Effective organizational governance and security strategy hinges on the integration of several key components. Security program documentation, security program management, and governance frameworks are integral components of an organization's overall security posture, ensuring that policies, procedures, and controls are systematically documented, managed, and aligned with regulatory requirements. Change and configuration management processes are essential for maintaining the integrity and consistency of systems, particularly when updates or modifications are necessary, thereby supporting the broader governance, risk, and compliance () initiatives. tools facilitate the integration and automation of these processes, enabling organizations to efficiently manage risks and ensure compliance with various standards and regulations. Data governance in staging environments is crucial for maintaining data integrity and security during the development and testing phases, ensuring that sensitive information is adequately protected before deployment. Additionally, the legal and privacy implications of AI use must be carefully considered to ensure that AI technologies are implemented in a manner that respects user privacy and complies with applicable laws. Together, these form a comprehensive approach to governing compliance and risk.
As you study this lesson, answer the following questions:
Why is the systematic control and documentation of IT infrastructure changes important in organizational governance and security strategy?
How does the governance of data in staging environments contribute to regulatory compliance before deployment?
What role do governance frameworks play in maintaining compliance and managing risks within an organization?
What are the legal and privacy considerations introduced by the use of AI, and how should organizations address these concerns to ensure transparency and accountability?
Policies, procedures, standards, and guidelines provide the structured framework that defines how an organization manages risk, ensures legal and regulatory compliance, and demonstrates transparent governance practices. Policies articulate the organization's intent and expectations, directing all related activities. Procedures translate policies into actionable steps to ensure consistent and repeatable implementation. Standards provide specific criteria and benchmarks and form the reference point to assess acceptable levels of protection. Guidelines provide a flexible set of practices to help steer the successful implementation of all other requirements. These documents support an environment that mitigates risks, ensures adherence to legal and regulatory mandates, and promotes a culture of accountability and continuous improvement.
Policies
Policies are the cornerstone documents within any organization. Broad in scope and authoritative in nature, policies provide a high-level, somewhat generalized statement of beliefs, goals, and objectives associated with different aspects of governance, risk, and compliance. Policies establish the foundation for more detailed documents that guide specific actions and behaviors.
Procedures
Procedures, as practical extensions of policies, describe specific actions to be taken to adhere to established policies. They are detailed, step-by-step instructions that ensure consistency and uniformity in the daily operations of an organization. When well-written, procedures are practical tools that steer employees' actions to mitigate the risks associated with their work tasks.
Standards
Generally, standards specify the minimum acceptable levels of compliance for many activities. Standards differ from procedures in that they help define the parameters within which policies and procedures operate. Standards help ensure that an organization meets various expectations for compliance, security, and performance. For example, a standard often defines "what great looks like," and this definition helps steer the level of detail and substance contained within policies, and the type and quantity of procedures incorporated by the organization to steer employee actions. A practical example includes using the Payment Card Industry Data Security Standard () to influence a corporate data protection policy's content directly. provides very specific, mandatory security requirements for protecting the Cardholder Data Environment (CDE) and practices regarding assessment and remediation. These details identify specific best practices that are then adapted to form the organization's policies and procedures.
Guidelines
Guidelines are unique because they are advisory in nature instead of mandatory. They offer recommended practices but allow for flexibility and discretion in implementation. Guidelines support the practical application of policies, procedures, and standards by providing context that helps organizations navigate complex or unforeseen situations where strict adherence to procedures or standards might not be possible or feasible.
Security Program Documentation
A pyramid diagram showing the hierarchy of policies, standards, procedures, and guidelines with corresponding questions: Policies (Why do I need to do this?), Standards (What is required?), Procedures (How do I do it?), Guidelines (What is the recommended guidance for how to do it?).
Support of Compliance
These interrelated documents (policies, procedures, standards, and guidelines) support a program by providing a structured approach to managing the organization's objectives, assessing and mitigating risks, and complying with relevant laws and regulations. But how do governance committees and risk managers know that the organization is operating in alignment with these requirements? All four types of documents directly support compliance because they provide the details needed by an information compliance team to ensure (via measurement and assessment) that all activities are carried out within defined boundaries.
When management prioritizes and actively supports security initiatives, the effectiveness of these programs dramatically improves. Security awareness and training programs are a classic example of the importance of management engagement. Security awareness and training programs educate employees about security topics such as phishing, social engineering, privacy protection, and many other subjects. These programs raise awareness of pressing issues and equip employees with the knowledge and skills to recognize and effectively respond to them.
Management's endorsement of these programs ensures their implementation and encourages continuous participation and engagement from employees. Management's commitment ensures adequate resources are allocated towards developing comprehensive training content, which often takes a lot of time and resources. Training and awareness materials require frequent updates and refreshers to keep up to date with new technologies, business practices, policy changes, and new and emerging threats. A management-driven approach means employees are more likely to treat security practices seriously and incorporate best practices into their daily activities, resulting in a resilient organizational culture that can better defend and withstand attacks. When training and awareness programs lack visible support and endorsement by the management team, they are generally perceived as unimportant compliance check-box formalities, rather than essential components of the organization's cybersecurity program.
It is important to highlight that management's commitment to cybersecurity extends beyond the initial support and resource allocation for security awareness and training programs. Management's commitment necessitates an ongoing awareness of the overall status of the cybersecurity program. (Most cybersecurity regulations also mandate this level of commitment.) Common leadership tools, such as the (Responsible, Accountable, Consulted, Informed) matrix, help define roles and responsibilities associated with specific tasks within the cybersecurity program. An matrix helps ensure everyone understands their specific duties and expectations. This level of clarity is critical in managing and maintaining a cybersecurity program, which often requires precise coordination and rapid action. Security tasks, such as risk assessments, implementation of new security software, monitoring, patching, , and other tasks, can be complex, involving multiple departments and input from various levels of staff and leadership.
For example, when deploying a new security tool, the IT department may be responsible for the technical implementation of the tool, while the security officer may be accountable for the overall success of the project and its alignment with regulatory mandates. Other stakeholders, such as the legal department, might need to be consulted to provide input on compliance issues, while senior management might simply need to be kept informed of progress or any significant changes.
Matrix
Responsibility assignment matrix showing tasks and roles of IT Department, Security Officer, Legal Department, and Senior Management.
The matrix facilitates smoother communication among all parties involved by establishing clear roles. Each member knows whom to approach for decisions or for escalation of issues, enhancing security operations' efficiency and effectiveness.
Effective communication and reporting are about keeping management informed and building a proactive security culture. Regular updates, through structured reporting mechanisms, ensure that management remains aware of any significant threats, incidents, and the security program's overall effectiveness. This flow of information allows management to make informed decisions about where to focus resources and how to adjust strategies to address evolving security challenges. Importantly, these communications should include more than just conveying problems; they should also include progress and successes.
Essential Topics in Security Awareness Training
Phishing
Explain phishing concepts, including their different forms, such as email phishing, spear phishing, whaling, vishing, and smishing.
Highlight common tactics phishers use, such as urgency, impersonation, and embedding malicious links or attachments.
Provide methods to identify suspicious emails or messages, such as checking the sender's email address, looking for poor grammar, and analyzing message content for warning signs.
Provide instructions for when a phishing attempt is identified, including not clicking links, reporting the incident to appropriate teams, and ways to handle the suspected message safely.
General Security
Introduce fundamental concepts such as the confidentiality, integrity, and availability (CIA) Triad and their importance in security programs.
Emphasize the importance of strong, unique passwords, the use of password managers, and the risks attributed to password reuse.
Highlight the importance of updating software and operating systems to address vulnerabilities. Describe the purpose of antimalware tools, firewalls, encryption, and the importance of securing devices used for work purposes.
Explain social engineering and how it is used to gain access to sensitive information and systems.
Explore different types of social engineering, such as pretexting, baiting, and tailgating.
Describe how to recognize and respond to suspected social engineering attacks, including ways to verify identities and approaches designed to protect from inadvertently "over-sharing" information that attackers can use in an attack.
Privacy
Explain fundamental privacy protection principles such as data minimization, purpose limitation, and retention.
Provide guidelines on handling personal data responsibly, including encryption, secure storage, and controlled access.
Highlight the significance of privacy regulations such as General Data Protection Regulation (), California Consumer Privacy Act (), and Health Insurance Portability and Accountability Act () and the potential penalties for non-compliance with these laws.
Describe the steps to take when a data breach or privacy incident occurs, including who to notify and how to contain the incident.
Operational Security (OpSec)
Introduce the concept of Operational Security and its importance in protecting information from adversaries.
Explore the five-step process of OpSec: Identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risks, and implementation of countermeasures.
Describe how to protect critical information in daily operations, including safe disposal of sensitive documents, secure communication methods, and limiting information sharing.
Describe workplace best practices such as locking unattended computers, using secure networks, and being mindful during conversations in a public setting.
Situational Awareness
Define information and its role in identifying and responding to potential threats.
Explore ways to recognize potential physical (environment) and digital threats.
Provide guidance on what actions to take when potential threats are identified, including reporting procedures and emergency protocols.
Stress the need for continuous vigilance and the "security-conscious mindset," both at work and in personal settings.
Governance frameworks play a critical role in establishing organizational security requirements because they provide structured guidelines, best practices, and processes. This helps organizations develop a security program that complies with all legal and regulatory requirements, effectively manages cybersecurity risks, and aligns with business objectives. In short, governance frameworks assist organizations in implementing a governance, risk, and compliance () program by serving as a guidebook or field guide. The National Institute of Standards and Technology (NIST) CSF 2.0 highlights the importance of governance in cybersecurity capabilities.
NIST Cybersecurity Framework
NIST Cybersecurity Framework wheel showing five core functions: Identify, Protect, Detect, Respond, and Recover, all governed by an overarching framework.
Popular Industry Governance Frameworks
Many governance frameworks exist and are utilized widely across various industries. Some very popular ones include (Control Objectives for Information and Related Technologies), (Information Technology Infrastructure Library), ISO/IEC 27001, and the NIST Cybersecurity Framework (CSF).
More information regarding and the can be found at the following websites.
: https://www.iso.org/standard/27001
: https://www.nist.gov/cyberframework
Control objectives for information and related technologies () is particularly effective for establishing a program. takes a holistic approach to IT governance and emphasizes alignment with business objectives. is divided into domains and processes, each covering different aspects of IT governance, including risk management and information security. It strives to integrate governance into everyday IT processes in an effort to ensure that IT-related decisions always align with important business goals and support regulatory compliance needs. emphasizes the use of stringent policies, standards, and processes to shape and define IT governance practices. It also provides guidance regarding different metrics and maturity models designed to help measure the program's effectiveness, which, in turn, drives continual improvement.
More information regarding the Framework can be found at https://www.isaca.org/resources/
The framework includes specific processes for identifying, evaluating, and managing IT risks. For example, can help establish a risk management program that aligns with overall business risks and prioritizes cybersecurity threats based on their potential impact on business operations. Additionally, provides tools and resources to help organizations ensure that their cybersecurity practices comply with relevant laws, regulations, and standards. By implementing 's governance and management objectives, organizations can create clear policies for information security, define roles and responsibilities, and establish audit and compliance checks.
is also well-suited for establishing a program. focuses specifically on the "service delivery" aspects of IT management. In the context of , "Service delivery" refers to a comprehensive set of management practices designed to ensure that IT services align with business objectives. continuously checks that IT services are providing value to the organization and provides guidance regarding the management of risk and compliance best practices. emphasizes continuous improvement, making it ideal for organizations actively working to improve processes in general, information and their cybersecurity operations specifically.
More information regarding the Framework can be found at https://www.axelos.com/certifications/itil-service-management/what-is-itil/
supports cybersecurity operations through its structured framework for managing business-aligned IT services. Its focus on service management makes it particularly useful for integrating cybersecurity into IT operations. advocates continuous service improvement, which can be adapted to cybersecurity operations. For example, structured reviews of security incidents can drive improvements in detection and response capabilities. Additionally, emphasizes secure service design and controlled service transition processes, which help prevent security issues during the deployment and operation of IT services.
You're in an overlay, press escape to exit
A nonregulatory government agency that develops computer security standards used by US federal agencies and publishes best practice guides and research.
Even when introduced at a basic level, change and configuration management programs provide tremendous benefits to a cybersecurity program. They foster collaboration between different organizational departments and help to standardize and enforce settings, especially with regard to secure configurations. Effective oversight of large and high-risk IT infrastructures requires a much more methodical and strategic approach to change and configuration management and differs from more common-practice approaches. Implementing an asset management life cycle, robust hardware and software inventories, and a Configuration Management Database (CMDB) provides a comprehensive view of an organization's IT infrastructure and supports effective decision-making.
Note:
Leverage CMDB best practices, additional resources and uses cases for long-term success.
The asset management life cycle defines the practices for effective control of IT assets from procurement to disposal. A life cycle approach ensures that assets are properly tracked, including their status, criticality, and current business value. An asset management program incorporates hardware and software inventories, which provide accurate and timely details regarding hardware and software vendors, version numbers, configuration details, and many other attributes. Inventories generally support day-to-day operations; for instance, a software inventory can be checked to confidently identify all instances of an application used by an organization. An asset inventory is especially important when risk managers must quickly assess the potential scope and impact of a newly discovered exploitable impacting specific software versions. An asset inventory can quickly list impacted systems ahead of more in-depth scanning and assessment performed by analysts.
A Configuration Management Database (CMDB) is a fundamental platform supporting asset management practices because it stores comprehensive information regarding all the components in an IT environment, including their interrelationships. The CMDB helps to organize and manage IT change and configuration management by maintaining data on the types, configurations, and relationships of all infrastructure components, including servers and software, as well as facilities and personnel. The benefits of implementing a CMDB are multifaceted, but most importantly, a CMDB enhances impact analysis for proposed changes and supports regulatory compliance by maintaining accurate historical data on IT assets.
Configuration Management Database (CMDB)
Diagram showing a CMDB (Configuration Management Database) in the center, connected to seven surrounding elements: Systems Management, Dashboards, Desktop Management, Telephony CTI/ACD, Databases, Applications, and MS Outlook/Lotus Notes.
Note:
A non-comprehensive list of CMDB platforms (or platforms that provide CMDB functionality) include ServiceNow, BMC Helix CMDB, and the open-source i-doit CMDB.
The risks associated with not integrating an asset management life cycle, hardware and software inventories, and a CMDB into change and configuration management programs can be significant, including increased incidents of service outages attributed to poorly planned changes and ineffective incident responses, especially with regard to quickly identifying and remediating risky assets. The inability to view or track interdependencies between assets can lead to conflicts and compatibility issues only identified after changes are made, resulting in lost productivity, frustration, and unscheduled downtime. Moreover, the lack of accurate asset data can perpetuate legal non-compliance problems, resulting in credibility and reputational damages and financial penalties. These risks underscore the urgency and importance of integrating these tools into configuration and change management practices.
Governance, Risk, and Compliance programs can benefit from integrating various tools designed to aid decision-making processes and organizational visibility at the strategic level.
Mapping
Governance, Risk, and Compliance () mapping tools visualize relationships and dependencies across various business processes, controls, risks, and compliance requirements. At its core, mapping is about creating a detailed, interactive model of an organization's entire risk and compliance profile to delineate how different mandates impact various parts of the business, identify where critical risks reside, and understand how various governance processes interact. The primary enhancement mapping tools bring to classical processes is information integration. mapping tools facilitate better strategic planning and decision-making by visually representing the risks associated with different activities. When properly implemented, mapping tools also allow organizations to react more swiftly to regulatory changes or emerging risks due to improvements in decision-making efficiency and effectiveness.
Automation
Governance, Risk, and Compliance () automation tools automate repetitive and manual tasks, allowing teams to focus on strategic decision-making and less on operational mechanics. Automation in the context of generally describes using software tools designed to handle routine tasks such as data collection, risk assessments, compliance checks, and reporting. When performed manually, these tasks are time-consuming and prone to human error. Automated tools offer the potential to continuously monitor and analyze data and alert on issues requiring immediate attention. This capability is crucial for organizations managing frequent regulatory changes where non-compliance risks are significant and potentially costly. The volume of data and information available to continues to increase exponentially; automation tools help teams manage increased data volumes, complicated interdependencies, and legal compliance requirements.
Another significant benefit of automation is improved auditability and transparency of processes. automation tools typically provide tracking and logging features to record every action taken, including who took it and when it occurred. This level of transparency helps demonstrate compliance and supports continuous process improvement within the organization's practices. Moreover, automation tools often feature centralized dashboards encouraging information sharing and aligning departments toward common compliance and risk management goals.
Compliance Tracking
Governance, Risk, and Compliance () compliance tracking tools provide a single source of authority for all compliance data, which is especially useful for organizations managing the requirements of many different regulations, standards, and legal mandates. Through effective consolidation of information, these tools make it easier for organizations to assess compliance and improve the accuracy of compliance reporting. Manual compilation of reports often leads to inaccuracies due to human error and outdated information. Compliance tracking tools help address these problems when they are configured to pull data directly from monitored systems, which helps ensure that reports are current and accurate. This reliability is essential not only for internal management but also for maintaining transparency with regulators and other external stakeholders.
Note:
Sources of information for a compliance tracking solution include databases, financial systems, operational data, transaction logs, document management systems, regulatory data feeds, third-party data feeds (often requiring a license), audit and assessment reports, and even email platforms
Tools for tracking compliance help streamline audit processes. They provide audit trails and historical data logs, allowing auditors to access detailed records of compliance activities easily. This helps auditors understand the context of decisions made and verify the organization's compliance status without sifting through physical documents or multiple software systems. This capability not only streamlines the auditing process but also enables organizations to demonstrate their commitment to compliance in a structured and repeatable manner.
Dashboard
Example of a dashboard summarizing key metrics and visualizations for risk exposure, compliance and privacy, supplier management, audit and controls, and ESG performance, with various charts and statistics.
