SANS GSEC Sarah deck
Initialization Vector (IV) Filtering
Attempt to mitigate weak IV attacks by system administrators. Really doesn't address the issue of WEP/RC4 being weak.
auditd
Auditd subsystem is maintained by RedHat and used as a logger for SELinux. Operates at the kernel level. Does not use syslog.
Template
.INF extension. Stored by default in %SystemRoot%\Security\Templates and %SystemRoot%\Inf\
Crontab file
/etc/crontab
Passd File
/etc/passd file whch lists encrypted password and GECOS info, default shell, home directory
Syslog severity levels
0 emergency and debug 7 are fairly standard. Others alert 1, critical 2, error 3, warning 4, notice 5, informational 6 are not standard across vendors.
HIPS Functions
1- Ensures files haven't been modified or had their permissions changed. 2- Monitors network activity relating to the specicific host it is installed on. 3- Checks application calls and interactions with the system and other applications.
PKI/SSL Establish Connection
1-Client web request; 2-server responds; 3-client validates cert and crypto; 4-client encrypts session key and sends session key to server; 5-optional client certificate exchcange; 6-server decrypts session key; 7-client ends key exchange; 8-server ends key exchange; 9-encrypted messages are exchanged.
Risk Management Process
1-Conduct rapid assessment of risks; 2-fully analyze risks or identify industry practice for due care; 3-setup security infrastructure; 4-design controls; 5- decide which resources are available and implement countermeasures; 6-conduct periodic reviews; 7-implement instrusion prevention and incident response.
Log Monitoring Setup
1-Firewalls, network gear; 2-other network security gear; 3-Servers (Unix, then Windows); 4-Other Server Apps (web, mail), 5-Database; 6-Applications; 7-Desktops
Password Assessment Methods
Dictionary Attack, Hybrid Attack, Brute-Force Attack, Precomputation Brute-Force Attack (Rainbow Tables). Method: find a valid user id, find the encryption algorithm used, obtain encrypted password, create a word list of possible passwords, encrypt each password in the list, determine whether there is a match.
Attack Process
Different than a pen test but similar steps
DMA
Direct Memory Access
DSSS
Direct Sequence Spread Spectrum
DRP
Disaster Recovery Plan
Configuration Management
Discipline of establishing a known baseline and managing that condition. "Risk assumed by one is shared by all." Discipline of establishing a known baseline condition and then managing that condition. Change control is critical. Partition your internal network to prevent spread of an exploit. To manage your configuration, you need 2 things: accurate baseline document; way to detect when a change occurs to that baseline (change control). For CM to be successful, we need instrumentation to detect unauthorized change, eg system scanners, network mapping, vulnerability scanners, p22. Web CM, p 172.
DACLs
Discretionary ACLs control permissions on a folder: read, write, execute, modify, full control.
DAC
Discretionary Access Control
DN
Distinguished Name
Active Defense Harbinger Distribution (ADHD)
Distro based on Ubuntu that has pre-loaded active defense tools.
DoS Attack
DoS attacks are possible against VMs and their host. A DoS attack against a host can cripple services across multiple different companies.
Router Attacks
DoS, DDoS, Packet Sniffing, Packet Misrouting, XSS, CRSF, SYN Flood, Route Table Poisoning, Malicious Insider
Policy Creation
Does this policy set the correct tone for my organization? State the issue; Identify the players; find all relevant documentation that exists; define the policy; identify penalties for noncompliance; make sure the policy is enforceable; submit the policy for review and approval.
Network Profile
Domain (only when AD is available), Public, Private. Maintain different firewall rules for each profile.
Domain GPO
Domain GPO overrides local GPO
Local GPO
Domain GPO overrides local GPO
System-level Objectives
Attackers goals and what tools they'll use to meet them. Execute unintended commands or access data without authorization? SQL or LDAP injection. Execute scripts in browser, hijack a user session, alter a website or redirect user to another site? XSS or CSRF.
Wireless Phishing
Attackers listen and steal personal info over wifi. They can infect user's browser cache.
Defense Science Board
Attacks, Defenses, Targets, Adversaries Diagram
KEYW Cyber Threat Taxonomy
Attacks, Defenses, Targets, Adversaries Diagram
Attack
Attempt to gain unauthorized access to an IS services, resources, or information, or the attempt to compromise an IS's integrity, availability or confidentiality
SSL/TLS
Encrypts, server identity verification and data integrity. Secret keys are negotiated during TLS/SSL setup, using algorithms such as RSA and DH key exchange. During initialization, server presents public key certificate to client to verify server identity. Server requests crypto key exchange. SSL/TLS is not a guarantee of security.
M$ EoL
End of Sales, End of Mainstream Support, End of Extended Support, End of Custom Support
Virtual Firewall
Ensure there's a virtual firewall between two guests running on the same host. The virtual firewall will analyze traffic between them.
IPv6 Features
Fixed header length of 40 bytes. Extended address space, autoconfiguration support, IPv6 over IPv4 tunneling, IPv4 over IPv6 translation, Flexible embedded protocol support. endpoint authentication, encryption support.
Certificate Revocation List
Flat file. Not updated in real-time
Spectre
Flaws in the computer's processor. Successful exploitation will yield kernel-level permissions and root-level file access.
VPNs
Flexible, cost-effective, fast to setup. Delay can be an issue. No dedicated bandwidth.
MAC Flooding
Flood the switch with MAC addresses. Switch starts acting like a hub which allows attacker to sniff traffic.
Active Defense
Focus on vulnerabilities in which there is a threat with a high likelihood and high impact to causing damage to critical assets. Stage 1- Identify internal critical assets; 2- Add environmental context (baselines); 3- Identify and profile most likely threat actors; 4- Conduct active defense missions. The goal is to find out as much about the adversary and slow them down.
Business Continuity Plan (BCP)
Focuses on availability of critical business processes. Long-term, strategic. Created by business.
SSH MFA
For critical services like SSH, MFA must be used. List of options: SSH keys, Google Authenticator, FreeOTP, Authy, Duo.
JEA
Just enough Admin is an optional PS remoting feature available in PS 5.0. It whitelists commands and block all others by default.
Preventive Control
Keeps a threat from coming in contact with a vulnerability
Permutation
Keeps same letters, but changes their position within text. Very easy to break. Substitution and permutation can be combined. Also known as transposition. Used in combination with substitution in modern crypto algorithms, p50.
KDC
Kerberos Distribution Center is AD Controller
Threat Assessment and Analysis
Identify existing countermeasures, threats and vulnerabilties. Support the expenditure of resources and determine the most cost-effective safeguards to offset the risks. Aid in the selection of cost-effective countermeasures that reduce existing risks to an acceptable level.
Kerberos
Kerberos explained on p33-35. Default authentication protocol for AD. Primarily uses UDP88, For large tickets, it switches to TCP88. Servers listen for password changes on UDP464, p212.
DMCrypt
Kernel module that allows hdd encryption on whole partitions. Linux distros allow at root level now (wiki)
Key Escrow
Key backup stored with third party.
Hypervisor
Key component of virtualization that allows software to emulate hardware. The hypervisor is the emulation software. Attacker owns everything if they can compromise the hypervisor.
Biometrics
Key factors in selecting: reliability, user friendliness, implementation cost, maintenance. Difficult to change credentials after compromise.
cgroups
Key feature of LXC. Made by Google. Focuses on CPU and Memory control.
namespaces
Key feature of LXC. Made by IBM. Focuses on obtaining resources that an app needs. Good for security and stability.
3DES
Key length is 168 bits. Based on key length, 3DES is not considered secure, even through there are no public reports claiming to have cracked it. 3DES is executed 48 times (rounds) whereas DES is executed 16 rounds.
LSA Secrets
Local Security Authority in Windows is designed to manage a systems security policy, auditing, logging users on to the system, and storing private data such as service account passwords. LSA secrets are stored in HKLM:\Security\Policy\Secrets key
LSA Secrets
Local Security Authority in Windows is designed to manage a systems security policy, auditing, logging users on to the system, and storing private data such as service account passwords. LSA secrets are stored in HKLM\Security\Policy\Secrets key
Account Lockout
Lockout duration 120 min; Lockout threshold 5 attempts; Reset lockout counter after 45 min
Logsurfer
Log alerting program
Logwatch
Log alerting program
Swatch
Log alerting program
OSSIM
Log analysis tool. Analyzes and correlates logs. Correlate and alert
OSSEC
Log analysis tool. Leading open-source tool for real-time log analysis. Correlate and alert.
SEC
Log analysis tool. Rule correlation and analysis of logs in near real-time. Flexible. Hard to use. Correlate and alert.
Logsentry
Log analysis tool. Use their scripts or create your own to look for specific strings in logs and then sends an email or other alert.
Swatch
Log analysis tool. Use their scripts or create your own to look for specific strings in logs and then sends an email or other alert.
Logwatch
Log analysis tool. Use their scripts or create your own to look for specific strings in logs and then sends an email or other alert. Correlate and alert.
SLCT
Log analysis tool. Uses a simple clustering technique to make sense of stored logs. Use it when you need to review large amounts of file logs.
Splunk
Log correlator, use third-party plugins to make it act like a SIEM. Difficult to deploy if you deviate from anything other than typical log aggregation.
Baseline
Log output of several commands and compare them with log changes. What's normal: type of network traffic, amount of network traffic, types of logs generated, number of logs generated, resource utilization, access times and length of access, current state and configuration.
Blue Pill
Logical attack that involves a rootkit manipulating low-lever kernel mode to provide root-level permissions to the attacker, giving attacker unlimited access to other guests. It does this by executing a false hypervisor.
Physical File System
Logical file system is made up of multiple physical disk partitions.
Type 2 Hypervisor
Logical hypervisors run internally within an OS as an application. VMWare Workstation, VMWare Player, VirtualBox
Virtual Defense
Logical separation through virtual switching and virtual firewall to provide filtering and inspection. Timely patching is key. Physical separation of VMs by security classification may be a regulatory requirement. Private VLANs are another good defense.
Information Management
Logical vs Physical Locations of data. Due to contractual, regulatory and jusidictional issues, its imperative to understand both logical and physical locations of data. Volume Storage. Volumes often use data dispersion to support resiliency and security. This includes IaaS instances typically as a virutal hdd. Object Storage is sometimes referred to as file storage. Its more like a file share accessed via APIs or web interface. Eg DropBox.
ls -l
Long listing of contents, includes attributes. Output on p172
Threat Hunting, Host
Look at startup fiels, registry changes, hidden processes.
Single Loss Expectancy (SLE)
Loss from a single event. SLE = Asset Value x Expsosure Factor
Alien Vault
Lots of prebuilt automation. Open Threat Exchange provides threat feed, identifying signatures it has created. File integrity monitoring, HIDS, NIDS and Vulnerability Scanning.
RDP Encryption levels
Low cleartext; client compatible where client determines the encryption; High server determines encryption level; FIPS compliant requires 3DES, AES, RSA and/or SHA. TLS is permitted if requested.
System Accounts
Low number UIDs. Better to disable account than to delete them. Set accounts so that no can login with them and they are audited.
M$ vs Organizational Accounts
M$ Account is for personal use like Outlook.com or OneDrive. Organizational Account is Exchange Online or O365.
Windows Defender ATP
M$ Advanced Threat Protection includes a suite of products for threat hunting and incident response.
MAAD
M$ Azure Active Directory
AADDS
M$ Azure Active Directory Domain Services
Azure ATD
M$ Azure Advanced Threat Detection
MBSA
M$ Baseline Security Analyzer
mstsc.exe
M$ Built-in Thin Client App
dir /w
M$ CLI to list contents of a directory.
dir
M$ Long listing of contents, including attributes
Office Online
M$ Office app. Free but limited. You have to save docs in OneDrive.
M$ OMS
M$ Operations Management Suite
SCCM
M$ System Center Configuration Manager used for CM of BYOD devices. Integrates with InTune
MOM
M$ System Center Operations Manager
MOM Server
M$ System Center Operations Manager watches over your servers by continuously extracting their Event Logs and other auditing data.
attrib
M$ change file attributes
copy
M$ copy files
del
M$ deletes a file
Smart Screen Filter
M$ filters known-evil URLs in M$ Edge and IE by default.
Outlook.com
M$ free email, calendar, contacts, etc. Competes with Gmail.
InTune
M$ inventory and management of BYOD. Enforces MDM security policies.
dir /a
M$ list hidden and regular files
md
M$ make directory
rd
M$ removes directory
rename
M$ rename files
dir env:\
M$ same as "set" command to see path variables in Windows
diruse.exe
M$ tool to alert you if any monitored folder exceeds a certain size
at.exe
M$ utility for scheduling tasks. Deprecated and shouldn't be used.
MAAD vs AADDS
MAAD does not support Kerberos, NTLM, Group Policy, or LDAP. It supports web-based authentication. AADDS provides traditional domain controller services. You don't have to upload your VMs for AADDS.
mbsacli.exe
MBSA cli version
M$ Authenticator
MFA on mobile devices.
M2M
Machine to Machine applications
aureport
Makese ausearch results easier to read
Internet Explorer
Manage IE using GPO Administrative Templates and Internet Explorer Maintenance.
auditpol.exe
Manage audit policies from cli
ntrights.exe
Manage privileges with scripts or free CLI tools like ntrights.exe
Data Migration Detection
Manage unapproved data moving to cloud services in two ways: Database Activity Monitorigin and File Activity Monitoring; URL filters and DLP tools
DR Planning Process
Management Awareness, Planning Committee (has at least one business stakeholder involved), Risk Assessment, Process Priority Establishment, Recovery Strategies, Testing Criteria.
Human Resources and Management Sensitive (Business Classification)
Management Proprietary Information. Personal Information (PII).
MAC
Mandatory Access Control
Incident Handlineg
Planning is key! Pre-established procedures that specify how to act during common attack situations. Six Step Process: 1-Preparation; 2-Identification; 3-Containment; 4-Eradication; 5-Recovery; 6-Lessons Learned.
PAM
Pluggable Authentication Modules
PAM
Pluggable Authentication Modules employs four management groups: Authentication, Passwords, Sessions, Accounts. Config files are stored in /etc/pam.d.
PPTP
Point-to-Point Tunneling Protocol is a VPN protcol uses IP 47, which is GRE, and TCP1723
Policy vs Procedure
Policy addresses what to do and Procedure addresses how to do it. Policy is read cover to cover and Procedure is referenced when having trouble following the policy. Policy is concisese and focused. Procedure is detailed and step-by-step. Policy is strategic and high level while Procedure is tactical.
SMART
Policy statement must be specific, measurable, achievable, realistic, time-based
NDA
Policy that covers use, control and enforcement. Protects both parties, shouldn't be one-sided. Protects sensitive information; individual receiving information agress to keep it confidential. Legal document that has certain specific requirements. Clearly written and easy to read. Should follow who NDA applies to, what NDA is, when NDA should be used, where NDA is applicable, and why NDA is important.
802.1x
Port Security feature. Provides network authentication. Its a framework that supports different authentication protocols known as Extensible Authentication Protocol (EAP) types. Standard by IEEE to authenticate to LAN and wireless LAN network devices.
Scanport
Port scan tool
Nmap
Port scan, vulnerability scanning, OS detection. Filtered means nmap can't tell if port is listening. -randomize_hosts options tells nmap to scan range of hosts in random order.
POSIX
Portable OS Interface
Shell
Portion of OS that allows users and proceses to interact. It also can act as the vehicle through which apps obtain permissions and interact with the kernel.
Ephemeral Ports
Ports that change each time the client runs. They are numbered above well-known ports ( > 1023 )
Firewalls
Preventative. Best way to protect a system is to air gap it from the network, but that's 0% functionality. 3 types of firewall: packet, stateful and proxy/NGFW. Helps with IDS if egress filtering is enabled and firewall logs traffic in both directions. Ingress is from Internet to protected network. Egress is protected network to Internet.
NIPS
Preventative. Layer 7.
NIDS Developments
Reduction in false positives with target OS identification, integrated vulnerability assessment for threat profiling/alert prioritization, NIDS integration with networking devices (eg IDS blade in switch), IDS in wifi.
OWASP
Reference to OWASP Top 10 Most Common Applicaton Attacks on Input Attacks page.
SELinux
Security Enhanced Linux is a loadable kernel module that provides mandatory access control policies. Security model is based on least privilege and starts with users having no rights at all. It doesn't replace existing Linux security, it enhances it. Good for systems that have default "allow."
SID
Security ID Numbers
SID
Security ID Numbers Everyone S-1-1-0; Authenticated Users Group S-1-5-11; Local Administrators Group S-1-5-32-544
SIEM
Security Incident & Event Monitoring
.inf
Security Template
Host: Header
The client sends the web server a Host: header that specifies which domain.
PUT
The client uses PUT to upload files to a web server, eg publishing new web pages or uploading email attachments.
Non-Persistent Cookie
They are destroyed every time the browser closes. Even though they are stored in memory, they can still be edited by user or MitM using Proxy like Paros.
Dwell Time
Threat Hunting Key Indicator. How long is the adversary in your organization?
Reinfection
Threat Hunting Key Indicator. How many times has an organization been compromised by the same adversary or the same threat?
Lateral Movement
Threat Hunting Key Indicator. How much damage is the adversary causing, in terms of number of systems compromised?
Risk
Threats x Vulnerabilities. Its impossible to completely eliminate all risk. Security deals with managing risk to your critical assets. Security professional must constantly track, manage, and mitigate risk to an organization's critical assets. Risk = Probability x Impact.
Data Protection
Three valid options: content discovery, volume storage encryption, object storage encryption
sysctl -w
To change (write) a variable until next reboot. Non-persistent file change. Great for testing before commiting to changes.
ROI
To obtain the required resources, it is ciritical to show an appropriate ROI for security. Financial benefit or return received from a given amount of money or capital invested into a product, service or line of business. aka Return on Capital Employed, Return on Network Worth, Return on Equity. ROI (%) = (gain - expenditure) / (expenditure) x 100
fsutil.exe
To see which file system is used and get its list of support features, open PowerShell and run this utility.
LogPP
Tool help conver multi-line logs to a single line format
strings -n 14 textfile.txt
Tool parses through any input file, searching for ASCII characters. -n 14 tells it to look for strings 14 characters or longer.
Artillery
Tool that can provide an early warning system. Honeypot, file system monitoring, threat intelligence feeds with optional trace-back capability.
