Chapter 9 Data

Hot site

AKA active backup model immediately available few minutes to hours tolerate only short period of downtime fully configured with cable infrastructure fully configured with mirror duplicate servers most effective backup site for disaster recovery expensive includes mirror site includes rolling hot site

Digital certificate

aka public key certificate, identity certificate binds public key with identity name of person/computer/org/object identifier

Analytic

algebraic manipulation to reduce complexity of algorithm

Security association dictates

algorithm selection cryptographic keys digital certificates manual/auto through Internet key exchange IKE

Diffie hellman key exchange

generates symmetric keys at sender/receiver over insecure channels first asymmetric algorithm

Location selection

geographic considerations

Low power devices

given that energy is required for device to en/decrypt

Hardware root of trust

hardware TMP is implementation of root of trust malware can't tamper with functions

Full disk encryption an dself encrypting drive

hardware based (FDE) require password or key to access encrypted data hard drive known as self encrypting drive (SED)

Collision resistance

hash algoriems ability to avoid same output from two guessed inputs

Digital signature

hash value for message hash value asym encrypted using sender's private encrypted hash value and message sent receiver decrypts with sender's public key receiver hashes the message integrity and nonrepudiation if two hashes match

Internet key exchange IKE

helps establish automatic SA helps 2 endpoints set up secure tunnel by providing secure exchange of shared keys before full IPsec transmission starts Diffie hellman key exchange to set up shared session, where cryptographic key sare derived mutual authentication by pre shared keys on both endpoints or certificate issued by CA can automate selection of best SA for each connection UDP 500

Public key infrastructure PKI

hierarchy of computers that issues and manages certificates CA issues certificates

Information classification

high medium low

Mirror site

hot site that has instant failover parallel processing immediate absolutely no downtime fully configured with infrastructure network systems telephone Internet fully configured functional servers up-to-date mirror of production system expensive

File level dlp

identify sensitive files in file system embed org security policy to file as it travels

Supporting obfuscation

only good if eyes don't know which camo is used reverse letters substitution cipher ROT13 XOR operation

Output Feedback (OFB)

output blocks fed back into block cipher acting as a key generated, these blocks make strings of bits to feed encryption algo

Approval policy manual

admin approve/deny all requests

Hybird attack

adding appendages to known dictionary words

Bitlocker

aka full volume encryption protects offline data access on lost/stolen devices

Bitlocker

aka full volume encryption protects offline data on lost devices

Restore

copying backup data to original storage location

Supporting authentication

cost effective multifactor methods for login

Cloud access security broker CASB

gatekeeper extending orgs security policies into cloud stroage infrastrcutre

Symmetric

sender uses private key to encrypt, receiver uses same key

Security association SA

shared security info between two network entities goal is secure communications

Medium

significant financial loss serious personal or org injury confidence reputation hardship/embarrassment

Diffusion

simple char change in plaintext cause change in cipher text

BitLocker without TPM

100MB system partition that contains boot files BIOS RAM

Code Signing

A Code Signing certificate allows software developers to sign their products before the distribute them. In this way users who download the software can be confident that it has not been modified since it was signed by the developer.

Cryptographic Service Provider

A Cryptographic Service Provider (CSP) resides on the client and generates the key pair.

PFX

A PFX file can contain multiple certificates. It contains both the public and private keys for the certificates and should never be shared outside the organization.

SAN

A Subject Alternate Name (SAN) certificate can protect more than one FQDN, even if there is no relationship to the names. For example a SAN could protect corpnet.xyz, corpnet.com and newcorp.org.

Online and Offline Certificate Authorities

A chain of trusted authorities begins with a root CA. Once the root CA is installed and its root certificate is created, it can be used to issue certificates authorizing intermediate CAs. An intermediate CA can issue, distribute and revoke certificates without the root CA. If a root CA is compromised, it requires that every certificate in the chain of trusted authorities is re-issued. To ensure the security and integrity of root CAs, they are commonly kept it in an offline state and only brought online when needed.

Cross Certification

A cross-certification or bridge model is used when one organization with a CA structure needs to trust certificates from another organization that has its own CA structure. By default, clients in an organization will trust certificates issued by their organization, but they don't trust other root CAs unless they are in an official third party list on the internet for trusted root CAs. Cross certification can be set up so both hierarchies trust each other. A root-to-root configuration allows clients in one organization to trust any certificate issued by the other organization's CAs, and vice versa. A mesh configuration provides trust paths that can be configured for more restrictive certificate validation. This could include root-to-subordinate CA, or even subordinate-to-subordinate.

Domain Validation

A domain validation certificate is typically used for Transport layer security. It is used to validate the identity of domain name servers who have control over a DNS domain.

DER

A file with a DER extension indicates that the certificate is DER encoded. A DER file contains a single certificate.

PEM

A file with a PEM extension indicates that the certificate is ASCII (Base64) encoded.

Data Producers

A person responsible for creating or capturing data. Most people in an organization are data producers.

Data Custodian

A person that is responsible for the quality of the data on a day-to-day basis.

Data Consumers

A person who is using the data. The data must be good enough for them to perform their work. They define what is good data.

Privacy Officer

A person who oversees data activities to ensure they are in compliance with government laws.

Registration Authority

A registration authority (RA) can be used in large enterprise environments to offload client enrollment request processing by handling verification of clients prior to certificates being issued. The RA: Accepts registrations. Distributes certificates and keys. Validates identities in a certificate request for the CA. Does not issue certificates directly. Though certificates are not issued until the RA validates the information, the RA cannot issue certificates.

Root

A root certificate is issued by a trusted certificate authority and identifies a root certificate authority. The private key in a root certificate is used to sign other certificates.

Data Owner

A senior person in an organization with the authority to make decisions regarding the quality of data created, stored, consumed and retired.

