can do everything the group can read and others can read
- Logger
    - Add entries to the system log
    - logger “hello world”
        - Adds hello world to the logs

## [Shell and Script Environments]()

- SSH
    - Encrypted console communication
- Windows Powershell
    - Command line for sysadmins on Windows
    - Extends the normal command line function (cmdlets)
    - Good for automating processes
- Python
    - A general purpose scripting language
    - Works in almost any OS
        - Very popular and well supported
    - Good for automation but it can do a lot more as well
- OpenSSL
    - A toolkit and crypto library for SSL/TLS
    - Create and manage the certificates and CA
    - Manage digests and hashing functions
    - Encryption and decryption

## [Packet Tools]()

- Wireshark
    - Capture and view packets from the network
- TCP dump
    - Packet capture from the command line
    - Write this data to a file that could then be analyzed in something like wireshark
- tcpreplay
    - A suite of packet replay utilities
        - Send the traffic back out onto the network
    - Good for testing security devices

## [Forensic Tools]()

- dd command
    - Create a bit by bit copy of a drive
    - Create an image file and then restore from the image if you want
- memdump
    - Copy information from the system memory
    - Many other tools can read this file that is made
    - use things like netcat, stunnel or others to send the data to another host
- WinHex
    - A hexadecimal editor for Windows
    - Disk cloning, secure wipes and other things
- FTK imager
    - A drive imaging tool
    - Can mount and perform file utilizes on Windows
    - Can read encrypted drivers as well (if you have the key)
    - Can import to many types of formats
- Autopsy
    - View and recover data from storage devices
        - Shift through all of the data
    - Extract many different data types
- Exploitation frameworks
    - Pre built toolkits for explorations
        - Like metasploit
        - or SET (Social Engineer Toolkit)
    - Can add and remove different modules to keep the tools up to data
- Password crackers
    - Find the passwords with brute force attacks
    - Online or offline crackers
    - Takes a lot of time and resources to do
- Data sanitization
    - Completely remove the data on a driver (good for reselling or reusing drives)
        - If the data is very important you are better off just completely destroy the driver
    - Can be done with just one file, or the whole drives
        - Cannot be recovered

## [Incident Response Process]()

- Security incidents
    - Malware, DDoS, Data theft, users install software that makes your system vulnerable, etc
- Roles and responsibilities
    - Incident response team
        - Could have IT management team, Compliance officers, Technical staff, users, etc
- NIST 800-61 a document to help you understand incident response
    - Tell you about the entire lifecycle of a security incident
        - Preparation
        - Detection and analysis
        - Containment, Eradication and Recovery
        - Post incident Activity
    - Preparing for an incident
        - Make sure you have communication methods in place
        - hardware and software incident handling software and logs in place
        - Incident analysis resources
            - Documentation, diagrams, baselines, etc
        - Mitigation software
        - Policies for incident handling
    - Detection
        - Monitoring everything (can be very hard to do)
        - Precursors
            - A heads up that something is off
            - logs, exploit announcement telling you to update, direct threats from people or groups
        - Indicators
            - Show you that an attack is happening
            - IPS informing you of things
            - Antivirus software, host based monitor detection, FIM, network traffic monitoring, etc
    - Isolation and containment
        - Don't just let things run their course
            - Keep it from spreading
        - Sandboxes to keep it isolated
            - They aren’t perfect and some sandbox can tell if it is in a sandbox
    - Recovery
        - Get things back to normal
        - First get rid of the malware and vulnerabilities, may need to a complete system wipe and restore off a backup
        - Can take months to do
            - Need to have a good plan that is efficient
                - Do the small changes first
    - Lessons learned
        - Make notes of what worked and what did not work
        - Have a meeting with the people involved
        - Do this quickly so you don't forget what happened
        - Documentation
            - What happened and when it happened?
            - How did your response work?
            - What should you change for next time?
            - Indicators to look out for
            - etc