WEPWedgie
Tool to accelerate process of collecting packets from wireless networks.
wnet/reinj
Tool to accelerate process of collecting packets from wireless networks.
hping3
Tool to craft packets. TCP version of ping. Port Scanner. Spoof IP address. See output, p20-21
StegSecret
Tool to detect stego in images.
Stegexpose
Tool to detect stego in images.
Ettercap
Tool to facilitate sniffing in a switched environment. Can sniff even in a switched environment. Relies on ARP cache poisoning.
Dsniff
Tool to facilitate sniffing in a switched environment. Sniffer that uses ARP redirection and IP forwarding
unshadow passwd shadow > unshadow.txt
Tool to merge passd and shadow files together. Preliminary step for John the Ripper.
md5deep
Tool to take forensic hash of file.
sha1deep
Tool to take forensic hash of file.
Bloover
Tool used for Bluejacking
BlueSniff
Tool used to circumvent Bluetooth security that allows attacker to locate and attack Bluetooth networks.
RedFang
Tool used to circumvent Bluetooth security that allows attacker to locate and attack Bluetooth networks.
AirSnort
Tool used to crack WEP keys.
WEPCrack
Tool used to crack WEP keys.
dwepcrack
Tool used to crack WEP keys.
Blackhole Exploit Toolkit (BET)
Toolkit installed on web servers and preconfigured to attack out-of-date code running on visitors' machines.
Content Discovery
Tools to identify sensitve info in storate. Once identified, info can be classified. Classified dat can be scanned with advanced content analysis techniques to audit.
TTPs
Tools, techniques and procedures
Classification Levels, Government
Top Secret (critical to protect), Secret (could harm national security), Confidential (could be detrimental to national security), Unclassified (data owners prefer to keep this info from being released, but it would not harm the nation if it were).
Log Deployment Challenges
Top challenge is political boundaries.
Deep Packet Inspection
Traditionally deployed with application-level firewall gateway that has deep understanding of protocol and has the logic to follow the fields inside the packet. Slow and expensive. In practice, it's used with shallow packet inspection.
NIDS Key Point
Trained staff, passive sniffer in security management console, incident response preparation, ROI calculation--better to outsource?
HTTP Protocol
Transaction-oriented. Stateless.
Station Controller
Transmits and receives frames through transceiver on Ethernet.
TLS
Transport Layer Security. Encrypts traffic between client and IIS Server
OSI Model
Transport Layer ensures reliable connectivity from end-to-end and handles sequencing of packets in a transmission. Session handles establishment and maintenance of connections between systems. Negotiates the connection, sets it up, makes sure the info exchanged across the connection is in syn on both sides. Presentation Layer makes sure data sent from one side is received in a format that is useful to the other side eg compression/decompression. Application Layer interacts with the application to determine which network services are required.
Decloak
Tries to discover attacker's true IP address. Uses flash and Java applets. Can be used as part of incident response or threat hunting activities. Could be considered hacking back.
DoublePulsar
Trojan backdoor tool that runs kernel mode, allowing for privileged access on compromised systems. Used in WannaCry attack.
IDS Alerts
True postive generates alerts; false positive generates alerts; true negative does not generate alerts; false negative does not generate alerts.
TPM
Trusted Platfom Module
IPsec Headers
Tunnel Mode encrypts IP Header and Data. Transport Mode only encrypts Data.
TTLS
Tunneled Transport Layer Security
Recovery
Two main options: install OS and apps from scratch, fix vulnerability, restore data; restore system from a trusted backup and patch the system.
Threat Hunting
Two major components of threat hunting: detection and intelligence, p176. Act of aggressively tracking and eliminating cyber adversaries from your network as early as possible, p178. Benefits: provide early and accurate detection, control and reduce impact and damage with faster response, improve defenses to make successful attacks increasingly difficult, gain better visibility into org's weaknesses, p179. Fits between active defense and intelligence, p183.
Web Authentication Methods
Two most commond are HTTP authentication and HTML form-based authentication.
syslog.conf
Two parts to entry in syslog.conf: filter and action. This is where you tell where you want syslog to store files, including if they are sent to remote server.
ICMP
Two purposes: to report errors or troubleshooting and to provide network information. It's a datagram like IP and UDP. Reports on state of a network.
Linux Security Permissions
Two ways to represent permissions: symbolic rwx and absolute 777
Linux-VServer
Type-1 Hypervisor VServer mitigates risk of escaping out of a guest by using segmented routing, chroot, extended quotas, etc.
Decoy Ports
Typically implemented at the firewall, which will always respond to a SYN with a SYN-ACK. Careful: opening decoy ports by enabling a real sevice on a server could increase attack surface and make you more vulnerable.
Data Diode
Typically references military technology that moves data into classified networks without the risk of leaking classified information. Usually a hardware appliance($$$) to control flow of traffic, only allowing unidirectional traffic flow. Input side is anode and output side is cathode.
RDP
UDP3389 media streaming. See HTTPS Tunneling RDP.
Superuser
UID0. Root. There can be multiple UID0 accounts but you can't audit them separately. Audits show UID0, that's it.
CNCI
US Comprehensive National Cybersecurity Intiative
USGCB
US DoD US Govt Configuration Baseline
Unix OS Types
Ubuntu and Kali are Debian. Fedora is RedHat. MacOS is BSD.
Ubuntu vs Fedora
Ubuntu is Debian. Fedora is Red Hat. Ubuntu uses APT and is less secure, eg firewall not enabled by default. Fedora uses RPM and Yum package manager
umask u=x
Umask with = will only allow specified permissions to be enabled.
Bluesnarfing
Unauthorized access of information via Bluetooth. Bluesnarfer is probably the most widely used tool
Resource Protection
Understanding your assets.
UEFI
Unified Extensible Firmware Interface
Ciphertext
Unintelligible message.
Cryptogram
Unintelligible message.
Distinguished Name (DN)
Unique identification used by CA to authenticate user/organization requesting a certificate.
john -format:MD5 -w:password.lst test
Use John the Ripper in wordlist mode to crack test file using password.lst wordlist.
ise .\ProcList.csv
Use PowerShell ISE to open ProcList comma delimited file.
WEP
Uses RC4.
File Integrity Checking
Uses a mathematical function called a one-way hash to create a hash-value of monitored file. Considered a HIDS feature.
Dictionary Attack
Uses a wordlist to crack passwords.
NTLMv2
Uses domain name, server challenge and other variables to randomize final hash to protect against precomputation. NTLMv2 adds username, domain name, client challenge, server challenge, and NTLM hash of the password to the hash function thereby injecting randomness or salt. This helps protect against pre-computational hash lookup attacks like Rainbow Tables. The NTLMv2 salt is not designed to protect against pass the hash attacks; other controls are needed to prevent that attack. Enforcing complex password requirements and length requirements are set in group policy/security tempaltes not by the NTLMv2 protocol.
Public Key Infrastructure
Uses for PKI, p125. Problems, p126-127.
Log Monitoring
Uses inclusive or exclusive analysis. Is considered a mechanism of host-based IDS. Powerful mechanism that offers the administrator a lot of flexibility.
Machine Learning
Uses modern computing techniques to streamline pattern recognition and aggregation, computational learning, and human-derived instruction sets to do predictive threat analysis.
Secure Simple Pairing (SSP)
Uses public key cryptography to make Bluetooth pairing more secure. Added in Bluetooth 2.1.
setarch
Utility that should be removed or not allowed to be used by any user. It tells the OS which architecture to use to run the program.
Cryptsetup
Utility to setup hdd encryption based on DMCrypt kernel module.
cut
Utility to trim output to exactly what you need, using bytes, characters, a special delimiter, etc to determine where to cut.
DaaS
VDI in the cloud. Great for BYOD. Eg O365
Cloud Infrastructure Attacks
VM Traffic sniffing eg vSwitch, insecure cryptography, API attacks, Lack of air-gapped systems, Hardware Flaws eg Spectre and Meltdown, DoS, Supply Chain Attacks, Insider Threat, Account Hijacking.
Guest OS
VM. Most common VM is an OS running on a virtual machine. Accesses virtual hardware through an emulator.
Direct Memory Access (DMA)
VMs have direct access to memory and controllers like video and NICs, which can provide a place for attackers to store and move code.
Isolation Errors
VMs need to be configured correctly so they only interact with authorized systems. If an attacker compromises one virtual system, she could also have access to all systems bridged to the compromised one.
Return on Security Investment (ROSI)
Value or perceived benefit obtained by investing resources in security--typically tied to the cost-effective method of reducing a critical risk.
Keys
Values used to intialize a particular algorithm. They permit the existence of unrestricted algorithms Strength of cryptosystem rests with the strength of its keys. The larger the keyspace the stronger the cryptosystem. Key must be protected.
Dash7
Very low frequency, well-suited to tracking moving objects or acting a wireless sensor network. No formal network structure required. Useful for peer-to-peer texts, smart advertising on posters and billboards, mobile in-store advertising.
more
View a page a time
tail
View real-time info, displaying last few lines of a file. Useful for viewing and analyzing log files.
VPS
Virtual Private Storage
/proc
Virtual file system.
Virtualization Benefits
Virtualization reduces downtime by improving failover capabilties.
Volume Storage Encryption
Volume protection from snapshot cloning, cloud service provider exposure, loss of physical drives, etc.
GFI LANguard
Vulnerability Scanner
Qualys QualysGuard
Vulnerability Scanner
Rapid7 Nexpose
Vulnerability Scanner
Tennable Nessus
Vulnerability Scanner
nCircle IP360
Vulnerability Scanner
Vulnerabiltity Analysis
Vulnerabilties are the primary focus for reducing an overall risk. Vulnerability analysis identifies weakness in the system that an attacker could exploit. Vulnerabilities are the primary focus for reducing an overall risk. Gives big picture of weaknesses in systems and apps.
802.11i
WPA2 is a security mechanism that provides encryption to wireless networks.
WannaCry
WannaCry ransomware worm was a confidentiality, integrity and availability attack that leveraged NSA Eternal Blue tool that exploited vulnerability in Windows SMBv1 protocol.
Facebook Breach
Watering Hole attack.
Captive Web Portal
Way to authenticate users. Intercepts requests for web page and substitute the page with a form that requests authentication.
Vulnerability
Weakness in a system that can be exploited.
Vulnerabilities
Weakness in a system that can be exploited. Only thing we can control
WPAD
Web Proxy Auto Discovery Protocol
WPAD
Web Proxy Auto-Discovery Protocol
Paros
Web Proxy Tool allows you to edit cookies.
Burp
Web proxy took that allows for cookie editing.
Cross-Site Request Forgery
Web-based attack for gaining control of web applications. Can be effective on routers too. Attack often comes in the form of an email with a link. Rebooting the router will nullify the attack.
Cross-Site Scripting
Web-based attack to reveal user's physical location. Attacker gets user's MAC address through the router and then uses location service to find them.
Kibana
Web-based dashboard for Logstash and elastic searches. Kibana data search engine can handle enormous amounts of data. Flexible, real--time reporting, data slicing, elastic search.
python -c 'print "A" * 100' > bof
Write 100 letter As to file named bof
Minimize Packages
XFCE is better than gnome because it uses far less space and fewer resources.
Yum
Yum package manager used by Fedora
ZPHA
Zero Power HA
802.15.14
ZigBee Wireless
su
switch user
utmp
complete picture of user logins, logouts, system events, current status of system, and system boot time. One of main log files.
messages
contains global system messages, including messages logged at startup. Mail, cron, daemon, kern and auth logged in /var/log/messages. General system activity log. Stores valuable, nondebug and noncritical messages. Great for anomaly hunting.
/var
contains logs, queues, etc. Files that change frequently
wtmp
historical data of utmp. One of mail log files.
honeyd
honey pot engine. Used by NOVA VMs.
history
last 100 commands I ran
Wmic.exe
legacy command for Windows Management Instrumentation programming
ls
list contents of directory
lsof
list of open files and the processes that opened them
ls -al
lists hidden and regular files
File Attributes
ls -ld example showing File Type, permissions, link count, etc
mkdir
make directory
inetd
manages services
xinetd
manages services. Replaced need for inetd and add-on serices. It also has embedded security features. Maintains /etc/xinetd.d directory where services reside as files. Disable the service by modifying the individual file. Modify /etc/inetd.conf.
Rc.d
manages services. if the system does not use an Internet super server or the server process is activated at system startup, then the services are managed by rc so they can operate independently. Modify /etc/rc.conf
mailog
messages from mail server eg sendmail
Unlock accounts
passwd -l <user>; usermod -L <user>, passwd -u <user>; usermod -U <user>
rmdir
removes directory
mv
rename files
Syslog message format
rfc lacks definition for syslog format standard which causes issues normalizing the data.
/
root file system
get-help invoke-command -full
rtfm!
Linux/Unix File Permissions
rwx set on File Owner, Group Owner and Everyone Else
Multi-Category Security (MCS)
s0:c0 to S0:c3.
Ctrl-R
search past typed commands
secedit
security template management. Secedit /configure /db A:\dbase.sdb as PowerShell scripte to update security template, p145.
secure
security-related messages like authentication failures, possible break-in attempts, ssh logins, failed passwords, sshd logouts, and invalid user accounts.
Hardware Abstraction Layer
see API.
get-process
see list of running processes in PS
kill -l <pid>
send the process an HUP signal
rootkit
set of binaries installed by attacker to provide a backdoor. Often disguised as OS programs in /usr/bin and /usr/sbin.
Syslog
system logging daemon, aka syslogd, normally starts at run level 1.
Tab
tab will show list of everything that matches everything typed
Brute-Force Attack
Most powerful and also the slowest.
Enterprise Admins
Most powerful group because it has full control over every domain in a forest.
MCS
Multi-Category Security
MU-MIMO
Multi-User Multiple-Input and Multiple-Output. Great for real-time communications over wifi.
MLS
Multilevel Security
Policy Statement
Must be clear, concise and SMART. Should contain the guiding principles of who, what, where, when, why. Should be consistent with law, regulations. Consistent with other levels of policy. Should be uniformly enforced, current, readily available, good version control.
Sensitive Information
Must reside on private network. Not visible from Internet.
Sefl-encrypting HDD
Must support TCG Opal 2.0 and IEEE-1667 and motherboard must support UEFI Secure Boot to use BitLocker for access control.
Network File Sharing (NFS)
NFS supports file sharing for Unix-based networks.
snort
NIDS to determine scope of compromise has built-in sniffer
NIPS Developments
NIPS can clean up garbage in network traffic. Example of server waiting to close a TCP connection with workstation. Some NIPS also support QoS.
FDCC
NIST Federal Desktop Core Configuration
john | grep mode
See list of mode in John the Ripper
Schema
Defines all possible types of objects and their attributes in the directory.
Configuration Naming Context
Defines all sites, subnets, and inter-site replication links.
Property-Level ACLs
Delegation of Authority can be controlled based on properties. Each property has its own DACL
Performance Testing
Demonstrates the architecture and resources provided are sufficient for web app's needs. Can also help determine what thresholds exist and what risks might be present of DoS attacks.
IDS Challenges
Deployment including topology and access limitations; analyzing encrypted traffic; quantity vs quality of signatures; peformance limitations with extensive analysis techniques; very costly for proper management.
Servermanagercmd.exe
Deprecated in favor of PowerShell command get-windowsfeature.
scw.exe
Deprecated. Moved into Server Manager tool in Server 2016. Not available in client OSes.
Procedure
Detailed steps to be followed. Mandatory. Explains how to carry out policy. Very detailed.
NIDS
Detective. Layer 7.
Eradication
Determinate root cause, not symptoms
Pen Test
Determine the scope
Pen Test Approach
Determine the scope, information gathering (similar to recon in attack process), scanning, enumeration, exploitation.
XFCE
Lightweight Desktop Environment. Requires fewer packages than Gnome.
LDAP
Lightweight Directory Access Protocol. Cleartext uses TCP3268. SSL-encrypted used TCP3269. LDAP uses Kerberos for authentication. LDAP is the default protocol for searching and editing the AD database.
Wireless Network Mapping Mitigation
Limit RF leakage and use strong authentication adn encryption.
Command Injection
Linux
GPG
Linux
Hashing
Linux
John the Ripper
Linux
Malicious Software
Linux
Nmap
Linux
Snort
Linux
aircrack.ng
Linux
hping3
Linux
tcpdump
Linux
Kismet
Linux and BSD Unix tool. Passive wireless sniffer, wardriving tool, vulnerability assessment tool, and IDS. Completely passive. As IDS, Kismet can identify malicious activity, including DoS, MitM and attacks against protocols. Can be deployed in client/server infrastructure, using the kismet_drone tool. Can also be integrated into Snort using Snort rules.
cd
Linux and Windows change directory
LUKS
Linux hdd encryption. Provides secure management of user passwords. LUKS volumes.
AppArmor
Linux kernel module that uses static analysis and machine learning to learn behaviors of apps, enforce security policies and detect 0-day threats. Can limit the capabilities of programs and has the features of an IPS.
Init
Linux original boot time starter service that only runs in linear. Init process starts as Process ID 1. It checks and mounts file systems and starts necessary services. Its the parent process to all other processes and adopts all orphaned processes in the user space. Using Init requires a reboot of the whole system when system changes are made. Init deals with services only during startup and shutdown.
OS Market Share
Linux runs most security appliances. Over 90% of all computers run Windows.
&
Linux. Run command background.
Security Log
List of Key Event ID Numbers
SIEM/Log Management
List of Terms, p161. Security Incident and Event Monitoring, p181 used for aggregation and correlation of logs, p181.
Windows vs Linux Cmds
List of commands
Token-Based Access Control
List of objects and their privileges (called capabilties) with each user, the opposite of list-based access control.
Active Directory
List of things stored in AD
Logical File System
Lists common conventions of directories
tcpdump --help
See most commonly used tcpdump switches on p44 of Workbook.
ps
See services running on a system and identify rogue processes. Not continuous like top. Use to establish a baseline. Good for threat hunting too.
802.11
See specs on p195
swapon -s
See swap partition current use.
whoami.exe /priv
See what privileges you have.
Protected Enclave
Segment of internal network defined by a common set of security policies. Anything you do to segment your network with switches, firewalls, routers, VPNs is part of this concept. Its a way to reduce the exposure or visibility into your network.
Cost Benefit Analysis
Select cost-effective and business appropriate countermeasures.
SDCs
Self Driving Cars
Package
Self-contained set of precompiled binaries that include all dependencies that are needed to run the software.
EnOcean
Self-powered wireless monitoring and control systems. Energy savings, flexibility.