PKI Hierarchy

A typical PKI involves multiple certificate authorities (CAs) arranged in a hierarchy. A root CA is the first CA in the hierarchy and the first CA to be set up. The root CA has a self-signed certificate and is often offline to protect the CA from compromise. The root CA does not usually issue certificates to end users or computers, unless the PKI structure is very small. A subordinate CA is a CA authorized by the root CA to issue certificates to other CAs, users, computers. The subordinate CA gets its certificate from the root CA. Subordinate CAs are added to the hierarchy in order to to distribute the workload of issuing certificates, or to designate specific CAs to issue certificates for specific uses. A subordinate CA is responsible for issuing certificates, holding the CPS, and publishing the Certificate Revocation List (CRL). Qualified subordination is implemented on a subordinate CA to restrict the issuance and usage of certificates. The following are two types of subordinate CAs: An issuing CA is at the bottom of the hierarchy, and actually issues the certificate to the clients. An intermediate CA is in the middle of a multi-tier system, and certifies issuing CAs or other intermediate CAs.

Enrollment Agent

An enrollment agent is a user who is authorized to request certificates for other users. Enrollment agents are typically authorized to request certificates that are used on smart cards. These agents can request the certificate and create the smart card that the authorized user can then use.

Extended Validation

An extended validation certificate is the highest form of SSL certificate. It is granted by a CA after the company's ownership, organizational information, physical location, and legal existence are verified.

backups, avoid single point of failure

Availability

BitLocker with TPM will secure

BIOS master boot record boot sector boot manager windows loader

Daily

Backs up all files modified that day regardless of the archive bit status. Resets the Archive Bit No

Copy

Backs up all files regardless of the archive bit status. Resets the Archive Bit No

Full

Backs up all files regardless of the archive bit. Resets the Archive Bit Yes

incremental

Backs up files on which the archive bit is set. This will back up only the data changed since the last full or incremental backup. Resets the Archive Bit Yes

Burning

Burning is the method of building a small fire somewhere legal and safe. Use metal tongs to burn your documents one by one or a few at a time. It's important to ensure that each document is turned into ash--if sensitive information escapes the flames and flies away, it might fall into the wrong hands.

CER

CER is the Microsoft convention for a CRT file which contains a certificate that is DER or PEM encoded.

Certificate Renewal

Certificate renewal is the process of extending the validity of a certificate. Certificates that are nearing expiration do not need to be reissued; instead, they can be renewed. To ensure that certificates remain valid, they should be renewed before they expire.

Certificate Revocation

Certificate revocation is the process of breaking the bond of a public key pair to a specific individual. Revocation occurs when the end entity falls out of the PKI system's scope of trust. The following are situations in which a digital certificate would be revoked: The identity of the subject (either a person or the computer) changes, such as changing from a maiden name to a married name. An employee is terminated. An organization sells a division or changes its name. A private key is compromised by a hacker. A laptop with a PKI-enabled application is lost or stolen. Revoked certificates that are On Hold can be unrevoked. Certificates revoked for other reasons cannot be unrevoked.

Certificate Validation

Certificate validation is the process used by recipients of certificates to verify the identity of the certificate holder. The following are important considerations: Most certification validation occurs by PKI-enabled applications that receive the certificate and use the information in the certificate to validate the identity of the subject. The more information or points that are validated, the stronger the validation process, and the stronger the security of the PKI system. A requirement for the release of PKI-enabled applications should be the validation of the subject's digital certificate.

Confidential

Confidential information is the lowest level of classified information used by the military. It allows restriction of release of information under the Freedom of Information Act. Release of this information could cause damage to military efforts.

Degaussing

Degaussing purges the hard disk by exposing it to high magnetic pulse that destroys all of the data on the disk. It also ruins the motors inside the drive.

File system encryption

EFS GPG Bitlocker FEK

EFS security considerations

EFS encryption tied to user account if password is compromised, EFS is compromised file cannot be encrypted if user key is corrupted or user account deleted encryption process is transparent to user and applications using file all directories under are encrypted auto decrypt when to non-NTFS auto decrypt when SMB protocol

Dual Key Pairs

Each certificate that is issued has a corresponding public and private key pair. If users are issued a single key pair, that key pair is used for both digital signatures and encryption. In an enterprise environment, it might be beneficial to use two key pairs: one key pair for digital signatures, and the other for encryption. The private key used for digital signatures is kept completely private. Only the user has access to this key and the key is never archived.The private key used for encryption is archived so that encrypted documents can be recovered if the private key is lost.If a single key pair is used for both digital signatures and encryption, it is possible for a recovery agent to obtain the private key from the key archive and use that key for signing documents. This violates the principle of non-repudiation, because someone other than the original user could have signed the document.

Email

Email certificates are used on mail servers to protect username, passwords and email correspondence.

Encrypting implementations

Encrypting File system GNU Privacy Guard and Pretty good Privacy Bitlocker

FACTA

FACTA, the Fair and Accurate Credit Transactions Act, was created to protect against identity theft. It applies to the disposal of consumer reports and related information. FACTA includes credit reports, credit scores, employment history information, check writing history, insurance claims, residential or tenant history, and medical history. Every business handles FACTA-protected information, and every business must comply with FACTA laws.

FISMA

FISMA, the Federal Information Security Management Act, protects government information. It is primarily concerned with proper data destruction and has detailed disposal requirements.

Differential

Fastest Backs up files on which the archived bit is set. This will back up only the data changed since the last full backup. Resets the Archive Bit No

Applications of cryptography

File system encryption digital signature digital envelope trusted platform module full disk encryption and self encrypting drive hardware root of trust hardware security modules

Public key infrastructure be aware of

PKI Hierarchy Cross Certification Dual Key Pairs

Full + Differential

Full backup performed periodically (for example, once per week) followed by differential backups (for example, once each day). Differential backups take progressively longer to complete as the period of time increases since the last full backup. To restore, restore the last full backup and the last differential backup. Next to a full backup, this is the fastest restore method.

Full + Incremental

Full backup performed periodically (for example, once per week), followed by incremental backups (for example, once each day). Incremental backups are quick to perform. This is the fastest backup method. To restore, restore the full backup and every subsequent incremental backup.