## [Incident Response Planning]()

- Exercise
    - Test yourself before an actual attack
    - Have rules of engagement to make sure the production network stays working
    - have a narrow focus for the attack
- Tabletop exercises
    - Perform a full scale drill and this can be costly and time consuming
        - Many of the issues are logistical issues, the issues can be found by talking not by physical attacks sometimes
    - Go through the proper responses and get everyone to talk about a simulated disaster
- Walkthrough
    - Actually step through what you would do if an incident occured
        - Everyone is involved
    - Finds actual faults and missing steps in your processes
- Simulation
    - Test with a simulated event
        - phishing, data breachers, etc
    - See who bites and who fails to response properly
        - Test your filters and other security devices to see if they can stop the attacks
- Stakeholder management
    - Keep a good relationship with the customers of IT
    - Most of this happens prior to the events happening
- Communication plan
    - Get a contact list in order and up to date
        - Management, CEO, IT team, HR, Legal department, etc
- Disaster recovery plan
    - Make sure IT is ready and can maintain uptime and keep the data available
    - Have a good recovery plan for every kind of disaster
- Continuity of operations planning (COOP)
    - What to do if your systems are disrupting and you cannot access things the normal way
    - You need an alternative to the technology that you normally use for your work
        - Should be documented and tested before you ever need it
- Incident response team
    - Receives, reviews and responses to incidents
    - Determine what time of incident is occurring and what response is needed
- Retention policies
    - Backup your data (offline, online, onsite, offsite, etc)
        - Needed for accidental deletion and disasters/attacks
    - Some orgs are required to stored some information for a certain amount of time
    - Recover the data when you need and prioritize the restoration

## [Attack Frameworks]()

- Attacks and reponses
    - You need to understand the attacks and how to best prevent and respond to them
- MITRE ATT&CK framework
    - Can view this entirely online
    - Determines the actions of an attacker
        - understand intrusions and how they occur
        - Help you to block the future attacks
- Diamond model of intrusion analysis
    - Understand intrusions
    - Appears simple but it is very complex in reality
    - Use the model to analyze and fill in the details
- Cyber Kill Chain
    - Seven phases of a cyber attack
        - A military concept
    1. Recon | Gathering intel
    2. Weaponization | payloads with exploits and backdoors
    3. Delivery | Sending the weapon
    4. Exploit | Execute code on the victim's system
    5. Installation | Install malware on the OS
    6. Command and Control | Creating a c2 channel for remote access
    7. Actions on objections | Remotely carry out other objectives

## [Vulnerability Scan Output]()

- Identify vulnerabilities
    - A scanner looks for known vulnerabilities
        - Can use resources online to learn about the vulnerabilities found
    - Some vulnerabilities are not definitely identified
        - Manually check to see if it is really vulnerable
- Scan results
    - Lack of security controls
        - Antivirus, firewall, anti-spyware, etc
    - Misconfigs
        - Open shares, guest access, etc
    - Real vulnerabilities
        - New ones and sometimes the old ones as well
            - Patch these
- False positives
    - A vulnerability that does not actual exists
- False negative
    - It exists but it does not get reported
    - Much worse than a false positive
    - Keep your scanners up to date to try and prevent this

## [SIEM Dashboards]()

- Security information and event management
    - Centralized logging
    - Many types of data in one pace
- Gather the logs from many devices
    - Use syslog to send the logs to the SIEM
- See trends in the data over long periods of time
    - Make alerts based on this data

## [Log Files]()

- Lots of logs from lots of different devices
    - Security events and other things are always being monitored
    - Need to be able to filter through the logs
- Application logs
    - Windows | Event Viewer
    - Linux or MacOS | /var/log
    - View them on the system or bring them into a SIEM
- Security log files
    - Show traffic flows, attempted exploits, blocked traffic, DNS sinkhole traffic, etc
        - Captured via IPS, firewalls or proxies
- Web logs
    - Who accessed the server and what they viewed
        - What errors the user saw
        - Exploit attempts
    - Server activity and more
- DNS logs
    - Lookup requests
    - Requests about bad URLs
        - Block or modify known bad requests
- Authentication logs
    - Know who logged in, or who failed to log in
        - Identify many failures and brute force attempts
    - Correlate with other logs and events
- Dump files
    - Store all contents of memory into an file
        - Easy to do in Windows Task manager
    - Some applications have their own methods of making dump files
- VoIP and call manager logs
    - Inbound and outbound call information
    - Security information
        - Authentication and other things
    - SIP traffic logs