Servicing Channels
Semi-Annual (Targeted) receives feature updates immediately. Home edition is locked into this one and cannot defer updates. Others are Semi-Annual, Windows Insider, Long-Term Channel. Semi-Annual (regular and Targeted) can defer feature udpates for up to 365 days or can apply them immediately. Semi-Annual Channel have to wait 4 montsh before automatic installation of feature updates.
hping3 -S 10.10.10.10 -p 21 -c 1
Send one SYN TCP packet to 10.10.10.10 port 21.
Bluejacking
Sending unsolicited message via Bluetooth to mobile devices.
Data Owner
Senior Management is ultimately responsible for appropriate data classification. Data Owner is in charge of data classification.
/bin/false
Setting a target module to /bin/false is a good convention for disabling it.
SMB
Sever Message Block protocol
nestat -l
Show all listening ports. Output on 176 and 184.
nestat -a
Show all ports.
nbtstat.exe -A
Shows NetBIOS connections.
ps -ef
Shows all running processes. Output on 181-182, 184, 199.
nmap --help | more
Shows some of the switches on p115. See scan techniques listed on p117. Timing options p118. Output options p119.
id
Shows your UID.
Android Oreo
Significant security changes in Oreo.
Object Storage Encryption
Similar to volume volume storage encryption. Employs Virtual Private Storage. Types of object storage encryption are: file/folder encryption, client/application encryption, proxy encryption.
Virtual Machine Software
Simple emulator for a computer created in software.
Workgroups
Since each computer is standalone, infected computer is less likely to infect others.
Snare
Singl machine Windows to syslog conversion
WSUS
Single WSUS server can handle 10,000+ computers. Can be load-balanced. Use TLS for WSUS over HTTPS, but HTTP is supported.
Tunnel VPN
Site-to-Site VPN
Clustering
Situation where plaintext message generates identical ciphertext message using same transformation algorithm, but with different crypto variables or keys.
Tcpdump
Sniffer
tcpdump
Sniffer tool for Unix-based systems, also ported to Windows as windump. Universally used and portable.
Virtualization, benefits and uses
Speeds up failover. Key components can be isolated and contained to reduce exposure. Ease of use and portability. Cheaper to scale. In 1960s, IBM created first fully virtualized systems.
Network Segmentation
Split computer network from the rest of the network with a switch, bridge, router, hub to boost performance and security.
VLAN Hopping Attack
Spoof 802.1Q tags to hop over to a different VLAN.
STP Attacks
Spoof BPDUs
IUSR
Special built-in account used by IIS Server for anonymous authentication.
SMART
Specific, Measurable, Achievable, Realistic, Time-Based.
SMART
Specificic, Measurable, Achievable, Realistic, Time-based
File Generation
Stego. Hide message by generating a new file. No host file is needed.
ESI
electronically stored information
Endscript directive
end of file in Logrotate.conf file.
find
find specific files
Shadow File
Lists username, encrypted password, password/login rules that control aging and expiration.
LKMs
Loadable kernel modules
LKMs
Loadable kernel modules. Gaining access and using LKMs is a good way to add rootkits.
Discretionary Access Control
Users manage the data they own. eg Windows workgroups and Linux file permissions.
scwcmd.exe
cli version of SCW. Used on Server OSes. Great for auditing and creating a GPO from an XML policy file.
scwcmd.exe
cli version of Security Configuration Wizard (scw.exe).
TCP Reset Attack
Attacker spoofs source IP, port, destination and sequence number in the packet and includes RST bit to terminate the session.
nodev
Device files are ignored in the file system. Files found in /dev and /devices are not allowed to communicate with the system drivers
RC4
Encryption protocol that was used in 802.11 WEP, SSL and TLS.
EFS
Encryption utility used by NTFS.
Object Auditing
First, enable Audit Object Access in computer's audit policy, Then, you configure the individual object SACL.
Gradm
Grsecurity utility to manage RBAC.
Zero Power HA (ZPHA)
HA device will reroute traffic if the IPS loses power.
HUP signal
kill -l <pid>
Permission Bits
"
Database Monitoring
"A more complete and rigorous test would involve a recurring process that logs in as a valid user, performs a transaction or query within the application, and checks to see whether the expected result is returned."
Package Manager
"APT, RPM, Yum. A Package Manager is a collection of software tools that automates the process of
Injection
Stego. Hide message within file's unused space. Increases file size. No theoretical limit on how much data can be hidden.
IDS Evasion
Attackers attempt to obfuscate traffic to get past IDS by changing characteristics of the traffic sent to exploit a particular vulnerability.
HIDS
"Uses signature and anomaly analysis with unauthorized change monitoring, log monitorign, and network monitoring. Organizations can reap significant benefit by correlating the data across multiple sensors with centralized alerting. Network monitoring uses signature analysis to identify EOI. Can monitor outbound and inbound traffic to detect pivoting, internal recon, lateral movement and C2. Can provide info NIDS can't see, eg analysis of unencrypted traffic streams, p140. Can be deployment nightmare and $$$, p141. HIDS technology now used to monitor configuration and status of network appliances, p 143.
Reverse Engineering
Technique used to reverse encrypted passwords. More commonly used for generating software license keys.
logrotate.conf
Tell log server to retain all received and local logs for at least 120 days.
Automatic Demotion
"Automatic Demotion to Guest occurs when Simple File Sharing is enabled.
IP
"Doesn't guarantee delivery or delivery in sequence. Includes fault tolerance features: TTL, checksum, ToS, fragmentation
Wireshark
"Examples of sniffers page.
Hash
"Goal is integrity. MD5, SHA, RIPEMD, HMAC. One-way transformation (no way to decrypt), irrversible. Key length is hash length. Fixed length output is often referred to as key length. Hashing proves document didn't change.
Password Cracking
"Offline process of attemping to guess passwords given password file information. Can be used to find non-compliant passwords without cracking compliant passwords.
HIPS
"One of major benefits is ability to identify and stop known and unknown attacks, p145. Uses a combination of signature analysis and anomaly analysis to identify attacks, p145. False positives are a problem, but less so on a distributed scale, limited support for protecting custom apps, additional burden, 10%-20% CPU and memory usage on hosts, p147.
Vulnerabilities
"While threats drive the risk calculation, vulnerabilities drive the risk reduction." Weaknesses in the system. They are inherent in complex systems. Always will be present. Poor coding practices and lack of error checking. Gateway by which threats are manifested. 2 categories: known and 0-day. 5 vulnerability axioms: 1 vulnerabilities are the gateways through which threats are manifested; 2 vulnerability scans without remediation have little value; 3 a little scanning and remediation is better than a lot fo scanning and less remediation; 4 prioritizing systems and vulnerabilities is critical; 5 stay on track. CNSS 4099 "weakness in an IS, system security procedures, internal controls, or implementation that could be exploited." eg Misconfigured server leaving a port service open without requiring authentication.
Boot volume
%SystemRoot% usually \Windows contains OS files. BitLocker can encrypt this volume.
NIPS Challenges
Organizations can't afford false positivees; NIPS have to keep up with traffic demands; NIPS tend to have less-extensive rule bases than IDS.
Promiscuous Mode
Tells computer NIC to accept every frame regardless of whether MAC address matches or not
Audit Privilege Use
(Failure)
Audit Account Logon Events
(Success, Failure)
Audit Account Management
(Success, Failure)
Audit Directory Service Access
(Success, Failure) On DCs, this required to log access to AD objects as defined by those individual audit settings.
Mandatory Access Control
Controls all access. Controls set by system and cannot be overwritten by sysadmin. Takes a lot of work to maintain b/c all data has classification and all users have a clearance.
missingok
Tells logrotate to continue to the next file if file doesn't exist.
Substitution
Stego. Message is hidden by substituting the least significant bits in a document. Limits to how much data can be hidden Can result in file degradation.
RoboCopy
CLI tool for copying and moving files. It does not use Volume Shaddow Copy Service, so it cannot copy files that are continually locked.
Micro-Segmentation
Concept implemented by SDN to analyze and filter traffic between endpoints.
schtasks.exe
Task Scheduler. CLI, PowerShell or MMC.
IPSec, Windows Implementation
Encrypts traffic but more importantly, it requires mutual authentication, which SSL does not. Can be managed through Group Policy or PowerShell, p227.
windump
Tcpdump ported to Windows. See tcpdump
Preparation, Incident Handling
Planning is everything. Preparation plays a vital role. Its very important to have a policy in place that covers and organization's approach to dealing with an incident.
Reconnaissance
Provides visibility into your orgnaization and insight into how the adversary will target you.
RPM
RedHat Package Manager, used by Fedora
TKIP
Temporary Key Integrity Protocol built into 802.11i WPA2. Works with CCMP . See WPA2.
Log Parsing
grep, cut, sed, awk, auditd
WPA2
Uses AES-CCMP encryption mechanisms to improve security of 802.11 networks. Requires a hardware replacement to upgrade to it.
Traceroute
Uses ICMP time exceeded to count hops as it follows a path to destination host.
Tracert
Uses ICMP time exceeded to count hops as it follows a path to destination host.
Server Nano
110MB. Server 2016 or later. No shell or desktop. Only a console to configure basic networking and firewall changes. Primary method for remote contol of Nano is PS.
Partitions
16 different partitions /hda0 through /hda7. 3 reasons to use partitions: makes it difficult for one subsystem to affect another by locking down partition to fixed size; backing up partitions is easier; you can set different security options on different partitions.
Log Size, Wrapping, and Consolidation
1MB holds 7,500 events. Recommended size is at least 50MB to start.
SSH/TLS Key Management
2 options listed: KeyBox and Puppet.
Syslog facility codes
24 facility codes. Local0-Local7 used most often. Common facilty codes are kern 0, user 1, daemon 3, auth 4, syslog 5, auth priv 10.
Bluetooth
2Mbps, up to 7 simultaneous connections, no LoS requirement. Class 1 supports 100 meters, Class 2 supports 10 meters, Class 3 supports 1 meter. Bluetooth v5 doubles the speed and quadruples the range. 2Mbps
OS Classes
3 Classes of Windows OS are Client, Server and Embedded
Network Design
3 goals: 1- any system visible from the Internet must reside in the DMZ and cannot contain sensitive information; 2- any system with sensitive information must reside on the private network and not be visible to the Internet; 3- only way a DMZ system can communicate with a private network system is through a proxy on the middleware tier, p36
Uneeded ports
3 ways to control and close unneeded ports: Comment out (#) uneeded services in /etc/inetd.conf; disable option (yes) in /etc/xinetd.d; comment out or set to NO in /etc/rc.conf.
Privilege Elevation
3 ways to elevate privileges: anonymous login with root account, which is not recommended; su command to gain superuser access, allowing normal user to switch to root; sudo command which allows normal user to run command with root privileges, which is the best for auditing and nomal user doesn't need to know root password.
dumpusers.exe
3rd party audit tool that uses null session
Authentication
4 ways to authenticate: something you know; something you have; something you are; some place you are.
Server Core
5GB size. Server 2008 or later.
Access Control Techniques
6 Common Types: Discretionary Access Control, Mandatory Access Control, Role-Based Access Control, List-Based Access Control, Token-Based Access Control.
MAC Address
6 byte value. 48-bit address. 12 hexadecimal digits. First half vendor code Cisco 00:00:0c. Hardware address.
Bitlocker TPM Operations
6 ways to implement BitLocker. Backup your Bitlocker Recovery Password!
802.11ac
6.9Gbps. MU-MIMO. Major performance boost over 802.11n.
Log Reports for SIEM
7 Top Log Reports: Authentication, Changes, Network Activity, Resource Access, Malware Activity, Failures, Analytics Reports
Super Bluetooth
802.11ad short-range < 10 meters uses ISM band 60GHz and provides 7Gbps throughput, no latency.
Sytem Call Interception
A technique used by HIPS software. It inserts its own processes between applcations accessing resources on the host and the actual OS resources.
Exclusive Analysis
A measure of log monitoring that uses a list of keywords or phrases as a white list of events. Log entries that don't match the exclusive keyword list are raised as alerts.
Inclusive Analysis
A measure of log monitoring that uses a list of keywords or phrases that define the events of interest. The keyword list is a blacklist.
Log Analysis
A measure that can be implemented by any organization at little cost. Used with HIDS reporting. See exclusive analysis and inclusive analysis.
File and Print Sharing
A network binding that should be disabled on computers directly connected to the Internet.
Decoy IPs
A network device, eg router, can be configured to respond to ping sweeps, making it appear that all IPs are active. VMs can be used to reply back on certain IPs.
Multiresolution Filtering
A technique that uses rule classification to quickly sort through traffic in order to rapidly identify malicious events. IPS will start with simple tests first. If it passes, the traffic is given more complex tests.
SQL Injection
A vulnerability that is exploited by insufficient input validation, which allows attacker to execute arbritrary SQL commands usually through an authorized web server application database account. It can also lead to OS compromise eg SQL server commadn xp_cmdshell stored procedure. Some web scripting languages like PHP with magic_quotes turned on automatically escape user-supplied data, but don't rely on that alone. Validate user input and filter special chaactures and SQL commands, eg ' and ; and : and ". Set max lengths on input. Use stored procedures instead of SQL queries. More defenses listed p149.
Multi-Master Replication
AD uses multi-master replication to share information among all controllers in the domain.
Advanced Packaging Tool
APT is a Debian packag management tool based on dpkg
Log Monitoring Strategy
Decision Tree.
VM Escape
Ability to compromise a system once and be able to access all other VMs. VM escape removes isolation between VMs and host. Guest escapes from sandbox and his able to access supervising hypervisor and its resources
Virtualization
Ability to emulate hardware using software. Allows hardware and software to decouple from each other. Key component is the ability for abstracting and emulating specific hardware components, which is done by the hypervisor.
AUP
Acceptable Use Policy
ACE
Access Control Entries
Access Control Entries (ACEs)
Access Control Entries are individual permissions stored in DACL. Manage with ICACLS.exe or in Security Tab Special Permissions. Gray-checked ACEs are inherited and solid-checked are explicitly assigned.
ACL
Access Control Lists on border router help firewall.
AGULP Model
Accounts, Global Groups, Universal Groups, Local Groups, Permissions & Rights. Unique Account is assigned to Global Group. Global Group is assigned to Universal Group. Global/Universal Groups are assigned to Local Groups. Local Groups are assigned Permissions & Rights.
Cryptanalysis
Act of obtaining plaintext or key from ciphertext. Used to pass on altered or fake messages to deceive intended recipient.
Detective Control
Action of tracking down the threat
ADHD
Active Defense Harbinger Distribution
Sprawl Management
Actively manage virtual environment. Know what's used. what's needed and what's not.
ARP
Address Resolution Protocol RFC826
ASLR
Address Space Layout Randomization prevents buffer overflows. Part of MacOS RunTime protection (p20). Use sysctl to enable ASLR for individual programs (p103). Use PaX to improve ASLR.
Known Vulnerabilities
Address with aggressive patch management.
Procedure
Addresses how to protect information in a detailed step-by-step way. Tactical.
Administrative Templates
Administrative Template settings are found under both Computer and User Configuration in the GPO. If there's a conflict, Computer Configuration setting usually wins.
Hidden Share
Administrators have full control. Registry entry listed. eg, C$
Misc ADM Settings (Adobe)
Adobe provides ADM/ADMX templates to import into GPOs
APT
Advanced Packaging Tool used in Debian (eg Ubuntu, Kali)
APT
Advanced Persistent Threat. See Advanced Persistent Threat. See Threat Agents.
QRadar
Advanced Sense Analytics Engine to detect advanced threats through network anomalies.
NMAP
Advanced host discovery, port and protocol mapping, vulnerability analysis framework.
Scanning
Advanced probing of the target for vulnerabilities that can be easily exploited. Network mapping, port mapping, vulnerability scanning, OS fingerprinting, war dialing, wireless scanning.
Incident
Adverse event in information system and/or network. Refers to harm or the significant threat of harm. Incident is composed of one or multiple events.
Tarpits
Aggressive technique that will send information to adversary's computer, causing it to use all of its resources or behave in a slow manner. Most common tarpit is manipulating TCP window size to really small or periodically setting to zero.
Security
All about understanding, managing and mitigating risk. What is the risk? Is this the highest priority risk? Is this the most cost-effective way of reducing the risk?
Forest, AD
All domains in a forest share a single Schema and Configuration Naming Context.
Trusts, Two-Way Transitive
All domains in a forest share two-way transitive trusts between them. Every domain in the forest trusts every other domain in the forest.
DAD
All for Windows to syslog logging
Source Routing
Allows IP packets to specify routing. Can be used to bypass firewall and other protections. Should be disabled by default.
Virtual Machine Introspection
Allows administrator to monitor all events within a virtual environment so any unusual behavior can be caught early. Specifically designed to have minimal effect. Eg hypervisor can check memory, system events, malware detection, especially when malware is designed to avoid antimalware detection. Can detect malware actions designed to avoid antimalware detection, since behavior is observered from outside.
Virtualization
Allows for better utilization of resources, but it could also create security concerns. Ability to emulate hardware using software.
Resource Sharing
Allows for simplified exchanges between VMs as well as their host OSes. This flexibility introduces risk. eg clipboard
Virtual Private Storage (VPS)
Allows users to access data over a shared infrastructure while protecting data, similar to a VPN. Uses encryption keys. File/folder protection, client/application encryption, proxy encryption.
Honeypots
Also known as sensors or canaries. Goal to slowdown basic host discovery. Honeypot is a single system. Research honeypots' goal to research systems with deliberate or known weaknesses. Production Honeypots: hardened systems to replicate a production system.
Hybrid Attack
Also uses wordlist and has configurable settings to account for password complexity policies.
NTFS DACLs
Always enforced, even with local users, IIS HTTP and FTP, RDP, SMB shared folders, PowerShell Remoting.
Virtual sprawl
Condition in an operating environment where number of VMs in existence reaches a point where they are no longer effectively managed or secured. Can happen through mismanagement and understaffing. Mitigated with right policies and automation.
System on a Chip (SOC)
Architecture for small Windows Server appliances
Cryptography
Art and science of inventing and refining ciphers to hide the meaning of communications. Big Picture diagram on p14. Thre core components of cryptography: 1-info is protected at rest; 2-info is protected in transit; 3-keys are properly protected and managed, p15. Goals of cryptography are confidentiality, authentication, integrity and non-repudiation.
War Dialing
Attack to find internal systems still attached to modems.
TCP Connection Spoofing
Attacker has to predict ISN the destination host will choose.
Supply Chain Attack
Attacker intercepts hardware or software and installs malicious components or publishes malicious APIs.