OpenPGP procedure

GPG/PGP generate random symmetric key symmetric key encrypted using receiver's public key encrypted symmetric key and message sent to receiver GPG/PGP decrypts symmetric key with receiver private key decrypted symmetric key decrypts rest of message

High availability cluster HA

Group of computers that are configured with the same service one node is configured as master other nodes configured as slaves Slave and master continually communicate when master fails slave takes over point of failure eliminated with use of redundant nodes

HIPAA

HIPAA stands for Health Insurance Portability and Accountability Act. HIPAA protects medical records and personal health information. Companies that provide healthcare insurance handle HIPAA-protected information. And, of course, companies that provide health-related services also handle HIPAA-protected information.

Hypertext Transport Protocol Secure

Hypertext Transport Protocol Secure (HTTPS) uses HTTP over SSL (Secure Socket Layer). It has replaced S-HTTP as the method of securing HTTP (web) traffic. It is a session-based encryption technology, meaning that the keys used for that session are valid for that session only. HTTP-S is used predominantly throughout the internet. HTTPS operates over TCP port 443.

Internet Protocol Security

Internet Protocol Security (IPsec) is a data encryption protocol for LAN-based applications. IPsec: Is widely deployed in VPN technology. Can be used with IP only. Can be used to encrypt any traffic supported by the IP protocol. This includes web, email, TELNET, file transfer, and SNMP traffic, as well as countless others. Includes both encryption and authentication mechanisms. Is fully capable of providing a secure communication means for any LAN or internet-based system using TCP/IP. Can be used with L2TP or alone to protect data. Requires either certificates or pre-shared keys. Functions at the Network layer of the OSI model. Generally can't be used when a NAT proxy is deployed. Operates at the Network layer (Layer 3). Uses UDP port 500.

PKI management areas

Key Protection Certificate Validation Key Archival Key Escrow Certificate Revocation Crypto Period Certificate Renewal Key Disposal

Key Archival

Key archival is the backup and archival of private keys for end users in case they lose their private keys. Normally, private keys are kept secret and the CA would never get a copy of the private key. Key archival and recovery is a complex, highly secure process that requires a significant amount of administrative overhead. With a key archival system: Private keys are sent to the CA and backed up by the CA. To protect the private keys during transit, they are encapsulated in a secure transmission of data to the CA. The location of the private keys' backup is secured. Recovery agents are usually administrators who are given the rights to restore private keys from the archive. Key archival uses a centralized approach to key management, where keys are managed by the CA and not only by individual users.

Key Disposal

Key disposal refers to removing the key when the it (or the storage mechanism) is no longer being used. Keys should not be disposed of until all data that was encrypted with those keys has been unencrypted or is no longer used. Use degaussing, overwriting, or media destruction to prevent the key from being recovered.

Virtual IP VIP

address presented to outside world does not correspond to actual physical network interface load balancing environment responsible for forwarding service request from client to physical server who will respond

Key Escrow

Key escrow is a form of key archival. The main difference between key escrow and key archival is that escrow stores keys with a trusted third party, either to increase security or to allow access only under controlled circumstances. With key escrow, keys might be retrieved by a business that needs access to employee files, or it might allow key access to law enforcement with the proper authorization to investigate crimes or enforce laws.

Key Protection

Key protection refers to using a different key structure for each service or function, such as files, messages, email attachments, transactions, etc. This allows an organization to limit its exposure if a key is compromised. Private keys should be protected and should never be shared or exposed. Public keys can be freely distributed.

Hashing algorithms

MD5 4, 3 SHA1, 2, 3 RIPEMD

Merkle hellman knapsack

MH subset sum problem given list of numbers and sum determine subset used to create sum earliest public key cryptosystem broken by Adi Shamir 1988 comeback but broken too

Machine/Computer

Machine or Computer certificates are used as proof of identity for a computer.

Maximum Tolerable Downtime

Maximum Tolerable Downtime (MTD) combines the RPO, RTO, MTBF, and MTTR to identify the length of time an organization can survive with a specified service, asset, or process down.

Message Security Protocol

Message security protocol (MSP) is a military implementation of PEM.

SHA1

NIST NSA 160 bit message digest

Copy backup

NTBACKUP.exe windows server backs up all regardless of archive bit does not mark them as having been backup.

OSCP Stapling

OCSP stapling is an efficient way to handle the verification of certificate information. Stapling allows the CA to be queried regularly and the responses to be cached.Otherwise, a request to a CA's server must be made for each certificate verification action.

Hybird cryptography

OS, apps, components use hybrid system combines symmetric and asymmetric combines symmetric systems to process large amounts of data and asymmetric to securely distribute keys

IPsec

OSI 3 Network layer mutual authentication integrity non-repudiation confidentiality authentication header encapsulating security payload

P12

P12 (or, more formally, PKCS #12), is a format for storing multiple certificates in a single file. It is commonly used to package a private key with its certificate or package all members of a chain of trust.

P7B

P7B is a format used by Microsoft for certificate interchange.

Pinning

Pinning is the process of associating a host with its expected certificate. Once the certificate is obtained for a host is is pinned to the host. Thereafter, all communication with that host should use the same certificate. If not, the communication is suspect.

Pretty Good Privacy

Pretty Good Privacy (PGP) is a commercial asymmetric cryptosystem used for email. PGP provides all four cryptographic services and uses the RSA public key encryption system for key exchange and digital signatures. It relies upon the IDEA or 3DES algorithm for encryption and is based on a pass phrase and a web of trust, not a hierarchy of trust. The public keys used in a PGP system are stored in a key ring. PGP can also secure the email attachments to the messages.

Privacy Enhanced Mail

Privacy Enhanced Mail (PEM) was one of the first email securing technologies. It supports digital signatures, digital certificates, and asymmetric key cryptography.

