501 ch 1 mastering security basics
- 1. Proprietary & Confidential @GoCyberSec | January 2020 Chapter 1 Mastering Security Basics CompTIA Security +
- 2. Proprietary & Confidential @GoCyberSec | January 2020 Introduction • Understanding core security goals • Introducing basic risk concepts • Understanding control types • Implementing virtualization • Using command-line tools
- 3. Proprietary & Confidential @GoCyberSec | January 2020 CIA Triad • Confidentiality – Access to information, assets, etc. should be granted only on a need to know basis • Integrity – Integrity makes sure that the information is not tampered whenever it travels from source to destination or at rest (storage) • Availability – Availability concept is to make sure that the services of an organization are available at all times
- 4. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Core Security Goals • Confidentiality –Encryption –Access Controls –Steganography
- 5. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Core Security Goals • Integrity –Hashing –Digital Signatures –Certificates –Non-repudiation
- 6. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Core Security Goals • Availability –Redundancy –Fault tolerance –Patching
- 7. Proprietary & Confidential @GoCyberSec | January 2020 Introducing Risk Concepts • Threats • Vulnerabilities –Any weakness • Risk is –The likelihood that a threat will exploit a vulnerability • Risk mitigation –Reduces the chances that a threat will exploit a vulnerability by implementing controls
- 8. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Control Types Overview • Technical controls use technology. • Administrative controls use administrative or management methods. • Physical controls refer to controls you can physically touch.
- 9. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Control Types Technical Controls • Use technology to reduce vulnerabilities • Examples – Encryption – Antivirus Software – Intrusion Detection Systems – Firewalls – Least Privilege.
- 10. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Control Types Administrative Controls • Use administrative or management methods • Examples – Risk Assessment – Information Security Policies, Procedures and Standards – Awareness & Training – Configuration & Change Management – Contingency Planning
- 11. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Control Types Physical Controls • Any controls that you can physically touch. • Examples – Light – Signs – Fences – Security Guards
- 12. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Sub-Control Types • Preventive attempt to prevent an incident from occurring. • Detective controls attempt to detect incidents after they have occurred. • Corrective controls attempt to reverse the impact of an incident. • Deterrent controls attempt to discourage individuals from causing an incident. • Compensating controls are alternative controls used when a primary control is not feasible.
- 13. Proprietary & Confidential @GoCyberSec | January 2020 Preventive and Detective Controls Detective controls • Attempt to detect incidents after they have occurred • Log monitoring, trend analysis, security audit, video surveillance, motion detection • Cannot predict when an incident will occur • Cannot Prevent an incident • Used after an incident
- 14. Proprietary & Confidential @GoCyberSec | January 2020 Preventive and Detective Controls Preventive controls • Attempt to prevent an incident from occurring • Hardening, training, guards, change management, disabling accounts • Stops the incident before it occurs.
- 15. Proprietary & Confidential @GoCyberSec | January 2020 Corrective and Compensating Controls Corrective controls –Attempt to reverse the impact of an incident –Active IDS, backups, system recovery Compensating –Alternative controls used when a primary control is not feasible –TOTP instead of smart card
- 16. Proprietary & Confidential @GoCyberSec | January 2020 Deterrent Controls Deterrent controls –Attempt to discourage individuals from causing an Incident –Cable locks, hardware locks, fences Compare to prevention – Deterrent encourages people to decide not to take an undesirable action –Prevention stops them from taking an undesirable action –Security guard can be both
- 17. Proprietary & Confidential @GoCyberSec | January 2020 Implementing Virtualization • Terminology –Hypervisor –Host –Guest –Host elasticity –Host scalability One host appears as five systems on a network
- 18. Proprietary & Confidential @GoCyberSec | January 2020 Comparing Hypervisors • Type I (bare-metal) – Runs directly on hardware – No host operating system required • Type II – Runs as software within an operating system
- 19. Proprietary & Confidential @GoCyberSec | January 2020 Application Cell Virtualization • Runs services or applications within isolated application cells (or containers) • Also called container virtualization
- 20. Proprietary & Confidential @GoCyberSec | January 2020 Application Cell Virtualization • Runs services or applications within isolated application cells (or containers) • Also called container virtualization
- 21. Proprietary & Confidential @GoCyberSec | January 2020 Using Virtualization • Snapshots – Copy of a VM at a moment in time – Can revert to a snapshot if necessary • VDI/VDE – A user’s desktop – Persistent VDE – keeps user changes – Non-persistent VDE – doesn’t keep user changes
- 22. Proprietary & Confidential @GoCyberSec | January 2020 Risks Associated with Virtualization • VMs are files – Can be copied • VM escape – Allows attacker to access host from guest • VM sprawl – Uncontrolled VM creation (not managed) • Loss of confidentiality
- 23. Proprietary & Confidential @GoCyberSec | January 2020 Command- Line Tools • Windows – Launch Command Prompt – Launch Command Prompt (Admin)
- 24. Proprietary & Confidential @GoCyberSec | January 2020 Command- Line Tools • Linux – Launch terminal in Kali
- 25. Proprietary & Confidential @GoCyberSec | January 2020 Understanding Switches & Case • Windows switches typically use slash / – ipconfig /? • Linux systems typically use dash – – ifconfig -? • Windows commands rarely case sensitive • Linux commands are case sensitive
- 26. Proprietary & Confidential @GoCyberSec | January 2020 Command Demo • Windows – Ipconfig – ping – Netstat – Tracert – ARP – Systeminfo • Linux – ifconfig – cd – ls – grep – mkdir – mv
- 27. Proprietary & Confidential @GoCyberSec | January 2020 Chapter 1 Summary • Understanding core security goals • Introducing basic risk concepts • Understanding control types • Implementing virtualization • Using command-line tools