List at least five connectivity methods., Cellular, Wi‐Fi, Bluetooth, NFC, RFID, Infrared, GPS, USB, What is RFID?, RFID (Radio Frequency Identification) is a relatively short range (from less than a foot of some passive tags to about 100 meters for active tags) wireless technology that uses a tag and a receiver to exchange information., How do organizations determine where to place access points to handle poor coverage areas?, They conduct site surveys and create heat maps showing where coverage is relative to existing access points., Name four common mobile device deployment and management models., BYOD (bring your own device), CYOD (choose your own device) COPE (Corporate owned, personally enabled), and corporate owned, What are two different techniques to ensure that the system is secure that modern UEFI firmware can leverage?, Secure boot ensures that the system boots using only software that the original equipment manufacturer (OEM) trusts. Measured boot is intended to help prevent boot‐level malware. Measured boot processes measure each component, starting with the firmware and ending with the boot start drivers., List and explain three major types of authentication in modern Wi‐Fi networks., Open networks do not require authentication or use encryption and often use a captive portal to information from users. Preshared keys (PSK) require that a passphrase or key is shared with anybody who wants to use the network and provides encryption. Enterprise authentication relies on a RADIUS server and utilizes an EAP protocol for authentication., What is the function of input validation?, Input validation helps prevent a wide range of problems, from cross‐site scripting (XSS) to SQL injection (SQLi) attacks., What are access restrictions?, Access restrictions are security measures that limit the ability of individuals or systems to access sensitive information or resources., What are two major usage modes provided by WPA3?, WPA‐Personal uses Simultaneous Authentication of Equals (SAE) mode to provide authentication while protecting against offline dictionary attacks. This allows clients to authenticate without an authentication server infrastructure. The other is WPA‐Enterprise, which relies on a RADIUS authentication server as part of an 802.1X implementation for authentication. This means users can have unique credentials and can be individually identified., What steps can be used to assess embedded systems?, Identify the manufacturer. Determine how the embedded system interfaces with the world. Identify services and their security. Check for patches and patch availability. Document response and support processes., Give three examples of features that an organization may want or need to ensure that mobile devices and the data they contain are secure., Application management Content management. Remote wipe Geolocation and geofencing Screen locks, passwords, and PINs are all part of normal device security models to prevent unauthorized access. Biometrics Context‐aware authentication Containerization is an increasingly common solution to handling separation of work and personal use contexts on devices. Storage segmentation can be used to keep personal and business data separate as well. Full‐device encryption (FDE), What are three phases of a baseline’s life cycle?, Establishing a baseline, deploying the security baseline, and maintaining the baseline, What is static code analysis and what is dynamic code analysis?, Static code analysis (sometimes called source code analysis) is conducted by reviewing the code for an application. Static analysis does not run the program, instead it focuses on understanding how the program is written and what the code is intended to do. Dynamic code analysis relies on execution of the code while providing it with input to test the software., What security constraints do you need to take into account when you consider security for embedded systems?, The overall computational power and capacity of embedded systems is usually much lower than a traditional PC or mobile device; embedded systems may not connect to a network; without network connectivity, CPU and memory capacity, and other elements, authentication is also likely to be impossible; and embedded systems may be very low cost, but many are effectively very high cost because they are a component in a larger industrial or specialized device., What are two types of access restrictions?, Geographic restrictions and permission restrictions, Name four code deployment environments., Development environment, test environment, staging environment, and production environment, Give some types of configuration settings recommended by CIS benchmark for Windows., Setting the password history to remember 24 or more passwords and setting maximum passwords age to “60 or fewer days, but not 0,” preventing users from simply changing their passwords 24 times to get back to the same password while requiring password changes every 2 months. Setting the minimum password length to 14 or more characters. Requiring password complexity. Disabling the storage of passwords using reversible encryption, Organizations that want to determine what software and configurations are used on mobile devices should deploy what type of solution?, Mobile device management (MDM), Explain parameterized queries., Parameterized queries offer another technique to protect applications against injection attacks., How do developers provide a way to confirm the authenticity of their code to end users?, Through code signing. Developers digitally sign their code with their own private key and then browsers can use the developer’s public key to verify that signature and ensure that the code is legitimate and