Private Internal

Private internal information is restricted to individuals within the organization. Private internal information might include: Personnel records Financial records Customer lists

Private Restricted

Private restricted information is restricted to limited authorized personnel within the organization. Private restricted information might include: Trade secrets Strategic information Highly sensitive information

Proprietary

Proprietary information is information that a company wishes to keep confidential. Proprietary information can include secret formulas, processes, and methods used in production.

PHI

Protected health information (PHI) is any information about health status, provision of health care, or payment for health care that can be linked to a specific individual. This includes any part of a patient's medical record or payment history.

Public with Full Distribution

Public with full distribution allows everyone to have free access to a copy of the information with no restrictions. A public website would be classified as public with full distribution.

Public with limited distribution

Public with limited distribution allows private information to be distributed to only selected individuals for a specific purpose. They may have to sign non-disclosure agreements (NDAs) to protect the information from becoming public knowledge.

Pulping

Pulping is a way of removing all traces of ink from paper by using chemicals and then mashing the paper into pulp. Since these chemicals can ruin carpet and clothing, you sho

Pulverizing

Pulverizing is like shredding, except that it uses a punch press or hammer system to crush a hard disk into a pile of metal confetti.

Purging

Purging is the removal of sensitive data, making sure that the data cannot be reconstructed by any known technique.

MD5

RSA 128 bit message digest

Transport layer security TLS

RSA, Diffie hellman for key exchange successor to SSL 3.0 similar to SSL but not interoperable apps use TLS and SSL Diffie hellman or RSA for session key exchange TLS Record, TLS handshake

PGP algorithm used

RSA/Diffie Hellman for asymmetric IDEA for symmetric

Recovery Point Objective

Recovery Point Objective (RPO) is a measurement of how old data is at the point that it is successfully recovered. Any data that has been lost between the RPO and the present must either be accepted as lost or reconstructed. Another aspect of RPO is the number of backups to choose from. Some systems offer multiple recovery points; others offer only one recovery point.

Recovery Time Objective

Recovery Time Objective (RTO) is the actual time required to successfully recover all operations.

Full Backup

Requires large amounts of storage for each backup. Takes the longest time to perform each backup. To restore, restore only the last backup. This is the fastest restore method.

Secure sockets layer SSL

SSL handshake protocol to establish secure channel certificate issued by CA Asymmetric encryption USA for key exchange protocol OSI 5 session port 443 SSL 3.0, 2.0, 1.0 session keys in 40 56 128 256-bit lengths end to end encryption LDAP communication, LDAPS and FTP, FTPS

Cluster details

San usage shared IP addresses client requests are directed to shared IP cluster members send out periodic heartbeat signals failover clustering provides redundancy convergence allowed cluster members to reach a consistent state clustering ensures service assessable in form of high availability elasticity scalability

Secret

Secret information is information that, if disclosed, could cause severe and permanent damage to military actions. This could include information about: Troop movement Deployments Military capabilities

Secure Electronic Transaction

Secure Electronic Transaction (SET) was developed by VISA and MasterCard to secure transactions. Credit card data and a digital certificate are stored in a plug-in to the user's web browser. An order received by a SET-enabled merchant server passes the encrypted payment information to the bank. Approval is electronically sent to the merchant. SET uses DES and RSA in addition to digital signatures.

Secure Hypertext Transport Protocol

Secure Hypertext Transport Protocol (S-HTTP) is the old method for securing communications on web servers. It is a message-based encryption technique in which each file is encrypted separately. S-HTTP is not used any more.

Secure Multipurpose Internet Mail Extensions

Secure Multipurpose Internet Mail Extensions (S/MIME) uses a standard public key encryption, authenticates through digital signatures, uses X.509 version 3 certificates, and is included in most web browsers. Similar to PGP, S/MIME can secure email attachments.

Secure Shell

Secure Shell (SSH) was developed for the UNIX platform to encrypt or secure communications for remote facilities. SSH operates over TCP port 22.

Secure Sockets Layer

Secure Sockets Layer (SSL) was developed by Netscape to secure internet-based client/server interactions. SSL authenticates the server to the client using public key cryptography and digital certificates and encrypts the entire communication session. SSL can be used to protect web (HTTP) traffic as well as TELNET, FTP, and email. SSL operates over TCP port 443. SSL operates at the Session layer of the OSI model. Session keys employed by SSL (Secure Sockets Layer) are available in 128-bit and 40-bit lengths.

Secure Real-Time Transport Protocol

Secure real-time transport protocol (SRTP) is a secure extension of RTP (real-time transport protocol) that adds enhanced security features. It was developed to secure VoIP (Voice over IP) communications. SRTP uses encryption and authentication and can achieve high throughput in multiple communications environments, including both hard-wired and wireless environments.

Self-signed

Self-signed certificates are not issued by a CA. They are signed by the person or device that created it. They are often used in an internal network to offer the same level of encryption as other certificates. However, they can't be used to prove identity since any attacker can create a self-signed certificate. They should not be used for pubic facing web sites and other applications.

Sensitive but Unclassified

Sensitive but unclassified information, if disclosed, could cause some harm, but not a national disaster.

Shredding

Shredding is running a hard disk through a disk shredder, physically destroying the drive.

Types of backup data

System state application user data

add these to increase protocol security

TLS, SSL, SSH (unsecure protocols)

Image backup

Takes a bit-level copy of a disk or partition. Individual files are not examined, so all data is copied regardless of the archive bit. A snapshot is an example of an image. Resets the Archive Bit No

CRL Distribution Point

The CRL is published at the CRL Distribution Point (CDP). Four areas where the CRL is usually published are: On the issuing CA, On an internet or intranet website, To a file so it can be exported to other distribution points, In a directory service, such as Active Directory

Certificate life cycle

The CSP generates the key pair. A certificate request is made to the CA. The CA approves or denies the request. The certificate is issued. The certificate may be renewed. The certificate may be revoked.

Certificate Authority

The Certificate Authority (CA) is an entity trusted to issue, store, and revoke digital certificates.