Documentation
Governance, Risk, and Compliance () documentation tools are designed to help organizations maintain accurate, organized, and accessible records of all GRC-related activities. documentation tools provide a centralized platform where all GRC-related documents are stored, managed, and updated systematically and securely. Moreover, they ensure that all documents are accurately version-controlled, making it easy to track changes and ensure that only the most current documents are used in any decision-making process.
Another important benefit of these tools is their role in supporting compliance. By automating the creation, storage, and maintenance of compliance-related documents, documentation tools help ensure that all necessary records are up-to-date and readily available.This extends to generating compliance reports, policies, and procedures, which can be configured to update automatically in response to regulatory changes.
The ComplianceAsCode project on GitHub (https://github.com/ComplianceAsCode/content) is an initiative aimed at providing a suite of resources to automate security compliance management on various information systems. The project leverages open-source tools and methodologies to translate security policies and compliance requirements into code, allowing organizations to integrate them directly into their IT infrastructure and development processes. This approach strives to ensure compliance is built into systems from the ground up rather than retroactively enforced (top-down.)
The project aligns closely with the principles of DevSecOps, which advocate for integrating security practices within IT projects' development and operational phases. By embedding compliance and security measures into the development pipeline, organizations can ensure that these considerations are addressed continuously throughout the software life cycle, rather than as an afterthought. The ComplianceAsCode project represents a significant shift in how compliance and security are managed within IT systems because it enables a more proactive, automated, and integrated approach to .
Continuous Monitoring
Governance, Risk, and Compliance () continuous monitoring tools provide ongoing analysis of compliance and risk metrics and help organizations keep pace with the dynamic nature of business operations, regulatory changes, and emerging risks.
In traditional processes, monitoring typically occurs through audits, reviews, and assessments at periodic intervals, such as monthly, quarterly, or annually. This approach, while systematic, can leave gaps during which new risks can emerge or compliance can lapse. Continuous monitoring tools provide near-real-time insights into an organization's risk and compliance status. This constant vigilance allows organizations to detect issues and respond information as they occur rather than waiting for the next scheduled review, reducing response times.
continuous monitoring tools can integrate deeply within an organization's information systems to enable the correlation of data from multiple sources, enhance the accuracy of risk assessments, and increase the effectiveness of compliance checks. These tools often incorporate data analysis and advanced technologies, such as AI and machine learning, to predict future risks based on identified trends and patterns.
Data governance, a critical aspect of organizational management, provides a robust framework that ensures the proper handling, security, and use of data across an enterprise. It encompasses the processes, policies, standards, and technologies employed to manage and protect data effectively. The central aim of data governance is to ensure that data is accurate, accessible, consistent, and protected in accordance with organizational policies and applicable regulatory requirements, thereby supporting the security and integrity of the organization's data.
Data governance practices play a crucial role in maintaining data accuracy, security, compliance, and life cycle management. They ensure that data is accurate and fit for its intended purpose, protected from unauthorized access, and used in compliance with laws and regulations. They also define how data can be acquired, used, maintained, and eventually disposed of.
Organizations commonly operate multiple environments, such as production, development, testing, and QA (quality assurance), to support software development and deployment life cycles, test and validate patches, provide training, and for many other purposes. In the production environment, live ("real") data is used, and the environment is closely guarded and monitored. Development and testing environments, on the other hand, are used for less formal testing of applications and changes and should be populated with test data that mimics real production data minus any sensitive information should be removed or replaced with placeholders. QA environments parallel production environments and should closely match production configurations to help validate upgrades, patches, and other changes before implementing them in production. Effective data governance must extend to these various test environments to ensure that any data used here is handled in accordance with policy and any legal requirements so that it remains secure. Many organizations lose sight of regulated data stored in test environments because they are frequently excluded from many of the stringent protections used in production.
Staging Environment
A three-stage workflow diagram showing the progression from Development to Testing/QA to Production, each stage represented by a circle with an icon and an arrow pointing right to indicate flow.
Data life cycle management (DLM) is a key component of data governance. It describes data handling from creation to (eventual) deletion, and when implemented effectively, it supports the goals of data governance by ensuring data quality and compliance over its lifetime.
Artificial Intelligence (AI) is profoundly improving organizational efficiency and supporting decision-making capabilities in new and unique ways. However, AI is also introducing new operational risks and challenges.
While it is well documented how AI tools can quickly bypass traditional security measures, such as AI-powered software designed to crack passwords or AI-powered chatbots designed to craft increasingly realistic email correspondence as part of a sophisticated phishing campaign, other, more indirect issues involve AI tools behaving in unanticipated ways. Examples include an AI system analyzing customer data and inadvertently exposing sensitive information due to flawed algorithms underpinning the AI software or errors made with the test data used to train it. Such issues can quickly escalate into full-scale data breaches.
The versatility and power of artificial intelligence (AI) make it susceptible to various forms of either intentional or inadvertent misuse. Examples include government surveillance, predictive policing, deep fakes and social manipulation (using social media feeds to post targeted content that polarizes communities and spreads extremist ideologies), biased decision-making, autonomous weapons, and automated hacking.
Note:
Predictive policing uses AI and data analytics to forecast where crimes are likely to occur and who is likely to commit them based on patterns and trends extracted from historical crime data.
These new classes of issues necessitate updates to corporate security policies designed to address the risks presented by AI, along with employee training and awareness activities. New or updated policies should define the responsible use of AI within the organization and the controls needed to manage AI-centric risks. Furthermore, as AI becomes more integrated into operational processes, organizations must consider the ethical implications concerning privacy, accountability, and transparency in AI-driven decisions. For example, if a bank chooses to utilize AI to detect fraudulent transactions, it must effectively identify an appropriate balance between threat detection and customer data privacy. For healthcare organizations, AI applications designed to process patient information must be rigorously tested to ensure they do not accidentally disclose protected health information due to programming errors, logic flaws, or learning biases.
Note:
AI learning biases are common and can manifest in several ways. Learning biases reflect the underlying characteristics of the data used for training AI systems or the algorithms' design attributes.
Lastly, the retail sector's use of AI-driven personalized marketing must implement guardrails designed to ensure that AI systems do not exploit consumers or invade their privacy.
Legal and regulatory risks underpin all of these examples. In addition to ethical and moral offenses, data breaches and privacy violations result in lengthy and expensive litigation, which may form the foundation of risk management practices in organizations that are not steered by moral or ethical obligations.
The legal implications of AI use are extensive and reflect the growing integration of AI technologies in many industry sectors and their potential impacts on society. Determining liability in cases where AI systems cause harm or damage is complex because traditional legal frameworks are built around human actions and intentions.
Further Reading:
NIST AI Risk Management Framework https://www.nist.gov/itl/ai-risk-management-framework
European Approach to Artificial Intelligence https://digital-strategy.ec.europa.eu/en/policies/european-approach-artificial-intelligence
Ownership & Liability
Regarding the use of AI, questions arise, such as who is responsible when an autonomous system causes an accident. Is it the manufacturer, the software developer, or the vehicle owner? What if an AI-driven medical diagnosis is wrong? Liability must be clearly defined between software developers, healthcare providers, data providers, and many other stakeholders.
Intellectual Property
Who owns the outputs generated by AI systems? Such definitions must be clearly identified. If an AI program writes a book or composes music, can these products be copyrighted, and if so, who is designated as the author? Additionally, if the AI software was trained using existing copyrighted materials, issues regarding copyright infringements and fair use would come into focus.
Discrimination and Equality
AI systems can perpetuate or even exacerbate biases present in training data, leading to discriminatory outcomes that can impact hiring, lending, and law enforcement actions. Legal frameworks such as the U.S. Civil Rights Act, the Americans with Disabilities Act, and other anti-discrimination laws mandate fairness and equality in these areas, so ensuring AI compliance with these legal standards is essential.
Explainable vs. Non-Explainable AI Models
Explainable AI describes models that can provide substantive insights regarding how they reached a "decision" or made a conclusion. These insights help us (humans) to determine when AI decisions are valid or trustworthy. Models such as these require algorithm transparency, meaning human operators can trace and understand the logic.
In contrast, Non-Explainable AI utilizes models often characterized as "black boxes" because their processes and algorithms are not transparent or (in some instances) understandable to humans. Models such as these often incorporate complex neural networks that obscure the logic behind their outputs.
Note:
A neural network is a type of artificial intelligence (AI) that models itself after the human brain, creating an artificial "neural" structure that enables machines to make decisions, recognize patterns, and solve problems in ways that are similar to human thinking. The power of neural networks in AI comes from their ability to learn patterns from vast amounts of data and make informed decisions without explicit programming for each specific task
Explainable AI models are important in areas where trust, confidence, compliance, and ethics are at the forefront because they allow independent assessment and evaluation of the methods used. Many of the most advanced and sophisticated AI models are non-explainable due to their complexity or are proprietary (and therefore legally protected.) While non-explainable models can accomplish sophisticated tasks, their non-explainable nature poses an ethical dilemma.
Exam Objectives Covered
Legal compliance is one of the most important things to keep in mind for any business, person, or industry. Awareness of industry-specific compliance, industry standards, and security and reporting frameworks is essential for organizations to navigate the complex landscape of regulatory requirements and best practices tailored to their specific sectors. These elements ensure that organizations adhere to the necessary protocols and benchmarks, thereby maintaining the integrity and security of their operations. The distinctions between audits, assessments, and certifications further clarify the different levels of scrutiny and validation required to demonstrate compliance and operational excellence. Privacy regulations add another layer of complexity, mandating that organizations protect personal data and respect user privacy across all operations. Additionally, awareness of cross-jurisdictional compliance requirements is critical for organizations operating in multiple regions, as it ensures that they meet the diverse legal and regulatory standards of each jurisdiction. Collectively, these concepts help maintain regulatory compliance, protect sensitive information, and foster trust with stakeholders.
As you study this lesson, answer the following questions:
Why is it important to differentiate between audits, assessments, and certifications in evaluating and validating compliance and security postures?
How does awareness of cross-jurisdictional and industry-specific compliance requirements benefit organizations?
What role do best practice hardening configurations and device hardening options play in securing systems against vulnerabilities?
How do industry standard publishers and risk frameworks contribute to maintaining a secure and compliant operational environment?
Industry-specific compliance ensures that organizations adhere to established laws, regulations, and standards designed to protect public health, safety, financial integrity, and the environment. It aims to safeguard sensitive information, maintain operational integrity, and uphold ethical practices within each sector. Compliance is measured through regular audits, assessments, and reporting mechanisms that evaluate adherence to these regulations and standards. Evaluations are conducted by regulatory bodies and internal compliance teams, using predefined metrics and benchmarks to identify non-compliance issues and enforce corrective actions, which drive continuous improvement and accountability.
Here is a non-comprehensive sample of several laws, regulations, and standards associated with different industrial sectors. The purpose of this information is to highlight the broad extent of the legal environment that shape cybersecurity practices.
Healthcare Sector
Health Insurance Portability and Accountability Act () was enacted in 1996 and focuses on protecting the privacy and security of patient health information by establishing national standards for protecting Protected Health Information (PHI).
The Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted in 2009 as part of the American Recovery and Reinvestment Act (ARRA). It was designed to promote the adoption and meaningful use of health information technology, particularly electronic health records (EHRs).
The Food and Drug Administration (FDA) regulations protect public health by ensuring the safety and security of drugs, biological products, and medical devices.
The Centers for Medicare and Medicaid Services (CMS) is an agency within the U.S. Department of Health and Human Services (HHS) that administers major healthcare programs, including Medicare, Medicaid, and the Children's Health Insurance Program (CHIP).
Financial Sector
The Sarbanes-Oxley Act, commonly called SOX ("socks") and sometimes the "Enron laws," was enacted in response to major corporate and accounting scandals at Enron and WorldCom corporations during the early 2000s. The primary objective of SOX is to enhance corporate governance and accountability by establishing strict reforms to improve financial disclosures and prevent accounting fraud.
Enron scandal: https://www.britannica.com/event/Enron-scandal
Rise and Fall of WorldCom: https://www.investopedia.com/terms/w/worldcom.asp
The Dodd-Frank Wall Street Reform and Consumer Protection Act (2010) was enacted in response to the 2008 financial crisis when significant weaknesses in the financial regulatory framework were exposed. The Dodd-Frank Act aims to promote the financial stability of the United States by improving accountability and transparency in the financial system.
The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act, primarily addresses the privacy and protection of consumer personal financial information. The key purpose of GLBA is to require financial institutions to explain information-sharing practices to their customers and to safeguard sensitive data.
Basel III is an international regulatory framework developed by the Basel Committee on Banking Supervision in response to the financial crisis of 2008. It is part of the broader Basel Accords that aim to strengthen global bank regulation, supervision, and risk management. Basel III requires banks to increase the quality and quantity of capital held to improve their ability to absorb shocks stemming from financial and economic stress.
Government Sector
Federal Information Security Modernization Act (FISMA) was initially enacted in 2002 and then updated in 2014. It is a critical regulation that governs information and information systems protection within federal agencies. The main purpose of FISMA is to establish a comprehensive framework to protect the information systems used by federal agencies.
OMB Circular A-130 is titled "Managing Information as a Strategic Resource" and provides comprehensive policy guidance for federal agencies on managing information resources, including information technology (IT), information security, and privacy. OMB Circular A-130 establishes guidelines for managing federal information resources to ensure they are used effectively and securely to support government missions and services.
The Freedom of Information Act (FOIA) was enacted in 1966 and is fundamental to promoting transparency and accountability in the federal government by providing the public with the right to access government records.
Utilities Sector
North American Electric Reliability Corporation (NERC) standards is a not-for-profit regulatory authority responsible for ensuring the reliability and security of the bulk power system in North America. NERC standards are mandatory for utilities operating in the United States, Canada, and parts of Mexico and establish guidelines and requirements for the planning and operation of the bulk power system to ensure its reliable performance.
Federal Energy Regulatory Commission (FERC) regulations is an independent agency that regulates the interstate transmission of electricity, natural gas, and oil. It also oversees the reliability of the electric grid and wholesale electricity markets. The purposes of FERC regulations include ensuring that electricity rates and charges in interstate commerce are reasonable and non-discriminatory to protect consumers from unfair practices.
The Environmental Protection Agency (EPA) regulations is responsible for protecting human health and the environment by enforcing regulations that limit the environmental impact of various industries, including the utilities sector. The purposes of EPA regulations in the utilities sector include regulating emissions of pollutants from power plants, such as sulfur dioxide, nitrogen oxides, and carbon dioxide, to reduce air pollution and mitigate environmental damage.
Occupational Safety and Health Administration (OSHA) standards is a federal agency that sets and enforces standards to ensure safe and healthy working conditions for employees in various industries, including the utilities sector. OSHA establishes safety requirements for utility workers, particularly those involved in high-risk activities such as working with electrical systems, heavy machinery, and hazardous materials.
Industry standards establish best practices and guidelines for protecting information systems and data. They provide a unified framework that helps organizations mitigate risks, measure compliance, and enhance resilience against threats. Organizations can safeguard operations, build trust with stakeholders, and maintain regulatory compliance by adhering to these standards.
International Organization for Standardization/International Electrotechnical Commission ISO/IEC 27k Series
The ISO/IEC 27000 series provides a comprehensive framework for managing information security, focusing on establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Its objective is to help organizations protect their information assets by adopting a risk management approach to ensure data confidentiality, integrity, and availability. The ISO/IEC 27000 series evaluates an organization's practices through a systematic approach. First, the organization implements an Information Security Management System (ISMS) based on the requirements and guidelines specified in ISO/IEC 27001, which outlines the required policies, procedures, and controls to manage information security risks effectively.
Evaluation begins with a risk assessment to identify potential threats and vulnerabilities to the organization's information assets. Based on the assessment results, the organization develops a risk treatment plan to mitigate identified risks through appropriate security controls. Controls are selected from the set provided in ISO/IEC 27002, representing best practice recommendations for information security management.
Once the ISMS is in place, internal audits verify that the implemented controls are functioning as intended and are aligned with the organization's security policies. Additionally, accredited certification bodies perform audits to assess compliance with ISO/IEC 27001 standards. ISO/IEC 27001 certification is achieved when an organization successfully demonstrates that its ISMS meets the standard's requirements.
The Digital Markets Act (DMA)
The Digital Markets Act (DMA) primarily addresses the regulatory environment for digital markets within the European Union, aiming to ensure fair competition and prevent anti-competitive practices by large digital platforms. While its main focus is on market dynamics and consumer protection, it also encompasses facets of cybersecurity by mandating that digital platforms adhere to stringent security measures. The Digital Markets Act (DMA) has significant implications for cybersecurity operations, particularly for large digital platforms known as "gatekeepers." These gatekeepers, typically major online platforms (the "big five:"Google, Apple, Facebook, Amazon, and Microsoft) with substantial influence over digital markets, are subject to strict regulatory requirements under the DMA to ensure fair competition and enhanced security practices.
Payment Card Industry Data Security Standard (PCI DSS)
Payment Card Industry Data Security Standard (PCI DSS) is a global data protection standard established and maintained by a consortium of payment card companies. PCI DSS identifies controls designed to prevent fraud and protect credit and debit card data. Organizations that take credit and debit cards are required to follow the standards described within the PCI DSS. The standard is available via https://www.pcisecuritystandards.org/document\_library.
Using Legal Contracts to Require Standards Compliance
Legal contracts often enforce compliance with external standards or identify similar requirements, such as demonstrating that internal programs closely align with industry best practice frameworks.
(Cybersecurity Framework)
The NIST Cybersecurity Framework, a highly regarded and widely adopted framework in the United States, plays a crucial role in helping organizations define six core functions within a cybersecurity program. Moreover, it offers a structured approach for continuous improvement, guided by the development of an organizational profile and an assessment of risk management practices against established CSF Tiers.