## [Log Management]()

- Syslog
    - The standard for message logging across all devices
    - Sends the logs to a SIEM
    - Some different versions like Rsyslog, syslog-ng, NXlog, etc
- Journalctl
    - Linux has quite a lot of logs
    - Syslog logs are stored in a standard format in binary
        - Journalctl allows you read these files
- Bandwidth monitors
    - Percentage of the usage overtime
        - Can be gathered through SNMP, Netflow, sFlow, etc
- Metadata
    - Data the describes other data sources
        - Like the location data in a photo file
        - or OS, IP, Headers, addresses, browser type, etc
- Netflow
    - Gather network stats from all traffic flows
        - Centralized unto a NetFlow server
    - A common standard with wide support
    - Probe watches the network communication and then sends the record to the collector
    - Tons of reporting options on the collector
- IPFIX
    - IP flow information export
    - A newer version of NetFlow
    - Lots of data support
        - Allow you to customized what type of data the collectors receive
- sFlow
    - sampled Flow
        - Only a port of the actual network traffic
    - Usually built into the infrastructure devices
        - Switches, routers, etc
    - Still gives you pretty accurate statistics
- Protocol analyzer output
    - Solver complex application issues and get detailed results
        - Like wireshark
    - They capture every packet so you can see everything and filter it to see what you really need

## [Endpoint Security Configuration]()

- The endpoint
    - The end user device
    - Many ways that they can be exploited
    - You need to monitor these devices and keep them safe and secure
- Application allow and deny lists
    - Any application can be dangerous
    - Allow list
        - Only the allowed application work
    - Deny list
        - Certain untrusted applications are not allowed
    - Quarantine
        - Anything sus goes there for further analysis
- Examples of approve lists
    - Can be done via checking to see hashes match before launching an application
    - Have a digital signature from certain publishers be allowed or disallowed
    - Only run software in these folders
    - Allow or deny based on the network zone

## [Security Configurations]()

- Configuration changes
    - Firewall rules
        - Manage application flows
    - MDM
        - Enable or disable phone functionality
    - DLP
        - Block the transfer of sensitive data through the network
    - Content filtering / URL filter
        - Limit access to untrusted sites
        - Real time blocking of malicious sites
    - Updating and revoking certificates
        - Manage certificates and the access devices have via the certificates
- Isolation
    - Isolate a device or software from everything else
    - Keep untrusted or infected devices away from the rest of the network
    - Process isolation
        - If a certain process is sus, block that communicating to the network
        - Can place devices on isolated VLAN
- Containment
    - Prevent the software from having anywhere to go
        - Place application in their own sandbox so they cannot affect each other
    - Can be reactive and contain suspicious activity or infected systems/applications
- Segmentation
    - Separate the network to prevent people from access things that they do not need access too
- SOAR
    - Security Orchestration, automation and response
        - Make security teams and changes more effective via automation
    - Runbooks
        - A checklists of steps to perform a certain task
            - A step by step approach to automation
    - Playbooks
        - Conditional steps to follow, a broad process

## [Digital Forensics]()

- Collect and protecting information from a security event
- 3 phases
    - Acquisition, analysis, and reporting
- Legal hold
    - A legal technique to preserve certain information
        - Can ask for many types of information
    - Can last any amount of time
- Capture video
    - A recording of an important event
        - Desktop recording or cameras
    - Reference it later
- Admissibility
    - Not all data can be used in the Court of law
        - Varies from location to location
    - Make sure you are authorized to gather the information needed
    - Use the proper procedures and tool for gathering
- Chain of custody
    - Make sure you know who held the evidence and when they had it
    - Everything into a central database and make sure it has integrity
- Recording time offsets
    - Know what timezone you are in so you can link the timeline of things
        - Timpstamps could be local files or in a certain timezone
    - The OS may have a time offset set manually that is not accurate to the actual timezone
        - Daylight savings is also something to look for
- Event logs
    - Tons of information
    - Export them and reference them later
- Interviews
    - Have the users tell you what they know about a situation
        - Not 100% accurate
    - Document this as soon as possible
- Reports
    - Document all of your findings
    - Include things like a summary, detailed explanation of how you got the data and what that data tells you

