CISSP - Domain 3
67 flashcards · Computer Science · by Jaysen Lewis
Define Zero Trust Security.
A strategy that addresses the limitations of the legacy network perimeter-based security model. Treats user identity as the control plane. (Identity is the new perimeter). Assumes compromise / breach in verifying every request in all phases of operation.
What is the "Secure Defaults" principle?
A system should "default" to running in a secure mode if we don't configure it otherwise. As opposed to a system requiring manual intervention, the default configuration settings of a system should default to secure, restrictive options that reflect conservative enforcement of security policy. Example: Implicit deny rule used by firewalls. HashiCorp "Deny by Default".
Describe "Trust but Verify".
No longer considered sufficient. Depended on an initial authentication process to gain access to the internal “secured” environment, then relied on generic access control methods.
Know the different Access Control types (DAC, MAC, RBAC, ABAC, RUBAC)
DAC - Discretionary Access Control Subjects have full control of objects they have created or been given access to. MAC - Mandatory Access Control System enforced, based on subject's clearance & object's labels. RBAC - Role Based Access Control Based on role of the subject ABAC - Attribute Based Access Control Subject, Object, Environment RUBAC - Rule Based Access Control Based on IF/THEN statements
What is a security model?
Used to determine how security will be implemented, what subjects can access the system and what objects they will have access to. Broad guidelines, not specific in nature. They are a way to formalize security policy. Provides a way for designers to map abstract statements into a security policy. Typically implemented by enforcing Integrity, Confidentiality or other controls.
What is the State Machine Model?
A Secure State Machine is a system that is always secure no matter what state it's in. All state transitions must be evaluated. Each possible state transition results in another secure state. Think "Travel from state to state, securely."
What is the Information Flow model? What are some examples?
Focuses on the directional flow of information (based on the State Machine Model). Biba and Bell-LaPadula are both information flow models.
What is the Non-Interference Model?
Ensures that the actions of different objects and subjects aren’t seen by (and don’t interfere with) other objects and subjects on the same system.
What is a Lattice-Based Model used for?
Lattice-Based Models are used to define the levels of security that an object may have and that a subject may have access to. Based on the interaction of any combo of Objects and Subjects. Bell LaPadula is Lattice-Based.
What are the 3 properties that are common when discussing security models?
Simple security property/ Rules for READ Star * security property Rules for WRITE Invocation property Rules around invocation/ calls, such as calls to subjects.
Study which security models are focused on ensuring Integrity or Confidentiality:
Bell-LaPadula is mostly used in the Government space and very rarely implemented outside of military applications; where the rest are typically seen in the commercial realm. If the exam mentions "Access Control Triplet" it's referring to the Clark-Wilson security model. If the exam mentions the "Invocation" property, it's Biba. Probably easiest to remember the Confidentiality side and the rest are Integrity. If it has an "i" in the name or has to do with interference, it's an integrity model.
Describe the Bell LaPadula security model.
A lattice-based, state machine model (& thus, an information flow model) that enforces Confidentiality. Uses Mandatory Access Control (MAC) to enforce the DoD multilevel security policy. (Government/ Rarely implemented outside of Gov or Military applications). No Read Up: Users should not have access to info higher than their security clearance level. No Write Down: Users cannot write below their security clearance level (to prevent leaks). (Opposite of Biba) Confidentiality – Simple NRU || * N…
Describe the Biba security model.
Another lattice-based model developed to address concerns of Integrity. No Read Down: Prevent corruption of the integrity of information accessed by a subject with a higher clearance level. No Write Up: Subject cannot write to a higher security level than what they're cleared for. Prevents information corruption. Introduces the "Invocation" property. Think "B-Ball Nerd" (Biba NRD) Integrity – Simple NRD || * NWU || Invocation N R/W U
Describe the Clark-Wilson Model.
Features the access control triple (triplet) and is focused on Integrity. Uses security labels to grant access to objects. Constrained Data Item (CDI) —is any data item whose integrity is protected by the security model. Unconstrained Data Item (UDI) —is any data item that is not controlled by the security model. Integrity Verification Procedure (IVP) —is a procedure that scans data items and confirms their integrity. Transformation Procedures (TPs) —are the only procedures that are allowed to…
What 4 basic operations does the Take Grant Model support? Does it ensure Confidentiality or Integrity?