The six core functions are:
Govern, Establish and enforce organizational policies and procedures to ensure cybersecurity risk management.
Identify, Develop an understanding of organizational cybersecurity risks to manage and minimize them effectively.
Protect, Implement safeguards to ensure critical infrastructure services and sensitive data are secured.
Detect, Implement activities to identify the occurrence of cybersecurity incidents promptly.
Respond, Develop and implement strategies to contain the impact of detected cybersecurity incidents.
Recover, Implement plans to restore capabilities and services affected by cybersecurity incidents.
Organizational profiles are utilized to interpret the core outcomes by taking into account an organization's mission objectives, stakeholder expectations, threat landscape, and requirements. This allows an organization to prioritize its actions in order to achieve specific outcomes and communicate this information to stakeholders.
Scope the Organizational Profile.
Gather the information needed to prepare the Organizational Profile.
Create the Organizational Profile.
Analyze the gaps between the Current and Target Profiles and create an action plan.
Implement the action plan and update the Organizational Profile.
CSF Tiers represent the level of an organization's cybersecurity risk governance and management practices, offering insight into the organization's approach to cybersecurity risks and its risk management processes.
More details regarding the can be obtained via https://www.nist.gov/itl/smallbusinesscyber/nist-cybersecurity-framework.
Best Practice Hardening Configurations
Best practice configurations are available to use as a reference when hardening endpoints. Two very popular sources of guidance include the U.S. Department of Defense (DoD) Security Technical Implementation Guides (STIGs) and the Center for Internet Security (CIS) CIS Benchmarks.
The DoD SCAP (Security Content Automation Protocol) Compliance Checker is available for download for free and can run automated system configuration checks against STIG (Security Technical Implementation Guides) Benchmarks https://www.cyber.mil/stigs/. DoD STIGs also include GPO (Microsoft Active Directory Group Policy Objects) objects that contain many best practice security configurations, although GPOs must be carefully inspected and tested prior to use/deployment to avoid unintended consequences such as breaking a system or software functionality.
CIS Benchmark configuration guides can be downloaded for free and include detailed descriptions of all configuration points, although the documents are very lengthy to use in this way https://www.cisecurity.org/cis-benchmarks/. CIS offers a software tool for checking configurations called CIS CAT, but access to the tool is limited to CIS Members. CIS benchmarks are also available in the Wazuh Security Platform, the professional version of the Tenable Nessus scanner, and CIS-hardened images are available for deployment within major cloud platforms, such as AWS or Azure.
Third-Party Evaluation
An effective and efficient way to assess a vendor is to identify whether they have participated in a third-party assessment. When performed by an independent and trusted authority, a third-party assessment demonstrates that the vendor has a well-established minimum level of maturity and/or capability in place.
The Cloud Security Alliance (CSA) is focused on ensuring secure cloud computing environments. It provides best practices, research, and educational resources to help organizations manage and mitigate security risks associated with cloud technologies. The CSA's relevance lies in its ability to bring together a global community of experts to develop frameworks and standards, such as the CSA Security Trust Assurance and Risk (STAR) program, which comprehensively assesses cloud providers' security postures. By promoting transparency and security assurance, the CSA helps businesses make informed decisions about their cloud service providers. Additionally,the CSA's research initiatives and working groups address emerging threats and evolving cloud security challenges, ensuring its guidance remains current and effective.The CSA is crucial in advancing secure cloud adoption, fostering trust in cloud services, and supporting security initiatives for organizations leveraging cloud computing. More information is available via https://cloudsecurityalliance.org/star.
System and Organization Controls (SOC) uses standards established by the American Institute of Certified Public Accountants (AICPA) to evaluate the policies, processes, and procedures in place and designed to protect technology and financial operations. In particular, SOC 2 is a framework for managing customer data based on five trust service principles: security, availability, processing integrity, confidentiality, and privacy. It ensures that organizations have effective controls to protect data from unauthorized access and cyber threats, which is crucial in today's landscape of frequent data breaches.
Achieving SOC 2 compliance demonstrates a commitment to data security and helps meet various regulatory requirements, such as those mandated by (General Data Protection Regulation) and (Health Insurance Portability and Accountability Act). This level of compliance demonstrates robust security practices to potential clients and customers. Additionally, becoming SOC 2 compliant often leads to internal operational improvements in risk management and IT infrastructure. For organizations using third-party vendors, SOC 2 reports offer a standardized way to assess the security of these vendors, providing insight and assurance regarding data protection practices in the supply chain. More information is available via <https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2>.
Audits, assessments, and certifications are not just tools, they are the pillars of effective organizational oversight. They are the backbone of compliance, continuous improvement initiatives, and credibility. While they are often used interchangeably, each has a unique value that significantly contributes to an organization's overall strength and trustworthiness.
Audits
Audits are typically rigorous and formal processes conducted by external groups and sometimes internal audit teams to verify that an organization complies with its policies and legal mandates. An audit uses a formal approach that seeks to measure performance against a specific metric. The scope and scrutiny of an audit are broad and can be used to assess compliance with internal policy or an industry standard. Audits can take days, weeks, months, or longer and be performed by a single person or a large team. Ultimately, the audit will produce a report identifying strengths and weaknesses and a report that identifies a prioritized list of recommended actions.
Assessments
Assessments, by contrast, are generally more flexible. They aim to evaluate certain aspects of organizational performance. For example, a cybersecurity assessment might identify vulnerabilities in an IT system as a matter of risk management practices instead of a more formal audit. Assessments are often diagnostic in nature and used to identify opportunities for improvement, manage risk, or inform strategic decisions. They may not have the formal scrutiny of audits, but they are still crucial for maintaining operational oversight.
Certifications
Certifications are formal processes designed to validate that an organization meets the specific standards set by an external party, resulting in formal recognition of compliance. For example, certification assesses a company's Information Security Management System (ISMS) and requires rigorous external evaluation. Certification helps an organization demonstrate its credibility and reliability to stakeholders, solidifying its trustworthiness.
The integration of both internal and external perspectives is not just advantageous; it is essential. Internal teams offer in-depth, nuanced insights into daily operations and strategic goals, making internal assessments particularly valuable for continuous improvement. Conversely, external auditors and certifiers bring objectivity and extensive industry experience, aiding in benchmarking an organization against its industry peers.
Undoubtedly, these formal approaches ensure legal compliance by regularly aligning an organization's practices with internal policy, legal mandates, and regulatory requirements. However, the implementation of audits, assessments, and certifications is not without its challenges. These processes are typically resource-intensive, demanding significant time and financial investment. Moreover, there is a risk of overemphasizing the specific criteria of an audit or certification, potentially neglecting broader risks, business needs, or innovative solutions. Overreliance on these validations can lead to a compliance 'check-box' mindset, where the minimum standards become the ceiling rather than the floor of quality and performance.
Many regulations describe their legal authority and also include details describing compliance requirements without referencing a separately maintained standard. Examples include the General Data Protection Regulation () and Children's Online Privacy Protection Act (COPPA), which are both focused on protecting privacy information.
General Data Protection Regulation ()
The General Data Protection Regulation enforces rules for organizations that offer services to entities in the European Union (EU) or that collect and analyze data on a subject located there. The rules are stringent and apply regardless of where the originating organization operates from or where the collected data is stored. Failure to comply with rules results in extremely costly fines.
There are seven principles of the :
Lawfulness, fairness, and transparency, Personal data must be processed legally, fairly, and transparently, ensuring individuals are aware of how their data is used.
Purpose limitation, Data must be collected for specific, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes.
Data minimization, Only the data that is necessary for the intended purpose should be collected and processed.
Accuracy, Personal data must be accurate and kept up to date, with inaccurate data corrected or deleted without delay.
Storage limitation, Data should be kept in a form that permits the identification of individuals only as long as necessary for the purposes for which it was collected.
Integrity and confidentiality (security), Personal data must be processed securely, protecting it from unauthorized or unlawful processing, loss, destruction, or damage.
Accountability, Organizations must take responsibility for complying with principles and be able to demonstrate their compliance.
Children's Online Privacy Protection Act (COPPA)
The Children's Online Privacy Protection Act (COPPA) is a US federal law designed to protect the privacy of children (inside and outside the United States) under the age of thirteen. It requires operators of websites or online services to provide clear privacy policies and details when consent from a parent or guardian is required. The act also describes the operator's responsibilities to protect information from being used for marketing purposes.
The California Consumer Privacy Act ()
The , which was enacted in 2018 and became effective on January 1, 2020, is a significant privacy law in the United States. It provides California residents with extensive rights over their personal data. These rights include the ability to know what personal information is being collected, the purpose of collection, and with whom it is being shared. Consumers can request access to their data, demand its deletion, and opt out of the sale of their information. The imposes strict requirements on businesses, mandating transparency and accountability in data practices, with significant penalties for non-compliance.
General Data Protection Law (LGPD)
The LGPD, which went into effect on September 18, 2020, is Brazil's comprehensive data protection regulation. It is based on the European Union's General Data Protection Regulation () and aims to standardize data protection laws across Brazil, improving privacy rights for individuals. The LGPD applies to any organization processing personal data of Brazillian constituents, regardless of where the organization is located. It provides individuals with rights such as access to information, data correction, deletion, and the right to be informed about data sharing. The law also stresses the importance of obtaining explicit consent from data subjects and requires strict data security measures, with significant fines for violations.
The legal environment is adapting quickly to keep pace with the increasingly rapid evolution of technology. Many new issues, including circumstances for which there is no precedent, are introduced from year to year.
In response, countries are implementing and enforcing laws governing how organizations collect, use, store, and protect data. Legal adaptation is happening quickly to keep pace with the increasingly rapid adoption and evolution of technology. Keeping pace with cyber attack methods, new computer and software platforms, and cyber defense tools is difficult. Compounding this complexity is the pace to which new laws governing how organizations collect, use, store, and protect data are being introduced, and it highlights the need for a well-crafted legal strategy.
Legal Jurisdiction
Understanding legal jurisdiction is essential when considering legal risk. The following list identifies the various jurisdictions that shape legal compliance.
Federal laws govern the entire United States, applying to all states and citizens within the country.
Federal regulations are special laws issued by federal agencies to enforce compliance across industry sectors, such as finance, healthcare, energy, transportation, communications, and environmental protection.
State laws are statutes and regulations enacted by individual U.S. states and govern that specific state.
International law encompasses rules and principles that govern the relationships and practices between nations.
This is complicated by organizations with international operations and for organizations operating public cloud platforms where the controlling corporation, cloud operations, and customers are dispersed globally.
Legal Risk and Compliance
E-discovery, or electronic discovery, refers to identifying, collecting, preserving, reviewing, and producing electronically stored information (ESI) in response to legal or regulatory requests. E-discovery ensures that all relevant digital evidence can be efficiently accessed and provided during litigation, investigations, and audits.
A legal hold is an order to preserve all relevant information before anticipated litigation. Understanding legal hold requirements ensures that data potentially relevant to ongoing or future legal cases is not destroyed or altered. It is critically important to establish processes for promptly identifying when a legal hold is necessary and ensuring that all pertinent data is preserved. As the legal situation that prompted the hold evolves, it is essential to correlate it to previous assumptions regarding what must be preserved.
Due diligence describes a thorough assessment of an organization's security posture, risks, and compliance status and is especially important during mergers, acquisitions, or partnerships. The due diligence process generally includes evaluating cybersecurity controls, identifying potential risks, and reviewing all applicable legal and regulatory requirements to assess compliance levels. Due diligence helps to mitigate risks and avoid exposure to legal liabilities.
Due care refers to the level of judgment, care, prudence, determination, and activity a "reasonable person" would be expected to perform under different circumstances. In a cybersecurity program, due care describes the initial implementation of security controls intended to protect data and systems. Adequate due care generally aligns with following established best practices and standards for mitigating risks and protecting against threats. Due care is the starting point, whereas due diligence describes the ongoing efforts required to maintain sufficient protection.
Export controls govern the transfer of certain types of information, technology, software, and hardware to foreign countries or entities. Managing export controls means ensuring that products subject to these regulations are not unlawfully shared or exported, and appropriate controls are required to ensure compliance with all applicable restrictions.
Recent examples of U.S. export controls:
NVIDIA AI Chips: https://www.reuters.com/technology/nvidia-may-be-forced-shift-out-some-countries-after-new-us-export-curbs-2023-10-17/
Equipment used to make computer chips: https://www.nytimes.com/2020/05/15/business/economy/commerce-department-huawei.html
Contractual obligations in cybersecurity refer to the specific requirements and responsibilities that an organization agrees to in contracts with third parties, customers, or service providers. These obligations often include provisions related to data protection, security standards, , and compliance with relevant laws and regulations. For example, the Payment Card Industry Data Security Standard () is a set of security standards designed to ensure that credit card information is used in a secure environment. Enforcement of is not carried out by a government agency but rather by the Payment Card Industry Security Standards Council (PCI SSC) and the major credit card brands via various legal contracts and other agreements.
Exam Objectives Covered
Risk management involves a comprehensive security posture meant to mitigate the effects of negative scenarios. Impact analysis, risk assessment and management, and third-party risk management are foundational practices in identifying and mitigating potential threats to an organization's operations and assets. These practices encompass a comprehensive evaluation of availability, confidentiality, integrity, and privacy risk considerations, ensuring that all aspects of data and system security are addressed. The risks associated with AI usage further complicate this landscape, necessitating specialized strategies to manage the unique vulnerabilities and ethical concerns posed by artificial intelligence. Effective crisis management and breach response plans are critical for swiftly addressing incidents, minimizing damage, and restoring normal operations. Taking on these challenges with proactive and reactive measures underscores your commitment to security and risk mitigation.
As you study this lesson, answer the following questions:
What are the key dimensions of security and compliance that need to be addressed in organizational risk management?
How do availability, confidentiality, and integrity risk considerations contribute to a security framework?
Why are effective breach response and crisis management strategies essential for organizations, and how do they mitigate the impact of security incidents?
What is the importance of third-party risk management in ensuring that external partners and vendors adhere to security and compliance standards?
Impact analysis requires careful examination of the potential consequences of security incidents on an organization's systems, data, operations, and reputation. The intent and purpose of impact analysis is to help organizations understand the severity of potential threats and prioritize their responses accordingly.
In particular, impact analysis starts by identifying critical assets and processes within an organization's infrastructure. These assets, which often include sensitive data, network capabilities, systems, and applications, are the key focus. Once these are identified, analysts can assess the potential impact of security incidents on these assets using various techniques.
One common method is scenario-based analysis, where analysts create hypothetical scenarios representing different threats, such as data breaches, malware infections, or denial-of-service attacks. Generally, a team is responsible for assessing these events to determine the impact of each scenario on the organization's operations, financials, regulatory compliance, and reputation.
Likelihood and plausibility are critical factors influencing impact assessment. Analysts must consider the likelihood of each scenario occurring, drawing from historical data, , system vulnerabilities, and organizational risk factors. They often utilize qualitative and quantitative risk assessment techniques to assign probabilities to different threat scenarios, such as the likelihood of a successful phishing attack or the probability of a ransomware infection.
Note:
"Extreme but plausible" cyber events are possible security incidents that could have a significant and disruptive impact if they occur, although they are not necessarily common. These events reflect situations that may appear unlikely. However, they are still feasible based on an analysis of existing cyber threats, vulnerabilities, and attack vectors.
For extreme but plausible impacts, organizations often adopt a proactive approach to managing these risks, which involves implementing robust security controls and measures to mitigate the likelihood of such events. For example, organizations might invest in advanced threat detection systems, employee training programs, and regular security assessments to reduce the risk of severe cyber incidents. It might also include moving the location of critical operations into areas less prone to natural disasters.
As security practitioners, we describe risk management as a process for identifying, assessing, and mitigating vulnerabilities and threats to an organization's essential functions. Risk is categorically bad in cybersecurity, but this viewpoint often conflicts with business operations that view risk as an essential and necessary component of growth and improvement. You may be familiar with the saying, "no risk, no reward," and while this is not a phrase commonly used within the context of security, it highlights the need for security practitioners to be involved in business decisions.
Risk Management
Risk management is a complex and multifaceted discipline, with approaches varying significantly from one organization to another. Factors such as size, sector, and regulatory and compliance requirements all influence how risk is handled. Many companies adopt enterprise risk management (ERM) policies and procedures, often based on established frameworks such as NIST's Risk Management Framework (RMF) or ISO 31000.
Risk Appetite and Tolerance
Risk appetite is often prescribed via regulations and defines how an organization will address identified risks. Some organizations will assertively address all items ranked via risk assessment as "medium" and "high." Other organizations may focus their attention only on items ranked as "high," and others may take a completely different approach, but all of these different approaches are based on appetite.
Note:
Sometimes, as is the case for the financial sector, a formal cyber risk appetite statement must be adopted to describe the amount of risk the organization is willing to accept in order to accomplish its mission.
Risk tolerance defines the thresholds that separate different levels of risk. Thresholds may be defined by money, impact, scope, time, compliance, and privacy, and describe the level of risk acceptable in order to achieve a goal.
Risk Prioritization
Cyber risk prioritization involves assessing and ranking the various threats an organization faces regarding their potential impact and likelihood. Organizations typically start by identifying critical assets and understanding their value and importance to business operations. Threats can come from various sources, such as cybercriminals, insiders, or even nation-states, while vulnerabilities might be found in outdated software, weak security protocols, or human error. Understanding the specific threats and vulnerabilities relevant to the organization is essential for accurate risk assessment.
Risk assessment frameworks from ISO, NIST, and others provide structured risk evaluation approaches. These frameworks typically recommend evaluating each threat's impact and likelihood of exploiting a . Based on these evaluations, organizations can then prioritize risks. High-impact, high-likelihood risks should be addressed first, as they pose the most significant threat to the organization. Risk prioritization helps ensure that resources are used effectively to improve security where needed.