## [Forensics Data Acquisition]()

- Order of volatility
    - How long does the data stick around?
    - Gather that data that is going to be gone soon first
- Disk
    - Copy everything from the disk
    - Prepare the drive to be imaged
        - Connect it to an imaging device
        - Copy everything, bit by bit
- RAM
    - Hard to gather information from the RAM
    - Some tools can help with memory dumps
        - Capture all of the data in the RAM
    - Can have important data that is not on a storage drive
- Swap/pagefile
    - Temporary files
    - A place to store RAM when memory is full
        - Removed when it is no longer needed
    - Like an extension of a memory dump
- OS
    - OS files can tell you a lot, they could be modified
    - If they are modified this can tell you quite a lot about a security event
    - Logs, open ports, current processes and more can also tell you quite a lot
- Device
    - Harder to recover data from mobile devices but can still be done
    - Image the device via USB
        - Gather lots of data
- Fireware
    - If the firmware has been modified it can tell about the security event that happened
        - Compare to a known good firmware
    - Understand how the device was exploited and what did the attack do
- Snapshot
    - Mostly for VMs
        - A imaging of a virtual machine
    - Basically like backups of the VM, can give you quite a lot of information
- Cache
    - Store data for use later
        - Temporary storage
        - Can last any amount of time
    - Contain specialized data for a certain process
    - Allows you to look at the cache instead of the original service for an answer
        - Makes things quicker
- Network
    - Connections and packet captures
    - May be able to see everything that was sent across the network
- Artifacts
    - Digital items left behind
        - Logs, flash memory, cache files, recycle bin, little bits found everywhere

## [On-Premises vs. Cloud Forensics]()

- Forensics in the cloud
    - Adds complexity and makes things more challenging
        - Things are not completely in your control
    - Hard to match the data to a user
    - May be extra rules that you have to follow
- Right to audit clauses
    - Make an agreement on how you can access the data
    - Make sure to keep the data safe even though it is not in your data center
        - Make sure you know how it is being protected
    - Make a contract to agree how audits should work
- Regulatory/jurisdiction
    - The legal world doesn’t know how to deal with cloud tech very well
        - Make sure you have a good legal team
    - Laws very from place to place a lot
        - The data may not even be in the same country
- Data breach notification laws
    - You may be forced to inform users that their data has been breached based on your location
    - The requirements for these notifications may vary from place to place

## [Managing Evidence]()

- Integrity
    - Via hashing, checksums (simple), Provenance (documentation of where the data came from)
- Preservation
    - Handle the evidence properly
    - Manage the collection process
        - Work off of copies not the original
    - Can be quite complicated
    - Make sure the data can be admissible in court if needed
- E-discovery
    - Electronic discovery
        - Gathering the data required by the legal process
    - Works together with digital forensics
- Data recovery
    - Extract the data without affect integrity and gather as much as possible
    - Can be difficult
        - Damage, deleted files, corruption, etc makes things harder
- Non-repudiate 
    - Proof of data integrity and the origin of the data
        - High confidence that you are right on who send the data
    - Provided via Message Authentication Codes (MAC) or Digital signatures
- Strategic intelligence/Counterintelligence
    - Focuses on a certain domain and gathering information on it
        - Gathered from many sources
    - Tracking lots of data and trends
    - Strategic counterintelligence (CI) is when you are trying to prevent people from gathering intelligence on you and your organization
# 5.0
## [Security Controls]()