Certificate Practice Statement

The Certificate Practice Statement (CPS) is a declaration of the security that the organization is implementing for all certificates issued by the CA holding the CPS. This statement tells potential partners or others relying on the security of the PKI system how well the security of the PKI system is being managed.

Certificate Revocation List

The Certificate Revocation List (CRL) consists of a list of certificates that have been previously revoked and resides at the CA. This list can be accessed by the client to verify the validity of a digital certificate.

Mean Time Between Failures

The Mean Time Between Failures (MTBF) identifies the average lifetime of a system or component. Components should be replaced about the time that the MTBF is reached.

Mean Time to Failure

The Mean Time to Failure (MTTF) measures the average time to failure of a system or component. This metric assumes that the system or component is not repaired at any point in its lifetime, which would extend its useful life.

Mean Time to Repair

The Mean Time to Repair (MTTR) identifies the average amount of time to repair a failed component or to restore operations. This time frame is also referred to as Mean Time to Restore.

Online Certificate Status Protocol

The Online Certificate Status Protocol (OCSP) is a protocol used for checking the status of an individual digital certificate to verify if it is good or has been revoked.

Crypto Period

The crypto period is the amount of time that a pair of keys is valid. When determining the crypto period, take the following into consideration: A long crypto period requires less overhead but provides less security. Use a longer crypto period for less sensitive data. A short crypto period requires more overhead but provides more security. Use a shorter crypto period for data that has high sensitivity and heavy use. The life of a key should not be greater than the life of the entity or object for which it was created.

Subordinate Certificate Authority

The subordinate CA is responsible for issuing certificates, holding the CPS, and publishing the CRL. Subordinate CAs function within the hierarchy in a parent-child relationship with the root CA or another subordinate CA.

Certificate Chaining

There are two types of CAs, root CAs and intermediate CAs. When validating a certificate, the client device (usually a web browser) will check the issuing CA, which may be an intermediate CA. The certificate of the issuing CA is then checked. If it is not trusted, the issuing CA of that certificate is checked and so on up the chain until a root CA is found. If no trusted CA in the chain is found, the browser will normally display an error.

Top Secret

Top secret information is the highest level of classified information used by the military. If top secret information is released, it poses grave consequences to national security. This could include information about: Development of new weapons Intelligence-gathering activities

Transport Layer Security

Transport Layer Security (TLS) was developed by Netscape to secure internet-based client/server interactions. TLS is based on SSL, but they are not interoperable. TLS authenticates the server to the client using public key cryptography and digital certificates. TLS encrypts the entire communication session between a server and a client. TLS can be used to protect web (HTTP) traffic as well as TELNET, FTP, and email. TLS operates over TCP port 443 or port 80. TLS has a specific version for wireless communications known as Wireless Transport Layer Security (WTLS).

Endpoint dlp

USB devices feedback to user as to violations runs on end user workstation/server

Unclassified

Unclassified information can be accessed by the public and poses no security threat.

User

User certificates are used as proof of identity for a person or user.

Authority Information Access

Users can obtain a copy of the CA's certificate from the authority information access (AIA). This is useful if the root CA is offline. It is common for root CAs to be offline so that they are less susceptible to compromise. The CA's certificate can be published to other locations that users can access. A copy of the certificate and the root CA's public key is necessary to verify digital signatures that the CA has implemented.

Wildcard

Wildcard certificates allow you to protects an unlimited number of subdomains within a single domain. For example, a certificate for corpnet.xyz will secure www.corpnet.xyz, help.corpnet.xyz, etc.

Wiping

Wiping is a software-based method of overwriting data to completely destroy all electronic data residing on a hard disk drive or other digital media. Wiping uses zeros and ones to overwrite data onto all sectors of the device. By overwriting the data on the storage device, the data is rendered unrecoverable and achieves data sanitization.

X.509

X.509 is the official standard of ITU Telecommunication Standardization Sector (ITU-T) that identifies the format for public key certificates and certification path validation. All X.509 certificates include the following data: tbsCertificate, Versions that apply to the certificate, Serial number, Signature, Issuer, Validity, Subject, Subject public key information, IssuerUniqueID and SubjectUniqueID, Extensions

Hash

a function that takes variable length string and compresses and transform it into a fixed length value then decrypted to unhashed for original message authenticate messages store passwords maintain data integrity

Fault tolerance

ability to respond to unexpected hardware or software failure without data loss or loss of operation

Duel load balancing

active passive active active

Load balancing tips

all nodes in work balancing cluster are active at all times all processing tasks to be completed and distributed between nodes in cluster nodes can share processing capabilities storage and ram tightly or loosely linked tighter link implies more nodes function as one system the more tightly linked the nodes in the cluster are the more identical the nodes need to be

Approval policy automatic

allows CA to review info and make decision

Secure hypertext transfer protocol S-HTTP

alternative protocol to HTTPS not as secure as HTTPS connectionless message security, so only partial secure channel does not use 443

Single point of failure

anyone failure can cause havoc for entire

Hardware security modules

associated with software/firmware cryptographic functions en/decryption key generation hashing key management plug in card Personal computer security module secure application module hardware cryptographic device cryptographic module

supporting non repudiation

assurance someone cannot deny something digital signature biometric

Weak key attack

attack on an encrypted algo that contains keys with poorly decrypted ciphertext

PKI attack

attacker attempts to have user accept fake or spoofed PKI certificate

Key clustering attack

attacker decrypt encoded message using different key than used in encryption

Chosen ciphertext attack

attacker produces cipher text then sends through a decryption process to see resulting plaintext

Authentication header AH

authenticity non-repudiation integrity no confidentiality packet data not encrypted protection against replay and MITM keyed hash based on all bytes in packet for authentication authenticates packets by digitally sign IP protocol 51

Rolling hot site

back of 18 wheel truck capability of hot site versatile expensive

Mode of operation

block cipher cipher block chaining cipher feedback output feedback counter galois counter mode

Active active

both load balancers work as a team to distribute the service requests

Counter (CTR)

both sender and receiver access reliable counter that computes new shared value each time ciphertext block is exchanged requires sync