Quantitative Risk Analysis
The variables used in quantitative analysis include the following:
Single Loss Expectancy (SLE), The amount lost in a single occurrence of the risk factor. Another way to think of single loss expectancy is "the cost of a single event," such as downtime.
Annual Rate of Occurrence (ARO), The number of times a single loss occurs in a year. For example, if a server outage is identified as an SLE event, and the outage occurs twice a month, then the ARO would be two times per month, multiplied by 12 months in a year to result in an ARO of 24.
Annualized Loss Expectancy (ALE), The amount that would be lost over the course of a year, or the sum-total of all single loss events over the span of 12 months.
ALE = SLE x ARO
Single Loss Expectancy can be further broken down into the following components:
Asset Value (AV), The value of an asset, such as a server or even an entire building.
Exposure Factor (EF), EF is the percentage of the asset value that would be lost. For example, if a building is exposed to a severe weather event, like a hurricane, tornado, or earthquake, only part of the building may be lost and this would be described as its "exposure factor."
SLE = AV x EF
When component costs can be easily determined, quantitative assessment can quickly identify appropriate courses of action.
The challenge of quantitative risk analysis becomes apparent when component costs are not clear. Sometimes, the value of component costs can be difficult to determine without historical data and this results in subjective guesswork. Despite this potential challenge, quantitative risk assessment frequently yields an effective description of assets and risks resulting in a sound basis for decision-making.
Qualitative Risk Analysis
Qualitative risk analysis describes the evaluation of risk through the use of words. For this reason, qualitative risk analysis is much more subjective than quantitative analysis. Qualitative risk analysis is well-suited to the analysis of intangible assets, for example an organization's reputation or brand image. These things are far more complicated to assess numerically and so quantitative analysis is often avoided. Qualitative risk analysis requires significant contributions from the marketing, sales, and communications departments (just to name a few) as these groups are best-suited, based on their unique insights, to assess the value of many intangible business assets and the impacts that various risk events can have on them.
Risk Validation & Remediation
Cyber risk validation and remediation practices ensure that identified risks are accurately assessed and effectively mitigated to protect an organization's critical assets and data. Validation begins after initial risk assessment and prioritization is complete. Validation aims to confirm that the identified risks are real and significant. Validation activities often include penetration testing, scanning, and .
Once risks are validated, remediation efforts can begin. Remediation aims to reduce identified risks to acceptable levels, the definition of which varies from one organization to another. This process starts with developing a remediation plan that outlines the actions needed to address each risk. These actions generally include applying patches to fix software vulnerabilities, updating security configurations, implementing additional security controls, improving security policies and procedures, and employee training.
The supply chain describes all the suppliers, vendors, and partners needed to deliver a final product. The supply chain presents significant risk, and organizations should consider forming a specialized supply chain risk management program. Some of the largest, highest-profile, and most impactful breaches in recent years have occurred due to vulnerabilities within the supply chain. Software and hardware contain vulnerabilities that can be described as intentional or unintentional flaws introduced into the final product and that are not easily tracked using traditional supply chain management practices.
The supply chain is a complex and diverse network. For hardware manufacturers, it involves providers of storage drives, video adapters, chips, and other components. For software companies, it extends to various software vendors, including the developers of the development tools, source-code repositories, development language, and third-party libraries. Even for traditional businesses, the supply chain is extensive, involving internet service providers, HVAC vendors, safety equipment suppliers, physical security guards, contractors, and other service providers, in addition to the supply chain of its hardware and software vendors. This complexity underscores the need for a specialized approach to supply chain risk management, as any in a vendor's cybersecurity operations can potentially lead to unauthorized access.
Supply Chain Visibility (SCV), SCV describes the capacity to understand how all vendor hardware, software, and services are produced and delivered and how they impact an organization's operations or finished products. This is a daunting task, as full visibility requires a comprehensive understanding of all levels of the supply chain, including the vendors and suppliers of an organization's vendors and suppliers or, to put another way, the 1st, 2nd, 3rd... level suppliers in the supply chain.
Third-Party Dependencies
The supply chain generally refers to the use and distribution of materials that comprise a finished product. Third parties form part of the supply chain but describe a broader set of relationships, such as vendors, suppliers, service providers, credit card processors, utilities, contractors, affiliates, trade associations, government agencies, etc. Understanding and documenting these relationships, including assessing the level of risk the third party poses to the organization, can help identify sources of trouble. Some elements specific to securing IT operations include identifying the code, hardware, and modules used within the environment and provided by third parties. A subprocessor is a specific type of third-party vendor that processes data on behalf of another company, typically a data controller or a primary data processor. Regarding data protection regulations, such as the General Data Protection Regulation () in the European Union, a subprocessor is any entity engaged by a data processor to assist with processing personal data. These elements can introduce vulnerabilities and should be assessed to determine their security level and capabilities.
Vendor Assessment
It is essential to research vendors prior to entering into any agreement. Researching a vendor can include everything from simple checks, such as reviewing the vendor's website, social media pages, and employer review sites, to more formal requirements, such as requesting evidence of independent third-party audits of the vendor's operations, finances, and cybersecurity capabilities.
Note:
Ultimately, it is important to select a vendor service or product based on an evaluation of the vendor's integrity and the presence of well-matched product or service features and functionality and not to select vendor products and services based solely on cost.
Importance of Backups and Testing
Backups are crucial in Business Continuity and Disaster Recovery (BCDR) because they provide assurance against data loss and facilitate recovery from major incidents such as hardware failure, malware outbreaks, filesystem corruption, database failures, and natural disasters.
Regularly testing backups is critically important because backup jobs routinely identify that they have "completed successfully," but the reality is that they often cannot be successfully used to perform a restore. Testing uncovers potential issues with backup sets, validates the effectiveness of recovery procedures, and establishes the timeframes needed to perform a restore (which can be surprisingly long). A proactive approach to validating backups significantly lowers the risk of encountering corrupted or incomplete backups when they are most needed.
Connected and Disconnected Backups
Connected and disconnected backups represent two different approaches to storing backup data. Connected backups are continuously or frequently synchronized with the live system, allowing for near-real-time backup and ensuring minimal data loss in case of a failure.
Connected backups, including online backups and backups to disk, store data on local or networked disk drives, offering fast backup and restore times due to high data transfer speeds. Connected backups can offer methods allowing for near-real-time copies, ensuring minimal data loss in case of a failure, and replication options to facilitate the creation of offsite backup copies. However, connected backups can be vulnerable to threats impacting the primary system, such as malware or ransomware, which may corrupt or encrypt backup sets, rendering them useless.
Disconnected backups are stored separately from the live system by taking storage volumes offline or "air-gapping" the backups, for example, ejecting a tape and storing it in a media storage cabinet or offsite location. Isolation makes the backups immune to threats that might compromise the primary system, therefore providing a higher level of assurance in the availability of the backups. With either of these approaches, it is essential to ensure that the backup server can also be restored from backups, including the ability to decrypt any backup sets initially made by the server.
Disconnected backups are invaluable in a disaster recovery scenario, such as a ransomware infection, because the backup sets remain untouched by the ransomware and allow the organization to restore all infected data without falling victim to the adversary's ransom demands.
The primary drawback of disconnected backups is the potential for more significant data loss between backups since they are typically not updated as frequently as connected backups are. Additionally, retrieving data from disconnected backups can take longer, impacting recovery time. However, the trade-off is often worth it because of their added assurance and peace of mind.
In reality, an enterprise backup system should incorporate both approaches. Enterprise backup platforms typically offer versatile automations that allow for fast backup to disk, data replication to offsite locations, and data copy options that enable disk-based backups to be duplicated to tape. This approach provides the benefits of both approaches: fast backups and restores and disconnected backups in case of disaster.
BCDR Testing
Business Continuity and Disaster Recovery (BCDR) testing ensures that an organization can effectively respond to major disruptions and maintain (or quickly resume) critical operations.
As previously identified, one key strategy is backup verification testing, which involves periodically restoring data from backups to verify their integrity and performance.
Full-scale and parallel disaster recovery drills test the effectiveness of the BCDR plan. These drills involve activating the recovery plan, activating backup systems, and operating from alternate sites to assess the organization's preparedness. Parallel tests differ from full-scale tests by allowing the DR site to be tested without impacting normal operations.
Tabletop exercises allow stakeholders to review and discuss the BCDR plan and their roles during a disaster. This is a surprisingly effective way to help identify gaps in the plan and ensure everyone understands their responsibilities.
Unauthorized access to data can have extensive and multifaceted impacts, ranging from financial losses to reputable damage. A data breach generally describes the exposure of personal information, trade secrets, confidential or proprietary data, or even national security details, leading to legal consequences, eroded stakeholder trust, and even national security impacts.
Responding to a data leak event demands swift and highly orchestrated actions. Organizations must contain the breach event to prevent further damage and assess the extent of the exposure to fully understand the scope of impact. Responding to a breach involving privacy data is a nuanced process involving personal information protected under various privacy laws, such as , , , and other laws dictating specific compliance requirements and reporting obligations in response to detecting a breach event.
Engaging with legal council is crucial to ensure proper navigation and interpretation of the complex landscape of privacy regulations. Lawyers and other legal professionals can help guide the organization regarding when and how to notify regulatory bodies and the impacted individuals (data subjects) within legally mandated time frames. Failure to adhere to these regulations can lead to hefty fines and further legal action.
Note:
Breach notification laws require organizations to notify affected individuals and relevant authorities when a security breach results in the unauthorized disclosure of personal information. The laws strive to ensure transparency and prompt communication, enabling individuals to take protective action to mitigate the impacts of unauthorized disclosure.
Breach notification laws vary by jurisdiction but generally include stipulations on the timing of the notification (such as within 72 hours of discovery) and the type of information that must be provided to both the victims and regulatory agencies. For example, the organization must inform affected individuals about the nature of the breach, the type of data involved, and the potential risks. Additionally, organizations must provide guidance regarding how individuals can protect themselves from subsequent issues, such as identity theft.
Testing capabilities and effectiveness is vital for preparedness. Simulated attacks, such as tabletop exercises or red teaming, offer practical insights into an organization's readiness and the performance of its response protocols. These exercises should mimic potential threats as closely as possible to provide a realistic assessment of how staff will react under pressure, highlighting areas where improvements are necessary. Continuously updating and refining strategies based on these tests ensures that an organization can swiftly adapt to emerging threats, maintaining the integrity of its data confidentiality measures. Additionally, regular audits and assessments can demonstrate a commitment to protecting privacy data and ensuring readiness if and when problems arise.
Data integrity is crucial across various domains, from applications to data, ensuring that data remains accurate and reliable throughout its life cycle. Several techniques and approaches exist to support integrity checking.
Hashing is a fundamental concept used to maintain and verify data integrity and sometimes to share knowledge of a shared secret without exposing it. Hashes are used to check the integrity of data at any point in its life cycle. For example, during the boot process of an operating system, the integrity of the bootloader is often verified using hash values. If the hash value of the bootloader loaded during the boot process differs from the expected hash, it indicates tampering or corruption. Hashing "strength" depends on the cryptographic robustness of the algorithm used; what this translates to, essentially, is that outdated or compromised hash functions can lead to vulnerabilities where an attacker might generate malicious data that can pass integrity checks. Identifying the appropriate hash function to use in different scenarios is important. Simple, low-risk integrity checks might match well with simple hash algorithms, but more robust algorithms are warranted when uniqueness and validity checks are needed in high-risk scenarios. Ultimately, the appropriate use of different hashing algorithms is identified in industry standards.
Maintain Integrity
The Trusted Platform Module () is a dedicated computer chip designed to secure hardware and is used extensively to enhance a device's security at the hardware level. One of its primary roles in many is to perform integrity checks on the bootloader, the program responsible for initializing and loading the operating system. When the device is configured, cryptographic hashes of the authorized bootloader are stored in the . The hashes serve as a benchmark for verifying the integrity of the bootloader during each boot process. When the device starts up, the is invoked to compare the cryptographic hash of the bootloader currently on the system to the trusted hash values stored within the . This comparison is done within the to prevent any external interference. If the hash of the current bootloader matches one of the trusted hashes stored in the , the boot process continues, establishing a "chain of trust." If the finds that the current bootloader's hash does not match the trusted hash, it indicates a potential security risk, such as tampering or corruption. In response, the can initiate protective actions. These actions might include preventing the boot process from proceeding or limiting the device's capabilities until the issue is resolved. This ensures that potentially compromised software does not load and protects the integrity of the device's operating system and data.
Remote journaling is another technique used to maintain integrity and involves keeping a log or "journal" of changes made to data. The journal is generally stored in a separate and secure location from the data it is associated with and may also be replicated off-site. This practice is tremendously helpful in recovery scenarios where data integrity might be in doubt following an unexpected event like a system crash or a security breach. Additionally, journals can often be "re-played" to help restore data to points in time that are much closer to when the failure event occurred.
Anti-tampering techniques are designed to prevent unauthorized data modifications and include software and hardware-based techniques. For example, anti-tampering techniques can help secure against attacks designed to root or jailbreak mobile devices. Techniques include , where the integrity of each component of the boot sequence is verified using digital certificates.
Interference
Ensuring the integrity of information is crucial to preventing the spread of malicious agendas like misinformation and disinformation campaigns. Defending against misinformation incorporates techniques designed to verify that the information shared across various media and online platforms has not been manipulated. Technology, critical analysis, and procedural safeguards are often employed to achieve this objective.
A practical way to ensure the integrity of digital content is to apply digital forensics techniques to verify its authenticity. For instance, analyzing metadata can reveal the origin of a digital file, including the device used to create it, the location, and the time. This information is crucial in assessing the legitimacy of content that may be part of an influence campaign. Analysts can also use advanced techniques such as reverse image searching to trace and identify the origin and any alterations made to digital content.
Note:
Reverse image searching is a technique used to identify an image's content or find similar images across the Internet. It involves uploading an image to a search engine, which then analyzes it using algorithms to detect shapes, colors, faces, or patterns and compares these elements against its database to find matches or related images.
Another method incorporates fact-checking services that leverage human expertise combined with artificial intelligence tools to scrutinize content for accuracy and bias. These services often use databases of verified information to cross-reference and validate current news stories and social media posts.
Furthermore, analysts can identify potential botnets or coordinated human groups spreading manipulated information by analyzing the traffic sources, propagation paths, and clustering of similar messages or themes across different social media platforms. The biggest challenge is often distinguishing between legitimate viral content and orchestrated campaigns.
Techniques such as these are part of a broader strategy to maintain the integrity of information in an era where data can be easily manipulated and abused.
New and emerging privacy legislation introduces many privacy risks that need careful consideration. The evolution of data subject rights, such as the right to access, erasure, and data portability, forms the cornerstone of many privacy laws. However, these rights come with inherent risks.
For example, the right to access requires organizations to provide individuals with copies of their data, which increases the risk of a data breach if proper mechanisms are not in place to validate the request's authenticity and the requestor's identity. Similarly, the right to erasure mandates the deletion of personal data upon request, which is often difficult because copies of data often exist in multiple locations, meaning residual data may be exposed in a breach despite the subject's assumption that their data had been removed. Biometric data is a unique and complex aspect of data privacy. The irrevocability of biometric data, such as fingerprints or facial recognition, poses a significant risk. Once compromised, it cannot be changed like a password, leading to long-term security concerns. The misuse of biometric data for unauthorized tracking and surveillance is a growing concern, significantly infringing on individual safety and privacy.
Note:
FTC statement regarding the misuse of consumer biometric data:https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-warns-about-misuses-biometric-information-harm-consumers
Data portability requirements can introduce risks during the transfer process, such as data interception, corruption, or loss. Data sovereignty issues are compounded when privacy legislation mandates local control over data. When data is stored within the geographic boundaries of multiple countries, each with its own regulatory framework, conflicting laws present significant challenges in maintaining compliance.
Social Media Platform Use of Biometrics
Social media platforms have increasingly incorporated biometric technologies, such as facial recognition, to enhance user experience and offer new features. However, the abuse of biometrics poses significant privacy risks and ethical concerns.
One of the primary issues with using biometrics on social media is the potential for unauthorized surveillance and tracking. When users upload photos or videos, platforms can automatically scan these media for facial features, identifying individuals without explicit consent, leading to people being tagged or identified in images without their knowledge. Such practices raise concerns about how social media companies monitor user activity and how they handle the vast amounts of biometric data they collect.
The potential for discrimination and bias in biometric systems also becomes more pronounced in a social media context. For example, social media facial recognition methods may misattribute inappropriate or criminal actions to innocent individuals. Another concern is the commercialization of biometric data. Social media companies might leverage biometric information for targeted advertising and personalized content delivery. While this is often described as a method to enhance user experience, it also raises ethical questions about consent and the extent to which users are aware of (and agree to) such invasive practices.
Note:
Vending machines using facial recognition on a college campus: https://hackaday.com/2024/02/27/big-candy-is-watching-you-facial-recognition-in-vending-machines-upsets-university
Furthermore, the legal and regulatory landscape around using biometrics in social media is still evolving. Many jurisdictions are grappling with how to balance innovation with privacy protection. Conflicting regulations across different regions often create loopholes that social media companies exploit, leading to inconsistent user protections.
Using AI in the workplace, like introducing any new system, changes an organization's risk inventory.
Excessive Agency
Excessive agency in AI, where an AI system operates with high levels of autonomy and makes decisions that traditionally require human judgment, can lead to numerous problems. These issues, primarily stemming from a lack of sufficient human oversight, can have serious consequences. The balance between AI autonomy and human control is crucial, and when this balance is disrupted, as in the case of excessive agency, the outcomes can be unpredictable and unmanageable, raising significant concerns.