Take, Grant, Create & Revoke. Confidentiality. Think of a confident lawyer saying "Take Grant, for example. You created this problem, now you're revoking his freedom."
What was the Brewer and Nash Model developed to prevent? Does it ensure Confidentiality or Integrity?
(Also called the "Chinese Wall Model") It was developed to prevent COI (conflict of interest problems). Deals with Confidentiality. Think "Chinese Wall"--->China--->Coi Fish. COI Can't see over the wall, so you have Confidentiality.
Which security model is THE non-interference model?
Goguen-Meseguer. Think Goggin Ice Center (You don't want an Interference penalty in Hockey)
Describe the Graham-Denning model:
This model uses a formal set of protection rules for which each object has an owner and a controller. Focused on the secure creation &deletion of both subjects & objects. A collection of 8 primary protection rules or actions that define the boundaries of certain secure actions. Securely create an object. Securely create a subject. Securely delete an object. Securely delete a subject. Securely provide the read access right. Securely provide the grant access right. Securely provide the delete acc…
Describe the 2 Failure Modes:
1) Fail Open Failed security controls are bypassed Less secure but consider the cost of a service disruption. 2) Fail Secure/ Fail Closed Failed security controls block access No access granted More secure but can be costly if service is disrupted.
In regards to Security Evaluation Models (Common Criteria), describe the difference between Certification and Accreditation
Certification - Determines that a system meets security criteria. Accreditation - Approves the use of a system in a specific environment. (Same as Authorization)
Policies like "Separation of Duties" and "Two-Person Control" can help reduce the likelihood of what?
Fraud & Abuse.
What is Defense in Depth?
Applying multiple, overlapping controls for one objective.
Know the different Cloud computing Roles:
Cloud Service Provider: Provides cloud computing services for sale to 3rd parties. Responsible for building and maintaining infrastructure (and can sometimes outsource those to other providers, making them both the CSP and Cloud Customer). Cloud Customer: Purchases and uses cloud computing resources/ infrastructure from CSPs. Cloud Service Partner: 3rd party companies that offer a service which interacts with a CSP offering; like security monitoring operations, audit providers or IAC developers…
What is the difference between Horizontal and Vertical scaling when it comes to Cloud computing?
Horizontal Scaling: Adding more servers (increasing your cluster size) to meet increased demand. Vertical Scaling: Adding more resources like CPU or RAM capacity to existing servers to meet increased demand.
Know the 2 types of Hypervisors:
Type 1 Hypervisor: Bare metal. The Hypervisor runs directly on top of the hardware and hosts guest operating systems on top of that. (Most common in Data Centers). Type 2 Hypervisor: The physical machine runs an OS of it's own and the hypervisor runs as a program on top of the OS. (Commonly used on personal machines).
What is a VM Escape attack?
When an attacker gets access to a VM and attempts to break out of the guest environment and obtain access to memory and storage of other VMs or the VM host. This is why Virtual machine isolation, secure multi-tenancy & security patching is critical. Each server must have access to only it's own memory and storage.
What is VM sprawl? What is used to reduce it?
VM sprawl is when there are large numbers of abandoned, unused and unmaintained VMs/servers in your environment. This poses significant risk due to unpatched security vulnerabilities. Instance Awareness reduces VM sprawl.
Know the ISO/IEC 17789:2014 standard:
Specifies cloud computing reference architecture. Includes cloud computing roles, activities and functional components and their relationships. Lays out a common terminology framework to assist with roles and responsibilities. NOTE: Reference architectures provide a useful framework but they're just a starting point. There are NO reference architecture police.
Know the purpose of the Cloud Security Alliance's: Cloud Controls Matrix (CCM):
The Cloud Controls Matrix (CCM) is designed to help CSPs and Cloud Customers understand the detailed security controls that may be used to achieve cloud security objectives.
Understand the typical Security Responsibilities between Customers and Vendors (or CSPs) when it comes to services like IaaS, Paas and SaaS:
What situation occurs when cloud service customers request more services than the provider has capacity for?
Oversubscription
Describe Full Disk Encryption (FDE)..
aka Full Volume Encryption (Bitlocker for Win, FileVault for Mac) Uses a form of Software Encryption Automatic encryption of the entire hard drive. Protects the entire contents of a drive. Helps in the event of theft/ loss: if someone gets ahold of your drive, they could very easily bypass the OS-level security to get ahold of the data on the drive. FDE makes this impossible.