Cryptogaphic attack types

brute force plaintext analytics weakness exploitation encryption MITM downgrade

Birthday attack

brute force that focuses on hashing algorithms hash until two plaintext messages found that produce hashed value 2 out of 23 with same bday for selected day, 253 used

EFS additional users

can be given access symmetric key is decrypted using added users private key

Plaintext

chosen cipher attack known plaintext attack chosen plaintext attack

Chosen plaintext attack

chosen plaintext to be encrypted worker steps away aka lunchtime/midnight attack

SSL procedure

client checks server certificate validity period (time) client compares name of cert with name on URL client verifies issuing CA is on list of trusted CA client uses CA public key to validate CA digital signature on server cert session key is used between client and server for SSL session duration MITM: client compares server DNS to DNS on cert continuous checking

SSL inspection procedure

client establishes SSl tunnel with proxy server client decrypts SSL session client scans content, repackages SSL session sends on traffic reverse if server establishes SSL tunnel with proxy proxy server blocks transmission of inappropriate content in either direction

PKI process

client generates public private keypair by cryptographic service provider CSP client requests certificate signing request CSR from CA by sending identifying information along with public key, digital sign with private key CA performs identity proofing by verifying information submitted validate who you say you are using approval policy in CA cert with valid lifetime period issued check for revoked certs with certificate revocation list CRL, Online certificate status protocol OCSP

TLS process

client sends hello to server with highest SSL/TSL version client supports, random number, list of ciphers, compression methods server responds with server hello, protocol version, different random number, selected cipher, compression method, certificate message afterward client responds with client key exchange message, random number echagned used to compute master secret, all further data for connection derived from master secret client sends change cipher spec message (more messages to come) client sends finished message, hash/MAC, server decrypts finished message and verify hash/MAC if fail, connection closes if successful server sends change cipher spec message noting future transmision will be encrypted server send finished message to client, hash/MAC, client decrypts finish message, verify MAC fail stop, succeed considered complete

SSl and certificate process

client uses HTTPS (SSL) browser server sends SSL certificate obtained from CA client verifies info in SSL client asks questions if pass then client trusts issuing CA and in turn trusts server

Node

cluster server connected physically by cables uses software to monitor and maintain connections

Cloud storage services

co-located cloud computing service web service application API app that use API

XOR

combines plaintext with a key 0 XOR 0 = 0 0 XOR 1 = 1 1 XOR 0 = 1 1 XOR 1 = 0 common in complex ciphers

Encrypt file on hard drive is which CIA

confidentiality

Clustering

connected group of independent computers to increase availability each cluster server is called node

Service Bureau

contracted site alternative backup processing services quick response and availability testing may be possible expensive resources buyer beware

Trusted platform module (TPM)

create hash of system components generate and store cryptographic keys required for integrity on Bitlocker system startup key start up key can require password use USB without TMP generates random numbers full support for asym (generate public and private keys)

Supporting confidentiality

data encryption to ensure confidentiality training strong passwords strong usernames multi factor authentication

raid 1 + 0 fault tolerance

data is available if one or more disks in a single set fails data is available even if two disks in different sets fail

Raid 0 + 1 fault tolerance

data is available if one or more disks in a single set fails data is lost if two disks in different mirrored sets fail

Data sovereignty

data laws apply to where data resides

Order of restoration

define order in which systems are services are re stored

Data loss prevention system DLP

detect and stop breaches of sensitive data

RIPEMD

developed by COSIC 128, 160, 256, 320 bit message digest alternative to government SHA hash

Collision

different inputs to cyptographic function produce same results

ElGamal

discrete logarithm problem taher elgamal 1984 extends diffie hellman for use in encryption and digital signatures used in GNU privacy guard and PGP very slow to create digital signatures Digital signature algorithm is variant of ElGamal signature scheme

Raid 1 + 0

disk mirroring and disk stripping multiple disk configured into two mirrored arrays then stripped across other set fault tolerance increase performance requires even number of disk minimum four discs 50% overhead most fast fault tolerant and expensive

Raid 0 + 1

disk stripping and disk monitoring multiple disks stripped creating single volume second set of disks is then added to mirror to the 1st fault tolerance increase performance even number of disks required minimum disks 4 50% overhead

Load balancing cluster

disperses workload between two or more computers or resources resource utilization throughput response time improved performance fault tolerance

Cloud storage

distributed resources but act as one federated cooperative storage highly fault tolerant through redundancy and distribution of data highly durable through versioned copies

Cipher feedback (CFB)

each ciphertext block fed back into encryption and used to encrypted next plaintext block

GNU privacy guard

email digitally signs emails encrypts documents implementation of PGP protocol

EFS

encrypt files and directories on NTFS partitions

Bitlocker procedure

encrypts entire contents of OS partition including OS files swap files, hibernation files all user files special key is required to access can save startup key to TPM TPM is used to perform integrity checking early in boot system won't boot if no pass from TPM integrity check prevents moving hard disk to other computer

DriveLock

encrypts entire contents of hard drive all files

Tunnel mode

encrypts entire packet data inside packet and IP header entire packet encapsulated in new packet

Bitlocker differs from EFS by

encrypts entire volumn instead of each file disk partition containing C:\ master boot does not encrypt system partition that contains boot files volume regardless of user as long as PIN passes only for offline attacks

Encrypting file system

encrypts files and folders NTFS partitions protect unsecured locations only original encrypter and added users can en/decrypt protects against offline access as well as online for unauth users does not provide online protection if auth user creds are compromised

Transport mode

encrypts only payload (data)

Cryptographic service providers (CSP)

enhance encryption libraries emails

Facts about hashes

ensure data integrity of files and messages in transit do not ensure confidentiality one way function aka message digest or digital fingerprint larger message digest more secure small change creates new hash

Certificate management

ensure security and availability of digital certificates planning and maintenance in public key infrastructure PKI

