Summary
Highlights
Vulnerability verification addresses false positives (scanner reports vulnerability that doesn't exist) and false negatives (vulnerability exists but scanner misses it). True positives are accurate findings. Prioritization uses the Common Vulnerability Scoring System (CVSS) (0-10 score based on exploitability, impact, scope) and Common Vulnerabilities and Exposures (CVE) (unique ID, description). Environmental variables (asset criticality, network topology, data sensitivity, user base, external dependencies, threat landscape, operational constraints, regulatory requirements) influence risk assessment. Risk tolerance/appetite dictates responses: acceptance, mitigation, transference, or avoidance. Remediation options include patching, insurance, segmentation, compensating controls (e.g., WAF for SQL injection), or formal exception/exemption (risk acceptance). Validation ensures remediation effectiveness (rescanning, auditing, verification). Reporting informs stakeholders.
Section 4.4 covers security alerting and monitoring. Monitoring involves tracking health and activity of computing resources (CPU, memory, disk, network), applications (response times, errors), and infrastructure (traffic, bandwidth, latency). Fluctuations can indicate malicious activity. Log aggregation consolidates logs from diverse sources (systems, applications, network, cloud) into a central SIEM for easier analysis and threat detection. Alerting triggers notifications based on predefined rules or anomalies, requiring investigation and response (containment, remediation, validation, quarantine). Alert tuning reduces false positives. AI and machine learning, user entity behavior analytics (UEBA), and sentiment analysis enhance log analysis. SIEM and SOAR are key tools for optimizing event detection, visibility, and automated response capabilities.
Modern antivirus solutions provide real-time protection, multi-layered defense (signature-based, behavior analysis, machine learning, heuristic analysis), sandboxing, and cloud-based threat intelligence. Data Loss Prevention (DLP) systems identify, inventory, and control sensitive data, preventing inadvertent disclosure via policy actions. Simple Network Management Protocol (SNMP) monitors network devices; SNMPv3 encrypts credentials, unlike older versions. NetFlow collects IP traffic statistics, providing counts rather than packet content (like Wireshark). Regular vulnerability scans identify weaknesses, verify configuration management, and help spot negative changes over time. SCAP (Security Content Automation Protocol) offers open standards for automated vulnerability management and compliance.
Section 4.5 explores enhancing security through enterprise capabilities. Firewalls use rule-based access control (source/destination IP, port, protocol, action) with standard or extended ACLs, often ending with a deny-all rule. Protocols like TCP (reliable), UDP (connectionless), and ICMP (diagnostics) define communication. Screened subnets (DMZ) isolate public-facing services. IDS/IPS use trends (anomalies) and signatures (known threats) for detection, with behavior-based systems offering broader detection. Web filters (agent-based or centralized proxy) scan URLs, block content categories, and leverage reputation databases to protect against malicious websites, balancing security with user experience and privacy. OS security uses Group Policy (Windows) or SELinux (Linux) for centralized configuration management.
Secure protocols for Enterprise include SSH (22), HTTPS (443), RDP (3389), DNS (53), DHCP (67/68), and NTP (123). IPsec protocols, Authentication Header (AH) for authentication only and Encapsulating Security Payload (ESP) for encryption and authentication, operate in transport or tunnel mode. Secure protocols ensure confidentiality, integrity, authentication, non-repudiation, and availability. DNS filters block malicious domains before connection. Email security relies on DKIM (digital signature for emails), SPF (authorized mail server list), and DMARC (policy for SPF/DKIM failures). Email gateways act as security checkpoints to filter out malware, viruses, ransomware, and spam, reducing phishing and ransomware risks.
File Integrity Monitoring (FIM) safeguards critical files from unauthorized changes by using cryptographic hashes to establish baselines and detect deviations, vital for configuration enforcement and incident response. Data Loss Prevention (DLP) identifies, monitors, and protects sensitive information, applying policies to various data repositories and preventing local overrides. Network Access Control (NAC) checks device compliance (patches, security policies) before granting network access, diverting non-compliant devices to a quarantine network. Extended Detection and Response (XDR) integrates security visibility across endpoints, cloud, email, and other solutions for proactive threat hunting and automated response, leveraging AI, machine learning, and threat intelligence. User Behavior Analytics (UBA) analyzes user activity to identify anomalous or risky behavior, detecting compromised accounts, insider threats, and malware infections.