was not modified by unauthorized individuals., What is sandboxing?, The practice of running an application in a controlled or isolated environment to prevent it from interacting negatively with other system resources or applications., What do you call a network run over standard Internet connections but using multiple layers of encryption to provide anonymous communication?, Dark web, Name the three techniques used by application testing and explain their differences., Static testing (analyzes code without executing it), dynamic testing (executes code as part of the test, running all the interfaces that the code exposes to the user with a variety of inputs, searching for vulnerabilities), and interactive testing (combines static and dynamic testing, analyzing the source code while testers interact with the application through exposed interfaces)., What are the benefits of penetration testing?, Penetration testing provides us with knowledge that we can’t obtain elsewhere; in the event that attackers are successful, penetration testing provides us with an important blueprint for remediation; and penetration tests can provide us with essential, focused information on specific attack targets., List all eight CVSS metrics and describe what kinds of measurements they evaluate., The eight Common Vulnerability Scoring System (CVSS) metrics are attack vector metric, attack complexity metric, privileges required metric, user interaction metric, confidentiality metric, integrity metric, availability metric, and scope metric. The first four measures evaluate the exploitability of the vulnerability, whereas the next three evaluate the impact of the vulnerability. The eighth metric discusses the scope of the vulnerability., Give some examples of controls that might affect scan results., Firewall settings, network segmentation, intrusion detection systems (IDSs), intrusion prevention systems (IPSs), What information does the output section provide on the report?, The output section of the report shows the detailed information returned by the remote system when probed for the vulnerability, including the name of the vulnerability, overall severity, detailed description, solution, references, port/hosts, vulnerability information, and risk information., Name five factors that influence how often an organization decides to conduct vulnerability scans against its systems., Risk appetite, regulatory requirements, technical constraints, business constraints, licensing limitations, How do you calculate the exploitability score for a vulnerability under CVSS?, Exploitability = 8.22 × AttackVector × AttackComplexity × PrivilegesRequired × UserInteraction, Explain true positive, false positive, true negative, and false negative, When a vulnerability scanner reports a vulnerability, this is known as a positive report. This report may either be accurate (a true positive report) or inaccurate (a false positive report). Similarly, when a scanner reports that a vulnerability is not present, this is a negative report. The negative report may either be accurate (a true negative report) or inaccurate (a false negative report)., How do you calculate the impact score for a vulnerability under CVSS?, Impact score = the value of the scope metric * ISS, What are the three major components of a security assessment?, Security tests, security assessments, and security audits, What information does the port/hosts section provide on the report?, The port/hosts section provides details on the server(s) that contain the vulnerability as well as the specific services on that server that have the vulnerability., What does the following CVSS vector mean? CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, Attack VectorNetwork (score0.85); Attack ComplexityLow (score0.77); Privileges RequiredNone (score0.85); User InteractionNone (score0.85); ScopeUnchanged; ConfidentialityHigh (score0.56); IntegrityNone (score0.00); AvailabilityNone (score0.00)., What is the function to calculate the impact sub‐score?, ISS = 1 – [(1 – Confidentiality) × (1 – Integrity) × (1 – Availability)], How do you calculate the CVSS base score for a vulnerability?, If the impact is 0, the base score is 0. If the scope metric is Unchanged, calculate the base score by adding together the impact and exploitability scores. If the scope metric is Changed, calculate the base score by adding together the impact and exploitability scores and multiplying the result by 1.08. The highest possible base score is 10. If the calculated value is greater than 10, set the base score to 10., Give three valuable information sources for reconciling scan results., Log reviews from servers, applications, network devices, and other sources that might contain information about possible attempts to exploit detected vulnerabilities; security information and event management (SIEM) systems that correlate log entries from multiple sources and provide actionable intelligence; and configuration management systems that provide information on the operating system and applications installed on a system., Name some sources you can use when you build your threat research toolkit., Vendor security information websites, vulnerability and threat feeds from vendors, government agencies, and private organizations, academic journals and technical publications, professional conferences and local industry group meetings, and social media accounts of prominent security professionals, What are four types of information‐gathering tools included in the Security+ exam outline?, Honeypots are configured to appear to be vulnerable and are heavily instrumented to record what an attacker does. Honeynets are networks set up to collect information about network