Downgrade

exploited through MITM lowering of encryption prototcols

Implementation attack

exploits implementation weakness in software protocol encryption algo

High

extreme financial loss extremely serious personal or org injury PII PHI

Cold site

few weeks to a few months to activate facility ready for equipment no hardware on site hookups for power HVAC telephone Internet infrastructure not active least expensive most common

Hashing uses

file integrity secure logon credential exchange

Birthday attack

focuses on hashing algorithm brute force attack where attacker hashes messages until one same hash is found

PGP and GPG do

follow OpenPGP standards RFC 4880 for en/decrpyt asymmetric/symmetric supports DSA(default) ELGamal(default) RSA AES 3DES Blowfish MD5 SHA1 GPG can't use IDEA because patent

Clustering load balancers

for high availability clustered in the same way as other server clusters

Round robin

full backup on one day with incremental/differential backups subsequent days when all tapes used, start over with oldest data simple

Mission essential functions

functions that help accomplish goals or missions

Measures for securing cloud storage

implement security controls data classification policy assign info into categories that determine storage, handling, access security classification based on sensitivity and criticality dispose of data when not needed by using tools

IPsec be aware of

included in windows firewall with advanced security called connection security rules NAT errors with IPsec VPN tunnel IPsec tunnels: main, quick most commonly used with L2TP vpns

Raid 0 Stripping

increase performance no fault tolerance minimum of two discs maximum 32 discs no overhead fastest of all types

Redundant array of independent disks RAID

inexpensive disk subsystem multiple physical disks into single logical unit improved performance fault tolerance hardware or software implementation hardware RAID more expensive but better performance

Side channel attack

info gained from physical system

Hashing provides

integrity

Secure shell SSH

interactive control of remote systems RSA public key for connection and authentication IDA by default Blowfish and DES use for unsecure protocols: SFTP, SCP

When replace hardware

just before Mean Time Between Failures MTBF is reached

Stateful

keeps track of client

Encryption attack

key clustering attack replay attack PKI attack side channel attack

Mathematical attack

key containing small data smaller data set provides fewer combinations to decipher 40 bit weak 128 bit strong longer key, more combinations in brute force

Management considerations (asymmetric)

keys can be disturbed, no relation required private always secret Asymmetric scalable for large expanding environments, two keys per user keyspace 1k-30k bits slow processing than symmetric ephemeral/static keys

High resilience

leakage-resilient cryptography secure and resistant to side channel attacks

Legal implications

legal issues if systems fail

Elasticity

level of difficulty involved when removing nodes from data store

Low latency

lightweight ciphers good for size and power consumption lower latency is required for cars process all rounds of cipher in one clock cycle == lower latency in block cipher round unrolling/unfolding

Resources vs security constraints

limitations of hardware IoT protocols that know this

low

limited financial loss limited or no to injury or org operations organizational effectiveness morale embarrassment or inconvenience

GNU privacy guard and Pretty good privacy

linux

Data Recover Agent

local DRA for individual workstation domain wide DRA, must be joined

When choosing cryptographic methods

low power devices low latency high resilience supporting confidentiality supporting integrity supporting obfuscation supporting authentication supporting non-repudiation resources vs security constraints

Supporting integrity

maintaining consistency, accuracy, trust of data over lifecycle cryptographic checksums for verification of integrity backups redundancies

Approval policy

manual or automatic

Object identifier OID

map certificate policy to CA best way to provide non-repudiation, public key belongs to individual

Least response time

member who responds most quickest

Least connections

member with the least number of connections

Redundancy

method of providing fault tolerance by providing duplicate or multiple components

Redundant site considerations

multiple documentations 25 miles from primary site acquire before disaster keep systems up-to-date specify requirements move most critical functions first to back up return least critical functions first to back up

Methods of providing redundancy

multiple network paths duplicate system components identical spare parts alternate means of power implementing raid 1 or raid 5 maintaining data backups duplicate servers separate Internet connection

Tower of hanoi

multiple tapes rotated through daily weekly schedule full and incremental/differential requires more tapes than GFS complicated

Managing backups

must be current to be useful do not combine incremental and differential backups image backups are fast for disk failure/malware backup store offsite backup store securely electronic vaulting rotate backup media type of data back up tech does not need to read file separation of duties: back up vs restore roles test

Reciprocal agreement

mutual aid agreement arrangement with other company share computing needs agreement to disruptive event agreement to take on capacity of other operation system no initial cost warm site may be used at its reciprocal site

DLP implementations

network dlp endpoint dlp file level dlp cloud dlp

Round Robin

no priority for selecting member each member shares requests partitioned out in circular order

secured comm when not stored on hard drive

non-repudiation

Key length

number of bits used to determine strength

Active passive

one load balancer is active and handles service requests passive load balancer is listening mode monitors performance of active if active fails passive becomes active and takes on duties

Electronic vaulting methods

online tape vaulting hierarchical storage remote journaling database shadowing

Warm site

partially configured redundant few days to few weeks to activate may be adequate for maximum tolerable downtime MDT fully configured with infrastructure equipped with communication links and data equipped with servers and clients software may not be installed or configured recovery from backups may be required cheaper than hot site

Secure logon credential exchange process

password used as key to perform hash on challenge text value hashed value is passed not password receiver host uses same method to compare hashes to verify

Cloud storage advantages

pay for what is used energy consumption savings availability and data protection storage maintenance virtual machine/docker copies natural disaster backup

PII

personally identifiable information full name address email national id passport IP VIM drivers lic face/fingerprints/handwriting credit cards digital id DOB birthplace genetic info tele logins

Cipher block chaining (CBC)

plaintext block is combined with previous cipher text block and result is encrypted with key

Email encryption

privacy enchanced mail pretty good privacy secure multipurpose internet mail extensions message security protocol

Round unrolling/unfolding

process al rounds of cipher in one clock cycle low latency

Fall back

process of returning client requests to the failed service or server when it comes back online

Backup

process ofcopying data to second form of storage tape CD removable hard disk flash drive solid state drive Archival bit for notification when file is created