Note:
AI hallucinations describe when an artificial intelligence system generates incorrect or nonsensical information that does not align with reality or logical interpretation. Hallucinations can occur for several reasons, primarily caused by limitations and design flaws in the AI system's underlying models and training data. More information regarding AI hallucinations is available from IBM at https://www.ibm.com/topics/ai-hallucinations
Too much autonomy raises significant ethical and legal concerns, particularly regarding accountability and the capability of existing legal frameworks to address the actions taken outside an AI system's intended scope. Ultimately, excessive agency erodes trust in AI systems,especially when decision-making processes lack transparency or the AI system's actions deviate from expectations and established norms.
Some practical examples of these problems exist in autonomous vehicles performing dangerous maneuvers, financial trading platforms making high-risk trades, healthcare AI systems recommending treatment plans and prescriptions, law enforcement AI used to identify suspects based on case data and facial recognition, and content moderation on social media platforms blocking or allowing content inappropriately.
Sensitive Information Disclosure
Sensitive data disclosure and misuse in an AI system can occur in two primary ways: through generated data and the provided data. For instance, an AI trained on confidential health records might unintentionally disclose specific patient details in its outputs, leading to privacy violations and legal risks associated with regulatory non-compliance.
It is vital to ensure that employees have a comprehensive understanding of AI systems' design limitations to avoid their misuse in the workplace. The risks of using an AI system without adequate security awareness are significant, especially when handling sensitive data. AI tools can access and process sensitive organizational data like customer records, email communications, business plans, or other protected data to increase productivity. However, this data can become training data for the AI system and may be provided as output toa completely unaffiliated user, resulting in a breach of sensitive information.
Addressing these issues requires employee training, establishing clear policies and guidelines regarding acceptable use, and implementing technical protections designed to limit and monitor access to public AI systems, such as Large Language Models (LLM), which are at the forefront of these problems.
Note:
A Large Language Model (LLM) is an advanced artificial intelligence system designed to understand and generate human-like text by processing vast amounts of written language data.
Overreliance
Overreliance on AI can potentially lead to the erosion of human skills and judgment. As AI assumes decision-making responsibilities, there is a risk that human practitioners may lose critical thinking capabilities and become overly dependent on AI recommendations, potentially discounting errors or misguidance. An overreliance on AI can also cultivate a false sense of security regarding the accuracy and capabilities of AI systems. For example, excessive trust in AI when driving autonomous vehicles can lead to negligent drivers who assume that the system can handle all aspects of driving under all conditions.This is just one example among many that are much less tangible.
Overreliance on AI can exacerbate existing biases found in its training data, potentially leading to unfair outcomes and discrimination. Because AI systems learn from historical data, AI often perpetuates and amplifies inherent biases in the data, affecting decisions in many modern business and government practices. The AI system's outputs can potentially reinforce societal inequalities and reduce opportunities for the groups negatively impacted by such biases.
Overreliance on AI in security operations can compromise the effectiveness and reliability of security protocols. When security platforms heavily leverage AI, security analysts may become overly reliant on their ability to detect threats or anomalies, potentially leading to a decrease in human oversight. This can be particularly problematic because AI systems, while powerful, may not always interpret complex or subtle security threats as accurately as a trained human might. Additionally, security operations that heavily integrate AI may suffer cascading failures if the AI system at the core of their capabilities encounters a bug or an outage. Such a systemic failure could incapacitate critical security operations, leaving infrastructures vulnerable at crucial moments.
Crisis management enables organizations to effectively respond to incidents that threaten their information systems and data integrity. At its core is a proactive crisis management plan, which is comprehensive and adaptable to various scenarios such as data breaches, ransomware attacks, or wide-scale system failures. The plan is not simply a document but a flexible framework that helps organizations prepare for and work through the most ominous issues.
The crisis management team, a central element of this practice, is composed of members from various departments including IT, legal, public relations, and executive leadership. This team plays a pivotal role in executing the crisis management plan. Their responsibilities include immediate response actions, communication activities (both internally and externally), and performing the steps necessary for recovery and post-crisis assessment. Each member's unique skills, expertise, and perspectives contribute to managing a crisis effectively.
Crisis Management Plan
A circular diagram showing the four steps of a crisis management plan: Assess Threats to Organization, Develop CMP, Test CMP, and Monitor Threats & Review CMP.
Consider a scenario where an organization suffers a data breach involving sensitive customer information. The crisis management team would oversee the actions needed to contain the breach to prevent further data loss and understand the scope and impact associated with the events that have already occurred. Concurrently, the legal team would assess the breach within the context of existing data protection laws, and the communications team would perform outreach to stakeholders and the public, explaining the nature of the breach, the potential impacts, and the steps the company is taking to address the issue. IT would work on technical assessments and recovery, securing and remediating impacted systems, and implementing measures to prevent future breaches.
Note:
The National Science Foundation provides an excellent overview of crisis management planning https://www.nsf.org/knowledge-library/creating-successful-crisis-management-plan
An organization must conduct regular assessments to determine whether it is prepared to handle a crisis event. In particular, tabletop exercises and simulated attacks can help evaluate the team's practical readiness to manage real crises. Continuously improving crisis management practices through lessons learned from drills and actual incidents, regularly updating and refining the crisis management plan, and staying informed regarding current events and new cybersecurity threats are essential to ensure readiness.
Comprehensive planning and integration with other established risk management strategies can significantly improve breach responses.
When a data breach occurs, the immediate priority is containment and assessment, which includes identifying the extent of the breach and the data affected. Impact analysis helps organizations understand the immediate consequences of the breach, such as loss of sensitive customer data or exposure of proprietary information, and shapes the prioritization of responses. Following the initial impact analysis, the breach response team must assess the exploited or other weaknesses that may have been exploited. Organizations typically rely on external vendors and service providers, who are, unfortunately, often points of . In the event of a breach, it is essential to assess whether third-party actions (or failures) contributed to the incident. Communication regarding the breach includes internal communication to ensure that all parts of the organization are aware of the breach and its impacts, as well as external communication to notify affected stakeholders and regulatory bodies as warranted. Data breach and privacy laws such as the , (California Consumer Privacy Act), and others heavily influence external communication practices.
The final stages of breach response include a post-incident analysis that provides feedback on existing risk management strategies and is based on lessons learned from the incident. This analysis addresses the specific vulnerabilities exploited in the breach and improves the organization's security practices and resilience.
Note:
The CISA (Cybersecurity and Infrastructure Security Agency) Plan (IRP) Basics document provides a useful overview of the major activities associated with an incident such as a breach. https://www.cisa.gov/resources-tools/resources/incident-response-plan-irp-basics
Readiness Assessment
Various activities and evaluations that focus on examining an organization's risk management practices can assess its ability to handle a security breach. To begin with, the organization must carry out a thorough risk assessment to determine its exposure to different threats and vulnerabilities within its systems, including those associated with third-party partnerships. This evaluation helps to identify the most probable and impactful risks, laying the foundation for the next steps in the assessment.
Once a risk assessment has been completed,it is important to evaluate the effectiveness of the organization's plan.This evaluation is typically carried out through tabletop exercises or simulated breach scenarios that imitate the various types of events attributed to the threats and vulnerabilities identified during the risk assessment. During these simulations, the team executes its plan and practices responses in a controlled manner. This type of exercise not only tests the practical applicability of the plan but also helps refine communication strategies, decision-making processes, and operational workflows involved in mitigating a breach.
Organizations must ensure they have dependable procedures for internal and external communication. Customers, employees, vendors, partners, regulatory bodies, and other stakeholders expect different levels of information, communication timeframes, and formats.
Reviewing and updating breach response plans is essential following these assessments and exercises. Learning from the outcomes of simulations and integrating new security insights and technologies into the plan ensures that the organization remains prepared for evolving threats.
In this module, you will learn various factors when implementing security into the early stages of the system's life cycle. In today's rapidly evolving technological landscape, applying software development principles is crucial for creating robust and scalable applications. Integrating software architecture ensures that these applications are well-structured and maintainable. To support operational resilience, it is essential to implement cloud infrastructure that can adapt to changing demands and recover from disruptions. Additionally, integrating concepts enhances security by verifying every access request, while troubleshooting using AAA (Authentication, Authorization, and Accounting) and (Identity and Access Management) ensures that access controls are properly managed and potential issues are swiftly resolved.
In this module, you will:
Apply software development.
Integrate software architecture.
Support operational resilience.
Implement cloud infrastructure.
Integrate concepts.
Troubleshoot using AAA and .
Exam Objectives Covered
is important in today's constantly evolving world of technology. Understanding and profiling threats, along with identifying attack patterns, are fundamental steps in structured threat assessment, enabling organizations to anticipate and mitigate potential security risks. By determining the , organizations can identify vulnerable points that may be exploited by adversaries. Modeling the applicability of threats to the specific organizational environment allows for a tailored approach to threat management, ensuring that defenses are aligned with the unique risk landscape. This process also involves recognizing threats to the model itself, ensuring that the threat assessment remains robust and accurate. The advent of AI-enabled attacks has introduced new complexities, as adversaries leverage artificial intelligence to enhance the sophistication and scale of their attacks. Conversely, AI-enabled assistants and digital workers can be harnessed to bolster security measures, providing advanced threat detection and response capabilities. Together, these elements underscore the critical importance of a comprehensive and adaptive approach to threat management, ensuring that organizations remain resilient in the face of evolving cyber threats.
As you study this lesson, answer the following questions:
What key characteristics and behaviors are used to profile different types of cyber threats, and how can these profiles help in predicting future attacks?
How can organizations continuously monitor and update their to account for changes in their IT environment and emerging threats?
What role does data poisoning play in threatening the reliability of a machine learning model, and what measures can be taken to detect and prevent it?
What are the potential risks and challenges associated with defending against AI-enabled attacks, and how can organizations adapt their cybersecurity strategies to address these threats?
Threat actors are driven by different motivations that shape their actions and strategies, including:
Financial Gain, A primary driver that motivates attackers to target financial institutions, e-commerce platforms, and individuals to steal sensitive data, deploy ransomware, or commit fraud to profit from the attack. For example, the WannaCry ransomware attack demonstrated how financial incentives can motivate large-scale, disruptive activities. (https://www.malwarebytes.com/wannacry)
Geopolitical Motivations, These generally drive state-sponsored (funded by a government) actors to gather intelligence, disrupt rivals, and destabilize regions. An example includes alleged interference by Russian, Chinese, Iranian, and North Korean threat actors in the political processes and public opinion of different countries via hacking, leaking sensitive information, and using social media campaigns to spread disinformation aimed at destabilizing democracies and promoting favorable outcomes for their interests.
Activism, Also called hacktivism, describes hacking to promote political agendas and social causes. Groups like Anonymous are notorious for launching attacks on organizations they perceive as unethical.
Notoriety, Some threat actors primarily seek recognition within the hacking community or the broader public domain and target high-profile organizations hoping to make headlines. An example includes the attacks performed by LulzSec on Sony Pictures. Lastly, espionage involves the covert collection of sensitive information.
Espionage, Describes the covert collection of sensitive information and is attributed primarily to nations and large corporations. Espionage seeks to gain competitive advantages by gathering intelligence on rivals. The Chinese-affiliated group menuPass is well-known for targeting organizations as a means to this end. https://attack.mitre.org/groups/G0045/
The time and money available to threat actors and resources significantly influence the scale and capability of their operations. For example, well-funded state-sponsored groups can perform prolonged campaigns using sophisticated tools, such as North Korea's Lazarus group (https://attack.mitre.org/groups/G0032/), which operates to fund state activities. The time available to a group also plays a crucial role; groups with more time can perform meticulous planning and highly focused attacks, while other groups prioritize simplicity and speed.
Capabilities are another critical aspect, encompassing supply chain access, creation, knowledge, and exploit development.
Knowledge, Can be technical or contextual and facilitates a threat actor's ability to craft effective attacks. For example, social engineering attacks depend on a deep understanding of human psychology and provocation.
& Exploit Creation, Describes discovering, developing, and exploiting new weaknesses in systems and software. Threat actors that operate in this manner are highly skilled and can identify previously unidentified flaws (zero-day vulnerabilities) and create corresponding exploits (exploit creation) to leverage them. This process requires extensive research, reverse engineering, and testing.
Supply Chain Attacks, When a threat actor infiltrates an organization by targeting less secure vendors and suppliers within their supply chain and best demonstrated by the SolarWinds incident, where attackers inserted malicious code into the software update infrastructure, leading to the compromise of numerous high-value target organizations. https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack
Attack patterns are closely linked to the motivations, resources, and capabilities of threat actors. For example, financially motivated actors often use phishing and ransomware as quick and effective means to extract money from victims, whereas threat actors driven by geopolitical ambitions engage in prolonged and complicated espionage campaigns. The sophistication level of an attack correlates with the resources available to the attack group; well-funded groups develop custom malware and sophisticated infrastructure, while lower-funded threat actors generally rely on off-the-shelf tools and publicly available scripts. The choice of attack vectors also correlates to the capabilities of the threat actor group. Those with deep technical knowledge favor custom exploits and complex supply chain compromises, while others opt for more common methods like dictionary attacks, credential stuffing, or social engineering.
Threat model frameworks and threat analysis help organizations identify, analyze, and mitigate the risks associated with threat actors.
MITRE ATT&CK
The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework is a comprehensive database of adversary tactics, techniques, and procedures (TTP) derived from real-world observations. The framework is invaluable for understanding the behavior and tactics of attackers during different stages of an attack. The ATT&CK framework allows red teams to perform adversary emulation by re-enacting the TTPs listed in the framework for specific threat actor groups the organization identifies as potential adversaries. https://attack.mitre.org
Screenshot of the MITRE ATT&CK Matrix for Enterprise, showing columns of cybersecurity tactics and their associated techniques used by attackers, such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.
Screenshot used with permission from MITRE ATT&CK
CAPEC
The Common Attack Pattern Enumeration and Classification (CAPEC) provides a detailed catalog of known attack patterns. CAPEC offers a broad view of attack strategies and potential consequences in contrast to ATT&CK, which focuses on specific attack techniques. CAPEC-66 (https://capec.mitre.org/data/definitions/66.html) describes the SQL Injection attack pattern and provides detailed descriptions of the attack patterns, potential impacts, and mitigations. For example, as part of the description, CAPEC recommends input validation, parameterized queries, and regular security audits as effective countermeasures to the attack. This detailed perspective helps organizations understand the specific techniques attackers use, the broader implications of the attack, and the essential mitigations to defend against them.
Screenshot of the CAPEC-66: SQL Injection page from the Common Attack Pattern Enumeration and Classification (CAPEC) website, detailing the description, likelihood, severity, and relationships of the SQL Injection attack pattern.
Screenshot used with permission of MITRE and the Common Attack Pattern Enumeration and Classification (CAPEC)
Cyber Kill Chain
The Cyber Kill Chain (https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html) outlines the stages of a cyber attack from reconnaissance through exfiltration. By understanding each phase, defenders can implement measures to detect and thwart attacks at various points in the chain. It also helps incident responders understand an active attack by determining where an attacker is compared to the kill chain's phases. Understanding the kill chain sequence supports the implementation of layered defenses intended to identify different types of activities.
The Cyber Kill Chain has 7 phases:
Reconnaissance - Gather information about the target, identifying potential vulnerabilities and entry points.
Weaponization - Develop or acquire malware and other tools to exploit the identified vulnerabilities.
Delivery - Transmit the weapon to the target.
Exploitation - Exploit vulnerabilities in the target's environment to execute the malware.
Installation - Install malware on the target system to establish a foothold and allow persistent access.
Command and Control (C2) - Establish a communication channel to remotely control the compromised systems and potentially exfiltrate data.
Actions on Objectives - Achieve the goals (data theft, disruption of services, or other similar outcomes)
Diagram illustrating the 7 steps of the Cyber Kill Chain, showing each phase of a cyber attack from Reconnaissance to Actions on Objectives.
Diamond Model of Intrusion Analysis
The Diamond Model of Intrusion Analysis provides a structured way to analyze security incidents by emphasizing the relationships between four core components: the adversary, their capabilities, the infrastructure they use, and the victim.
Diagram of the Diamond Model of Intrusion Analysis, showing a diamond shape with labeled vertices: adversary, capability, victim, and infrastructure; includes meta-features and contextual notes.
STRIDE and OWASP
The STRIDE framework categorizes threats based on their potential impact: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE). Categorization in this way helps to systematically assess a system's security. For example, in an e-commerce platform, the threat of Information Disclosure could involve unauthorized access to customer data, while Denial of Service would manifest as downtime. Consideration of each category evokes a different set of security considerations and countermeasures to support the development of a comprehensive assessment.
The Open Web Application Security Project (OWASP) provides authoritative guidance for improving software security, especially web application security. OWASP's projects and resources, such as the OWASP Top Ten (https://owasp.org/www-project-top-ten/), provide specific insights and guidance regarding critical security risks to web applications. OWASP also provides best practices and tools to help developers secure their applications against well-known and frequently exploited vulnerabilities.
Analysis Methods
Abuse cases are practical scenarios that describe how a system can be attacked or misused and are often based on the attack and abuse examples identified in one or more threat model frameworks. By analyzing abuse cases, organizations can anticipate and suitably defend against the threats they represent.
A few common abuse case examples include the following:
Login Brute Force Attack - Automated scripts, botnets, or tools like Hydra and Burp Suite can be used to perform brute force attacks.
SQL Injection - Analyze and abuse web forms, URL parameters, search fields, or any other input fields that ultimately interact with a database.
Cross-Site Scripting (XSS) - Analyze comment/message functionality, search inputs, or any areas where user input is reflected/posted back onto web pages.
Insider Threat with Privileged Access - This abuse case concerns an insider's misuse of access privileges to perform malicious actions, such as data theft. It focuses on understanding the functionality and data access levels available to different system users and the potential ways it could be abused.