Section 4.6 delves into Identity and Access Management (IAM). It covers identity life cycle management, including provisioning (creating accounts with least privilege) and de-provisioning (disabling/deleting accounts upon separation) to prevent unauthorized access. Permission assignment can be direct to users, via groups, or through roles (pre-scoped permissions for job functions), with roles providing more dynamic and flexible management. Identity proofing verifies a user's claimed identity using methods like document verification, knowledge-based authentication (dynamic preferred over static), and biometrics. Federation establishes trusts between identity domains (e.g., on-premises AD with cloud providers, or social identities).
Single Sign-On (SSO) allows users to log in once for multiple applications, often using SAML (XML-based standard for authentication/authorization exchange) or OAuth 2.0 (open standard for authorization, commonly used with social logins like Facebook/Google). LDAP (Lightweight Directory Access Protocol) is used by directory services like Microsoft Active Directory for user and computer management, often coupled with Kerberos for authentication (preventing replay attacks with timestamps). Interoperability ensures different identity providers and applications work together seamlessly. Attestation confirms a device's compliance with company policies, often using a hardware root of trust like a Trusted Platform Module (TPM) for secure key storage and boot processes.
Authentication tokens include HMAC-based One-Time Passwords (HOTP) and Time-based One-Time Passwords (TOTP), often found in authenticator apps (soft tokens) or hardware devices (hard tokens/security keys like YubiKey). Password best practices emphasize complexity (mix of character types), length (12+ characters), reuse prevention (password history), and minimum age. Password managers help users create, store, and manage secure passwords. Passwordless authentication, such as FIDO2 (public key cryptography with physical devices) and Windows Hello for Business (asymmetric keys, TPM-protected gestures), reduces reliance on passwords due to their inherent weaknesses (reusability, susceptibility to phishing and replay attacks), enhancing overall security.
Privileged Access Management (PAM) tools apply stringent security controls to accounts with elevated privileges (admin/root). Key PAM concepts include Just-in-Time (JIT) permissions, which activate privileges only when needed and revoke them after a set period, minimizing exposure. Password vaulting allows users to access privileged accounts without knowing the password, managing credentials securely. Ephemeral credentials are short-lived, automatically expiring after a brief period, enhancing security by limiting the window for unauthorized access. These tools collectively reinforce the principle of least privilege and significantly reduce the attack surface for high-value accounts.
Section 4.7 focuses on the importance of automation and orchestration in secure operations. Automation involves mechanizing single tasks (e.g., patch management, password resets), while orchestration manages automated tasks across complete workflows (e.g., incident response involving multiple tools). Use cases include user and resource provisioning/decommissioning, guard rails (policy-based enforcement), security groups management, ticket creation and escalation, enabling/disabling services, continuous integration and testing (CI/CD), and API integrations. The benefits include efficiency and time savings (automating high-frequency, high-effort tasks), consistent enforcement of security baselines, standardized infrastructure configuration, secure scaling of operations, improved employee retention (less repetitive work), and faster reaction times to security incidents, making automation a 'workforce multiplier'.
While beneficial, automation and orchestration also have considerations and potential pitfalls. Increased complexity can introduce new vulnerabilities and management challenges if not handled skillfully. Initial costs for tools, infrastructure, and training can be significant, requiring a careful cost-benefit analysis. Over-reliance on a single automation tool or platform can create single points of failure, necessitating redundancy. Technical debt can accumulate if scripts and integrations are not regularly updated and maintained, leading to issues and vulnerabilities. Ongoing supportability requires continuous training, documentation, monitoring, and updating to ensure long-term success and avoid negating the benefits. Careful planning in the design phase is crucial to address these challenges.
Section 4.8 covers incident response activities, focusing on the seven phases: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Preparation involves planning, documentation, and team formation. Detection utilizes monitoring tools like SIEM, SOAR, XDR, and IDS/IPS to identify potential threats. Analysis confirms if a detected event is a true incident (triage). Containment limits damage and prevents spread. Eradication removes incident artifacts (malware, backdoors). Recovery restores systems to normal operations. Lessons learned involves root cause analysis to prevent recurrence, leading to documentation updates, training, or tooling changes. Training ensures the incident response team has the expertise to respond effectively. Testing (tabletop exercises, simulations) evaluates the plan's effectiveness. Digital forensics and evidence handling (legal hold, chain of custody) are critical for legal admissibility.
Evidence for legal cases must be relevant, material, competent (legally collected), and sufficient. Digital evidence can be found on hard drives, volatile memory (RAM, page file), operating systems, network connections, and firmware. Artifacts refer to any piece of evidence. CCTV footage can aid physical investigations. Timestamps are crucial for establishing event timelines, accounting for time zone offsets. Volatility dictates the order of evidence collection: collect most volatile data (CPU cache, registers, routing tables, live network connections, RAM) first, as it disappears quickly. Evidence preservation ensures original data remains unaltered, often requiring forensic copies (sector-by-sector copies) and immutable storage (WORM drives, legal holds on cloud storage). Chain of custody documents every handler of evidence. E-discovery handles identifying, preserving, and collecting electronically stored information, often with support from cloud service providers. Forensic data recovery retrieves hidden or deleted data for legal purposes, requiring specialized training. Reporting details findings, tools, evidence, and recommendations.