- Security controls
    - Many security risks are out there and you need to prevent them as best you can
    - Limit impact and damage of events as well
- Managerial controls
    - Focuses on the design of security and the policies of security
- Operational controls
    - Managed by people
    - Like user awareness and security guards
- Technical controls
    - IPS, antiviruses, firewalls, etc
- Control types
    - Preventive
        - Door lock, guard, firewall, etc
    - Detective
        - Detect and record but may not prevent
        - Motion detection, IDS, etc
    - Corrective
        - Mitigate damage from a security event
        - IPS, backups, etc
    - Deterrent
        - Does not stop access but discourages it
        - warning signs, lights, login banner warning you of logging
    - Compensating
        - Tries to recovery from an attack
        - Hot sites, backup power, etc
    - Physical
        - Fences, locks, mantraps, etc

## [Security Regulations and Standards]()

- Compliance
    - Meeting the standards of the laws, policies and regulations
    - Regulations can be dealing with many types of data and processes
    - There can be fines and other penalties for failing to meet compliance
- GDOR (General Data Protection Regulation)
    - EU regulation
    - Allows the EU to control what happens to EU citizens information
        - The data does not leave the EU and you have control over where and how the data is stored
    - Every website is forced to give you detailed information on their privacy policy
- PCI DSS
    - A standard for protecting credit cards
    - 6 control objectives
        - Build and maintain a secure network and systems
        - Protect cardholder data
        - Maintain a vulnerability management program
        - Implement strong access control measures
        - Regularly monitor and test networks
        - Maintain an information security policy

## [Security Frameworks]()

- Security Frameworks
    - Where do you even start?
        - A guideline to provide you with some of this information
    - You may need to make modifications to the framework to make it suit your needs
- Center for Internet Security (CIS)
    - Critial Security Controls (CIS CSC)
    - Helps you to improve your cyber defenses
        - Has 20 key actions
    - Written by IT professionals and has practical information
- NIST RMF
    - Used by the US government agencies
    - 6 different steps
        1. Categorize - Define the environment
        2. Select - Pick appropriate controls
        3. Implement - Define proper implementation
        4. Assess - Determine if controls are working
        5. Authorize - Make a decision to authorize a system
        6. Monitor - Check for ongoing compliance 
- NIST CSF
    - A voluntary commercial framework
    - Contains a framework core
        - Identify, Protect, Detect, Response and Recover
    - Framework Implementation Tiers
        - A view of cybersecurity risk and processes to manage the risks
    - Framework profile
        - Policies, guidelines and standards are applied to the implementations
- ISO IEC
    - International level framework
        - Very detailed standards
    - ISO IEC 27001
        - Standard for an Information Security Management System (ISMS)
    - ISO IEC 27002
        - Code of practice for information security controls
    - ISO IEC 27701
        - Privacy Information Management Systems (PIMS)
    - ISO 31000
        - International standard for risk management practices
- SSAE SOC 2 Type I/II
    - An auditing standard SSAE 18
    - Suite of reports created during this is called the SOE 2
    - Type I audit tests controls in place a certain point in time
    - Type II audit tests controls over a period of at least six months
- Cloud Security alliance (CSA)
    - Security in the cloud org
    - Made the Cloud Controls Matrix (CCM)
        - Cloud specific security controls that are mapped to standards, best practices and regulations
    - Provides methodology and tools to help you along the way

## [Security Configurations]()

- Secure Configurations
    - No system is secure without them
    - There are lots of hardening guides out there to help you
- Web server handling
    - Access a server with your browser
    - Publicly facing devices have huge concern for data leaks and server access
        - Make need to add banner information and disable directory browsing among other things to try and prevent this
        - Configure permissions properly and configure SSL will also keep things safer
- OS hardening
    - Many types of OS so this can get difficult and you will need to use many different guides
    - Keep things up to date and patched
    - Configure good password policies and user account permissions
    - Network access and security controls
    - Monitoring and content reporting
- Application server
    - Disable all unnecessary services
    - Keep the OS and other things up to date
    - Configure file permissions and access controls properly
- Network infrastructure devices
    - Authentication, don't use the defaults
    - Check with manufacturer for security updates
        - Doesn’t happen often

