1. Digital Security
Digital Security
Information security
Information Security means protecting information and information systems from unauthorised access, use, disclosure, disruption, modification, or destruction. Constitutes a basic right: protection of self.
Link to originalDigital Security
Digital security consists of technologies, processes and controls designed to protect systems, networks, programs, devices and data from attacks.
Link to originalContents
Security Triad
CIA Security Triad
The CIA security triad consists of confidentiality, integrity and availability.
Link to original
- Confidentiality: Prevent disclosure of information to unauthorized individuals.
- Integrity: Ensure that data has not been tampered with and the sourec of information is genuine.
- Availability: Data is obtainable regardless of how information is stored, access, or protected.
AAA Security Principle
Link to originalAAA Security Principle
The AAA security principle is a framework that builds on top of the CIA triad.
Link to original
- We control who is permitted to use resources, through authentication. Process of identifying user-validity by asking for credentials.
- We use permissions to determine what they are authorized to do. Authorization is enforcing policies for determining the qualities of activities, resources, or services.
- We log actions perfomed on the network, through accounting (non-repudiation). It ensures that network admins will always be able to track down the user to monitor and audit their activites such as logins, data sent, time and location of access.
2. Security Threats and Attacks
Security Threats and Attacks
Passive Attacks
Passive attacks
Passive attacks attempt to use information from the system by external bodies that do not affect system resources.
Link to originalActive Attacks
Active attacks
Active attacks attempt to intercept existing streams of information and use tactics such as:
Link to original
- Masquerade: Replacing the peer that a user is trying to connect to / pretending to be another machine.
- Replay: Messages are resent to try to either break or gain access to a system.
- Modification of messages: Pass all data through themselves and take or modify any data they wish to.
Distributed Attacks
Distributed attack
A distributed attack is when code is injected into seemingly trusted software.
Link to originalInsider Attacks
Insider attack
Insider attacks occur when a seemingly trusted individual performs a malicious attack on a network they already are authorized to access.
Link to originalSocial Engineering
Social engineering
Social engineering is the acquisition of security-sensitive information or unauthorised access privileges by an outside attacker, based upon the abuse of a trust relationship.
Human-based social engineering:
- Social engineer may call a help desk, the engineer will often know names of employees and lingo of the company.
- A social engineer may pretend to be an important user which means their request is less likely to be turned down, and they may threaten to report the employee to their supervisor if they don’t comply.
- The social engineer may have obtained the name of someone in the organisation who has authority to grant access information, and thereby pretend that they sent them.
- A social engineer may pretend to be someone from an infrastructure-support group.
Computer-based social engineering:
Link to original
- Malware in mail attachments
- Websites which farm credentials
- Popup windows that farm information
- Fake wireless networks that could capture information
- Phishing: attackers use web-based services to launch attacks on devices connected to web to acquire various bits of information by masquerading as someone trustworthy within some electronic communication.
- SMiShing: phishing over SMS
- Vishing: phishing over VoIP
Denial of Service
Link to originalDenial-of-service attack
Denial-of-service attack: Flooding systems or servers with traffic to exhaust resources and bandwidth.
Link to original
- Volume-based attacks:
UDP flood
A UDP flood is a form of volumetric DoS attack where the attacker targets and overwhelms random ports on the host with UDP packets.
Link to originalICMP flood
ICMP flood is a flood of ping requests. (ICMP echo request packets)
Link to original- Application attacks:
HTTP flood
A HTTP flood is a Layer-7 application attack that uses botnets, attacker spams HTTP requests to host.
Link to originalSlow Loris
Slow Loris sends small portions of a HTTP request to a server. These are sent in timed intervals so the request does not time out, the server runs out of available connections.
Link to original- Protocol attacks:
TCP SYN flood
TCP SYN flood is where an attacker sends seemingly normal SYN requests to a server which cause it to respond with SYN-ACK packets. This causes the target machine to slowly run out of memory as it waits for ACK packets from the attacker.
Link to originalPing of Death
A Ping of Death is where an attacker tries to crash or freeze a server by sending a normal ping request that is either fragmented or oversized.
Link to original
3. Software Faults and Hazards
Software Faults and Hazards
Software vulnerabilities
Software vulnerabilities involve bugs in software, these bugs can cause security breaches or information leaks. A common attack vector is a buffer overflow which an give an attacker control over the device.