Section 4.9 focuses on data sources to support investigations. SIEM solutions aggregate various log data for expedited investigation. Log data types include firewall logs (network traffic), application logs (app events and activities), endpoint logs (system/user activities specific to devices), OS security logs (user logins, privileged account activities, configuration changes), IDS/IPS logs (detected threats), and network logs (traffic through network devices). Metadata (data about data) from files, emails, web pages, and mobile devices enriches log entries with timestamps, IP addresses, and user/device identifiers, aiding in event correlation and sequence understanding. Complementary data sources include vulnerability scans (unpatched weaknesses), automated reports (suspicious activity overview), dashboards (metrics, alerts), and packet captures (detailed content, protocol-level analysis for causal factors).
Welcome to Domain 4 of the Security Plus exam cram series 2024 Edition, focusing on security operations. This is the largest domain, consisting of nine parts. We'll cover security techniques for computing resources, security implications of asset management, vulnerability management, alerting and monitoring, Enterprise capabilities, identity and access management, automation, orchestration, the seven phases of incident response, and data sources for investigation. A PDF copy of the presentation and clickable table of contents are available for exam preparation.
Section 4.1 focuses on applying common security techniques to computing resources, including secure baselines, hardening various targets like wireless devices and mobile solutions, wireless security settings (WPA3, RADIUS), and application security methods like sandboxing and monitoring. We'll differentiate between controls (high-level features), benchmarks (security recommendations for specific technologies), and baselines (implementation of benchmarks). Configuration and change management are crucial for maintaining these benchmarks, as are regular vulnerability scans and patch management.
Hardening involves reducing a system's attack surface. This applies to mobile devices (strong passwords, app management, remote wipe), workstations (login credentials, disabled services, least privilege, antimalware, host firewalls), network devices (strong passwords, firmware updates, ACLs, segmentation), cloud infrastructure (IAM, encryption, logging, secure configuration, CI/CD, infrastructure as code), industrial control systems (segmentation, physical security, change management, monitoring), embedded and real-time operating systems (secure coding, limited functionality, firmware updates), and IoT devices (strong passwords, firmware updates, network segmentation, limiting functionality). Server hardening utilizes VM images and templates, with infrastructure as code being the standard in cloud environments.
For operating systems, security includes closing unneeded listening ports, restricting registry access, and implementing disk encryption (BitLocker for Windows, DM-Crypt for Linux). Patch management ensures systems are updated with current patches following a process of evaluation, testing, approval, and deployment for both native OS and third-party applications. Urgent 'out-of-band' patches are for critical issues and must be deployed promptly to prevent outages and security breaches.
Wireless device security begins with site surveys to map signal strength and optimize access point placement, avoiding dead zones and excessive network footprint. Mobile solutions involve features like strong passwords/pins, GeoFencing, application management (allow lists), content management (encrypted data, restricted sharing), remote wipe (full or selective wipe for BYOD), screen locks, geolocation, and careful handling of push notifications. Mobile device management (MDM) and unified endpoint management (UEM) platforms enforce these policies, including disallowing rooted/jailbroken devices.
Mobile security risks include third-party app stores, side-loading, rooting/jailbreaking (which remove vendor security restrictions), custom firmware, carrier unlocking, firmware over-the-air (OTA) updates, and various messaging types (SMS, MMS, RCS) that can be exploited for data theft via steganography. External media (SD cards) and USB On-The-Go pose data exfiltration risks. Microphones and GPS tagging introduce privacy and security concerns, allowing eavesdropping or revealing sensitive locations. Common mobile deployment models include Bring Your Own Device (BYOD), Corporate-Owned (CO), Choose Your Own Device (CYOD), and Corporate-Owned, Personally-Enabled (COPE), each with different security implications and management controls.
Mobile connection methods include 5G, which offers faster speeds and improved security over 4G but still has some legacy vulnerabilities. SIM cards are vulnerable authentication factors, often abused for MFA. Bluetooth (802.15) has security concerns like bluejacking (unsolicited messages), bluesnarfing (data theft), and bluebugging (backdoor attacks). RFID and NFC are used for tracking and payments but share vulnerabilities. USB and infrared are also connection methods with potential security risks. Wireless network models include point-to-point, point-to-multipoint, broadcast, and mesh. Attacks include evil twin (fake Wi-Fi), disassociation attacks, and jamming.