## [Personnel Security]()

- AUP
    - How should you use company assets?
- Business policies
    - Job rotation
        - No one maintains control for a long period of time
    - Mandatory vacations
        - Rotate others through the job
        - Make sure things are working as normal
    - Separation of duties
        - Split the knowledge so no one knows everything
            - One person knows half of the safe combinations and another person has the other half
        - Dual control
            - Two people must be present to do something
                - two keys
    - Clean desk policy
        - When you leave, nothing is on your desk in the open
- Least privilege
    - Don't give people privilege that they don't need
        - Only give the minimum required for them to perform their job functions
    - Also limits how malware can affect the system, limited it
- Background checks
    - Screening before you are employed
    - Vary a lot from country to country
    - Adverse action
        - You are not hired because of the background check results
- NDA
    - Limit the amount of information that you can share
- Social media analysis
    - Gather data from social media to understand more about your present on the internet
    - Can be used to make an hiring decision
- On-boarding
    - Agreements need to be signed
        - AUP and others
    - Accounts need to be made
    - Hardware will need to be provided if they don't have one
- Off-boarding
    - Should be pre planned
    - What happens to the hardware? accounts? data they have been using?
        - Often disable accounts but not delete them
- User training
    - Capture the flag is quite common for security training
    - Phishing simulations
        - See who bites and may need extra training
    - Computer based training (CBT)
        - Video, audio and Q&A on your own time
- Role based security awareness training
    - Train before giving access
    - Very specialized training
        - Can apply to third party contractors, vendors, and partners
    - Detailed records of who received the training

## [Third-party Risk Management]()

- Vendors
    - Important company data is often shared
    - Perform a risk assessment on providing that data to the vendor
    - Use contracts for a clear understanding of the security requirements
- Supply chain
    - Do a supply chain assessment
        - Understand the security risks of the supply chain
        - Try to improve the security of the supply chain if needed
- Business partners
    - Closer than a vendor, may even be direct links to the partner
    - Make sure communication happens over a trusted connection
        - Monitor it
    - Policies should be in place to handle risks involved in this
        - Include additional security between partners
            - Like firewall
- Common Agreements
    - SLA
        - Sets the service terms for a certain service or product
    - MOU
        - Agreements with a third party that don't need a full blown contract
        - Understanding what the requirements for a business process is
    - Measurement system analysis (MSA)
        - Evaluate and assess the quality of the measurement systems
        - Don't make decisions on incorrect data!
    - Business Partnership Agreement (BPA)
        - Going into business together and all the agreements that go along with that
    - NDA
        - Keep things secret
        - Can be one way or both ways
- Product support lifetime
    - End of Life (EOL)
        - Stop selling a product that you were using
    - End of service life (EOSL)
        - Stop supporting a product
        - No more patches and updates

## [Managing Data]()

- Data governance
    - Rules, processes and accountability for the data
    - Data steward is the person the manages the data governance
    - Formal rules for how this data is managed and should be used
- Data classification
    - Identify data types
        - Personal data, public information, restricted, etc
        - Make sure the data is used and secured properly
        - Compliance laws may need to be followed
- Data retention
    - Keep files that change often for version control
        - Safe the different versions of a single file
    - Good for helping you recover from a virus infection and other attacks
    - Often legal requirements for how long you need to store data

## [Credential Policies]()

- Credential management
    - Stands between the data and the outside world
    - Passwords should NOT be embedded in the application
        - Not secure at all, the passwords should be on the server instead
    - Communication should be encrypted
- Personnel accounts
    - Everyone should have their own account and no one else should be able to access said account
    - Storage and files can be private to that user
    - Normal user accounts should not have privileges access
        - No access that they do not need
    - The default and most common account type
- Third party accounts
    - Access to external third party systems
        - Things like cloud access
    - Or external people access your internal network
    - 2FA is good for this
    - Audit the third parties to make sure things are secure
- Device accounts
    - Access to devices
    - Device certificates would identify trusted devices
        - Manage this through a MDM
    - Additional security can be added
        - Like GPS based checks and tying a device with a user
- Service accounts
    - Accounts used by the services to access the data that they need
        - You don't see these accounts
    - Only give the service the access that they need and nothing more
    - Make sure you have good password policies in place for these accounts as well
- Admin and Root accounts
    - Elevated access to one or more systems on the network
        - Access and change everything
    - Needs to be carefully protected and only use these accounts when needed