CDP Manipulation
Analyze packets and gain info. Leverage known vulnerabilities.
Android vs iOS
Android is open and iOS is closed. Android has more functionality and more security issues historically. Android has 2/3 market share (69%)
Annualized Loss Expectancy (ALE)
Annual expected loss based on a threat. ALE = SLE x ARO
Offensive Countermeasures
Another name for Active Defense.
Slice
Another name for partitions
Threat
Any event that can cause an undesirable outcome.
Client/Application Encryption
App is embedded with engine encryption to protect data. Eg mobile apps.
PaaS
Appeals to Devs
IaaS
Appeals to SysAdmins
SaaS
Appeals to users. Eg O365 and OneDrive.
Hardware Security Module (HSM)
Appliance to manage your encryption keys. Allows RMS and other Azure servicess to access your data in a plaintext form as necessary. In theory, M$ can't access your keys.
TCP/IP
Application OSI 5-7, Transport (TCP) OSI 4, Internet (IP) OSI 3, Network OSI 1-2. p143 shows Partial TCP/IP suite and how it maps to OSI model. IP maps to Layer 3 and is responsible for determining route to be taken between two network devices, handles flow control, segmentation/desegmentation, error control functions. See IP for more details.
API
Application Programming Interface. Hardware Abstraction Layer. Cloud APIs allow virtual plaforms to locally leverage resources of powerful remote apps. Using server-side apps, APIs can access libraries and repositories from a variety of programming languages. APIs server as building blocks of many sophisticated applications.
chroot()
Application isolation feature enabled on app-by-app basis. Containers and Virtualization. Some apps now provide preconfigured chroot() areas. Problem is that chrooted app may has to have access to dependencies placed in its chroot directory.
Service
Application that either waits in the background or carries out special tasks in the background (Linux.com). Its a process that starts on boot and provides critical functions (stackexchange)
Containers vs VMs
Applications run on the same OS with the same kernel. More scalable. Apps will run the same in all environments. They are isolated to achieve a level of security. Lightweight, fast-to-launch server that shares OS files of hosting server in a sandboxed way. It can have its own IP, MAC address and private view of the file system.
Standard
Applied to the organization as a whole. Specifies a certain way something is done or certail brand or type of equipment to use.
gradm -F -L /etc/grsec/learning.logs -O /etc/grsec/policy
Apply output file as policy.
Honeytoken
Approach of creating fake protected data with labels that are set to trigger an alert from IDS if attacker attempts to exfiltrate. Easiest and most cost-effective honey deceptive technique, p215.
Defense-In-Depth (DiD), Network Design
Approach that advocates use of multiple layers of protection to guard against failure of a single security compromise. Separating systems into several network sections is one example. Configuring firewall to restrict how traffic crosses section boundaries is another. A border router is a third. Fundamental principle is that you're not relying on any single security mechanism to cause single point of failure, p38.
BCP Key Components
Assess (BIA), Evaluate, Prepare, Mitigate, Respond, Recover.
Role-Based Access Control
Assigns users to roles or groups based on their functions. Groups are assigned authorization to perform functions on certain data
NIDS Advantages
Assists in auditing.
List-Based Access Control
Associates a list of users and their privileges with each object. Each object has a default set of privileges that applies to unlisted users.
Binding, IIS
Associates each site with its certificate
Circuit Level Gateway
At Layer 5 Session. They filter TCP handshake, but not individual packets. Good for screening private network.
Permissions
Attached to a particular object, eg Read access to a file.
Honey Badger
Attack Back tool. Determines physical location of a system. Uses geolocation, wifi and IP. Pretends to be an administrator interface. Runs java applet on the local machine.
Hardening Guides
Automation of hardening can make security of systems more scalable and auditable. But, they can be dangerous if applied blindly.
Input Attacks
Avoid making system calls within web applications, especially when the system call is based on user input. Used built-in app functions or library within your programming language instead. Strip OS commands and characters from input. Define valid characters for input. Delete all others from input.
OS Command Injection
Avoid making system calls within web applications. Used built-in app functions instead. Strip OS commands and characters from input. Define valid characters for input. Delete all others from input.
Azure AD PIM
Azure AD Privileged Identity Management
Rights Management Service (RMS)
Azure Rights Management Services for O365 is a DLP feature to encrypt data files in case of file leak
Azure ASC
Azure Security Center
Maintaining Access
Backdoors, persistent processes, creating accounts, covert channels.
BITS
Background Intelligent Transfer Service
Type 1 Hypervisor
Baremetal hypervisor. Reduces attack surface b/c its a stripped down OS. Original hypervisors developed by IBM were Type 1. Common ones today are XenServer by Citrix, VMWare ESX, M$ Hyper-V.
Security as a Service
Barriers are compliance, multi-tenancy and vendor lock-in. Multi-tenancy presents concerns of data leakage between virtual instances. Providers should take extra precautions to ensure data is compartmentalized and any data shared is anonymous to protect the identity of the source.
Authorization
Based on least privilege, where entity is only given minimal access to do the job.
CIA Triad
Confidentiality (vs Disclosure); Integrity (vs Alteration); Availability (vs Destruction). Security and Functionality are inversely related.
Policy
Baseline Framework Pyramid, top down: Policy, Standards, Guidelines, Procedures. Policy is general management statement. Defines the "what" to do in order to protect information. Safeguards information while reducing personal liability for staff. You must have executive and user buy-in. Security policy statement should strongly reflect the management's beliefs that if information is not secure, the business will suffer. Policy is a mandatory directive, that indicatates a conscious decision to follow a path toward a specified objective, p71
Indicators of Compromise (IoC)
Baseline a system using ls, ps and netstat to identify and mitigate adversaries trying to install programs, run daemons/services, make outbound connections.
Anomalies Detected
Baselines help sift through noise. Visualizations help identify outliers easier.
Shell examples
Bash, sh, csh, sh, ksh, tcsh, Windows cmd.exe and powershell.exe, DOS command.com.
HTTP Authentication
Basic mode: credentials sent in cleartext Base-64 encoded, see process p177. Digest Mode: Sent in MD5 hash of password.
Threat Hunting Types
Basic, Statistical Analysis, Visualization Techniques, Simple Aggregration, Machine learning, Bayesian Probability.
Bayesian Probability
Bayesian statistics is a theoretical computation where facts about a given state are expressed by degrees of belief. It takes complex data patterns and tells you the important information about them.
Risk Management
Before you begin managing risk, you need to understand business operations and what types of risk they might be exposed to, p202. Goal of risk management is identify, measure, control, and minimize or eliminate the likelihood of an attack, p202. An understanding of how security is implemented in your organization and how security threats affect your business operations. Main focus is to reduce the risk to an acceptable level, p203.
Isolation
Being able to separate OSes and applications is one of the key benefits of virtualization.
Virtualization Security
Benefits are isolation to handle application instability, resilience and high availability, automation, data governance, forensic analysis b/c you can make an exact copy of a physical computer. Lack of air gap can be an issue p55.
Social Engineering
Best-known techniques are urgency, impersonation and third-party authorization.
Overall Security
Better visibility, reducing the attack surface, controlling the damaage, early detection. What is the risk? Is this the highest priority risk? Is this the most cost-effective way of reducing the risk?
Journald
Binary logger used by Systemd instead of syslog.
BET
Blackhole Exploit Toolkit
Hybrid Cloud
Blend of Public and Private models
Controlled Folder Access
Blocks changes to protected folders from untrusted apps. Requires Windows Defender A/V to be enabled and real-time protectection turned on.
BNEP
Bluetooth Network Encapsulation Protocol
IoT
Bluetooth v5 designed for IoT performance and functionality.
XOR
Boolean Exclusive XOR is one of the fundamental operations in cryptography. One or other is true (1), but not both (0)
Separation of Duties
Break critical task across multiple people to limit your points of exposure. No single person can make a decision.
Bridge
Bridge makes a decision about whether a frame should be sent to other port.
Equifax Breach
Confidentiality and Integrity attack on Apache Struts vulnerability that allowed for remote code execution.
wslconfig.exe
Configure WSL to run multiple distros of Linux side-by-side
Directed Broadcasts
Broadcasts sent to target sbunet without broadcasting to entire network. Used in older DoS attacks. Should be disabled or at least restricted.
SaltStack
Built for speed in the cloud. Also known for reliability, security, modularity and scalability. Uses public crypto to secure two-way communications between main configuration server and client servers. Many well-known cloud providers offer integration into Salt Cloud.
Guest Account
Built-in account. If DC or computer doesn't know account, then they may login the account as a guest. Best to assign long passphrase and disable it. Net.exe user guest <longpassphrase> /active:no /times:
Auditing
Built-in auditing, automates security checks making auditing a part of your infrastructure will simplify the review process.
IPC$
Built-in share for inter-process communications and should not be modfied. Registry setting.
IP Tables
Built-in to the Linux kernel. More than just a firewall, its a complete packet inspection system.
BCP
Business Continuity Planning
BIA
Business Impact Analysis
BRP
Business Resumption Planning
Locking User Accounts after failures
By default, most Unix systems don't lockout accounts after set number of login attempts. Use /etc/pam.d/system-auth to enforce account lockout after too many failed attempts. Set no_magic_root so that it's not applied to root account.
Virtual Ethernet Adapters
Connect virtual systems to each other or to a virtual switch. Configure them to interact with specific virtual switches.
Switch Attacks
CDP manipulation, MAC flooding, DHCP spoofing, STP attacks, VLAN Hopping Attack, Telnet Attack
Whisker
CGI Web Vulnerability Scanner Tool.
SMB vs CIFS
CIFS is SMB plus a few enhancements. Both protocols allow for folders and printers to be shared on network. Shared folder permissions are enforced by File and Print Sharing Service no NTFS filesystem driver.
Center for Internet Security (CIS)
CIS configuration benchmarks provide best practices for hardening OSes to protect endpoints. Provides security templates for OSes.
Reg.exe
CLI regedit
fc.exe
CLI to compare 2 files
wecutil.exe
CLI to manage Windows Event Collector
winrm.vbs
CLI to manage Windows Event Collector
Public Cloud
CSP owns infrastructure.
Shared Folder Permissions
Can be accessed from Network Neighborhood, Mapped Drive Letters, Run Line or Shortcuts.
DNS, bogus entries
Can be combined with other active defense methods to mislead and slow down adversary. Can redirect adversary to honeypots, jailed environments or tarpits.
Entity Relationship Diagram
Can be helpful in trying to analyze what entities must be used to implement a particular control.
Web proxy
Can be used for MitM attack. App sits between client computer and web server.
WLAN IDS
Can implement rogue AP countermeasures to DoS discovered rogue APs.
Network Obfuscation and Virtualized Anti-Reconnaissance (NOVA)
Can launch several decoy VMs and manage them with a centralized management tool. Various VMs are called haystacks. VMs run honeyd as the honeypot engine. Used as an early warning system.
Rapid VM Deployment
Can lead to virtual sprawl.
SSL VPNs
Can work in essentially any web browser. Browser must be able to handle specific types of active content (eg Java, JavaScript, Flash or ActiveX). Tunnels are usually created using a nonstandard tunnel method.
CSE
Canadian Security Establishment
Air Gap
Cannot physically isolate VMs that are hosted on same Hypervisor. Hypervisor provides a software connection between VMs it hosts.
airodump-ng wlan0
Capture wireless frames
Database Activity Monitoring (DAM) Tools
Captures and records all SQL activity in real-time and generates alerts on policy violations. Mitigates SQL injections attacks. DAM tools are usually agent based connecting to central collection server.
CSMA/CD
Carrier Sense Multiple Access with Collision Detection
CSMA/CD
Carrier Sense Multiple Access with Collision Detection. Listens before transmitting to avoid collisions.
Vector
Categories of attack. Can be internal or external. Outsider attack from network. Insider attack from local network or local system. Attack from malicious code.
ro
Causes kernel to prevent writes or updates to given file system.
Centralized logging
Central server should only receive logs from only authorized machines and firewalled from all others. Several partitions can be used for logging to segment the risk of a DOS. Aslo rotate logs quicker and/or have lots of disks to weather DOS. Only run syslog service on central server and limit logins from sysadmin IPs.
Apache2syslog
Centrlization of Apache logs via syslog
CA
Certificate Authority
CRL
Certificate Revocation List
Certificates
Certificate lifecycle, p115.
Containers vs VMs
Containers require fewer resources than VMs.
CFA
Controlled Folder Access
Enabing Password Aging
Controlled in two config files: /etc/login.defs and /etc/default/useradd. In most Unix OSes, the password-expiring and password-rotation features are disabled.
Router Hardening
Change default password, disable ip directed broadcasts, disable http configuration, block ICMP ping requests, disable ip source routing, determine and establish packet filtering, establish ingress and egress filtering policies, maintain physical security of the router, review security logs, upgrade to latest IOS.
Chgrp
Change group ownership.
Rotation of Duties
Change jobs on a regular basis to prevent anyone from being able to get comfortable and cover their tracks. Minimizes chance of collusion.
Chown
Change user ownership.
Chkrootkit
Check Rootkit looks for suspicious processes and known bad files. Common false positive is mail server Port 465. Don't rely on this alone. Script that uses grep to search for signatures and compares list of /proc filesystem with output of ps command to look for discrepancies.
Handling Errors
Check for error conditions and handle errors gracefully, even ones that should never happen.
CBC-MAC
Cipher Block Chaining Message Authentication Code
SAFER+
Cipher used by Bluetooth algorithm for encryption and authentication, usually using 128 bit keys and 4 digit PINs that users often set to easily guessed numbers. Can support 256 bit keys.
Threat
Circumstance or event with potential to adversely impact a system, p37. Any activities that could potentially affect CIA of your systems or services. Protect against most likely threats based on: intellectual property, business goals, validated data, past history. Primary Threats: malware, insider threat, APTs, natural disasters, terrorism. Threats drive the risk calulation. CNSS-4009 "any circumstance or event with a potential to adversely impact an IS through unauthorized access, destruction, disclosure, modification of data, and/or DoS" p37. Two types of threats: intentional and unintentional.
Endpoint Security
Clear visibility is imperative, and organizations today are not doing a great job with detection.
cls
Clear your screen in PowerShell.
SSL/TLS
Client and Web Server use PKI asymmetric to negotiate a session key symmetric.
Group Policy
Client downloads and applies GPOs at bootup, logon and every 90-120 minutes. Enable auditing and IPSec settings here. AD Group policy will overwrite the local group policy every 90 minutes by default.
Disaster Recovery
Client should not depend on single provider and should have a DR plan in place. IaaS providers should have contractual agreements with multiple platform providers and have tools to rapidly restore systems in the event of loss.
HEAD
Client uses HEAD to retrieve information from the server. Similar to GET. Server will check if information requested is there and respond. Won't send over all information requested. Used to save bandwidth and client resources for large information reququests.
Transport VPN
Client-to-Site VPN. Between two hosts, p100.
CSP
Cloud Service Provider
Cryptosystem
Collection of all possible inputs and all possible outputs, in addition to the algorithm and keys. Humans are a part of a cryptosystem.
Snapshots
Collection of data that documents the configuration and running state of a system at a given point in time.
Rootkit
Collection of software tools that work to cloak the existence of malicious files and tools that have been installed by manipulating files, disabling AV and opening backdoors.
secedit.exe /analyze
Comapares setttings of .inf Security Templates.
Directory Traversal Attack
Combination of flawed access control and input attack.
C&C
Command and Control
C2
Command and Control
auditctl
Command used to audit system calls. See list of switches and uses of auditctl on p161 and 163.
Domain Tools
Commercial. Threat Hunting. DNS reserach and analysis tool
Endgame
Commercial. Threat Hunting. Full platform that supports detecting, mitigating and exploiting cyber vulnerabilities and attacks.
Sqrl
Commercial. Threat Hunting. Secure automated login mechanism that enforces authentication.
Carbon Black
Commerical. Threat Hunting. Detection of malicious anomalies and malware.
Malware Bytes
Commerical. Threat Hunting. Endpoint security tools for detection and remediation of malware, including rootkits.
Grsecurity
Commericially packaged set of patches for Unix kernel designed to enhance security with true role-based access control, creating full least-privilege system. Hardens file system and includes more audit logging capabilties. Includes PaX. List of features p111.
CNSS
Committee on National Security Systems
CIFS
Common Internet File System protocol
CVE
Common Vulnerabilities and Explosures
Binding, Network
Communications path between networking component like service or protocol and physical network adapter.
Private
Company's internal systems. Do not provide access to these systems from the Internet. They contain sensitive information.
OS Enhancements comparison
Compares features of grsecurity, AppArmor, SELinux
Effective Permission
Comparison of final share permission and final NTFS permission. Deny always wins.
PKI Problems
Competing/incomplete standards, certification of CAs, etc
GPO Checklist
Complete list of recommended GPO settings for best security practices. Baseline.
GPO Settings
Complete list of recommended GPO settings for best security practices. Baseline.
Stack Management
Complete stack management focuses on end-to-end connections within the virtual environment to ensure there are no gaps.
Critical Security Controls (CSC)
Controls centered on root cause analysis. You cannot manage what you cannot measure. 15 of the 20 controls can be monitored automatically or continuously. Guiding principles: Defenses should be automated and measured at regulary intervals using automatation; Undertake a variety of specific technical controls (instead of operational controls) to address current attack landscape; fix root cause problems to prevent or detect attacks in a timely fashion; establish measurements of security program effectiveness and to form a common language to talk about risk. 3 control priority families: system controls, network controls; application controls, p100. Key rules are each control has to map to actual known attack; if a known attack does not exist, it cannot be a control; "offense must inform defense."
Innocent Infringement
Copyright idea that someone may use work w/o understanding it belongs to the author, if the author doesn't display a copryight notice.
Kernel
Core component of OS, referred to as the brains, manages the hardware and executing processes. It must have a dedicated space in memory to reside.
Risk Management
Core focus is CIA Triad.
nbs
Correlate and Alert
Propietary (Business Classification)
Cost of procuring, profit margins, contact lists, etc. Contracts, financials.
CCM
Counter with CBC-MAC
CCMP
Counter-Mode/CBC-MAC Protocol. Protocol built into 802.11i WPA2. Works with TKIP. See WPA2.
Software Defined Network (SDN)
Covers network technologies that make the network as flexible and agile as a virtual machine or virtualized storage.