Wireless security uses cryptographic protocols like CCMP (Counter Mode CBC-MAC Protocol), which uses AES with a 128-bit key and is part of WPA2. SAE (Simultaneous Authentication of Equals) is a newer authentication method used with WPA3 Personal, replacing WPA2 Pre-Shared Keys and protecting against brute-force attacks with perfect forward secrecy. WPA3, released in 2018, uses stronger 256-bit GCM-P (Galois/Counter Mode Protocol) and comes in Personal and Enterprise versions. RADIUS, TACACS+, and 802.1X are AAA protocols for centralized authentication, authorization, and accounting. Other authentication methods like WPS (Wi-Fi Protected Setup) are considered insecure. EAP, PEAP, and LEAP are extensible authentication protocols. Captive portals are common in public Wi-Fi for additional validation.
Application security involves secure coding practices such as input validation to prevent buffer overflows, integer overflows, and SQL injection attacks. Secure cookies with the 'secure' flag prevent session hijacking, and HTTP Strict Transport Security (HSTS) headers enforce HTTPS. Code signing verifies authenticity, while allow lists and block lists control application execution. Application testing techniques include static code analysis (without execution, requires source code), dynamic code analysis (during execution, doesn't require source code, uses fuzzing), and manual code review. Web Application Firewalls (WAF) protect against web attacks (XSS, CSRF, SQL injection) using OWASP rule sets. Next-Generation Firewalls (NGFW) offer deep packet inspection and intrusion prevention, integrating threat intelligence. Sandboxing isolates applications for testing and malware analysis. Linux 'change root jail' provides process isolation. Monitoring logs via SIEM tools is crucial for detecting malicious activity.
Section 4.2 covers the asset management life cycle, which involves tracking hardware, software, and data from acquisition to disposal to minimize risks like unauthorized access or data disclosure. This includes establishing secure baselines during acquisition (vendor reputation, valid licenses, secure OS), defining ownership and classification during assignment and accounting (confidentiality, integrity, availability), monitoring and tracking (inventory, enumeration, physical tags, vulnerability scans), and proper disposal and decommissioning (sanitization, destruction, certification, data retention policies). Failure to manage assets properly can lead to security blind spots and data leaks, increasing the attack surface.
Section 4.3 details the vulnerability management life cycle: identification, analysis, response/remediation, validation, and reporting. Identification sources include vulnerability scans, penetration tests, bug bounty programs, and audits. Analysis involves confirming and prioritizing vulnerabilities using CVSS and CVE metrics. Response includes patching, isolation, compensating controls, risk transference (insurance), or risk acceptance. Validation ensures the vulnerability is resolved, often through rescanning or audits. Reporting communicates findings and recommendations to stakeholders. Different scan types include credentialed vs. non-credentialed, intrusive vs. non-intrusive, configuration reviews, network scans, and web application scans. Static and dynamic analysis, package monitoring, and threat feeds (open-source, proprietary, vulnerability databases like NVD) are also crucial.
Threat intelligence feeds provide continuous data on cyber threats, including indicators of compromise (IoCs), attacker information, and zero-day threats, consumed via machine-readable formats (TAXII, STIX) or human-readable reports. Automated Indicator Sharing (AIS) facilitates real-time exchange of IoCs. Threat maps offer real-time visualization of attacks. File and code repositories, vendor websites, academic journals, RFCs, industry groups, and social media are other intelligence sources. Penetration testing is an active test that exploits vulnerabilities, contrasting with vulnerability scanning (passive detection). Pen test types include known environment (white box), unknown environment (black box), and partially known environment (gray box). Key concepts include lateral movement, privilege escalation, and persistence. Red, blue, purple, and white teams simulate attacks and defenses. Responsible disclosure and bug bounties encourage ethical hacking.
Access control models include non-discretionary (system-wide restrictions), discretionary (object owner grants access, like NTFS), role-based (RBAC, users in roles/groups, non-discretionary), rule-based (global rules, like firewalls), mandatory (labels for objects/subjects), and attribute-based (ABAC, based on user attributes like department). Time-based logins restrict access to specific hours. Least privilege and need-to-know principles limit access to necessary resources, reducing incident scope. Multi-Factor Authentication (MFA) requires two or more authentication factors: something you know (password), something you have (device), or something you are (biometric). Biometrics include fingerprint, retina, iris, voice, vein, gait, and facial recognition, with important error metrics like Crossover Error Rate (CER), False Acceptance Rate (FAR), and False Rejection Rate (FRR).