Define HSM
Hardware Security Module (HSM) Dedicated hardware built for the purpose of performing encryption and decryption operations en mass & managing encryption keys Helpful with larger loads of encryption
What is a TPM (in context of HSM)?
Trusted Platform Modules (TPM) Specialized HSM Allows the use of FDE on a hardrive in a manner that minimizes the impact on system performance. Since the TPM has the encryption keys, it prevents an attacker from removing an encrypted hard drive from a computer and placing it in another computer for reading. If the correct TPM isn't present, the contents of the drive can't be read.
What is a Self-Encrypting Drive (SED)?
Performs encryption automatically Contains all the hardware & software necessary to perform encryption independent of the OS. McAfee Encrypted USB Drive is a good example.
What are the 2 Data Flow Control concepts?
Controlling Bandwidth Consumption Ensure that the inbound & outbound data transmissions occur at a rate that the network/ hardware can support. 2. Understanding how sensitive data flows Use data flow maps to apply security controls appropriately
What are 2 types of Database Focused Attacks?
Aggregation Someone with low-level clearance that can piece together sensitive information by combing the facts available to them. Inference Someone figures out sensitive information from the facts available to them.
Know the OWASP Top 10 web security issues/ threats:
Open Web App Security Project Top 10 (2021): Broken Access Controls Cryptographic Failures Injection Flaws Attacker inserts unwanted code; SQL Injection Attacks Insecure Design Fail to meet security requirements Security Misconfiguration Vulnerable and Outdated Components Identification and Authentication Failures Software and Data Integrity Failures Allows insertion of insecure code Security Logging and Monitoring Failures Deprives analysts of needed data Server-Side Request Forgery (SSRF) Tri…
What is a SQL Injection attack and what can you do to prevent it?
Hijacking a simple SQL query to "inject" a userpass database with comments that allow an attacker to flip the password of a user Single quotes (') are critical to SQL Injection attacks 3 ways to Prevent: Use Input Validation (Web-App Server Side) Example: Input should never contain a single quote Use of Parameterized SQL (Prevents Client-Side input validation bypass) Precompiles SQL code on the database server to prevent user input from altering query structure Attackers who try to leverage "Cl…
What is a Cross-Site Scripting (XSS) attack and how can it be defended against?
When an attacker embeds malicious scripts into a 3rd party websites to be ran in browsers by innocent visitors. Typically leveraging the "<script></script>" tags in html code. Defense: Use Input Validation Example: don't allow HTML with the <script> tags.
What is a Cross-Site Request Forgery (CSRF or XSRF) attack and how you defend against it?
Client-Side attack Takes advantage of users logged into multiple sites at once (via browser tabs) and tricks the user's browser into sending illegitimate cross-site malicious requests without the user's knowledge Often using fake image tags to execute the desired malicious command Defense: Re-architect web apps to use cryptographically strong tokens for transactions. Prevent HTTP Get Requests Advise users to logout of sites when finished (User Education). Enforce Idle Auto-Logout
What is a Server-Side Request Forgery (SSRF) attack and how can you defend against it?
Server-Side attack Tamper with metadata Manipulates servers into retrieving malicious data from what-it-thinks is a legitimate/trust source.
How can you defend against directory traversal attacks?
Use Input Validation Example: prevent the inclusion of periods "." or ".." in user requests Attacks look like unusual "../../" in URL requests Set strict file access controls
What is an Overflow (aka Buffer Overflow) attack and how can it be defended against?
Overflowing user input fields with data that is larger than the buffer Seeks to write data to areas of memory reserved for other purposes Stuffing fields with tons of text to crash a system Can result in unexpected behavior like revealing more user data than would normally happen (Mike's Hotel Wifi example) Can also result in privilege escalation attacks Defense: Input validation to ensure input is in the right format (example: has to be valid email address) etc Field limits Preset input
What is a Session Hijacking attack and how can it be defended against?
Intercepting authentication cookie values and using it to impersonate a user login. Attacker can also guess cookie values from previously discovered data (Cookie Guessing) Vulnerable to session replay attacks (if cookie values are not encrypted in-transit) Defense: Ensure cookies are configured with the "Secure" attribute to ensure they are sent with an encrypted connection i.e. Encrypt the cookies in-transit
How can we prevent/ mitigate Privilege Escalation attacks?