Disaster Recovery Plan (DRP)
Covers the restoration of critical information systems that support the business processes. Its a part of BCP, p161. DRP provides a response to disruption, wherease BCP implements the recovery, p160.
aircrack-ng SEC401_WEP.cap
Cracks WEP key found in pcap file.
New-NetIPSecRule
Create an IPSec rule
Tripwire
Creates a cryptographic hash value of a file. If file is modified, the tool can detect a change because the new hash is different than the original hash.
Take Ownership
Creator Owner is owner of file or folder. Usually the person who created it. Audit who uses this privilege. Greatest threat to least privileges principle.
Form-Based Authentication
Credentials entered and sent as HTML form data. Common to see <INPUT TYPE>= "PASSWORD"> tag. Secure form-based authentication requires a secure channel, eg SSL.
CSC
Critical Security Controls
Security Association
Critical part of IPSec. They document common services, called transforms, that are particular to an IPSec connection.
/etc/crontab
Cron daemon (crond) works way through /etc/crontab file every minute to see if there is a task for it to perform at a scheduled time.
Codes
Cryptographic transformation that operates at level of words or phrases
Cipher
Cryptographic transformation that operates on characters or bits.
Cryptology
Cryptography and cryptanalysis
Advanced Persistent Threat
Cyber espionage is more likely to use APT strategy. APTs can be multi-year, mutidimensional and are often highly targeted. Key property: Stealth. Unlike APTs, traditional threats are known for being automated, consistent and opportunistic.
STIG
DISA and NSA Security Technical Implementation Guides
Data Loss Prevention (DLP)
DLP identifies, monitors and protects data at rest, data in motion, data in use using deep content analysis. DLP enforces this in two ways: blocking data to stop a workflow and allowing data flow to proceed after data has been encrypted.
Semi-Public
DMZ. Resources that are our contributions to Internet. Must be reachable from the Internet and also need Internet access (eg DNS, email). Cannot contain sensitive information.
DNS Sinkhole
DNS server that gives out false information
Data Classification
Data Classification is the responsibility of the Data Owner, Sr Management. Data Classification Process: 1 Identify roles; 2 Identify classification and labeling criteria; 3 Owner classifies the data; 4 Identify exceptions to the classification policy; 5 Specify the controls for each classification level; 6 Identify declassification, destruction, or transference procedures; 7 Include an enterprise awareness program about data classification.
DLCI
Data Link Connection Identifier Frame Relay address with 10 bits
DLP
Data Loss Prevention
DLP
Data Loss Prevention. If you encrypt your data, you cannot use this feature.
Honeycreds
Decoy accounts to distract an attacker. Often named for wellknown default system accounts that usually have privileged access.
NTFS
Default file system. Up to 256TB max volume size
Data Fragmentation
Data fragmented and distributed acorss multiple remote servers. Used for storing long-lived data in the cloud with high assurance. Combined with encryption, its very resistant to compromise because attacker has to defeat many cloud nodes to retrieve fragments.
Steganography
Data hiding. Provides confidentiality but not secrecy. It doesn't guarantee safety. Hide data within data, eg images, Word docs, sound files, mpegs, text documents, fractals, HTML files, p44.
Encapsulating Security Payload (ESP)
Data integrity. No modification of data in transit. Confidentiality, data can be encrypted. Origin authentication, identifies where data originated.
Authentication Header (AH)
Data integrity. No modification of data in transit. No confidentiality. Origin authentication identifies where data originated.
Big Data
Data warehouses that many customers find easier to store in the cloud.
DAM Tools
Database Activity Monitoring tools
Active Defense Types
Deception, Attribution, Attack Back
Secrets
Don't build secrets into your code.
Session Tracking Mechanisms
Don't make your own. Use off-the-shelf libraries that are well-maintained and time-tested.
GPO Updates
Downloaded automatically at startup, shutdown, logon, logoff, every 90-120 minutes.
Prevention is ideal, but detection is a must.
Dr. Cole quote
libcap
Driver interface used by tcpdump
Network Access Control (NAC)
Dyanamic VLAN allocation. Isolates systems when they initially connect. Enables systems to be scanned and checked before connecting them to trusted segment.
DLL
Dynamic Link Library allows apps to share codes and procedures
Loadable dynamic modules
Dynamic loading modules are more vulnerable to rootkits than loadable kernel modules, no reboot required. They increase flexibility
EAPOL
EAP over LAN used to encapsulate frame between 802.1x supplicant and authenticator. Authenticator encapsulates EAPOL in RADIUS request to Authentication Server.
Encapsulation
Each layer of TCP/IP protocol stack adds a header as the packet moves down the stack
Decapsulation
Each layer of TCP/IP protocol stack strips off a header as the packet moves up the stack
MySQL
Easy relational database good for storing logs. Use to store logs.
Tractable Problems
Easy to solve in polynomial time
Tractable Problems
Easy to solve in polynomial time. Symmetric Encryptions. Eg, Constant problems, linear problems, quadratic problems, cubic problems. Calculation of any standard ciphertext is a tractable problem. Eg Data Encryption Standard (DES).
Low Orbit Ion Cannon
Easy to use attack tool
Metasploit
Easy to use tool
RF-Jamming
Easy way to DoS a 2.4GHz or higher wifi network. Used against 802.11, Bluetooth and other networks. Bluetooth is less susceptible b/c its on FHSS instead of DSSS/OFDM.
Wireless Top 5 Security Risks
Eavesdropping, Masquerading, DoS, Rogue APs, Wireless Phishing.
False Headers
Eg, add deceptive web server identity information to HTTP header.
ediscovery
Electronic aspect of collecting data for compliance, lawsuit or investigation. Collect ESI (electronically stored information) from web, email, social media, voicemail, video, etc.
ECC
Elliptic Curve Cryptosystems
PKI Uses
Email, hdd encryption, code and driver signing, wifi authentication, NAC/NAP, digital signatures, etc
Hidden Fields
Embedded state information in an HTML form. A little harder to implement. Info isn't displayed to user. They aren't hard to alter and can be viewed by View Source command in browser.
Process Enforcement
Enable IT-specific virtualization processes to increase in efficiency and simplify management.
airmon-ng start wlan0
Enables and disables wireless interface monitoring
modinfo
Enables you to see what modules do
autrace
Enables you to trace the process of a binary and have it bind to an ausearch
ESP
Encapsulation Security Payload
Encryption Key Management
Encryption means your data could never be created or edited using any O365 apps, which defeats the purpose. Also means you can't use keyword indexing, document/message searches, legal e-discovery, DLP filtering, Cortana calendar management, etc.
Overlap partition
Entire hdd geometry. Usually the third slice (/hda/2?) of the. Orginally had to be third because first had to be root and second had to be swap space. Do not use for file systems.
Jailed Environments
Environment, eg VDI, can be created to look like real VDI environment, but its contained and controlled with no real data.
Trust Zones
Establish trust zones for different deployed environments. Similar to security classifications or levels of sensitivity. Each VM should fall into a security category regardless of its function and this is where it should reside on the ntwork with appropriate access controls for appropriate levels of security. Don't span trust levles within a physical host is golden rule of secure virtualization design. Minimize what runs on host. Only use as host.
Security Policy
Establishes what you must do to protect information. Used to help identify, measure and evaluate how. Strategic.
Annualized Rate Occurrence (ARO)
Estimated frequency at which a threat is expected to occur.
Windows Event Collector
Event data is sent over SSL and uses Web Services Management protocol to push and/or pull data from monitored systems.
EOI
Event of Interest
Event of Interest (EOI)
Event of Interest is some activity that is flagged by the IDS, which generates an alert.
EOI
Events of Interest
Application Analysis
Exclusive-based, identifies anomalous conditions on the network after it has a complete understanding of the protocol/application and how it operates. IDS learns normal network activity. Then, any use of the protocol or application that doesn't match the IDS' understanding of normal functions is reported. Protocol activity that is unknown is flagged. Difficult to implement and expensive.
runas.exe
Execute command with elevated privileges
Metasploit
Exploitation toolkit to help identify whether vulnerability exists or its a false positive.
PFX file
Exported certificate and private key
ESR
Extended Support Release
ESR
Extended Support Release is a version of Firefox that will only get bug fixes and security patches, not new features, for at least 54 weeks.
EAP
Extensible Authentication Protocol
EAP
Extensible Authentication Protocol. EAP types are authentication protocols that are part of authentication framework 802.1x.
FIDO
Fast Identity Online, 3rd party MFA tool. Can be used in browsers for authentication.
Shallow Packet Inspection
Fast but little fidelity. In practice, its used with deep packet inspection. Eg source and destinatino address and port information from headers; specific ICMP error messages; undesirable TCP flag combinations (SYN/FIN); impossible fragmentation combinations (gaps, overlaps); packet size information (too small UDP packets)
DES
Fast encryption algorithm. Symmetric key, 64-bit block cipher. 56-bit key size. 4 DES operation modes: ECB, CBC, OFB, CFB. DES and 2DES are not secure. Since DES is not a group, multiple encryptions increase security.
Feature & Quality Updates
Feature Update 180 days. Quality Updates smaller monthly.
Reuse Attack Protector (RAP)
Feature in Grsecurity
Application Behavior Monitoring
Feature of HIPS where a manufacturer selects a supported app and records the intended functionality in normal use. Its difficult to get right because apps are constantly changing functionality with updates and new releases.
Package Management
Features listed on p236: download validation, installation of dependencies, binary format; standard locations for installation, user experience components and verification of installation.
FIPS
Federal Information Processing Standard
FIC
File Integrity Checking
OneDrive
File storage in Azure SaaS
System volume
Files needed for boot-up process
Rainbow Tables
Files produced from precomputed password hash values used by the cracking tool to quickly lookup hash values and corresponding plaintext passwords
D-Bus Interface
Firewall D-Bus allows applications to adapt firewall settings.
netfilter
Firewall replaced by nftables.
nftables
Firewall, subsystem of Linux kernel to provide classification and filtering of network packets. Replacement for netfilter.
HTTP Request
First part of HTTP conversation, initiated by client. May include Host: Header.
Gaining Access
First real milestone of an attack is gaining access or getting a shell.
ls -ld /sbin/su /etc
Forces ls to display file attributes for actual directories listed, eg /sbin/su and /etc
AD Forest and Trust
Forest is one or more AD domains. Trusts link domains together in a forest. Cross forest trusts are entire forests trusting other forests.
Baseline
Foundation for evaluating policy. Documentation Baseline for Policy, p69. Its a more specific implementation of a standard and tends to include more technical details. Usually a baseline starts as a guideline until its properly modified to meet the needs of the organization. eg hardening rules for a new server start as a guideline and become a baseline.
Azure AD Connect
Free M$ AD sync tool with SHA256 hashed and salted password protection.
Ansible
Free application that's more feature-rich and easier to manage than free Puppet. Includes software deployment, task execution and CM using a main controller machine that talks to "nodes," controlled machines with JSON protocol over SSH. Excellent choice for consistency, stability and overall security.
Wireshark
Free, Threat Hunting. Network monitoring and packet analysis tool.
Passive DNS
Free. Collect and analyze DNS for threat hunting.
Bro/Zeek
Free. Framework for network monitoring used for forensics, metrics, NIDS. Threat Hunting.
Python
Free. Threat Hunting. Script for automation.
Autoruns
Free. Threat Hunting. Windows tool that shows you what tools automatically run at startup.
FHSS
Frequency Hopping Spread Spectrum
Defense-In-Depth (DiD), Primary Section
From outer to inner: policies, procedures, awareness; physical; perimeter; internal network; host; application; data. 4 approaches to defense-in-depth: Uniform protection; protected enclaves; information-centric; threat vector analysis. Information-Centric Defense-In-Depth, outer-to-inner: Network; Host: Application: Info p17.
FVEK
Full Volume Encryption Key encrypts/decrypts all sectors of Bitlocker-protected volume. This is not needed on self-encrypting HDDs.
FTE
Full-time equivalent. Cost of one full time employee.
Enumeration
Further extension of scanning process. Identify exploitable vulnerabiltiies of the system. List file permissions, user accounts on open ports, idle ports and other system items used for entry into the system.
Global Catalog Server (GC)
GC special DC that replicates AD database in forest
GECOS
GE Compliant OS (GECOS) stores metadata. Used by John the Ripper to crack password.
GPG
GNU Privacy Guard
Grep
GNU regular expression text filter. It can match on anything except newline.
GNU
GNU's not Unix :-P
GNU Privacy Guard (GPG)
GPG provides two protections for email: confidentiality through encryption and message integrity and source identification through digital signatures. Uses a hybrid of symmetric and asymmetric encryption.
GPO
GPO can manage security settings not included in INF security template. GPOs are stored as ADM/ADMX and are more comprehensive than a local .INF security template. Settings from Computer Configuration tend to take precedence over User Configuration section of GPO Administrative Templates. GPOs
Regedit.exe
GUI regedit
windiff.exe
GUI to compare 2 files. Also works from CLI.
Threat Intelligence
Gathering and correlating inforamtion about the adversary to better understand how they work and operate. Driven by forensics, analysis and third-party sources.
Privileges
General capability that is not tied to any particular object. Manage them through GPOs.
Syslog-ng
General purpose logging, reliable delivery. Use to collect logs.
Business Resumption Planning (BRP)
Generic term used to refer to the actionable plan that coordinates efforts to restore an organization to normal working order.
NIST IR 7298
Glossary of Key Information Security Terms
Asymmetric Keys
Goal is authentication. RSA, ElGamal, ECC. Public key. Dual or 2-key encryption. Slower than symmetric. Used as a secure channel for public key exchange. Technical non-repudiation via digital signatures. Primary uses are key exchange (for symmmetric encryption), authentication and non-repudiation, p31. Employs trapdoor function, p32-33. Public key crypto proves it was the recipient who created the document.
Symmetric Keys
Goal is confidentiality, privacy. DES, 3DES, IDEA, AES, RC4, RC5. Techniques are substituion (XOR, rotation, arbitrary substitution), permutation, hybrid. Secret key. Fast. Doesn't scale well. No technical non-repudiation. Pre-shared key. Requires a secure channel.
Digital Signature
Goal is non-repudiation. Asymmetric + Hash.
Attribution Active Defense
Goal to identify and find out details about the adversary. Useful for incident response. Valuable if legal action is desired.
Egress Filtering
Good IDS technique. You can use your firewall log files to track dropped egress traffic. You're a better net citizen.
CLI commands
Good for CMD batch scripts
Recon
Google, chat rooms, dark web, company website, system documentation, theHarvester, Whois, Shodan, Host command.
GPMC
Group Policy Management Console
Rings (M$)
Group of computers assigned to a particular servicing channel with a particular update deferral period.
Domain Local
Groups that get replicated through AD and can be used on any computer
Classification Levels, Business
HR and management sensitive; Trade Secrets, manufacturing proprietary; Business Proprietary, contracts, financials; Public Releasable.
HTTP Request and Response
HTTP is stateless and transaction-oriented. Client sends a Host: header, specifying which domain the request is for. Clients use PUT to upload files. The client request includes a header stanza that follows the request and can include any piece of info Some requests include a body, which may include a POST to fill out form data (ie HTTP PUT).
Compression
Handled by the NTFS driver itself, which makes compression transparent to the user.
NTFS driver
Handles compression, which makes compression transparent to the user.
Rowhammer
Hardware exploit that manipulates physical memory to escalate user privileges and escape VM isolation.
TPM
Hardware-based crypto. Handles cryptography calculations and key storage.
Unidirectional Gateways
Has multiple NIC that handle data handoff to software controls. Layered solutions that rely on software components to gather data, and then send to an appliance with physical one-way data flow capability.
Integrity Check Value (ICV)
Hashed value to ensure integrity of packet. AH hashes every field in packet that doesn't change in transit (eg doesn't hash TTL). ESP only hashes information in ESP message.
md5sum < file1.txt
Hashes file1.txt with md5
sha1sum < file1.txt
Hashes file1.txt with sha1
Precomputation Attack
Hashes of possible passwords are precomputed and stored in a database called a rainbow table. Tthe hashes are matched with password, which take a fraction of the time it'd take to brute-force a hash.
Virtual Switches
Have several forms: embedded within the virtual software, included as firmware on the server and virtual ethernet adapters.
Issue-Specific Policies
Help clarify organization's security posture. They provide clear guidance on many topics within the company. Covers specific areas such as: authentication, monitoring, physical security, backups, disaster recovery, acceptable use, audit and assessment, incident handling, employee and contractor access, employee monitoring, and awareness training.
HTTPS Tunneling of RDP
Helps prevent MitM attacks, improves encryption and is firewall-friendly (ie helps users get around firewalls blocking 3389).
VLANs
Helps with least privilege
Elliptic Curve Cryptosystems
High security levels with low key lengths, high-speed processing, low power and storage requirements. Eg uses in resource-constrained environments: mobile phones, smart cards, wireless communications, electronic cash, ATMs. Growing popularity. Cracking only in poor implementations with small key lengths.
LogRhythm
High-end SIEM. File Integrity Monitoring agent. Provides unprecented anomaly detection.
Conceptual Design
High-level design that includes core components of network architecture
Histograms
Histograms are graphical representations of the number of occurrences of data in a given distribution. A histogram of an encrypted document shows the frequency of characters is normalized, which makes it easy to detect. High entropy indicates encryption, p49.
OSSEC
Host based IDS focused on tracking and identifying indicators of compromise. Active alerting capability when alteration is made to a key file. Generates email alerts too. Integrates with SIEM.
Samhain
Host based IDS with ability to centrally monitor logs. Rootkit detection and port monitoring.
HIDS
Host-based IDS
Trade Secrets (Business Classification)
How products are created. R&D.
kismet
IDS and wireless network sniffer
Data Normalization
IDS takes a baseline of data before before analysis.
Tripwire
IDS through integrity checking. Open-source and commercial. Creates secure db baseline of file and directory attributes. Verified with SHA.
Online Certificate Status Protcol (OCSP)
IETF recommends as a replacement for CRLs. Real-time notification of revoked certificates.
RD Web Access
IIS Server provides web portal for roaming users. Supports SSO and other features.
Passive Analysis
IPS uses passive analysis to reduce false positives. Passive analysis identify host OSes, network architecture, and vulnerabilities present in the network. This information helps IPS classify attacks to internal systems.
RFC 2401
IPSec
IPv4 vs IPv6
IPv4 no authentication, no built-in encryption, best effort transport. IPv6 provides authentication of endpoints, support encryption in protocol, QoS features provided.