## [Organizational Policies]()

- Change management
    - How should you make a change?
    - Changes can cause lots of issues and downtime if not done properly
    - Have clear policies on how changes are to be made and when they should be made
        - Back a fallback plan if something goes wrong
- Change control
    - The formal process for managing change
    - Use the process for any and all changes
        - Know the risk associated with the change
        - Make a plan for the change before going ahead and doing it
            - Get approval for the change
            - Know what to do if things go wrong
        - Document everything
- Asset management
    - Identify and tracking assets
        - Often automated
    - Helpful for looking into a security problem among other things
    - Track both hardware and data
        - Even track licenses
    - Verify that everything is up to date and patched

## [Risk Management Types]()

- Risk management
    - Identify all of the assets that could be affected by an attack
    - Identify the threats and what the results of those threats could be
        - Also determine the severity of the risk
- Risk assessments
    - External threats
    - Internal threats
    - Legacy and outdated systems that are not well protected and patched
- Multi party risk
    - Breaches involving multiple parties
        - Happens when your network is connected to other orgs networks in some way
    - Can be quite bad and have a huge impact
- Risks assessments
    - Intellectual property theft
        - Can happen through many ways and can cause quite a lot of issues
    - Software compliance and licensing
        - Don’t have too few or too many licensing
        - Financial risk and legal risk if things are not done properly
- Risk management strategies
    - Acceptance
        - Stay where you are and do not make changes
    - Risk avoidance
        - Stop participating in high risk activity
    - Transference
        - Buy cyber security insurance
    - Mitigation
        - Decrease the risk

## [Risk Analysis]()

- Evaluating risk
    - Risk register
        - Identify and document the risk associated with each step of a process
        - Also monitor results of risks
    - Risk heat map
        - Visually determine the risk assessment
- Audit risk model
    - Inherent risk
        - Risk that exists in absence of controls
    - Residual risk
        - Inherent risk + control effectiveness
        - Risk that still exists after controls are considered
    - Risk appetite
        - The amount of risk an org is willing to take
- Risk control assessment
    - The risk has been determined
    - Now build requirements for these risks
        - Find the gaps in the security
    - Build and maintain security systems based on the requirements
    - See if controls are compliant or non compliant
- Risk awareness
    - Always changing and you need to keep up to date
    - You need as much knowledge as possible about these risks and how to deal with them
    - Maintain awareness for users and other groups in your orgs
- Regulations that affect risk posture
    - Tons of regulations for cybersecurity
    - HIPAA is a health care regulation that can relate to IT as well
    - GDPR
        - EU data protection and privacy
- Qualitative risk assessment
    - Ask opinions of others about the significance of a risk and display visually how risky things might be
- Quantitative risk assessment
    - Takes into account the likelihood, how much money would be lost, and other factors to see how bad a risk would be
    - Do you add more controls or not based on the data you compiled?
- Disaster types
    - Environmental threats
    - Person made threats
    - Can be internal or external