Denial of Service (DoS) - Perform traffic flooding, application-layer attacks (such as attacks against the HTTP protocol or how web applications handle requests), or exploit system-specific vulnerabilities to cause crashes.
Antipatterns identify solutions to problems that may seem effective initially but ultimately lead to adverse outcomes or inefficiencies. Antipatterns can emerge when certain practices or procedures intended to enhance security actually undermine it or fail to address the real issues. A common antipattern is security through obscurity, which describes relying on secrecy (or a lack of knowledge) about a system's design, architecture, or implementation details as a method to keep it secure. Another antipattern is the overreliance on perimeter security, which describes how organizations often focus heavily on protecting the outer boundaries of their networks using firewalls and intrusion detection systems and neglect internal security requirements. Recognizing antipatterns is crucial for developing effective security strategies.
Attack trees and graphs are used to represent potential attack paths and their components visually. They help to deconstruct complex systems to aid in deeper analysis and provide a useful form of documentation. The root of an attack tree represents the attacker's ultimate goal, while the branches illustrate the steps needed to accomplish it.
Analyze the uploaded image and provide me with the proper alt text and long description to assist visually-impaired users.
Determination describes the process of identifying and assessing all potential attacker entry points. It requires careful analysis of system architecture, data flows, trust boundaries, and user interactions. It must also consider external factors like third-party connections and the organization's public digital presence. determination aims to identify vulnerabilities (many of which are non-obvious) and mitigate them to control risk.
Architecture reviews are the cornerstone of understanding the structural layout of any system. They provide security analysts and architects with the details needed to pinpoint weak spots in a design. For example, a monolithic architecture (where all components of an application are integrated into a single codebase) will have different vulnerabilities compared to a microservices architecture (an application composed of independently deployed services). Architecture reviews also consider the deployment environment, such as on-premises, public cloud, or hybrid, and how these environments could introduce vulnerabilities.
Data Flows and Trust Boundaries
Security teams can identify areas where sensitive information could be exposed by mapping out how data moves through a system, from entry to storage and processing. For example, if data is transmitted in cleartext between different services within a microservices architecture, it represents a significant issue. Further inspection may reveal that the data transmission includes usernames and passwords, which is a major problem! Understanding data flows helps to identify critical data paths that need robust protection.
Trust boundaries are the thresholds where different trust levels exist, such as between user and admin functionality or internal systems vs external ones. Each boundary represents a potential breach point if not properly secured. For example, an internal application communicating with an external API should have robust validation and authentication mechanisms in place to prevent unauthorized access to either end of the communication pathway.
Flowchart illustrating trust boundaries in an online payment system threat model, highlighting the interactions and data flow between a customer, merchant web server, and Stripe payment service, with key trust boundaries demarcated between each system component.
Code Reviews and User Factors
Examining source code for security vulnerabilities is critically important and becoming more common as the static and dynamic code analysis tools and technologies available to developers improve. Code reviews often include checks for issues like SQL injection, cross-site scripting (XSS), and buffer overflow, but can extend well beyond these foundational checks depending on the coding language used, tools available for the development tools, the platform used to manage and deploy code, and skills of the developers. By reviewing code, developers can have greater confidence that best practices are enforced and vulnerabilities are identified quickly.
From the perspective of determining the , user factors include analysis of onboarding and offboarding practices, the access levels granted to different users, the strength of existing authentication mechanisms, and the degree to which user behaviors are monitored and controlled. Some controls needed to manage risks in this area include implementing multi-factor authentication () to reduce the risk of unauthorized access, regular training to help users recognize phishing attempts, and tracking user activities to detect anomalies that could indicate a breach.
Organizational Change
Organizational change, including mergers, acquisitions, divestitures, and staffing changes, can introduce new and significant risks. When organizations merge, part of the merger process requires the systems from each organization to be combined, which is rarely an easy process as the systems in place at each organization will be very different most of the time. System integration projects stemming from mergers and acquisitions mandate careful assessment to maintain security. Business drivers in merger and acquisition activities are notoriously time-constrained as leadership teams work diligently to extract value and profits from the new business structure.
Unfortunately, hurried system integrations have been the root cause of some of the most significant breaches in recent times. In contrast, divestitures describe the process of a company selling or spinning off a portion of its business. This process requires clear definitions of the boundaries of the divestiture, including which assets, systems, data, and personnel will be transferred or separated to specify which IT infrastructure components will be impacted. There are heightened risks of data leakage and unauthorized access during divestiture, and sensitive customer data, intellectual property, and proprietary business processes must be carefully controlled.
Lastly, staffing changes can lead to gaps in security awareness, improperly configured user access, loss of company equipment and data, and the introduction of insider threats when candidates are not adequately vetted or onboarded when joining the company.
Enumeration and Discovery
Systematically identifying and cataloging all assets that attackers could potentially target helps organizations understand the full scope of their digital risks and increases awareness of all possible entry points and other important issues.
Internally and Externally Facing Assets, These include all hardware, software, and network resources used by the organization. Internally facing assets describe those used within the organization's internal network, such as internal servers, databases, and workstations. Externally facing assets, such as web servers, email servers, and public APIs, are directly accessible from the outside (such as from the internet as an unauthenticated user.) Enumerating these assets requires identifying each system, reviewing and interpreting configurations, and evaluating their exposure to likely threats. This process aims to locate vulnerabilities like outdated software or misconfigurations that attackers could exploit.
Third-Party Connections, Each connection to a third-party service introduces an additional layer of risk, as third parties have inconsistent security practices. Enumerating third-party connections requires analyzing all the third-party services an organization uses, including APIs, software, and outsourced services.
Unsanctioned Assets or Accounts, Often referred to as "shadow IT," unsanctioned assets and accounts describe hardware, software, and cloud services used without explicit organizational approval or oversight, such as personal devices, unauthorized applications, or unapproved cloud accounts. These assets typically bypass the organization's security controls and pose significant risks because they are improperly managed. They can be discovered through several methods, such as network device scanning and internet activity logs.
Cloud Services Discovery, Describes locating unapproved cloud resources used by employees. Cloud services discovery. It depends on a catalog of all authorized cloud assets, such as virtual machines, storage buckets, databases, and applications, to aid in the discovery of unauthorized ones. Assessing access controls, encryption settings, and data compliance for cloud resources is also an important aspect of this exercise.
Public Digital Presence, Describes an organization's public digital presence and includes its websites, social media accounts, and any other online platform where it maintains a presence. Collectively, this represents a digital footprint and is a unique potential . Attackers can gain unauthorized access to social media accounts, wreak immeasurable reputable damage, or use publicly available information to forge specialized attacks and targeted social engineering campaigns.
Assessing and modeling potential threats to determine their applicability and potential impact is important because it helps to shape the specifics regarding all the protections and associated capabilities needed to build and govern an effective security program. When moving beyond legal and regulatory requirements, the overall approach to security must be tailored from one organization and based on specifics regarding the threats likely to be faced.
For example, a large international bank will face threats different from a small two-branch local bank. While both programs will significantly overlap, the large international bank will have much deeper and more advanced capabilities designed to resist the threats it will face, such as nation-state adversaries. Whether enhancing an existing system or building one from the start, the goal remains to protect critical assets and ensure the organization's resilience in the face of evolving threats. The approach varies significantly depending on the type of threats likely to be faced and the skills and resources available to the organization.
When an organization already has a mature security program and supporting capabilities, the focus of new defensive capabilities often shifts toward integrating and optimizing new controls within existing infrastructure and tools. For example, an organization may already have a next-generation firewall and intrusion detection system (IDS), but a requirement to defend against advanced persistent threats (APTs) would undoubtedly require the organization to implement more sophisticated platform data feeds that can identify APT activity more quickly and reliably. When adding capability to existing infrastructure, the challenge often lies in finding a fair balance between the available features and sophistication of new tools with the constraints of integration, budget, and time.
The approach is fundamentally different and much broader for an organization without any existing security program. The process begins with a comprehensive risk assessment to identify critical assets and their threat vectors. For example, a startup working with sensitive customer data must prioritize compliance with all applicable data protection regulations, and the selection of controls will be significantly influenced by the need for scalability and adaptability to support growth and change. The absence of an existing security program offers a unique opportunity to design a security architecture from scratch and free from the constraints of business-critical legacy systems. In contrast, this also means the organization must be vigilant about selecting controls that provide a strong foundation for future security enhancements while lacking employees with skills and experience in these critical areas.
Both scenarios underscore the importance of understanding the interplay between existing infrastructure and new threats. An organization with an established program will face challenges when integrating new technologies without disrupting existing capabilities. Conversely, a new organization must navigate the complexities of selecting the proper set of controls needed to build resilient systems.
frameworks such as STRIDE, DREAD, PASTA, OCTAVE, and others help all organizations (new or established) systematically identify, assess, and prioritize potential threats. They provide structured methodologies for analyzing potential vulnerabilities and attack vectors, which, in turn, help develop appropriate mitigation strategies. frameworks also encourage using diagrams and "what if" scenarios to help uncover previously hidden risks.
A diagram illustrating a web application architecture, including a browser, web application, message queue, background worker process, and database, showing their interactions and data flows.
Additional Resources:
OWASP using STRIDE https://owasp.org/www-community/Threat\_Modeling\_Process
DREAD https://www.practical-devsecops.com/dread-threat-modeling/
PASTA https://versprite.com/blog/what-is-pasta-threat-modeling/
OCTAVE <https://insights.sei.cmu.edu/documents/2102/2006_004_001_14675.pdf>
Assessing and modeling potential threats to determine their applicability and potential impact is important because it helps to shape the specifics regarding all the protections and associated capabilities needed to build and govern an effective security program. When moving beyond legal and regulatory requirements, the overall approach to security must be tailored from one organization and based on specifics regarding the threats likely to be faced.
For example, a large international bank will face threats different from a small two-branch local bank. While both programs will significantly overlap, the large international bank will have much deeper and more advanced capabilities designed to resist the threats it will face, such as nation-state adversaries. Whether enhancing an existing system or building one from the start, the goal remains to protect critical assets and ensure the organization's resilience in the face of evolving threats. The approach varies significantly depending on the type of threats likely to be faced and the skills and resources available to the organization.
When an organization already has a mature security program and supporting capabilities, the focus of new defensive capabilities often shifts toward integrating and optimizing new controls within existing infrastructure and tools. For example, an organization may already have a next-generation firewall and intrusion detection system (IDS), but a requirement to defend against advanced persistent threats (APTs) would undoubtedly require the organization to implement more sophisticated platform data feeds that can identify APT activity more quickly and reliably. When adding capability to existing infrastructure, the challenge often lies in finding a fair balance between the available features and sophistication of new tools with the constraints of integration, budget, and time.
The approach is fundamentally different and much broader for an organization without any existing security program. The process begins with a comprehensive risk assessment to identify critical assets and their threat vectors. For example, a startup working with sensitive customer data must prioritize compliance with all applicable data protection regulations, and the selection of controls will be significantly influenced by the need for scalability and adaptability to support growth and change. The absence of an existing security program offers a unique opportunity to design a security architecture from scratch and free from the constraints of business-critical legacy systems. In contrast, this also means the organization must be vigilant about selecting controls that provide a strong foundation for future security enhancements while lacking employees with skills and experience in these critical areas.
Both scenarios underscore the importance of understanding the interplay between existing infrastructure and new threats. An organization with an established program will face challenges when integrating new technologies without disrupting existing capabilities. Conversely, a new organization must navigate the complexities of selecting the proper set of controls needed to build resilient systems.
frameworks such as STRIDE, DREAD, PASTA, OCTAVE, and others help all organizations (new or established) systematically identify, assess, and prioritize potential threats. They provide structured methodologies for analyzing potential vulnerabilities and attack vectors, which, in turn, help develop appropriate mitigation strategies. frameworks also encourage using diagrams and "what if" scenarios to help uncover previously hidden risks.
A diagram illustrating a web application architecture, including a browser, web application, message queue, background worker process, and database, showing their interactions and data flows.
Additional Resources:
OWASP using STRIDE https://owasp.org/www-community/Threat\_Modeling\_Process
DREAD https://www.practical-devsecops.com/dread-threat-modeling/
PASTA https://versprite.com/blog/what-is-pasta-threat-modeling/
OCTAVE <https://insights.sei.cmu.edu/documents/2102/2006_004_001_14675.pdf>
AI-enabled attacks leverage artificial intelligence (AI) and machine learning technologies to improve their effectiveness, scale, and sophistication. AI-enabled attacks utilize advanced algorithms and automation to exploit vulnerabilities, manipulate data, and deceive targets more efficiently than traditional methods.
For example, AI-enabled attacks can:
Automate the identification and exploitation of vulnerabilities.
Analyze data from social media, emails, and other related sources to craft highly personalized phishing attacks.
Adapt and evolve in real-time to identify bypass techniques for traditional cybersecurity defenses.
As AI-enabled attacks continue to advance, deploying equally sophisticated defenses to mitigate them will be paramount. Organizations and individuals must stay informed and adopt new technologies designed to protect against these emerging threats.
AI pipeline injections describe how an attacker can insert malicious data into the machine learning pipeline an AI system depends upon (such as the fraud detection system at a bank) to corrupt training data and lead to incorrect or harmful outputs.
AI enhances social engineering techniques by developing highly personalized and convincing attacks crafted using data harvested from social media platforms. For example, a sophisticated AI-based phishing attack can craft emails that perfectly mimic a co-worker's writing style and even reply to messages sent by the victim.
Automated exploit generation uses AI to identify software vulnerabilities and automatically create exploits for them. Perhaps one of the more disturbing evolutions in AI-enabled attacks, automated exploit generation is the ultimate point-and-click adversarial tool. In essence, automated exploit generation simplifies the process of finding and exploiting vulnerabilities.
Deep Fakes an Digital Media Manipulation
Deep fakes use deep learning techniques to create realistic, simulated digital media, such as video or audio. They are convincing representations of real people who appear to be saying or doing things they never actually did. Deep Fakes pose significant risks to personal reputations, political stability, and public trust.
Note:
Deep fake scammer walks off with $25 million in first-of-its-kind AI heist: https://arstechnica.com/information-technology/2024/02/deepfake-scammer-walks-off-with-25-million-in-first-of-its-kind-ai-heist/
Digital media manipulation describes altering images, videos, or other forms of media to mislead or deceive audiences, ranging from simple photo edits to complex video alterations.
Interactivity Exploits
Interactivity exploits target the interactive elements of software, websites, or systems. These exploits can manipulate user interactions to achieve malicious ends, such as redirecting users to phishing sites or executing malicious scripts.
The meshing of AI interactivity and deepfakes is an emerging concern, with the potential for positive applications and malicious exploitation. AI systems, especially those involved in interactive communication like chatbots, can be exploited to manipulate users by tailoring responses to elicit specific emotions or actions. The result is that attackers can leverage AI to scam, spread misinformation, and manipulate public opinion more effectively than using traditional methods. Expanding on this concept, Deepfakes use AI to create highly realistic fake images, videos, or audio recordings. When combined with interactive AI, deepfakes can enhance the illusion of authenticity. For example, an interactive AI can hold a conversation while a deepfake video provides the visual presence of a person, making the deception more convincing.
Plugins often extend the functionality of websites, applications, and platforms, but they can also become entry points for malicious activities. Unsecure plugin design refers to vulnerabilities in third-party software plugins that attackers can exploit. For example, AI chatbots provide customer support functionality and are popular plugins for many web platforms. Attackers sometimes perform command injection attacks against the chatbot plugin to execute commands on the webserver hosting the chatbot. When successful, these attacks provide the attacker with access to the website's backend services, customer data, or even the entire server.
AI-enabled assistants, or Digital Workers, are sophisticated software applications that leverage artificial intelligence (AI) technologies to perform various tasks traditionally handled by humans. They can automate repetitive, mundane, or complex tasks and can also provide support for customer service, administrative work, data analysis, and many other areas. AI-enabled assistants bring significant benefits but also require careful management to avoid potentially catastrophic problems.
AI-enabled assistants require access to sensitive information to perform tasks. For example, a digital assistant might need access to email systems, internal documents, and scheduling systems to help manage meetings or organize tasks. The AI assistant's access must be restricted based on carefully pre-established requirements. For example, it would likely be suitable for a customer service bot to access customer record databases, excluding financial transaction information. Properly configuring these permissions is crucial to prevent unauthorized access and data breaches stemming from prompt injection, model-reversing, and other AI-focused threats.
Guardrails describe the predefined boundaries established to ensure AI assistants operate within ethical and legal limitations and are essential for preserving trust and ensuring compliance with laws and regulations. Guardrails typically include content filtering, ethical communication guidelines, and decision-making limitations and help prevent misuse or overreach of AI capabilities. For example, an AI used in a healthcare setting might be restricted from providing medical diagnoses but can offer general information and defer to a healthcare professional for anything more. Likewise, digital workers in legal practice may provide document summaries but are not allowed to generate legal advice.
Data loss prevention (DLP) measures are vital to protect confidential information processed by AI-enabled systems. An AI that handles sensitive information can benefit from DLP tools that help monitor, detect, and block data misuse. For example, DLP software can enforce policies restricting data access based on user location or device, classify data based on its sensitivity, and apply appropriate protection measures based on this determination.
Transparency in AI usage supports the idea that users have the right to know when interacting with an AI system rather than a human and helps ensure that users understand the limitations and capabilities of the system they are engaging with. Disclosure is often managed by including disclaimers in communications using AI, such as automated emails, chatbots, and virtual assistants. This simple addition manages user expectations and supports many legal requirements.