attacks. A honeyfile is an intentionally attractive file that contains unique, detectable data that is left in an area for attackers to take. Honeytokens are data intended to be attractive to attackers used to allow security professionals to track data., What do you call a geographic view of threat intelligence?, A threat map., What is open source threat intelligence?, Open source threat intelligence is threat intelligence that is acquired from publicly available sources., What is threat intelligence?, Threat intelligence is the set of activities and resources available to cybersecurity professionals seeking to learn about changes in the threat environment., What are three common questions that come into play when we assess a threat intelligence source or a specific threat intelligence notification?, Is it timely? Is the information accurate? Is the information relevant?, What does establishing rules of engagement do?, Establishing rules of engagement helps define the boundaries within which the vendor should operate. They normally include setting clear communication protocols, defining responsibilities, and establishing processes for issue resolution., Name seven elements in the security information and event management system., SIEM dashboard, sensors, sensitivity and threshold, trends, alerts and alarms, correlation and analysis, rules., What are the three common detection methods to identify unwanted and potentially malicious traffic?, Signature-based, Heuristic-based/Behavior-based, and Anomaly-based. Signature‐based detections rely on a known hash or signature matching to detect a threat. Heuristic or behavior‐based detections look for specific patterns or sets of actions that match threat behaviors. Anomaly‐based detections establish a baseline for an organization or network and then flags when out‐of‐the‐ordinary behavior occurs., What are the differences between stateless firewalls and stateful firewalls?, Stateless firewalls (sometimes called packet filters) filter every packet based on data like the source and destination IP and port, the protocol, and other information that can be gleaned from the packet’s headers, whereas stateful firewalls (sometimes called dynamic packet filters) pay attention to the state of traffic between systems., Name two different environments that DLP systems work in., Agent‐based DLP and agentless DLP, What is DLP and what can it do?, DLP is data loss prevention. DLP systems help organizations enforce information handling policies and procedures to prevent data loss and theft., Describe key elements of DLP., Key elements of data loss prevention (DLP) systems are the ability to classify data so that organizations know which data should be protected; data labeling or tagging functions, to support classification and management practices; policy management and enforcement functions used to manage data to the standards set by the organization; and monitoring and reporting capabilities, to quickly notify administrators or security practitioners about issues or potential problems., Name two mechanisms of action of DLP systems., Pattern matching and watermarking, Describe EDR., Endpoint detection and response (EDR) tools combine monitoring capabilities on endpoint devices and systems using a client or software agent with network monitoring and log analysis capabilities to collect, correlate, and analyze events. Key features of EDR systems are the ability to search and explore the collected data and to use it for investigations as well as the ability to detect suspicious data., Describe the functions of DKIM, SPF, and DMARC in protecting email., DomainKeys Identified Mail (DKIM) allows organizations to add content to messages to identify them as being from their domain. Sender Policy Framework (SPF) allows organizations to publish a list of their authorized email servers. SPF records specify which systems are allowed to send email from that domain. Domain‐based Message Authentication, Reporting and Conformance (DMARC) is a protocol that uses SPF and DKIM to determine if an email message is authentic., List four types of protocol‐level protections., Loop prevention, broadcast storm prevention, bridge protocol data unit (BPDU) guard, and Dynamic Host Configuration Protocol (DHCP) snooping, List three common biometric technologies., Fingerprints, retina scanning, iris recognition; facial recognition; voice recognition; vein recognition, and gait analysis, List five common ways to assert or claim an identity., Usernames, certificates, tokens, SSH keys, and smart cards., What principle says that individuals should only be granted the minimum set of permissions necessary to carry out their job functions?, The principle of least privilege says that individuals should only be granted the minimum set of permissions necessary to carry out their job functions., Name at least three authentication technologies., Extensible Authentication Protocol (EAP), Challenge Handshake Authentication Protocol (CHAP), Password Authentication Protocol (PAP), 802.1X, Remote Authentication Dial‐In User Service (RADIUS), Terminal Access Controller Access Control System Plus (TACACS+), and Kerberos, What are two primary models for generation of one‐time passwords?, TOTP, or time‐based one‐time passwords and HMAC‐based one‐time password (HOTP), What are password vaults?, Software solutions that store, manage, and secure passwords and other information, allowing users to use strong passwords without memorizing dozens, or hundreds, of individual complex passwords., List common account types used for Windows systems., User accounts; privileged or administrative accounts; shared and generic accounts or credentials; guest accounts; and service