Input Validation Enforce "Least Privilege" OS, Platform and App patching (so known vulns cannot be exploited) Use DEP (Data Execution Prevention) and ASLR (address space layout randomization technologies) technologies
Industrial Control Systems (ICSs) are tempting targets for attackers because..?
They can have drastic implications (taking down power grids, intoxicating water supply systems) Systems are often not well-secured nor current on patching ICS types:
How can we secure networks that have untrusted IoT/ smart/ embedded devices present?
Network Segmentation: Segmenting embedded devices into their own "Embedded Device Network". (Same concept as an isolated Firewall DMZ). Application Firewalls placed in front of embedded systems provide added protection.
How can we secure Mainframe systems that are connected to enterprise networks?
Treat them like an embedded device & you can use the same security controls (like network segmentation) that you would use for embedded devices.
What technology can you use as a compensating control when it's not possible to patch an embedded system?
Wrappers
Understand the different types of ICSs (Industrial Control Systems):
SCADA (Supervisory Controls And Data Acquisition): Usually found in Natural Gas Pipelines, Power Production & Water Supply systems. SCADA Attacks can be devastating - Attacks on water systems, power grids, sewage systems etc. DCS (Distributed Control Systems): Control and adjust systems as they receive feedback Bad feedback can cause serious issues PLC (Programmable Logic Controllers): Handles & responds specialized input and output in difficult environments with special temperature/ vibration…
Know where cool air distribution or hot air return vents should typically be placed in regards to the cold aisle/ hot aisle approach for data centers.
Understand that you need to pump cool air into the cold aisle and warm air out of the hot aisle, like so:
Understand the different classes of Fire Extinguishers and what types of fires they deal with:
*** For the exam, you may be tasked with identifying the appropriate extinguishers for multiple classes of fires at once like an A,C,D situation: Easy memory: A = Average fire stuff (wood, cloth, trash) B = BP Gas (Liquid, Gas, Oil) C = Circuits (Electrical) D = Destroy (Heavy Metal, Industrial) K = Kitchen (fats and oils) Labels also list the classes of fires that can be fought with the extinguisher.
What is the required temperature range for a data center?
Between 64.4o <--> 80.6o F
What type of lock always requires entering a code to enter the facility?
Cipher lock
Be familiar with TAXII, STIX and CybOX frameworks:
All 3 work together to understand, describe and communicate threats (Threat Intel Sharing). *** STIX is a language that can use CybOX words, and the communication is possible with TAXII. CybOX provides a structure for measuring and reporting on events related to cyber security such as the generation of a registry key or activity on a specific IP port. STIX (Language) defines a structure to describe a threat. It allows for the definition of a threat, a threat actor, an incident type and a course…
Know the difference between Reputational Threat Research and Behavioral Threat Research
What is the typical process of Threat Hunting?
Establish hypothesis Search for indicators of compromise Discover compromise Incident Response
What is the basic principle underlying threat hunting activities?
Assumption of compromise
What security technology best assists with the automation of security workflows and enhance SIEM capabilities?
SOAR (Security Orchestration, Automation and Response)
Know the different approaches (focuses) to threat identification:
What type of organization facilitates cybersecurity information sharing among a industry-specific communities?
ISAC
What is a standardized language used to communicate security information between systems and organizations? STIX, CybOX or TAXII?
STIX
Know the quick facts about SOAP vs. REST APIs:
What is SOA?
Service-Oriented Architecture Design philosophy that embraces the use of discrete services that may be accessed by customers in a black-box fashion. Users don't need to know how the service works, they just to know what it does and how to access it.
Know the facts about Common Criteria ISO 15408 and the different EAL levels.
Common Criteria ISO 15408 - Structured methodology for documenting & validating security requirements. Defines a protection profile that specifies the security requirements and protections of a product that is to be evaluated. Protection Profile (PP): set of security requirements for a category of products that meet specific consumer security needs Security Target (ST): identifies the security properties of TOE (Target of Evaluation) Security Functional Requirements (SFRs): Specific individual…
What is Deidentification?
Deidentification is the process of moving through a dataset and removing data that may be individually-identifying. It's better to enforce anonymity or data obfuscation.