Exam Objectives Covered
Software development is an important component of security design. Defining security requirements is an initial step in ensuring that software is designed with robust protections against potential threats. Software assurance practices further this goal by incorporating security measures throughout the development lifecycle, while continuous integration and continuous deployment () pipelines facilitate the rapid and consistent delivery of secure code. Supply chain risk management extends these principles beyond the organization, addressing vulnerabilities that may arise from third-party components and services. Hardware assurance complements these efforts by ensuring that physical devices meet stringent security standards. End-of-life (EOL) considerations are also essential, as they dictate the secure decommissioning of outdated systems to prevent residual risks. Collectively, these elements form a comprehensive approach to maintaining security throughout the entire lifecycle of software assets.
As you study this lesson, answer the following questions:
How does Continuous Integration/Continuous Deployment () contribute to maintaining up-to-date and secure software in the development process?
Why are End-of-Life (EOL) considerations important for managing risks associated with outdated hardware and software?
What roles do hardware assurance and software assurance play in ensuring the security and integrity of an organization's infrastructure?
How does supply chain risk management help in identifying and mitigating risks associated with third-party vendors and components?
Software requirements gathering has two main objectives: defining functional and non-functional requirements. Functional requirements describe what an application must do, while non-functional requirements focus on the qualities or attributes the software should have. It is essential to define security-specific functionalities when adapting traditional methods to incorporate secure coding best practices.
For example, a functional requirement might identify that users must be able to reset their password; functionally, this may be relatively straightforward but poses a significant security risk. Password reset mechanisms are frequent targets for attack, and the secure methods of incorporating password reset are not intuitive by any measure. When incorporating secure coding practices into a requirements-gathering exercise, the password reset function would include additional details defining secure best practices, such as those outlined in OWASP's Forgot Password Cheat Sheet.
Non-functional software requirements define the attributes that shape how the software operates to meet its functional requirements. They must also be adapted to include security best practices. For example, a non-functional requirement might specify that user data must be encrypted at rest and in transit and identify the cryptographic libraries and coding design patterns that must be used to accomplish this objective. A high-level description of how this looks is provided by OWASP (https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/stable-en/02-checklist/05-checklist#cryptographic-practices)
All cryptographic functions used to protect secrets from the application user must be implemented on a trusted system.
Protect secrets from unauthorized access.
Cryptographic modules should fail securely.
All random numbers, random file names, random GUIDs, and random strings should be generated using the cryptographic module's approved random number generator.
Cryptographic modules used by the application should be compliant to FIPS 140-2 or an equivalent standard.
Establish and utilize a policy and process for how cryptographic keys will be managed.
This example only describes the incorporation of cryptography; other non-functional requirements would include specifics regarding input validation, output encoding, authentication and password management, session management, access control, error handling and logging, data protection, communication security, system configuration, database security, file management, memory management, and general coding practices. Thankfully, OWASP provides guidance for all of these areas.
Flowchart comparing Process and Secure Process, showing steps in each process side by side.
Balancing security and usability is a pressing challenge. Unfortunately, security protections can hinder the user experience, so finding a balance that offers effective protection without frustrating users is essential. For example, while multi-factor authentication undoubtedly improves authentication, it also adds steps to the login process. Adaptive authentication techniques can adjust the requirement for based on user behavior and context. If a user consistently logs in from the same location and device, the software might only require a password, but whenever an attempt is made to authenticate from a new location or device, then would be triggered. Strong password policies are another example. Strong passwords are vital, but overly complex password length and complexity requirements can lead to new risks, such as users consistently writing down or storing passwords in text files or reusing passwords across multiple applications. A balanced approach might incorporate password managers and leverage single sign-on () solutions.
Underpinning all of this is the need for the decisions to be made early in the software development lifecycle (). Incorporating coding best practices is not a bolt-on exercise; these requirements fundamentally change how an application is coded and the time needed to create a finished product. Time and budget pressures invariably result in security features being skipped unless they are formally incorporated as functional and non-functional requirements in the planning and design phases of the .
Sandboxing/Development Environment
As part of the evaluation and testing of software, it is important to build different environments. Creating multiple environments allows for testing and evaluation work to be performed without impacting operations. The use of these environments should also extend to performing security testing and evaluation so that results can be used and incorporated into development efforts prior to final release.
Development, typically used in early stages of testing, development environments are usually openly accessible for developers to perform broad testing and proof of concept evaluations.
Test/Integration, in this environment, code from multiple developers is merged to a single master copy and subjected to unit and functional tests. These tests are designed to verify that code builds correctly and fulfills all required functionality.
Staging or quality-assurance, testing in staging/QA is typically focused more on regression, user acceptance and performance testing. The configuration of this environment should mirror production as closely as possible to provide the highest level of confidence that testing and evaluation work can identify any potential issues prior to production release. If the environments do not match closely, issues may not be uncovered until they are released to production where they may cause negative operational impacts. It is important to include the same protection mechanisms as production in order to validate that changes do not conflict with any mandatory security controls, including access controls, monitoring tools, IDS/IPS, backup/archive, and others.
Production, the live, organization-supporting environment used by staff, employees, customers, vendors, contractors, and partners on a day-to-day basis.
Sandbox, describes how each of these development environments are segmented from all the others. No processes should be able to connect to anything outside the sandbox. Only the minimum tools and services necessary to perform code development and testing should be allowed in each sandbox. This mitigates the chances of a development environment being used to access any others, especially production, but also prevents any unintended crossover where a system in one environment mistakenly communicates with one of the others and adds, changes, or deletes data there.
Note:
Testing environments should run in separate networks and be restricted from communicating with each other.
Validating Third-Party Libraries
It is common to leverage the expertise of others in the development of software applications. The modular nature of modern languages allows for the integration of software developed by others.
For example, an organization may task its own developers with the creation of a new web app, but the regulatory requirements governing the implementation of mechanisms, such as OpenID and , are beyond the skills and knowledge of the internal teams, and are also considered too risky to develop independently. In order to still incorporate these features while avoiding developing code in this area, a third-party library that performs the work of OpenID and can be used instead. This allows developers to make calls, or requests, to the library to enable the implementation of the required features. This approach saves time and can potentially reduce risk so long as the third-party library is developed to a high security standard. This situation describes another scenario where the third party's security capabilities and careful evaluation of the library's functionality (from a security perspective) is essential. If internally developed software is created in a highly secure way but incorporates libraries that are unsecure, then the overall security of the finished product is jeopardized. To complicate this problem, the third-party library may have itself incorporated third-party libraries, which essentially become fourth-party libraries to the organization using the code.
Software Assurance Methods
Static Application Security Testing (SAST), SAST is a security testing method that analyzes source code, byte code, or binary code for vulnerabilities without executing the code. Tools used to support SAST include SonarQube, Checkmarx, Veracode, and Snyk.
SAST Workflow diagram showing steps from source code to fixing vulnerabilities.
Dynamic Application Security Testing (DAST), DAST describes testing an application in its running state to identify vulnerabilities that an attacker could exploit by simulating their actions against the application. Many tools exist to support this level of evaluation, but two important examples include OWASP ZAP and PortsSwigger Burp Suite.
Interactive Application Security Testing (IAST), IAST combines SAST and DAST elements by analyzing real-time code behavior within a running application. IAST is beneficial for detecting vulnerabilities in complex applications, such as those using modern web frameworks, APIs, and microservices architecture. It also helps reduce the risk of false negatives associated with using DAST or SAST alone.
Runtime Application Self-Protection (RASP), RASP is a security technology that monitors and protects applications during runtime. RASP solutions help detect and prevent attacks like SQL injection (SQLi), cross-site scripting (XSS), and buffer overflow.
Software Composition Analysis (SCA), SCA tools help to identify and manage open-source components (and their vulnerabilities) within a software project, and they also directly support the creation of a Software BIll of Materials.
Software Bill of Materials (SBoM), An SBoM is a comprehensive inventory of all software application components, libraries, and dependencies. The SBoM details each component's version, source, and license, and can help identify vulnerable components otherwise hidden within a software project.
Formal Methods, Formal methods provide a strict framework for proving the correctness and reliability of a system through formal verification approaches and are associated with "safety-critical systems" such as aerospace, automotive, financial, medical, and cryptographic use cases.
These software assurance methods provide a comprehensive and multi-faceted approach to ensuring the security and reliability of software systems by identifying vulnerabilities that can appear in many different places. These methods support creating and maintaining a solid framework for identifying, mitigating, and managing vulnerabilities throughout the software development lifecycle.
Continuous Integration/Continuous Delivery () Pipelines
Continuous Integration (CI) is the principle that developers should commit and test updates often, every day or sometimes even more frequently. This is designed to reduce the chances of two developers spending time on code changes that are later found to conflict with one another. CI aims to detect and resolve these conflicts early, as it is easier to diagnose one or two conflicts or build errors than it is to diagnose the causes of tens of them. For effective CI, it is important to use an automated test suite to validate each build quickly.
Continuous Delivery (CD) Cycle
A circular diagram illustrating the process of Continuous Delivery with five stages: Develop, Build, Test, Deploy, and Release arranged in a cycle.
Continuous Delivery/Continuous Deployment
Where CI is about managing code in development, continuous delivery (CD) is about testing all of the infrastructure that supports the application, including networking, database functionality, client software, and security.
Where continuous delivery tests that an updated application (version) and its supporting infrastructure are ready for production, continuous deployment is the separate process of making changes to the production environment using configuration management platforms to support the newly updated application.
Note:
A few popular and deployment automation tools include Puppet, Ansible, Terraform, OpenTofu, Chef, Jenkins and Gitlab. Readers are encouraged to explore these tools and the free learning resources available for each one to gain a deeper understanding of them and their role in security automation.
Defined DevOps Pipeline
To keep up with the demand for feature enhancements, patches, and upgrades in alignment with present-day users' expectations and requirements in response to rapidly changing security challenges, DevOps has established a model to more tightly integrate development and operations teams. In order for this collaboration and rapid development process to work, a pipeline is needed to define the overall process. The DevOps pipeline can be compared to an assembly line which is comprised of distinct steps but never ends. Much like an assembly line, the pipeline should be reflective of the organization's requirements and type of product needed. Regardless of the type of organization or software in development, the DevOps pipeline is typically composed of the following eight steps:
Plan
Code
Build
Test
Release
Deploy
Operate
Monitor
The DevOps Pipeline
The steps in Development are plan, code, build, and test. The steps in operations are release, deploy, operate, and monitor.
Supporting Software Assurance
Coding Standards, A set of guidelines for writing code to ensure consistency, readability, and maintainability. Examples include Google's C++ Style Guide, CERT C Coding Standard, Oracle Java Coding Standard, ISO/IEC TS 17961, and CWE (Common Weakness Enumeration) Coding Standards.
Linting, Often added to integrated development environments, linters analyze code for adherence to coding standards and other quality issues, such as variable declarations and naming conventions. Linters help enforce compliance with coding standards.
Branch Protection, Policies and rules within version control systems (such as Git) to protect branches (a parallel version of a coding project) from direct changes.
Continuous Improvement, In relation to software assurance, this translates to regularly refining practices, toolsets, and source code to enhance the quality, performance, and security of software development practices.
Canary Test, Describes when a small subset of users is exposed to a new feature or software version to help detect issues before a wider release.
Regression Test, Comprehensively testing software functionality to confirm that recent code changes in one area do not adversely affect the expected functionality in another. Ideally, regression tests are configured to operate using automated methods, but sometimes, regression testing is a much more formal and manual evaluation performed by subject matter experts in various business units.
Integration Test, A type of testing designed to verify the interactions between different software modules to ensure everything continues to work as expected. Modules sometimes work differently when integrated with others, so this type of testing is designed to locate issues associated with integration and is ideally configured to operate using automation.
Unit Tests, Another example of automated testing that evaluates individual functional elements of a software application to ensure they work correctly. Unit tests are typically written by developers and incorporated into integrated development environments to streamline their use. When unit tests are well-designed, they can be run frequently by a developer as they write code to validate that changes work correctly and do not introduce errors. Testing in this way supports early issue detection and correction.
The supply chain describes all of the suppliers, vendors, and partners needed to deliver a final product. The supply chain presents a significant amount of risk, and organizations should consider forming a specialized supply chain risk management program. Some of the largest, highest-profile, and impactful breaches in recent years have occurred due to vulnerabilities within the supply chain. Software and hardware contain vulnerabilities which can be described as intentional or unintentional flaws introduced into the final product and not easily tracked using traditional supply chain management practices.
The supply chain is far-reaching and diverse. For hardware manufacturers, the supply chain includes the providers of storage drives, video adapters, chips, and other components. For a software company, the supply chain may include many other software vendors, such as the developers of the development tools themselves, source-code repositories, development language, and third-party libraries. For a traditional business, the supply chain includes, but is not limited to, internet service providers, HVAC vendors, safety equipment suppliers, physical security guards, contractors, other service providers, and the supply chain of its hardware and software vendors! Any weakness in the cybersecurity operations of a vendor is a potential avenue of attack and source of unauthorized access.
Supply Chain Risk Management
Diagram showing a company's third- and fourth-party risk ecosystem. A central circle labeled "Company" connects to three "Third-Party Vendor" circles. Each third-party vendor connects to four "Fourth-Party Vendor" circles.
Supply Chain Visibility (SCV), Describes the capacity to understand how all vendor hardware, software, and services are produced and delivered as well as how they impact an organization's operations or finished products. This is a daunting task, as full visibility requires a comprehensive understanding of all levels of the supply chain, to include the vendors and suppliers of an organization's vendors and suppliers or to put another way, the 1st, 2nd, 3rd... nth level suppliers in the supply chain.
Third-Party Dependencies
Supply chain generally refers to the use and distribution of materials comprising a finished product. Third-parties form part of the supply chain but describe a far broader set of relationships such as vendors, suppliers, service providers, credit card processors, utilities, contractors, affiliates, trade associations, government agencies, and many others. Understanding and documenting these relationships, including an assessment of the level of risk the third-party poses to the organization can help identify sources of trouble. Some elements specific to securing IT operations include identifying the code, hardware, and modules used within the environment and provided by third-parties. These elements can introduce vulnerabilities and should be assessed to determine their security level and capabilities.
Supply Chain Risk Management
The supply chain is fraught with many risks stemming from third-party vulnerabilities, lack of visibility into the entire supply chain, insider threats, supply chain complexity, compliance issues attributed to suppliers, counterfeit products, geopolitical dynamics, and deficient security practices by suppliers. Addressing these risks requires a comprehensive and proactive approach to supply chain risk management, emphasizing continuous monitoring, stringent vetting, and effective collaboration with suppliers to preserve cybersecurity resilience.
Suppliers often provide software or hardware components integrated into an organization's systems. When these components have unpatched vulnerabilities, they can serve as an entry point for attackers, potentially leading to significant data breaches or system compromises. Also, suppliers may inadvertently introduce malicious code, such as spyware or ransomware, through their products. The lack of visibility and control over the extended supply chain is a significant source of risk. Most organizations rely on numerous tiers of suppliers and do not have direct oversight or control over their cybersecurity practices.
Supply chain risk management (SCRM) describes a comprehensive and proactive approach to identifying, assessing, and mitigating risks associated with the various supply chain entities, including suppliers, vendors, service providers, and any third parties that might impact an organization's cybersecurity posture. Organizations must ensure that suppliers adhere to relevant cybersecurity practices. Contractual agreements with suppliers should clearly define cybersecurity expectations and responsibilities, including clauses to mandate regular security assessments, data protection measures, and protocols for reporting and addressing security incidents. Well-crafted contracts ensure that suppliers are legally bound to maintain a certain level of cybersecurity hygiene.
Hardware assurance includes the design of secure hardware architectures that incorporate security features like mechanisms, hardware-based encryption, and physical anti-tamper features. Reputable and trustworthy device manufacturers implement testing procedures designed to detect and mitigate issues that could compromise hardware functionality, reliability, or security. Non-technical approaches associated with hardware assurance focus on administrative controls that support secure lifecycle management practices of hardware devices, including supply chain risk assessments. Ensuring that equipment suppliers adhere to best practices in security and manufacturing techniques is essential. Training and awareness programs for employees who design, develop, and maintain hardware also help to support hardware assurance.
Several frameworks and standards exist to provide benchmarks for hardware security. One such framework is the Common Criteria (CC) for Information Technology Security Evaluation (an international standard for computer security certification). The Common Criteria provides a framework for evaluating the security properties of hardware and software components.
Note:
More information regarding Common Critera can be found at https://www.commoncriteriaportal.org/cc/index.cfm
The National Institute of Standards and Technology (NIST) also offers guidelines and standards, such as NIST SP 800-53, which recommend security controls primarily intended for federal information systems but expanded for general use since revision 5, including hardware security practices. The Trusted Foundry program (also known as the Trusted Suppliers Program) is another example and is associated with U.S. defense-grade hardware components, ensuring they meet stringent security and manufacturing quality standards.
The following is a non-exhaustive list of real-world events associated with hardware security flaws:
Inside the infamous Mirai IoT Botnet: A Retrospective Analysis: https://blog.cloudflare.com/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis/
Hackers can remotely exploit insulin pump for unauthorized insulin injections: https://www.csoonline.com/article/558223/hackers-can-remotely-exploit-insulin-pump-for-unauthorized-insulin-injections.html
The ECU killer: broken authentication in automotive security: https://cydrill.com/cyber-security/the-unlikely-ecu-killer-broken-authentication-in-automotive-security/
Thunderstrike, Infecting Apple MacBooks with EFI Bootkit via Thunderbolt Ports: https://thehackernews.com/2015/01/thunderstrike-infecting-apple-macbooks.html
BadUSB: https://hackaday.com/tag/badusb/
The ROCA : How it works and what to do about it: https://www.techtarget.com/searchsecurity/tip/The-ROCA-vulnerability-How-it-works-and-what-to-do-about-it
NIST SP 800-53
NIST SP 800-53 offers best practices tailored to enhancing hardware security as part of an overall information system security framework. The special publication (SP) identifies the need to incorporate security controls into hardware designs to ensure they cannot be easily tampered with or compromised. SP 800-53 also recommends maintaining and monitoring the configurations of hardware devices to prevent unauthorized changes and to ensure that systems operate securely and as intended. Additionally, SP 800-53 addresses the secure disposal and decommissioning of hardware, among many other recommendations.