IPSec Phase 1
ISAKMP channel established. Privacy. Main Mode (checks identify of endpoings) of Aggressive Mode (does not, which is fine if using PKI to setup VPN}
Azure
IaaS and PaaS. VMs and containers running Windows and Linux. Its M$'s cloud infrastructure. Azure AD can be used for SSO across a who's who of websites.
ldd
Identify app dependencies. Handy for setting up chroot directory.
Access Control
Identity, Authentication, Authorization, Accountability, p29. Least privilege, need to know, separation of duties, rotation of duties, p30. Models that deal with protecting sensitive data or assets to ensure confidentiality and integrity, p27.
Simple File Sharing
If Simple File Sharing is enabled, then all remote authentication to the computer will be treated as remote access by the Guest Account. This is called automatic demotion to Guest.
HIDS vs network firewall
If packet is allowed, then HIDS will forward packet up protocol stack and network firewall will forward it.
Copyright
If two parties agree that a written piece of work is for hire, then the rights become that of the owner. US Library of Congress interpretation is followed in slide.
Meet-in-the-Middle Attack
If you have both the cleartext and corresponding ciphertext, you can perform this attack on 2DES.
IPS
Implementing IPS behind a firewall allows you to narrow down your search of infected internal systems, p102. Deploying IPS between the firewall and ISP router ensures the firewall and DMZ servers are protected, p102. To detect the greatest number of attacks without false positives, NIPS tools use passive OS fingerprinting and vulnerability, p103. Since they're inline, IPSes have the ability to fail open.
Cost-Benefit Analysis
Important to show that high-priority risk and the solution is the most cost-effective for reducing the risk.
Data Dispersion
Improves data security without use of encryption mechanisms. Can provide HA and assurance of data stored in the cloud.
Authenticator
In 802.1x, the Authenticator either provides or prevents network access to Supplicant. It handles challenge and response, but forwards credentials to backend Authentication Server (usually RADIUS). An Authenticator is usually a switch or AP.
Supplicant
In 802.1x, the Supplicant attempts to connect to the network. Its the client device.
Rotate Directive
In logrotate, it tells how many copies of logfile to keep.
apt-get install <package-name>
Install specified software will all associated dependencies.
yum install syslog-ng
Install syslogNG package.
Core Server
Installation option that only provides command shell, nothing else. Drive footprint 2-4GB
IR
Incident Response
Law Enforcement
Incident Response--Preparation: Have a list of phone numbers for each agency you might need to involve.
Logical Design
Includes all major network components plus their relationships. For developers and security architects. Includes business services, application names, and other relevant info for development purposes. Understanding communication flow and knowing where valuable data is begins with the logical architecture.SANS401 GSEC INDEXBookPageComments
Anomaly Analysis
Inclusive-based, meaning IDS vendor identifies conditions that are anomalous through its analysis of the protocol and its expected behavior. Only those conditions identified are reported by the IDS. It requires an understanding of what "normal" is. Baseline of network is performed. Can catch 0-day exploits.
Switch
Increase security by reducing visibility.
IoC
Indicators of Compromise
Threat Agents
Individual or organization that's capable and motivated to carry out an attack. How active is each threat agent? How might a successful attack serve a particular threat agent's goals? 3 broad categories of threat agents: criminals, esponiage, hacktivists.
ISM
Industrial, Scientific, Medical radio
Infected System
Infected systesm are a giant integrity problem. Main strategy for fixing and infected system is rebuilding it from scratch.
IaaS
Infrastructure as a Service gives clients ability to rent IT infrastructure compoenents from a public cloud provider.
Upstart
Init alernative. Supports parallel booting of services. Upstart introduces jobs, events, and emitting services.
Runlevel
Init runlevels: 0 shutodwn; 1 single-user; 2 multiuser; 3 multiuser w/ networking, 5 starting w/ display manager and graphics; 6 reboot. Used on System-V, not BSD distro.
Starting Services in Linux
Init, Upstart, Systemd, Cron
ClientHello
Initial SSL/TLS message sent from client to the server. Includes list of CipherSuites client supports.
ISN
Initial Sequence Number
IV
Initialization Vector
Stegonagraphy Methods
Injection, substitution, file generation.
aireplay-ng
Injects and replays wireless frames
Intel VT Technology
Integrated some of Blue Pill functionality into the Intel VT Technology.
IP
Intellectual Property
IPC
Inter-process communication
ICV
Intergrity Check Value
IETF
Internet Engineering Task Force
IKE
Internet Key Exchange
ISAKMP
Internet Security Association and Key Management Protocol
Pivot Points
Intial point of entry gives adversary a foothold in your network.
Risk Analysis
Involves determining the risks and their impact on the infrastructure. When determining what types ot threats your enterprise could be exposed to, its vital that information security professionals spend time assessing how they might be attacked. All possible threats must be considered. After creating a list, determine if they are actually viable threats to the enterprise. "Identifying likely vectors and entities that pose a risk to the business."
Virtualizaton Benefits
Isolation of OSes and apps. Small attack surface of Type 1 Hypervisor code. HA. Quick quarantine for out-of-compliance systems. Resiliency. Can backup the whole machine, not just the data on it. Virtual appliances can be spun up quickly for one or two functions. Reduces attack surface.
Keybox
KeyBox is open-source and has 2FA integration within web interface with Google Authenticator and FreeOTP.
Intellectual Property (IP)
Know where your valuable data is.
Resource Protection
Knowing your vulnerabilities is a critical stage of resource protection
LSPP
Labeled Security Protection Profile
Multilevel Security (MLS)
Labels are an attribute of MLS systems, which are based on Bell-LaPadula Mandatory Access Model. MLS is used in Labeled Security Protection environments (LSPP).
Physical Design
Last design created before final implementation, includes known details of OSes, version numbers and relevant patches. Also includes physical constraints or limitations identified within server components, data flows or connections.
Logrotate
Later definitions overwrite earlier ones. Linux packages expect to be able to include logrotate config files in /etc/logroate.d.
Hyperjumping
Lateral compromise where attacker jumps from guest OS to another. Uses one guest OS to compromise another. Doesn't compromise the Host OS or Hypervisor.
Frame
Layer 2 data chunk transmitted by Ethernet over the wire.
Ethernet
Layer 2 protocol. Shared media. It is a CSMA/CD protocol.
Packet Firewall
Layer 3. Fastest, cheapest and weakest. Think router with ACLs (including established). Simply looks at TCP flags, but doesn't inspect them. No state inspection of ACK flag set. Vulnerable to ACK scan.
TCP
Layer 4 is responsible for transmission of data between two endpoint systems involved in communication. Issues related to reliability and cost-effective data transfter belong to this layer. p153 TCP Header.
Stateful Firewall
Layer 4. Keeps track of TCP connections in a stateful tracking table. UDP an ICMP traffic is added with a timeout duration. Stateful firewall isn't able to differentiate between legitimate Port Unreachable messages from an attacker sending tis same traffic to an internal host, so it'll blindly accept the traffic.
Proxy Firewall
Layer 7. Essentially tears down packet layer by layer on one interface and builds it back up on the opposite interface.
Protocol Stack
Layers of protocols that allow computers to communicate
List dynamic dependencies
Ldd tools identifies application's depdendencies.
gradm -F -L /etc/grsec/learning.logs
Learning mode for grsecurity
LSB
Least Signicant Bit
NetBIOS
Legacy set of connectionless and connection-oritented protocols used for name resolution. Can be disabled 90% of the time.
Client-to-Client VPN
Less common. Most secure. Doesn't scale well. See Transport VPN.
5G
Less than 1ms latency compared to 4G's 25ms. Must provide connections that are 100x faster than current speeds to accomodate IoT devices like self-driving cars, robot-aided surgeries.
Netcat
Lets you see raw connection, including header information.
XFCE
Lightweight Desktop Environment
Antivirus Software
Many vendors are calling their products endpoint security software/suites.
Critical Security Controls Standards Mapping
Maps which NIST controls map to CSC
Risk Evaluation
Match threats and known vulnerabilities, calcuate ALE. Estimate risk from unknown vulnerabilities.
Trapdoor Function
Mathematical function that are easy to calculate and hard to calculate inverse. Eg multiplication vs factorization and exponentiation vs logarithm
msf exploit show options
Metaploit framework showing Apache struts exploit that that takes advantage of XStream's failure to do input validation
NetFlow
Method of collecting IP traffic and monitoring network traffic. Using flow-based analysis, relying on algorithms and behavior rather than signatures, helps you detect 0-day attacks.
Black Box Diagramming
Method of depicting a device, system or object only in terms of inputs and output without requiring knowledge of its internal workings. Simplifies the characteristics of the network during the design phase.
Pen Testing
Method of evaluating the security posture of a computer system or network by simulating identified attacks by a malicious user, known as a hacker.
Deception Active Defense
Method that creates less legal concerns. Honeypots. Activity to mislead and slow down the adversary. Can increase time and difficulty of pen tests.
Signature Analysis
Most commond method of identifying EOI. Performs pattern-matching on packets based on rules. Rules use criteria based on protocol, address and port info, payload contents, string matching, traffic flow analysis, flags in protocol headers, any fields in the packet.
Azure Global Administrator
Most important role. Can assign, reset and delete all other roles. aka Company Administrator
Internal Threat
Most organizations focus on external threats, but internal threats often cause the most damage.
Password Policy
Minimum pw length 15 chars; Pw history 24 pws; Max age 90 days; Min Age 1 day; Max length 127 chars. No gui for custom pw policies. Use PowerShell.
Telnet Attack
Misnamed. Really a distributed SYN attack. Windows OS has an accessible telnet executable taht can setup a TCP session. Popular DOS attack with botnet operators.
Mission Statement
Mission statement is operational. States the purpose of your organization. You need an approved mission statement to move forward with policy. Mission statement is at top of policy pyramid.
DHCP Spoofing
MitM attack wher attacker listens to DHCP requests and answer them with an IP Address pretending to be default gateway.
Office Mobile
Mobile versions of M$ Office apps. Free but limited.
/etc/syslog.conf
Modify this file on host to send its log files to another server
Web App Monitoring
Monitor web content and use a file integrity checker. Integrate checks with SIEM. Build and maintain a custom monitoring tool using Perl or Python scripts.
Critical Control #2 Software Inventory
Monitor with file integrity checking tools; use app whitelisting; deploy software inventory tools; use VMs or air-gapped systems to isolate and run apps that are required for business but pose a high risk to the network.
File Activity Monitoring
Monitors and records all activitity within designated file repositories at the user lever. Generates alerts on policy violations. Requires an endpoint agent of phsyical appliance between cloud storage and cloud consumers.
Frequency Analysis
Monolithic cipers or one-to-one ciphers can be broken with this technique.
Lynis
More robust and detailed than Bastille. Good for standalone systems that need to comply with regulated frameworks like SOX, HIPAA, PCI DSS, etc. Audits for authentication methods, expired SSL certs, outdated software, patches, user accounts w/o passwords, incorrect file permissions and firewall rules.
Discretionary Access Control
Most Linux variants use DAC enabling the sysadmin and users to manage the security on files they own or manage. Its possible for a DAC system to be default deny or default allow.
Attack Back Active Defense
Most aggressive step. Has legal implications.
Uniform Protection
Most common approach to defense-in-depth and usually the starting point for most organizations. Treat all systems as equally important. All parts of the organization and intellectual property receive equal protection. Eg patching.
One-Time Passwords
Most common way to implement OTPs are token-based devices liek SecurID tokens. Good countermeasures against keyboard and network sniffing.
Eternal Blue
NSA toolkit used in WannaCry attack.
NTLMv1
NT LAN Manager LANMAN old protocol for authentication. Best to decommission.
Encryption
NTFS uses EFS and BitLocker to support encryption.
Regsvc.exe
Name of key to modify for remote registry service permissions.
winreg
Name of key to modify for remote registry service permissions. HKLM\System\CurrentControlSet\Control\Secure\PipeServers\winreg\
CNSS 4009
National Information Assurance Glossary
NIST
National Institute of Standards and Technology
IPSec Phase 2
Negotiates details of ESP and AH SAs. Primary Mode or Quick Mode.
nc.exe
Netcat ported to Windows.
nc.traditional 127.0.0.1 333
Netcat tool is a network sutility that allows you to connect to TCP Port 333 on localhost. Also connects to UDP ports, transmits files, an executes commands.
Honeynet
Nettwork of decoys designed to deceive and slowdown adversary.
NAC
Network Access Control
NFS
Network File Sharing
NLA
Network Level Authentication
NLA
Network Level Authentication for RDS prevents DoS attacks against servers by requiring the client to authenticate before server memory is allocated.
NOVA
Network Obfuscation and Virtualized Anti-Reconnaissance
nmap
Network scanner.
NBS
Never Before Seen
Advanced Application Shielding
New feature introduced in HIPS that essentially locks an app into a sandbox where its not permitted to communicate with other apps.
nft add rule ip filter output ip daddr 10.10.10.10 drop
Nftables rule to drop packets destined for 10.10.10.10.
Border Router
Placed between ISP and firewall. Can be used to filter traffic that is obviously unwanted, like invalid traffic RFC1918 sourced from Internet. Also helps protect firewall from attack by taking some of burden off it.
NOEXEC
Noexec prevents processes from making exec systems calls. They have to sudo. Part of MacOS RunTime protection. Part of Grsecurity.
System Restore Points
Not enabled by default in Windows 10. Snapshots computer's configuration. Checkpoints from 1-3 months.
Sticky Bit
Now allows for world writeable directory, but owner is the only one who can delete files in that directory. N/A to files. Only applies to directories. Real-world example is /tmp has sticky bit set so that anyone can write to it.
Autopilot
OEM-customized device that allows for the device to automagically get upgraded, joined to Azure AD.
OSI Layers Map to Network Security Devices
OSI Map Tab
at.exe
Obsolete way to see scheduled tasks
Block Cipher
Obtained by segregating plaintext into blocks of n characters or bits and applying the identical encryptiong algorithm and key to each block.
Session IDs
Often stored as a hidden form element, part of the URL query string, or in a cookie. Can be exploited by session attack. Best to use cookies.
dropmyrights.exe
Old 3rd party executable DropMyRights literally drops the rights of an application from unrestricted to normal, constrained, or untrusted.
Enum
Old standalone binaries, labeled as a hacker tool but not likely to cause vulnerabiltities.
Bluebugging
Older hardware implementations. Manipulates target phone into compromising its security. Installs a backdoor. Calls back to attacker who can eavesdrop on phone calls. Can also create call forwarding.
Bastille
Older standalone tool meant to be a tutorial for hardening your Linux system.
cfEngine
Oldest CM tool. Open source and commericial versions available. Started as local datacenter tool. Now more cloud-based. Has a monitoring and modeling compliance engine.
Ingress Filtering
On a firewall, all inbound packets are dropped if they contain a source address from within the network address space
TrueCrypt
On the fly encryption (OTFE). Deprecated.
Telnet
Plaintext. Use SSH
Threat Assessment
One input into risk analysis. Analyze the cost effectiveness of countermeasures for reducing exposure.
File System Hardening
One of features in Grsecurity
Kernel Auditing
One of features in Grsecurity
Trusted Path Execution (TPE)
One of features in Grsecurity
POST
One of two most common HTTP methods. Appends the form data inside the HTTP Request, embedded HTML Header. Better for sensitive data.
GET
One of two most common HTTP methods. Client uses GET to retrieve information from the server. Requests data from the specified source. Appends the data to the URL, so its visible in the URL. Not safe for sensitive data.
Arbitrary Subsitution
One-to-one substitution of characters. Easy to crack with frequency analysis.
Rotation Substitution
One-to-one substitution of characters. eg ROT-3 Caesar Cipher and ROT-13 appeared on Usenet. Easy to crack.
OCSP
Online Certificate Status Protocol
RSA
Only been cracked with poor implementation using too small key lengths. Used in SSL.
cut -f 2-4 data.txt
Only display fields (aka columns) 2-4
Need to Know
Only give person access when they need it. Take away access when it is no longer required.
get-winevent -logname system -maxevents 500
Only show last 500 events in System Log. Script and send files to collector (eg SIEM)
Logstash
Open source solution for log aggregation, pipelining, and storage.
PaX
Open sources memory protection utility for the kernel and other memory protections. Improves ASLR, protects against arbitrary code execution, code execution in a different order, code execution with malicious code. Best to run it with grsecurity because of tight feature integration.
Docker
Open standard single applcation LXC containers. Docker is an evolutionary enhancement of LXC that has moved away from LXC and now has its own libcontainer framework based on Go. Single process and stateless based containers.
LXC
Open standard to create containers. Has security to isolate apps using several kernel features to achieve this. Overcomes the limitatio of chroot by containing all required components. Can run on a single OS. Between chroot and full virtualization. Key features are cgroups and namespaces.
GNU Project
Open-source OS that Linus Torvalds partnered with. GNU/Linux is the real name of Linux OS. 2% of Linux kernel is still Torvald's code.
Chef
Open-source centrally-managed DevOps tool that can push and control versions of code. Adds an abstraction layer (Chef Server and Chef clients). Works onsite, in the cloud and hybrid.
Graylog2
Open-source log management and SIEM. Can normalize and correlate logs with searches you build and alert on. Easy to setup and use. No prebuilt anomaly detection rules, alerts or searches.
Process Hacker
Open-source process manager tool to analyze services, device drivers, listening TCP ports, disk activity, and other Windows internals.
LOGalyze
Open-source solution. Easy to deploy, offers a dashboard, reporting and searching capability. No prebuilt anomaly detection rules, alerts or searches.
Snort
Open-source tool, low-cost, suitable for monitoring multiple sites/sensors, efficient detect system, low effort for reporting. 5 rules: pass, log (snort.conf), alert, activate (listens for alert and then activates dyanamic rule), dynamic (inactive until another rule activates), p93.
Private Cloud
Organization owns hardware infrastructure that supports and houses the cloud systems.
Standard
Organizational, strategic. Focuses on what technology to use. Usually refers to specific hardware and software.
Puppet
Originally devops tool written in Ruby. Open Source and Commerical versions available. One of most popular.
OFDM
Orthogonal Frequency Division Multiplexing
/bin, /opt
Other places where apps may be stored
netstat
Output 174 and 184.
df command
Output of command. 5-10% of hdd is reserved, so Use% includes that unwritable percentage too.
top
Output on p186-193.
tail
Output on p194-197.
netstat -s
Output. Statistics.
netstat -at
Output. TCP
netstat -au
Output. UDP.