accounts associated with applications and services, List four types of factors in multifactor authentication and explain them., Something you know, including passwords, PINs, or the answer to a security question; something you have, like a smartcard or token; something you are, which relies on a physical characteristic of the person who is authenticating themselves; and somewhere you are, sometimes called a location factor, is based on your current location. Location can be detected with GPS technology or viewing IP address information., Name five common access control schemes., Attribute‐based access control (ABAC), role‐based access control (RBAC), rule‐based access control (RBAC or RuBAC), mandatory access control (MAC), and discretionary access control (DAC), What does an SSO system allow?, Single sign‐on (SSO) systems allow a user to log in with a single identity, and then use multiple systems or services without reauthenticating., What is SAML?, Security Assertions Markup Language (SAML) is an XML‐based open standard for exchanging authentication and authorization information., List and explain all three primary rules of role‐based access control (RBAC)., Role assignment, which states that subjects can use only permissions that match a role they have been assigned; role authorization, which states that the subject’s active role must be authorized for the subject—this prevents subjects from taking on roles they shouldn’t be able to; and permission authorization, which states that subjects can only use permissions that their active role is allowed to use., What are APIs?, Application programming interfaces (APIs) are interfaces between clients and servers or applications and operating systems that define how the client should ask for information from the server and how the server will respond., Describe the continuous integration (CI) and continuous deployment (CD) pipeline., Developer commits change, build process is triggered, build report is delivered, tests run against build, test report is delivered, and if successful, code is deployed., What is the function of security groups?, They define permissible network traffic., What are runbooks?, The operational procedures guides that organizations use to perform actions., What are common elements in a typical forensic report?, A summary of the forensic investigation and findings; an outline of the forensic process, including tools used and any assumptions that were made about the tools or process; a series of sections detailing the findings for each device or drive—accuracy is critical when findings are shared, and conclusions must be backed up with evidence and appropriate detail; and recommendations or conclusions in more detail than the summary included., Who are the typical team members in an incident response team?, Members of management or organizational leadership, technical experts, communications and public relations staff, legal and human relations staff, law enforcement, Name four use cases for forensics., Forensics may be used for investigations, incident response, intelligence, and counterintelligence., List 5 common logs used by incident responders., System logs, application logs, security logs, vulnerability scan output, network and security device logs, web logs, DNS logs, authentication logs, dump files, and VoIP and SIP logs., What is the process of obtaining and protecting forensic data called?, Preservation, What are six steps in the incident response process?, Preparation, identification, containment, eradication, recovery, and lessons learned, What are the 9 stages in the EDRM model?, Information governance, Identification of electronically stored information, Preservation of the information, Collection of the information, Processing of the data, Review of the data, Analysis of the information, Production of the data, Presentation for testimony in court and for further analysis, What is the process of conducting a digital investigation intended to find artifacts related to criminal activity or for litigation called?, E‐discovery, After an event or incident, what process is used to determine why it occurred?, Root cause analysis is used to determine why an event or issue occurred, What documentation is created to demonstrate that forensic data and artifacts were handled properly and that they were not modified or changed during the forensic process?, Chain‐of‐custody documentation., List four incident response plan types., Communication plans, stakeholder management plans, business continuity plans, and disaster recovery plans, What are the three major types of exercises that incident response teams use to prepare?, Tabletop, walkthroughs, simulations, What is used to ensure that organization that may be engaged in litigation retain relevant data?, A legal hold., What is the Linux dd command? Give an example to copy a drive mounted as /dev/sda to a file called example.img., The Linux dd command is a command‐line utility that allows you to create disk images for forensic or other purposes. Example: dd if=/dev/sda of=example.img conv=noerror,sync, List the order of volatility., From most volatile to least volatile: CPU cache and register; ephemeral data such as the process table, kernel statistics, the system’s ARP cache, and similar information; the content of RAM; swap and pagefile information; files and data on a disk; the operating system (Windows Registry); data on devices such as smartphones, tables, IoT devices, and embedded or specialized systems; firmware; snapshots from VMs; network traffic and logs; and artifacts like devices, printouts, media, and other items.

Domain4

by
Print
Embed

Leaderboard

Visual style

Options

Switch template

Continue editing: ?