## [Business Impact Analysis]()

- Recovery
    - Recovery time objective (RTO)
        - How long will it take to get up and running to a certain level
            - Not necessarily a complete recovery time
    - Recovery point objective (RPO)
        - What requirements do you need to get up and running?
        - What level of service is acceptable
    - Mean time to repair (MTTR)
        - How long does it normally take to fix an issue
    - Mean time between failures (MTBF)
        - How long between failures?
- Functional recovery plans
    - Step by step guide to get back up and running
    - Has things like contact information on it as well
    - Need to know the technical process to resolve the problem
    - Test the system to make sure it actual working properly when you are done with the fix
- Removing single points of failure
    - Need redundancy
        - Physical duplicates and backups
        - Backup power system
        - Backup personnel and location
    - Can't remove all single points of failure very well
        - Can cost lots of time and money
- Disaster recovery plan (DRP)
    - Detailed plan for resuming operations after a disaster
        - For many types of disasters
    - Lots of planning prior to disasters needed
        - Backups, cloud alternatives, remote sites, etc
    - Third party options can work as well
- Impact
    - Life and wellbeing of employees
    - Property and risk to assets
    - Safety
    - Fiance
    - Reputation
- Mission essential functions
    - What functions are most important to the organization
        - What should you get up and running first?
    - What are the most important technical resources and functions?
- Site risk assessment
    - Recovery plans should consider the environments that you are dealing with

## [Privacy and Data Breaches]()

- Information life cycle
    - Creation and receipt
    - Distribution
    - Use
    - Maintenance
    - Disposition
- Consequences (of data breaches)
    - Reputation damage
    - Identity theft and other private information theft
    - Fines or lawsuits
    - Stealing company secrets
- Notification
    - Internal escalation process
        - External escalation process may be needed if you need more help
    - Public notifications and disclosures
- Privacy impact assessment (PIA)
    - Almost anything can affect privacy
    - Privacy risk need to be identified in each initiative
    - Fix the privacy concerns before they are actually an issue
- Notices
    - Terms of service
        - Can show you how a company is handling data
    - Privacy notice and privacy policies
        - Tells you how a company is handling the sensitive information of its customers

## [Data Classifications]()

- Labeling sensitive data
    - Not all data has the same level of sensitivity
    - Different levels need different security and handling methods
- Data classifications
    - Proprietary
        - The property of an org and important
    - PII Personally identifiable information
        - Tied to a certain person | name, phone number, etc
    - PHI Protected Health information
        - Personal health information
    - Public / unclassified
        - Anyone can see it
    - Private, Classified, etc
        - Only some people can access it
        - May need an NDA
    - Sensitive
        - PII, PHI, etc
    - Confidential
        - Very sensitive, must be approved to view
    - Critical
        - VERY important
        - Could be publically available or kept very secret
    - Financial information
        - Internal company information
    - Government data
        - Can be open that anyone can view
        - Not all government is like this but a lot of it is
    - Customer data
        - Legal handling requirements come with this type of data

## [Enhancing Privacy]()

- Tokenization
    - Replace sensitive data with a placeholder
    - Common for credit cards
    - Can't get the original number back from the tokenization
        - Not encryption or hashing
        - Token can change every time it is used
- Data minimization
    - Minimal data collection
    - Only collect what you really need
    - Only have access to what you need for a certain task
- Data masking
    - Show the data exists without letting you see any of it
    - Replace credit card info or passwords with ***** or other things
        - Or many other ways to do this
- Anonymizations
    - Make it impossible to identify individual data from a dataset
        - Via hashing, masking, etc
    - Can be done with some data but not all of it
    - Cannot be reversed once the information is anonymized
- Pseudo anonymization
    - Reversible if needed for other processes
    - Can be done via random replacement
        - Change the name of a person to a random name each time it is accessed, etc
    - Consistent replacements
        - This name will always = this name

## [Data Roles and Responsibilities]()

- Data responsibilities
    - Data owner
        - Someone that owns a certain set of data and is responsible for it
- Data roles
    - Data controller
        - Responsible for the purposes and means of which the data is processes
    - Data processor
        - Processes data on behalf of the data controller
    - Data custodians or stewards
        - Responsible for data accuracy, privacy and security
        - Deal with compliance, security controls, labels for the data and much more
    - Data protection officer (DPO)
        - Responsible for the overall organization's data privacy
        - Sets the policies and procedures

Security-Plus-Notes

Security-Plus-Notes 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Security-Plus-Notes

Security-Plus-Notes 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README