Convergence

process that cluster members use to reach a consistent state

Digital signature

protection of integrity non-repudiation mathematical scheme for demonstrating authenticity of digital message or document credibility guarantee no tampering

Kerberos

prove identity over non-secure environment

Hashing file integrity

prove integrity of downloaded files

Uses

provide confidentiality, strong authentication, and non-repudiation data encryption to secure data digital signing to confirm integrity of message digital signing to confirm authenticity of sender key exchange to ensure keys are secure during transit asymmetric encryption used to securely exchange symmetric keys

Encapsulating security payload ESP

provides all of AH common used IPsec protocol data encryption IP protocol 50

Block cipher

provides confidentiality and authenticity en/decrypt one fixed length block per block en/decrypt combine blocks for additional security used when amount of data is known

Elliptic curve cryptography ECC

public key cryptography groups of numbers in elliptical curve Koblitz Miller 1985 more efficient algo than others used in conjunction with other methods reduce key size small amounts of data for small devices 160-bit key equivalent to 1024-bit RSA less computational power less memory

Perfect forward secrecy

public key cryptography systems random public keys per each session no deterministic algorithm is used while generating public key no single value can be used to compromise multiple messages

Rivest, Shamir, Adleman

public key cryptosystem used to secure data transmission factoring large numbers into prime values 1977 widely used defacto encryption standard asymmetric systems based on difficulty of factoring N (product of two large prime numbers, 201) key length 512-bits to 8k bits (2401 digits) modular arithmetic and elementary number theory

Functionality

public key made available to anyone private key secret one key encrypts, other key decrypts strength of asymmetric encryption lies in security and security of private key if private key is discovered new key pair required keys created by Local security authority (security kernel and cryptographic service provide CSP Asymmetric key ciphers are two associated algorithms that are inverses computationally infeasible to derive second algo from first without private key

Raid levels

raid 0 raid 5 raid 1 raid 0 + 1 raid 1 + 0

Replay attack

re-transmit encryption session keys in hopes of accessing encrypted resource in decrypted mode

Certificate process

request issue manage

Grandfather father son GFS

scheme to identify three categories of backup Monthly > weekly > daily

Cryptography in LAN and web

secure electronic transaction secure sockets layer transport layer security secure hypertext transport protocol hypertext transport protocol secure secure shell internet protocol security secure real time transport protocol

Hyper text transfer protocol secure HTTPS

secure form of HTTP SSL or TLS to encrypt before data transfer stateful requires 443

SFTP vs FTPS

secure shell FTP FTP that uses SSL along with server certificate

SSl end to end encryption disadvantages

security software cannot detect embedded attacks in transit internal users can use SSl to bypass proxy servers or internet content filtering

Known plaintext attack

seen plaintext and resulting ciphertext

Affinity

selection based on Infinity IP addresses of client such as Class C

Key exchange

sender encrypts message with key receiver must decrypt symmetric asymmetric key length

Asymmetric

sender key and receiver key are different distribute symmetric keys (hybrid)

Digital envelope

sender requests copy of receiver public key receiver or CA sends digital certificate contains public key sender asym encrypted message with public key sender sends asym encrypted message receiver uses their private key to decrypt

Output

simple char change in plaintext will cause several char to change in cipher text (diffusion) two different inputs to cryptographic func produce same output (collision)

Unified threat management UTM

single network appliance service on network next gen firewalls anti malware, spam content filtering web filtering firewall intrusion detection VPN

Cloud dlp

software traffic to and from cloud detect sensitive data being in violation of org security policy AWS Macie

Network dlp

software/hardware installed near network perimeter analyzes network traffic detects violations of org security policy

Weakness exploitation types

statistical attack dictionary attack weak key attack implementation attack hybrid attack

Offsite backups

storing backups in another location apart from main campus

Raid 0

stripe set breaks data into units and stores units across series of disks by reading an writing to all disks simultaneously

Hashing security concerns

strong hash outputs large number of bits hash should be made from entire message not portion avalanche effect (amplification) small change means large change

Questions client ask in HTTP SSL

subject name in cert match URL cert expired trust this CA

Chassis intrusion detection

switch sends signal to BIOS when cover removed

Scalability

systems ability to handle a growing level of work

Raid 5 overhead

three discs 33% four discs 25% five discs 20%

IPsec modes of operation

transport tunnel

Brute force

tries every known combination lots of time mathematical attack birthday attack

Collision

two different messages produce same hash value

Raid 1 mirroring

two duplicate disks simultaneously if one fails data is on other instant system switch fault tolerance does not increase performance require two discs 50% overhead most expensive

Secure logon credential exchange

used to secure logon credentials during exchange password used as key to perform hash on challegence text value, honly hashed value passed LANMAN NTLM CHAP MSCHAP

Implementations (asymmetric)

used with protocols SSL/TLS IPsec VPN (pptp, l2tp, sstp) S/MIME and PGP for email SSH tunnels

EFS procedure

user saves file system generates symmetric key or file encryption key FEK (currently: AES SHA ECC) encryption key encrypted using Asymmetric with users public key stored in file header in Data Decryption Field (DDF) encryption key can also be encrypted using public key of Data Recover Agent DRA Trusted agent DRA can decrypt if users private key is lost/corrupted

Galois/Counter mode (GCM)

variation of counter mode does not require high performance hardware

Intent of load balancing

virtualize a service web/database service offered by multiple servers Forward service request from a client to a single member of cluster chooses or schedules members based on algorithm Red Robin affinity least connections lease response time

Raid 5 stripping with distributed parity

volume combines disk stripping across multiple disks with parity for data redundancy parity information stored on disk if one disk fails data can be recovered using parity on remaining disks fault tolerance increase performance no fault tolerance if two or more disks fail require minimum of three discs overhead: 1 / N - 1

Statistical attack

weakness in cryptosystem inability to produce true random numbers floating point errors

DLP states

while in use on endpoint while in motion as transmitted while at rest on storage medium while being transmitted to/from cloud services

Dictionary attack

words and common variations