Windows PS vs PS Core
PS 5.0 is frozen, legacy. Core is open-source and the future of cross-platform Azure management.
set-MpPreference -EnableControlledFolderAccess Audit Mode
PS enable CFA in audit-only mode
get-WmiObject
PS equivalent of wmic.exe
get-ciminstance
PS equivalent of wmic.exe
get-service -computername keithbox
PS query list of services
Set-ItemProperty
PS regedit
Compare-Objects
PS to compare 2 files
get-ciminstance -query "select * from w32_bios*
PS to extract BIOS information from WMI
get-help -full get-windowsfeature
PS to get help with features
show-EventLog
PS to launch event viewer
import-module servermanager
PS to manage server roles
get-windowsfeature -computername Server47
PS to see features on remote server47
paxctld
PaX memory protection utility.
dpkg
Packagement mangement tool that APT is based on.
Endpoint Firewalls
Packet Filter (Stateful), Application Control and OS Control. Packet Filter looks at packets from network to PC. Application Control Firewall can screen incoming packets and keep a set of fules for applications. OS Control is most flexible and won't allow a program to run or access the Internet without approval.
Swap Partition
Page file for the virtual memory system. Originally had to be the second partition on hdd. Called a "raw disk" partition that it isn't mounted, so its not listed by df. Use swapon -s to see swap partition's current use.
sed
Parses and transforms text. One of earliest tools to support regex.
BearTrap
Part of ADHD. Opens ports to mislead, monitor, track and block connections. Simple way to open ports in a controlled and secure manner.
Intial Sequence Number (ISN)
Part of TCP three-way handshake.
Resource separation
Place systems with different security requirements into separate areas. Follow three core rules: Any system visible to Internet must reside in DMZ; any system with senstive information must reside in private network and not be visible to the Internet; only way a DMZ system can communicate with a private network is through a proxy on the middleware tier.
/etc/shadow
Password Database
Cain
Password cracking
Enforce Stronger Passwords
Password enforcement, /etc/pam.d/system-auth.
Patching
Patch maintenance and management process and schedule to ensure patches are up-to-date for both online and offline VMs.
/etc/sysctl.conf
Permanently change system variables so that they will load at boot time
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
Permit inbound SSH from session taht we have intiated from this system.
Least Privilege
Person has least amount of access to do their job. Basics of secure coding: only grant account access to the resources it needs, p173
Incident Handler
Person responsible for responding to alerts. Uses the information generated by the IDS to idnentify the intent of the suspicious activity and takes some action based on the analysis.
PAN
Personal Area Network
Bluetooth PANs
Personal Area Networks are susceptible to hacking
OS Editions
Personal Editions: Starter, Home and Ultimate. Work Editions: Business, Pro and Enterprise.
PII
Personally Identifiable Information
Internet Security Association and Key Management Protocol (ISAKMP)
Phase 1 negotiation to establish privacy over a secure channel.
Cookies
Piece of data created by a web server and stored in the web browser. Often used to track user authentication and application session data. Most websites encrypt cookie's contents. A server can set optional secure flag on any cookie to notify browser that it is only to send the cookie along with SSL-encrypted requests. Users can edit their own cookies, whether Persistent or Non-Persistent.
Scanning
Ping, Nikto, Netcat, nmap.
Interim Report
Pitch project summary, asset identification and valuation report and a plan to senior management.
Session State
Prime target for attack in web connections. See Session Attack.
Defense in Depth
Principle that protections need to be layered
Intractable Problems
Problems that can't be solved in polynomial time. Asymmetric Encryption. Eg, exponential, superpolynomial, factoring large integers into primes (RSA), solving discrete logarithms over finite fields (El Gamal), computing elliptic curves in a finite field (ECC).
Software Testing
Process of executing a program or system with intent of finding errors. Its important to test how app will respond to unexpected or invalid input.
Access Management
Process of managing users, data and their relationships consists of 4 tasks: Account Administration, Maintenance, Monitoring, Revocation.
Threat Enumeration
Process of understanding threats in your system or network. List all possible threat agents. List all attack methods. List the system level objectives.
Jobs
Processes that maintain system activities that need to occur continuously. Introduced in Upstart
SHA
Produces 160-bit hash value.
Policy Types
Program Policy, which is high-level; Issue-Specific Policy, eg AUP; System-Specific Policy, eg Linux Servers vs Windows.
chkdsk.exe /?
Program that runs automatically after a (power) failure of BSOD. Use it to schedule a full volume or sector-level scan at the next reboot.
BCP-DRP Planning Lifecycle
Project Initiation, Risk Analysis, Business Impact Analysis, Build the Plan, Test and Validate the Plan, Modify and Update the Plan, Approve and Implement the Plan
File System Security
Protect OS binaries in /usr. Don't allow users to create or bring set-UID and set-GID programs on the machine. Put /var on a separate partition. Allow for unexpected growth on heavily used partitions. Goal: all systems should either be mounted ro or nosuid.
Session Attack
Protect against session attacks by making session IDs random and long. Uses an established session toolikit like Burp to test predictability of session IDs. Encrypt session information in cookies. Use new session ID immedately uppon user authentication. Have session IDs expire on logout or periodically timeout. Digitally has Session IDs.
PEAP
Protected Extensible Authentication Protocol
Security Policy
Protects organization, the people and the information. Establishes what must be done to protect information stored on computers. Protects people who are trying to do the right thing. Policies are the laws of an organization that set the boundaries of what is and is not acceptable.
Bluetooth Network Encapsulation Protocol (BNEP)
Protocol that allows Bluetooth devices to extend access to the wired network from a wireless connection, similar to 801.11.
Internet Key Exchange (IKE)
Protocol that negotiates session details of an IPSec connection and documents them as Security Associations (SAs).
IPSec
Protocols 50 for ESP and 51 for AH
IPSec
Provides data integrity, confidentiality and authentication. Besides encryption, it can also do static packet filtering.
top
Provides dynamic, real-time view of what is running on a system. Continuous output. Show processor activity. Baseline and spot anonomolies.
netstat
Provides visibility into network activity, network connections, route tables, interface statistics.
Reconnaissance
Provides visibility into your organization and insight into how the adversary will target you
PKI
Public Key Infrastructure
Vector-Oriented Defense-In-Depth
Purpose is to identify various vectors by which threats can become manifested and provide security mechanisms to shutdown, remove or mitigate the vector.
Policy Table of Contents
Purpose; related documents aka references; cancellation which explains when new policy supercedes old one; background which amplifies need for policy; scope; policy statement which identifies guiding principle of what is to be done; responsibility; action.
Risk Assessment
Quantitative and Qualitative Risks. Threat assessment is one input in risk analysis.
Industrial Scientific Medical (ISM)
Radio band 60GHz used by Super Bluetooh 801.11ad
Salt
Random value added to a password hash to protect against precomputation attacks. Each account has a different salt.
Entropy
Randomness collected by an operating system or application for use in cryptography or other uses that require random data. ... A lack of entropy can have a negative impact on performance and security (wiki)
File vs Directory
Read allows us to read file contents and get directory listings. Write allows us to modify file contents and create/remove files within a directory. Execute allows us to execute files and access files in a directory.
Logging activities
Real-time tasks (malware outbreaks, serious internal abuse, loss of service on critical assets, regulated data theft), p191. Daily Tasks (unauthorized configuration changes, disruption in other services, intrusion evidence, suspicious login failures, minor malware activity, activity summary), p192. Weekly Tasks (review inside and perimeter log trends, routine account creation/removal, host and network changes, less critical attack and probe summary), p194. Monthly Tasks (review long-term network and system log trends, minor policy violation summary, various resource usage reports, security technology performance measurement), p195. Quarterly, p196. Annual Tasks (log retention, IT budget planning), p197.
Business Continuity
Recommendations: client should review cloud service providers commitment to maintain continuity, client should conduct on-site assessment facility to verify access controls are used to maintain continuity of service; client should ensure they'll receive confirmation of BCP/DR test conducted by CSP.
Attack Process
Recon, scanning, gaining access, maintaining access, clearing tracks
Cyber Attack Methodology
Recon, scanning, gaining access, maintaining access, covering tracks
RDP
Remote Desktop Services uses TCP 3389
Remote Desktop Services (RDS)
Remote Desktop Services. See p254-255 for a list of roles.
RPC
Remote Procedure Call sessions are used by trust relationships, NetLogon, Outlook, NTLM authentication, remote administration, etc. "Trust relationships, the NetLogon secure channel, Outlook messaging, NTLM pass-through authentication, remote administration, etc all can use RPC-based sessions. RPC sessions typically begin with a client connection to TCP/135 on the server. Then, the server will redirect the client to another "ephemeral" high-numbered port for subsequent communications."
LASSO
Remote Windows to syslog mass conversion
Systemd
Replaces init daemon. Supports parallel processing, monitors after boot and support device hotplugging. Kali uses systemd. Services and daemons are managed as actions against units. Unit files are identified by .service suffix. Has better uptime. 3 core functions: integrated method for managing both systems and services; we can use to create and develop new services; provides an interface between apps and kernel, which is more secure and controlled. Not compatible with cron or other init managers.
Universal Groups
Replicated to every domain in a multi-domain forest.
IDS
Reports attacks against monitored systems/networks. Alarm System. Mature technology. Requires monitoring, alerting and reaction. Doesn't replace other security controls. High-maintenance and expensive. Requires well-trained staff to understand and correctly interpret alerts generated. Analyst needs comprehensive policies governing information security and a clear understanding of what actions are needed to protect business assets.
Noncompliance Policies
Reprimand, termination. Legal violations: criminal, civil, regulatory.
Active Directory Service Access
Required to begin logging access to AD objects, as defined by those objects' SACLs.
Reset vs Refresh
Reset sets system back to factory defaults, "remove everything." Refersh keeps your data files and personalization preferences, but not firewall rules or 3rd party apps.
ReFS
Resilient file system. Supports 35,000TB. Not bootable. Used for large storage volumes
Public
Resources on the Internet. Cannot be trusted.
Corrective Control
Response to fighting threat once they're found
Conditional Access Policies
Restrict resources by group membership, trusted device, IP address, geolocation.
find /lib/modules/'uname -r' -name *modulename*
Return all modules with the name specified in your search.
ROSI
Return on Security Investment
RAP
Reuse Attack Protector
Security Configuration Wizard (SCW)
Security Configuration Wizard gui wizard to disable uneeded services, Windows Firewall, IPSec policies, IIS web stuff, etc for selected roles on older Windows OSes. XML policy.
SCA
Security Configuration and Analysis Tool
Reversible Encryption
Reversible algorithms are not reccommended for passwords. Use irreversible algorithms or hashing.
Password Encryption
Reversible algorithms are not reccommended for passwords. Use irreversible algorithms or hashing. If attacker finds key for one password, chances are he now has the key to all the passwords in the database. See Reversible Encryption.
Password Strength
Reversible algorithms are not reccommended for passwords. Use irreversible algorithms or hashing. Its secure as long as you can keep attacker from finding the key to decyrpt the password.
/var/log/rkhunter.conf
Review this log after running complete check of system
Rhosts
Rhosts is the user equivalent of the /etc/hosts.equiv file. It contains a list of host-user combinations, rather than hosts in general. If a host-user combination is listed in this file, the specified user is granted permission to log in remotely from the specified host without having to supply a password.Rhosts is vulnerable. Eg, an attacker using echo ++> /.hosts can overwrite the file to allow any host to connect to the machine.
Risk
Risk = Threats x Vulnerabilities. The job of the security professional is to constantly track, manage, and mitigate risk to an organization's critical assets. "While threats drive the risk calculation, vulnerabilities drive the risk reduction" p13.
RBAC
Role based access control
Incident Response
Roles and responsbilities in IR must be agreed upon in the SLAs between CSP and customer. Customer won't be able to conduct forensic investigation of network components managed by CSP.
Rkhunter
Rootkit Hunter scans for rootkits, backdoors, and possible local exploits by comparing SHA-1 hashes of important files with good ones in an online database.
rkhunter -c --enable all --disable none
Rootkit Hunter to run a complete check of the system.
Rootkit Detectors
Rootkit detectors work best with file integrity checking. Work best at detecting kernel-level rootkits.
Vector of Attack
Routers and Switches are often not kept up to date and can give attackers visibility into the network.
RSBAC
Ruleset-Based Access Control
Cygwin
Run Linux packages compiled in a Linux environment (cygwin) on Windows. Its a small app that allows you to access ported libraries and programs from Linux on Windows desktop. Good for Linux development. Don't install everything! If utilies aren't ported, you can locate source code and compile them into a cygwin ported binary. Its not an emulator.
snort -c /etc/snort/snort.conf -i eth0 -A full
Run snort with the specified configuration in /etc/snort/snort.conf on int eth0 in full alerting mode.
Windows Defender App Guard (WDAG)
Runs Edge Browser inside a container, application sandbox.
S Mode vs Full Mode
S Mode is stripped down and will only allow for M$ apps and Edge Browser.
SCA
Security Configuration and Analysis Tool. Its an mmc snap-in. See secedit.exe for cli version of tool.
SCA
Security Configuration and Analysis snap-in tool. Secedit.exe cli version of tool. Compare computer policies against a template.
Netcat
classic but relevant and effective scanning tool that is often used to both steal sensitive files from a victim system and to upload malicious files.
SHA-1-SHA-2
SHA-1 output 160-bit, SHA-2 output 256-bit and 512-bit, SHA-3 output is 256-bit and 512-bit.
File Integrity Checking
SHA1
SIEM for Web
SIEM log correlation helps with timely detection of attacks by watching log files.
Service Set Identifier (SSID)
SSID is network name.
SUID/SGID
SUID allows files to execute with privileges of file's owner. /usr and /usr/local contain SUID/SGID but can be read-only. Best practice to track which programs have SUID and SGID set.
O365
SaaS and DaaS. VoIP, desktop Windows, web-hosting, etc.
WPA
Same as 801.11.i. Temporary Key Integrity Protocol (TKIP) and Counter-Mode/CBC-MAC (CCMP) provide strong encryption, replay protection, and integrity protection.
Firewalls
Same software can provide both network and host-based firewalls, allowing for centralized management and control.
Administrative Unit
Same thing as Organizational Unit, but in Azure.
Port Scan
Scans for open ports on remote host(s).
set-scheduledtask -full
Schedule a task in M$.
Cron
Scheduling daemon that starts an action in the background at a preset time. Crond syncs off system clock. Can't use systemd if using cron.
Grep
Search logs.
LogParser
Search logs.
Splunk
Search logs.
Header Stanza
Second part of HTTP client request. Headers following can include any piece of information the client wants to know. If server doesn't understand, then it drops the request.
Bitlocker
Sector-level encryption AES-128 or 256 and verification of the integrity of boot-up files and other startup data structures. It must have at least 2 volumes: boot and system. Only the boot volume is encrypted. AES-128 by default.
UEFI Secure Boot
Secure Boot requires UEFI, Windows 8 or later and a GUID Partition Table (GPT) bootable HDD partition. It doesn't require TPM or whole drive encryption. Secure boot is able to resist malware on bootup.
SKEME
Secure Key Exchange Mechanism
SSP
Secure Simple Pairing
SAT
Security Access Token
SAT
Security Access Token includes user SID, AD group SIDs, local group SIDs, privileges listed in local server's registry (32)
SCW.exe
Security Configuration Wizard
Covering Tracks
Security logs, file manipulation, creating accounts, rootkits
sed -n '1~2' license.txt
Sed will print every other line of license.txt file.
sed -n '1,5p' license.txt
Sed will print first five lines of the license.txt file and will only print them once (-n)
RFC826
See ARP
Open Threat Exchange
See Alien Vault.
Protocol Analysis
See Application Analysis
Network Adapter Binding
See Binding, Network.
Intellectual Property
See Copyright.
ISO 27002:2013 Annex A
See Critical Security Controls Standards Mapping
NIST 800-53
See Critical Security Controls Standards Mapping
NIST Core Framework 2014
See Critical Security Controls Standards Mapping
Information-Centric Defense
See Defense-In-Depth. Information-Centric defense starts with an awareness of the value of information within an organization. Identify the most valuable information and implement controls to prevent unauthorized employees from accessing it. A good starting point is to identify your organization's intellectual property, restrict it to a single, section of the network, assign a single group of sysadmins to it, mark the data, and thoroughly check for this level of data leaving your network.
URL Directory Traversal
See Directory Traversal Attack.
Domain Guest Account
See Global Guest Account
Global Guest Account
See Guest Account
NIDS Challenges
See IDS Challenges.
GPO Option Sharing and Security Model
See Local Guest Account
Sharing and Security Model GPO Option
See Local Guest Account
Log Tasks
See Logging Activities
Network Location Firewall Defaults
See Network Profile.
Session Cookie
See Non-Persistent Cookie
Stateless Packet Filter
See Packet Firewall.
Load Testing
See Performance Testing.
Rainbow Table Attack
See Precomputation Attack. Rainbow Table store precomputed hashes.
Enclave
See Protected Enclave.
Network Enclave
See Protected Enclave.
Next Gen Firewall
See Proxy Firewall.
Advanced Sense Analytics Engine
See QRadar.
Log Management Software
See SIEM for Web
DMZ
See Semi-Public.
IDS Rules and Signature Criteria
See Signature Analysis for a quick list of criteria.
Forensic Snapshots
See Snapshots.
System Snapshots
See Snapshots.
Functionality Testing
See Software Testing.
Meltdown
See Spectre
801.11ad
See Super Bluetooth.
Services
See System Services, how to disable
World Wide Web Publishing Service
See System Services, how to disable. Screenshot of WWW Publishing Service Dependencies, p204.
Crypto Key Lengths Compared
See Table on p79
Window Size
See Tarpits
Site-to-Site VPN
See Tunnel VPN
Baremetal Hypervisor
See Type 1 Hypervisor.
Blue Screen of Death (BSOD)
See chkdsk.exe
Information Dispersion
See data dispersion
Get-WindowsFeature
See installed roles and features from PS
servermanagercmd.exe -query
See installed roles and features from cli
get-scheduledtask
See list of current scheduled tasks in PS
Separation
Separate test VMs from production VMs.
Configuration Management Web
Separate, distinct workspaces and environments for different developers and different releases of same product. Version control system that tracks changes to the code, allows developers to check in/check out components, and ensures code changes do not overlap. Formal processes for use of the versioning systems and development environments.
Middleware
Separates DMZ from Private Network. Eg proxy servers that filter and block. Provides and extra layer of protection.