Link to originalCross-site scripting
Cross-site scripting (XSS) is a vulnerability in a website which allows malicious code to run on said website, typically a malicious Javascipt payload is executed giving the attacker full control over a user’s account or their presence on said website. Similar to an SQL injection except this malicious code is executed on the server.
Link to originalLink to originalSpam email
Spam email is unsolicited email sent without the consent of the addresses and without any attempt at targeting recipients who are likely to be interested in its contents. Could potentially be a phishing attack.
Link to original
4. Cyber Security
Cyber Security
An attack occurs when an unauthorized individual or group of individuals attempt to access, modify, disrupt or damage systems.
Typically they try to accomplish one or more goal:
- Someone wants to access your resources.
- Wants to modify information.
- Is attempting to disrupt your network and services.
Common Attacks
Link to original
Dumpster diving (Security)
Dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network.
Link to originalShoulder Surfing
Shoulder surfing is the practice of spying on the user of a cash-dispensing machine or other electronic device in order to obtain their personal identification number, password, or other confidential PII.
Link to originalTailgating (Security)
Tailgating is where a bad actor follows an authorized person through a security checkpoint or door to gain access.
Link to originalImpersonation
Impersonation involves an attack masquerading as a valid network user, usually someone with higher privileges.
Link to originalPhishing
Phishing is sending fradulent communciations which appear to come from a reputable source.
Link to originalBackdoor attacks
Backdoor attacks where malicious attackers either introduce a hook into a system or takes advantage of troubleshooting procedures. Usually used to bypass authentication. Most common strategies include: Exposed administration interfaces, redundnt interfaces, hidden parameters, redundant users, authorization for 3rd parties, old users in systems, and exposed configuration data.
Link to originalMan-in-the-middle attacks
Man-in-the-middle attack is an access attack but it can be used to modify data.
Link to original
IP spoofing
IP spoofing: Making data look as if it came from a trusted hosted when it actually didn’t.
Link to originalDNS spoofing
DNS spoofing: Redirecting a user to a fake website rather than the real one they intended to visit.
Link to originalHTTPS spoofing
HTTPS spoofing: Trying to make a victim believe they are visiting a trusted website.
Link to originalARP spoofing
ARP spoofing: With ARP poisoning, an attacker sends ARP messages onto a local area network, this can be used to trick devices to connect to different devices.
Link to originalSSL hijacking
SSL hijacking: Attacker forges SSL handshake and intercepts information between victim and target. Typically they try to downgrade the connection.
Link to originalEmail hijacking
Email hijacking: Hacker compromises and gains access to a victim’s email account.
Link to originalWi-Fi eavesdropping
Wi-Fi eavesdropping: Setting up Wi-Fi networks with purpose of redirecting traffic through them.
Link to originalSession hijacking
Session hijacking: Stealing browser cookies or data that authenticates a user with a website.
Link to originalBrute-force attacks
Brute-force attacks are where the attacker tries every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
Link to originalSQL injection
SQL injection: Injecting malicious code into a server that uses SQL and forcing it to reveal or execute malicious code.
Link to originalDenial-of-service attack
Denial-of-service attack: Flooding systems or servers with traffic to exhaust resources and bandwidth.
Link to original
- Volume-based attacks:
UDP flood
A UDP flood is a form of volumetric DoS attack where the attacker targets and overwhelms random ports on the host with UDP packets.
Link to originalICMP flood
ICMP flood is a flood of ping requests. (ICMP echo request packets)
Link to original- Application attacks:
HTTP flood
A HTTP flood is a Layer-7 application attack that uses botnets, attacker spams HTTP requests to host.
Link to originalSlow Loris
Slow Loris sends small portions of a HTTP request to a server. These are sent in timed intervals so the request does not time out, the server runs out of available connections.
Link to original- Protocol attacks:
TCP SYN flood
TCP SYN flood is where an attacker sends seemingly normal SYN requests to a server which cause it to respond with SYN-ACK packets. This causes the target machine to slowly run out of memory as it waits for ACK packets from the attacker.
Link to originalPing of Death
A Ping of Death is where an attacker tries to crash or freeze a server by sending a normal ping request that is either fragmented or oversized.
Link to originalZero-day exploit
Zero-day Exploit: An exploit of this kind is usually either found by attackers and quickly patched or found by security researchers, either way as soon as people find out about it there is a window of opportunity where systems are still unpatched and vulnerable.
Link to original