SMB
Server Messsage Block is a file and print sharing protocol. With NetBIOS, it uses TCP139. It uses TCP445 by itself. Sometimes called CIFS
SNI
Server Name Indication
SNI
Server Name Indication used by HTTPS to identify which website is being requested
SSL Initialization
Server presents a public key certificate to client to verify server identity. Clients can present their certs as well.
Headless
Server that does not require a video card, monitor, keyboard or mouse.
W3C
Server-side extended logging format.
Session Tracking/Maintaining State
Session state is a prime target for attack.
Bluetooth Security
Set Bluetooth devices to non-disvoverable after they're paired. But, they'll still respond to PAGE request from other Bluetooth devices, making MAC address scanning possible (BD_ADDR). Starting with Bluetooth 2.1, devices use Secure Simple Pairing (SSP) that uses public key cryptography.
Umask
Set default permissions assigned to new files and folders. Default file permissions are 666 and 777 for a directory. Umask is subtracted from default value.
Set-Cookie
Set-Cookie Header is created by server and sent to the client in response to client's request. After receiving the cookie, the client places it in a cookie header and sends it back in all subsequent requests to the server.
SDN
Software Defined Network
IP Address
Software address. 32 bits or 4 bytes in length. Net_ID and Host_ID.
Package Management Tools
Solve the issue of package maintenance by monitoring for updates and providing a way to automatically upgrade apps.
Body
Some HTTP requests have a body. Only place in the header where client will send data back to the server, eg POST or PUT methods.
Collisions
Some hash functions are vulnerable to collisions, where two different files are hashed and produce the same output. Strong hashing prevents similar items from colliding. The larger the bit length, the less likely there will be a collision.
Event
Something that happened that you witnessed or can demonstrate actually occured. Not all events are considered incidents.
External Threat
Source of most attacks.
Source Routing
Source routing allows a packet's sender to specify the route the packet takes through the network. Its a security hole. Disable it with sysctl.
Session User
Source to the Proxy/Application Gateway.
Common Vulnerabilities and Exposures (CVEs)
Standard for cataloging vulnerabilities
X.509
Standard for digital certificates that includes demographics, validity period, supported encryption, public/private key, signature of issuing CA.
Host OS
Standard installed OS that provides virtualization platform. Has direct access to the hardware, p46
Server Editions
Standard, Enterprise, Datacenter, Small Business and Server Essentials
Protocols
Standardize format of communication, specify the order or timing of communication, allow all parties to determine the meaning of a communication.
ISA SP-99
Standards refering to combination of software and hardware that allows information to flow out of a secure network unidirectionally. See IEC 62443
IEC 62443
Standards refering to combination of software and hardware that allows information to flow out of a secure network unidirectionally. See ISA SP-99
df
Stands for disk free. Used to see how much hdd space is used by mounted partitions.
systemctl start name.service
Start a service using Systemd.
gpa &
Start up Gnu Privacy Assistant (GPA) tool and run in background.
Policy and Risk Management
Start with policy because it dictates the security posture the company wants to take with respect to protecting its resources.
Nano Server
Starting with Windows 2016. Less than 110MB drive space. Can only be run as a container, not a VM. Mainly intended for web apps.
TCP Flags
Stateful Firewalls can respond intelligently to out of order packets that include malformed TCP flag combinations.
Windows Firewall
Stateful dynamic filtering. Deep integration with IPSec driver, making it easy to setup IPSec encryption with Kerberos authentication, p216. It lacks the sophisticated intrusion capabilities offered by other personal firewalls, and there's not support for automatic forwarding of log data to a central server. See Keep Blocking and Unblock, p222. Manage the firewall with Group Policy, PowerShell or netsh.exe, p 220. For Firewall-IPSec integration: secure Connection is mutual authentication and packet signing; require encryption is mutual authentication and encryption, p220.
Ack Flag
Stateless Packet Filter doesn't do TCP inspection. No state inspection ACK flag set. Vulnerable to ACK scan.
Birthday Attack
Statistical probability used for this collision attack. If an attacker can find a two messages that generate the same hash value, the can substitute one message for the other. Useful wiht a list of password hashes. If they can hash enough passwords on their own to generate a cleartext to cause a collsion, then its as good as having the original cleartext password.
Cryptographic Algorithm
Step-by-step procedure to encipher plaintext and decipher ciphertext
Persistent Cookie
Sticks around until its expiration date which could be years. Stored in a text file on client's hdd.
SSH
Still vulnerable because adversary can brute force the password, passwords lack complexity, not changed often, do not have a lockout and are the same across the organization. Only allow SSH access to router from the router's internal interface. Force everyone to VPN in first, and then SSH to the router. VPN sessions are logged and router SSH sessions usually aren't.
/var/log/syslog
Store logs in flat files here.
/dev and /devices
Stores files that talk to system devices. Good idea to set to nodev on these file
/etc/fstab
Stores info about disk partitions, mount points, and options applied to each partition
/etc/passwd
Stores username, User ID, etc
Sudo and Sudoers
Su switch users. Sudo gives more granular control. Use sudo and setup auditing and role-based control.
AllowedPaths
Subkey off winreg defines registry paths that will still be remotely readable despite your share permissions on the winreg key.
Guideline
Suggestions. Applies to security measure that might be implemented in more than one way.
AES - Advanced Encryption Standard
Supports 3 keys sizes: 128-bit, 192-bit, 256-bit. Algorithm in depth on p74-75.
MFA Azure AD
Supports SMS with a PIN, M$ Authenticator App, Phone Call with recorded message, etc.
Rsyslogd
Supports both local and remote logging, syslog.conf, regex. Located in /etc/rsyslog.conf or /etc/rsyslog.d/*.conf.
SELinux
Supports role-based access controls
Firwalld
Supports zone to define trust levels for each interface. Uses the D-Bus interface which is also used for firew configuration tools firewall-cmd, firewallctl, firewall-config. RHEL 7, CentOS 7, Fedora 18 and newer OSes use firewalld as the default management tool. Features listed on p214.
chkconfig --del syslog && chkconfig --add syslog-ng
Switch from traditional syslog to syslog-ng
SSL Encryption Keys
Symmetric. Each side randomly generates a key and uses RSA or DH to exchange them. Every request a client makes to an SSL web server generates an entirely new encryption key.
sysctl
Sysctl used to audit and modify kernel settings while the system is running. Its generally exported as part of the procfs within /proc/sys. Can be used to view and modify system setttings like source routing, adjusting rate limiting, and randomizing memory address space for processes. Modify kernel runtime parameters to tweak system performance and security (rootusers.com). Can be used to disable the loading of all new kernel modules by setting kernel-modules_disabled.
syslog security
Syslog traffic in cleartext makes it vulnerable to replay attacks. UDP so unreliable delivery and easily spoofed to get past ACLs. It can be configured to use TCP, but syslog doesn't prioritize and differentiate messages.
SACL
System ACL
SACL
System ACL that enables administrators to log attempts to access a secured object.
SOC
System On a Chip
System Services, how to disable
System Services in GPO allow you to disable any services in AD.
System Directories
System directories are installed with Linux. Some have sticky bit set like /tmp and /var/tmp
Attack Commonalities
System visible from public Internet; Unchecked scanning and enumeration; unpatched vulnerability was exploited; system had weak authentication.
SYN Flood Attack
TCP SYN packets sent by attacker to destination server. Since the server will be unable to establish a connection, the address becomes unreachable. Type of DoS attack
SQL
TCP/UDP 1433 and 1434 for queries
TPM.msc
TPM management
Cold Boot Attack
TPM only BitLocker method is vulnerable to this attack. Remove batteries and power from computer, do a live boot and read BitLocker encryption key and other sensitive data from RAM.
Evidence Integrity
Take a forensic hash. MD5 is considered most popular.
Hyperjacking
Take control of Hypervisor and gain access to all VMs. Typically launched against Type 2 Hypervisors. Fake hypervisor is installed on the host machine.
Takeown.exe
Take ownership of files recursively on local or remote computer.
MD5
Takes variable-length input and produces fixed-length output that is 128 bits. Output is referred to as hash, digest, fingerprint.
Ruleset-Based Access Control
Targets actions based on rules for subjects (entities) operating on objects (data). Its implemented in apps and OSes.
Vulnerability Scanning
Test for services, multiple ports on multiple machines, test to see whether vulnerability is present, reporting. Notify everyone of upcoming scan, provide contact info. scan when you're available in the office or by phone., heavy scan but don't DoS the network, priortize vulnerabilties based on your environment. Focus of program should be on remediation, not on the scanning. What are the highest risk systems? Scanning AND remedition of those systems should be phase 1.
gedit
Text editor.
/proc/sys
The files here represent the current state of the kernel.
Local Guest Account
The local guest account should be disabled and have a non-blank password, mainly because of the unexpected automatic logon feature. This is the recommendation for both the local guest account on all machines. "To discourage the use of local accounts in general, the recommendation is to set the "Sharing and security model" GPO option to "Guest only" so that the end result is automatic demotion to an account which has been disabled and has a non-blank password, i.e., it deliberately breaks the access when doing an over-the-network logon to access a shared folder or printer. *If* local accounts are going to be used anyway, despite the recommendation to use global account whenever possible, then the GPO option should be set to "Classic", i.e., to not require everyone to log on with their own local accounts. But even in this case the guest account should still be disabled and have a non-blank password." -Jason Fossen
awk '/^UUID/ {print $1;}' /etc/fstab
Use awk to list all UUIDs in /etc/fstab.
ls
Use ls to establish a baseline. Simple is better.
netsh advfirewall show allprofiles
Use netsh to see all Windows Firewall profiles
Exploit
Use of a specific attack against a specifically identified vulnerability of the target.
Gap Analysis
Use qualitative, quantitative, or best practice/checklist risk measurement to define the gap between our current risk status and where we want to be.
/bin/sh
Use rbash to go to restricted shell.
IPv6 Hardening in Linux
Use sysctl to harden IPv6 by doing 3 things: disable router advertisements, prevent self-assignment of IPv6 addresses, adjust rate-limiting to limit resources used.
File Integrity Checking
Use to monitor files and configuration of web server to look for defacement of website. "Monitors the file system based on the number of preset rules and generates alerts when modified, or deleted out of compliance with those rules." Monitor the web server files and web server configuration settings.
xxd snort.log
Use xxd tool to review snort.log file.
Discrete Logarithm
Used by El Gamal and DH and Schnorr signature scheme. Intractactable problem
Integer Factorization
Used by RSA. Intractable problem.
Emitting Event
Used by Upstart when jobs need to send or cause events to trigger other jobs. Ideal for jobs that have dependencies on other jobs.
Event
Used by jobs in Upstart to casue and allow activity on a system to occur. Event might be a time of day that triggers a job to start.
World-Writable Directories
Used by programs to hold intermediate results. Its extremely important to set sticky bit on world-writable directories.
Port Forwarding
Used extensively to keep unwanted traffic off networks. Intercepts traffic destined for certain IP address and port combination and redirects to different IP and/or port number to hide exactly what services are running on the network, using only IP addresses to carry out multiple tasks and dropping all unrelated traffic at the firewall.
Management Port
Used for authorized sniffing.
Port mirroring
Used for authorized sniffing.
SPAN
Used for authorized sniffing.
Compmgmt.msc
Used for local management of users and groups
ZigBee Wireless
Used for product tracking, medical device monitoring, sensor monitroing, control networks, home automation. eg Honeywell HVAC. Simple protocol requring fewer memory and processor resources than Bluetooth. 802.15.4. Uses AES-CCM key is used to encrypt MAC, Network and Application layers, but this takes more resources and is considered optional. Good for M2M applications. Zigbee mesh networks use IPv6 addressing.
SAM Database
Used for storing local accounts and passwords.
modprobe
Used to add and remove loadable kernel modules (LKMs) to the kernel. Exists in /etc/modprobe.d. Can be used to whitelist/blacklist specific modules.
python struts-pwn.py -h
Used to exploit Apache struts.
Big-O Notation
Used to give a general idea of how many operations a problem takes relative to the input size n.
GECOS
Used to guess passwords
Application Monitoring Software
Used to identify availabilty issues.
netsh.exe
Used to manage Windows firewall and network adapters from cli
Core Evaluation Test
Used to measure success of control implementation. eg did the controls find and alert within 24 hours of an installed app that's not whitelisted
WSMAN
Used to remote with PS Core
Claims
User claims is the set of attributes of that user's accounts in AD, eg military rank, security clearance level, etc.
/home, /export/home
User home directories
Ack Scan
When attacker sends packets with ACK flag set and packet firewall permits them ingress to protected network. Hosts will generate RST ACK packet in response, letting attacker know the host's ports are up and unfiltered.
TCP Sequence Prediction Attack
When spoofing a connection, ACKs do not go back to the attacker. To complete the connection, the attacker has to correctly guess the ISN. Predicting the ISN that the destination host will choose isn't trivial, but can be done. Mitigate this attack is to block source-routed traffic and traffic that has a source IP from your private network.
/usr/local
Where 3rd-party apps are typically stored
Registry
Where Windows stores configuration settings for hardware, OS, apps and user preferences. See p149 for user-friendly registry editor using GP.
audit.rules
Where auditd stores rules. Generally stored in /etc/audit/rules.d/audit.rules.
/usr/bin, /usr/sbin
Where programs packaged with OS are stored
AppLocker
Whitelists/Blacklists executables to protect against malware and unwanted apps. SHA-256 hashes app's executable file or script. Create AppLocker rule using GPO and wizard. Also supports audit-only to test out new rules.
Application Whitelisting
Whitlisted apps are on an approved list of executable files that's cryptographically hashed. Only whitelisted apps are allowed to run. Either setup in passive mode (alerting) or active mode (blocking). Blocking mode s recommended. Passive mode isn't ideal but will provide visibility to the SOC.
Long-Term Channel
Will never get feature updates. Must upgrade entire OS. Only receives monthly quality updates.
Cain & Abel
Windows
MBSA
Windows
Process Hacker
Windows
Secedit
Windows
Steganography
Windows
Wireshark
Windows
WDAG
Windows Defender App Guard
wf.msc
Windows Defender Firewall with Advanced Security
pfirewall.log
Windows Firewall logs in ASCII text with W3C Extended Format. Only dropped packets and initial packet in a successful connection are logged.
Unblock, Windows Firewall
Windows Firewall will create a rule for this program permitting it to listen on the port its currently requesting and on any other port it may request in the future.
Keep Blocking, Windows Firewall
Windows Firewall won't allow program to acquire a listening port. Train users to choose this option when there is any doubt.
WMI
Windows Management Instrumentation programming interface
WMIC
Windows Management Instrumentation service runs on RPC. Older tool.
Windows RE
Windows Recovery Environment
WinRM
Windows Remote Administration which is required for remotely connecting with PS to Nano. You can use RDP to connect to Nano, but you won't get a gui desktop.
M$ Backup Services
Windows Server Backup (WSB) is fully integrated with Volume Shadow Copy system.
WSUS
Windows Server Update Services
wsl.exe ifconfig
Windows Subsystem Linux run ifconfig
WSL
Windows Subsystem for Linux
WIDS
Wireless IDS
STA
Wireless station
John the Ripper
Wordlist is the simplest. Put common words at the beginning of the list. Single Crack mode uses username and GECOS, and is faster than wordlist and should be used first. Incremental Mode is the most powerful and most time-consuming. External Mode is when John is extended with a subset of C compiled at runtime. Configure john.ini file to perform substitutions and other transformations. MD5 hashed passwords start with $1$
Protected Enclave
Workgroups that require additional protection are segmented from the rest of the internal organization. Restrict access to critical segments. Internal firewallls, VLAN, ACLs.
Syslog-NG
Works across variety of OSes, including M$. Replaces traditional syslog. Filter by hostname and log messages using regex.
Ctrl-L
clear screen
Null User Session
aka Anonymous Access is an SMB session with a blank username and pw. net.exe use \\ipaddress\IPC$ "" /user;"" Null sessions could allow download of complte list of all user accounts and more from unfirewalled DC
Set-GID
aka SGID allows normal user special access privileges to execute privileges of file's group owner. if Set-GID on a directory, then new files inherit group ownership. eg used for lp to print.
Set-UID
aka SUID. Allows normal users special access privileges to execute privileges of file's owner. N/A for directories
utmpdump
allows you to pass utmp file info as output
Internal Threats
caused by intentional and unintentional insiders. Most common and most damaging.
chmod
change file attributes. Change permissions on a file or directory.
Absolute File Modes
chmod 755 is Owner has rwx, Group Owner has r-x and Everyone Else has r-x.
cp
copies files
sudo
delegate authority to users
rm
deletes a file
servermangercmd.exe
deprecated way to see features
dmesg
display and driver message. Used to examine or control the kernel ring buffer. Shows diagnostic info about kernel and system drivers from bootup processes. Also shows shows some info after system is booted, eg USB devices plugged. Captures only the kernel's messages of any log level.
awk
full scripting language tool
create directive
in logrotate, it gives the file permissions owner and group the permission to create the file after rotatin.
UDP
p160 UDP Header.
DH Key Exchange
p29 explains two-key algorithm.
Password Management
p50 Password protection: protect encrypted passwords, enforce strong password policy, use one time passwords or MFA, prevent precomputation attacks. p51 say use a 15 character password, change passwords every 90 days, lockouts after 3 failed attempts, passwords must contain at least 1 alpha 1 number and 1 special character, users can reuse last five passwords.
grep
perform string searches. Output on p199-200
/usr
primary OS directory, read-only
sc.exe
query and reconfigure any service or device driver on local or remote computer
Query and reconfigure any service or device driver on local or remote standalone computer. Might not be installed. You may have to download from M$.
query list of services
last -f /var/log/wtmp
reads from utmp wtmp and btmp. Shows who logged in, when they logged in, when they logged out, etc. Historical data.
lastb
reads the btmp file to show login failures that have occurred
who
reads the utmp file and shows who is currently logged in
btmp
records failed login attempts
sysctl -a
shows all variables for the system.
/var/log/message
used by message utility.
nbstat.exe -A ipAddress
used for reconnaissance
Log Files of Interest
utmp, wtmp, btmp, dmesg, messages, maillog, secure
Nikto
web server scanning tool that provides system identification and configuration analysis.
Windows Defender FW with Adv Security
wf.msc snap-in
Buffer Overflows
when poorly coded applications don't do error checking and allow memory buffer space to be overwritten by executable system commands. Defenses: keep OS, apps, languages, runtime environment, server addon up-to-date and patched; run vulnerability scanner against your site; implement IPS or Web App Firewall; Validate and Sanitize user input.
last -f
will show all last info as well as who last read from utmp or btmp file