Note:
NIST SP 800-53 is available from https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.
Hardware products must undergo evaluation and certification to satisfy certain security standards. This approach provides reassurance to consumers and organizations that their hardware investments are dependable and secure. The effective implementation of hardware assurance practices depends upon both technical and non-technical approaches.
Certification and Validation Process
A horizontal process flowchart with five labeled steps: Initiation, Preparation, Evaluation, Certification, and Maintenance, each represented in a blue box connected by arrows from left to right.
Process Description
Initiation
The Sponsor (often the product vendor) initiates the certification. An accredited and independent testing Laboratory performs the evaluation.
Preparation
The Security Target (ST) defines the security requirements for the Target of Evaluation (TOE).
The TOE (product or system) is prepared for evaluation, including documentation and access to source code as required.
Evaluation
The Laboratory conducts Testing, including assessments and penetration testing.
Assurance Activities verify the development process and other critical aspects of the TOE's lifecycle.
Certification
The Laboratory creates a detailed Report to document all findings.
A national Certification Body reviews the report and issues a Certificate if appropriate.
Maintenance Regular Re-evaluation is typically necessary to ensure ongoing compliance and to address new vulnerabilities.
An end-of-life (EOL) status indicates that a device manufacturer or software developer will no longer offer updates, support, or continuing security patches for a product. This phase is significant because it profoundly impacts security operations.
This EOL status poses significant risks, as systems running outdated software or hardware become prime targets for attack. The potential for data breaches and security compromises increases significantly. Additionally, compatibility issues may arise as other applications and platforms continue to keep pace with newer software and hardware features. Compliance becomes a major concern also. Many organizations operate under strict regulatory requirements that mandate the use of supported and regularly updated software to protect sensitive data, such as personally identifiable information (PII), protected health information (PHI), financial records, company proprietary data, and other forms of sensitive records. Using EOS software or hardware will invariably lead to significant non-compliance issues, resulting in hefty fines and reputable damage.
Moreover, the lack of vendor support means that troubleshooting, repairs, and maintenance must be managed internally or through third-party providers, typically at a higher cost and with limited effectiveness. This can strain an organization's resources, requiring excessive time, attention, and funds to maintain legacy systems.
Many organizations have historically struggled with transitioning from widely used versions of the Windows Operating System despite receiving ample notice from Microsoft regarding their planned EOL. The Windows operating system frequently represents a critically important and tightly integrated platform running at the core of company operations, and migrating to newer systems requires significant effort and resources, in addition to posing substantial operational risks. Similarly, older versions of enterprise software tools like Microsoft Office or the Adobe Creative Suite present major challenges when they reach their end of life and require upgrades. Companies that have built their daily operations around specific features provided by these software suites typically find it difficult to change without disrupting business operations and various productivity workflows.
Another common scenario includes the proprietary hardware devices often found in manufacturing and healthcare environments. For example, when the hardware used in medical imaging or industrial control systems reaches EOL, replacing or upgrading them can be prohibitively expensive and technically challenging. Development platforms are also susceptible to these issues. Organizations that have developed applications using older versions of Java.NET, and other languages frequently need to manage major redevelopment projects to sustain compatibility with newer versions, which is complicated due to changes in code characteristics and deprecated features.
To successfully handle any of these challenges, it is important to weigh factors such as cost, training, compatibility, and the potential for downtime. The potential impact of EOL systems should influence purchasing and acquisition choices. System planning and design considerations must consider the lifecycle of the products chosen, balancing initial costs against the total cost of ownership, which includes potential future expenses related to upgrades, maintenance, and meeting compliance requirements. Consider the following reading:
Understanding the Hidden Cyber Risk from Tech Debt (EoL/EoS): https://blog.qualys.com/product-tech/2024/07/09/understanding-the-hidden-cyber-risk-from-tech-debt-eol-eos
How to manage end-of-life assets from the beginning: https://www.ey.com/en\_us/insights/consulting/itam-helps-enhance-assets-end-of-life-governance-from-the-beginning
End-of-life assets: managing risks in outdated technology: https://www.runzero.com/blog/eol-asset-risk-management/
Attackers Don't Like You Having Visibility Into Your End-Of-Life Assets: <https://www.forbes.com/councils/forbestechcouncil/2023/09/26/attackers-dont-like-you-having-visibility-into-your-end-of-life-assets/>
Exam Objectives Covered
Software is a basic layer of security architecture. management and reduction are essential strategies for minimizing the potential entry points for malicious actors, thereby enhancing an organization's overall security posture. Detection and threat-hunting enablers play a crucial role in identifying and mitigating threats in real time, complementing the proactive measures taken during the design of information and data security frameworks. Data loss prevention (DLP) mechanisms are integral to safeguarding sensitive information from unauthorized access or exfiltration, particularly in complex hybrid infrastructures that blend on-premises and cloud environments. The integration of third-party services and solutions adds another layer of complexity, necessitating rigorous control effectiveness to ensure that all security measures are functioning as intended. This all contributes to overall security architecture and design, making sure operational integrity is maintained throughout.
As you study this lesson, answer the following questions:
Why is management and reduction important for minimizing the risk of a security breach?
How does measuring control effectiveness contribute to ensuring that security controls are performing as intended?
What role do Data Loss Prevention (DLP) strategies play in safeguarding sensitive information from unauthorized access and exfiltration?
Why is it important to ensure that third-party integrations adhere to the same security standards as the organization, and what risks do they introduce?
management involves identifying, assessing, and mitigating potential entry points attackers can exploit in a system and leverages automation to find, evaluate, and prioritize vulnerabilities and risks. Some popular ASM solutions include.
Benefits of incorporating ASM include:
A comprehensive and continuous inventory of all assets and configurations
Identification and prioritization of vulnerabilities based on risk and impact.
Identification of unnecessary services, open ports, and misconfigurations.
Providing insights regarding how different security controls interact and where gaps might exist.
Provides specific recommendations for mitigating risks associated with legacy systems.
A non-exhaustive list of popular ASM solutions:
CyCognito Management https://www.cycognito.com/platform/attack-surface-management.php
Mandiant Management https://www.mandiant.com/advantage/attack-surface-management
Palo Alto Cortex Xpanse https://www.paloaltonetworks.com/cortex/cortex-xpanse
Microsoft Defender External Management https://www.microsoft.com/en-us/security/business/cloud-security/microsoft-defender-external-attack-surface-management
CrowdStrike Falcon Surface https://www.crowdstrike.com/products/exposure-management/falcon-surface/
Tenable Management https://www.tenable.com/products/attack-surface-management
IBM Randori https://www.ibm.com/products/randori-recon
management (ASM) helps reduce risk by systematically identifying and addressing potential vulnerabilities within an environment. By mapping out all possible entry points, ASM more clearly identifies where the environment may be susceptible to attack. This level of insight helps prioritize implementing targeted defensive technologies and tools designed to address these vulnerabilities. Additionally, ASM leverages continuous monitoring and assessment to promptly detect and respond to new threats that may otherwise go unnoticed for extended periods or until they are exploited. By maintaining an active view of the environment's , ASM reduces the likelihood of successful attacks and can also help identify ways to minimize potential impacts.
Some practical benefits of management (ASM) include support for the following areas.
ASM Benefits Description
management ASM provides a comprehensive and continuous inventory of all assets and configurations, identifying and prioritizing vulnerabilities based on risk and impact to help security teams prioritize the most critical issues and ensure that resources are used effectively to reduce the riskiest attack vectors.
System hardening ASM helps to identify unnecessary services, open ports, and misconfigurations that attackers could exploit. By offering detailed insights into potential vulnerabilities, ASM helps organizations ensure that best practice configurations are active and in place to secure their systems. It also provides early warning in instances where unused services may still be running, active ports may still be open/listening, or insufficient levels of access control exist.
Defense-in-depth ASM can identify how different security controls interact and where gaps may exist to support the implementation of additional defensive layers to ensure that if one layer is breached, others remain in place to offer protection.
Legacy components Legacy software and devices pose significant security risks. ASM helps by continuously monitoring legacy systems for new vulnerabilities or any change in their configuration. ASM can also provide specific recommendations for mitigating risks associated with any identified legacy systems, including actions such as isolation or virtual patching.
Detection and , while both crucial capabilities, serve different purposes. Detection relies on automated mechanisms to identify potential security threats as they occur. This form of detection is based on predefined rules, signatures, data feeds, and, more recently, machine learning to recognize the signs of malicious activity. In contrast, is a proactive technique where skilled analysts actively search for signs of threats that may have bypassed automated detection systems. is a hypothesis-driven approach that requires active exploration and analysis to uncover otherwise hidden threats. Both of these approaches rely on similar toolsets to operate effectively.
Tools such as those provided by SolarWinds or Nagios play a crucial role in continuously monitoring network traffic. Similarly, endpoint protection solutions like CrowdStrike Falcon Insight, Microsoft Defender , or Palo Alto Cortex monitor endpoints for unusual activity. The combination of these security tools can lead to quicker detection of anomalies that could be indicative of a threat. For instance, unusual network traffic patterns can be linked to suspicious endpoint activity, triggering faster alerting and response.
Alerting strategies are often integrated with security incident and event management () platforms and use predefined rules and machine learning models to continuously analyze log data to trigger alerts when suspicious activities are detected. For instance, if the detects a user attempting to access multiple sensitive files they don't typically interact with, it can generate an alert. Advanced alerting systems can also use correlation rules to identify patterns across different data sources, which could indicate a compromised account.
Furthermore, platforms allow analysts to leverage community sources to locate search strings for an (Security Information and Event Management) to identify Indicators of Compromise (IoCs). Community-driven allows security professionals and researchers to share their expertise, knowledge, and experiences in detecting threats. Security teams can then integrate these community-sourced search strings into their systems, enabling them to detect known IoCs and identify potential threats.
Flowchart illustrating the process of threat detection and alerting, starting from community , search strings, and integration, leading to detection of Indicators of Compromise (IoCs) and resulting in threat alerts.
Sensors support detection and by enabling the collection of relevant data from various points in the network and endpoints. Well-placed sensors provide valuable insights into potential security threats and help security teams detect and respond to incidents more effectively. Sensors are generally placed in positions intended to capture network traffic, endpoint activities, cloud traffic, and devices such as printers and IoT. Sensor data is typically fed into an platform so automated detection mechanisms, and analysts can more effectively search the data.
Centralized Logging
Centralized logging describes collecting log data from diverse systems, applications, and devices across an organization's IT infrastructure and consolidating it into a centralized location for analysis. To support cybersecurity operations, the centralized logging platform is typically a that helps to interpret log data and extract important security events. The visibility provided by centralized logging is crucial for detecting and analyzing potential threats, as it allows security teams to monitor activities across different systems and correlate events that may appear benign in isolation but represent a security incident when viewed concurrently. Centralized logging makes it easier to identify otherwise hidden patterns by correlating data from multiple sources. When logs are collected and analyzed in a single location, automated processes can quickly identify known indicators of compromise, triggering alerts for security teams to investigate. This rapid detection capability is essential for minimizing the impact of a security incident. Centralized logging provides a valuable resource for forensic analysis if a breach incident occurs. Logs provide a detailed timeline of events, showing what happened, when it happened, and which systems or users were involved or impacted.
Centralized logging supports by providing a rich dataset that security analysts can query and analyze to identify unusual behavior or patterns that may indicate a threat. By maintaining log data in a single repository, threat hunters can perform more thorough and efficient investigations and potentially leverage advanced techniques like machine learning and behavioral analysis if the platform supports it.
Common infrastructure and systems included in centralized logging include:
Network devices such as routers, firewalls, and switches generate logs that provide insight into network traffic.
Web servers, database servers, and application servers generate logs with details that can help identify suspicious activity, such as unauthorized access attempts.
Workstations, laptops, and mobile devices log events such as software installations, file access, and user logins, which help detect malicious activity on systems that are frequently attackers' first point of access.
Intrusion detection systems (IDS), intrusion prevention systems (IPS), and anti-virus software generate logs that provide specific information regarding detected threats, attempted exploits, and blocked attacks.
Cloud service logs include details regarding user access, resource provisioning, and configuration changes.
Authentication systems such as Microsoft Active Directory or cloud-centric solutions such as EntraID and Okta provide logs crucial for identifying unauthorized access attempts.
Information and data security design encompasses various strategies and frameworks to protect sensitive data from unauthorized access, alteration, or destruction. At the core of these strategies is the implementation of classification models, data labeling, and tagging methods that ensure data is handled appropriately based on its sensitivity and value.
Classification models categorize data into different sensitivity levels, such as public, confidential, and critical, to help determine the appropriate security measures for each data type. For example, public data may require minimal security protections, whereas critical data would necessitate robust encryption and stringent access controls, among other things.
Data Classification
Data classification is the process of organizing data based on its sensitivity, importance, and potential impact if compromised or mishandled. It helps organizations manage data effectively, ensure security, and comply with regulations. Some common classifications include the following, but classification names often vary from one organization to another.
Public (unclassified), There are no restrictions on viewing the data. Public information presents no risk to an organization if it is disclosed but does present a risk if it is modified or not available.
Confidential (secret), The information is highly sensitive and for viewing only by approved persons within the owner organization, and possibly by trusted third parties under NDA.
Critical (top secret), The information is too valuable to allow any risk of its capture. Viewing is severely restricted.
Note:
Data classification labels can be chosen at the discretion of the organization. Secret and Top Secret are common labels used in military organizations but are less common outside of that realm.
Data Labeling and Tagging
Data labeling describes the assignment of specific labels to data based on its classification level. Labels act as markers that indicate the data's sensitivity and steer how it should be handled, stored, and transmitted. Data owners can apply labels manually or automatically through automated data discovery and classification tools.
Tagging strategies enhance data management by attaching metadata tags to data assets. Tags are used in addition to classification and provide extra context about the data, such as its origin, usage, regulatory requirements, and retention policies. Tags facilitate efficient data tracking, auditing, and compliance with legal and organizational standards.
A Sensitivity Label Applied in Microsoft Excel
A Microsoft Excel save dialog displays an expanded "Sensitivity" dropdown menu with options such as Confidential, Highly Confidential, Personal, Public, and General, emphasizing how users can label file sensitivity.
Screenshot used with permission by Microsoft.
Data Loss Prevention
Data Loss Prevention (DLP) prevents data breaches by protecting sensitive data, including personal information, financial data, intellectual property, and other confidential information.
Conceptually, DLP works by monitoring and controlling data flows within the organization and when data is sent externally. DLP typically depends upon a combination of tools, such as network security appliances, endpoint agents, and data discovery tools. These tools help to identify, monitor, and protect data and enforce compliance with acceptable data use policies.
For instance, an organization leveraging DLP can establish rules to monitor email traffic and block the transmission of sensitive information like personally identifying numbers (such as passport numbers) or credit card data. If an employee attempts to send an email containing such information, the DLP system can immediately block the email and alert the security team. This rapid response significantly reduces the risk of data breaches by ensuring employees cannot send sensitive information to unauthorized recipients. Another way DLP reduces risk is by scanning and protecting endpoints such as laptops and mobile devices. If an employee tries to copy sensitive files to a USB drive, the DLP system can block it.
DLP solutions also help mitigate the risk of data exfiltration. Conceptually, DLP works by identifying sensitive data through various means, such as pattern matching, fingerprinting, and contextual analysis. Once the data is identified, DLP solutions can apply policies to control and monitor its usage and movement. Network-based DLP solutions can monitor network traffic for unauthorized data transfers. By inspecting data packets, these solutions can identify sensitive information being transmitted over the network and take appropriate actions such as blocking the transmission or redirecting it for further analysis.
Data Discovery
Data discovery describes the process of identifying and cataloging data across an organization. It requires locating structured and unstructured data stored in databases, file systems, cloud environments, or on endpoints like laptops, desktops, and mobile devices. Without first performing data discovery, it is difficult to sufficiently protect it using data loss prevention tools.
The discovery process locates and classifies data by applying tags based on data types, such as personally identifiable information (PII), financial records, intellectual property, or any other type of regulated or sensitive data. Additionally, continuous data discovery approaches ensure that DLP systems maintain near real-time insight regarding changes in the data environment.
Data at Rest
Data at rest identifies that the data is in some sort of persistent storage media. Examples of types of data that may be at rest include financial information stored in databases, archived audiovisual media, operational policies, and other management documents, system configuration data, and more. In this state, it is usually possible to encrypt the data, using techniques such as whole disk encryption, database encryption, and file- or folder-level encryption. AES is an example of a method to protect data at rest. On Microsoft Windows computers, this can be accomplished by using BitLocker.
Data in Transit
Data in transit (sometimes referred to as data in motion) is described as the state when data is moved, for example data transmitted over a network. Examples of data that may be in transit include website traffic, remote access traffic, data being synchronized between cloud repositories, files moving between a client and server, and more. TLS or IPSec are examples of methods designed to protect data in transit. Another common application of protecting data in transit is through the use of VPN. VPN protects data in motion but should also leverage to verify that the endpoints are trusted/pre-authorized prior to authentication.
Data Loss Prevention
Data Loss Prevention (DLP) prevents data breaches by protecting sensitive data, including personal information, financial data, intellectual property, and other confidential information.
Conceptually, DLP works by monitoring and controlling data flows within the organization and when data is sent externally. DLP typically depends upon a combination of tools, such as network security appliances, endpoint agents, and data discovery tools. These tools help to identify, monitor, and protect data and enforce compliance with acceptable data use policies.
For instance, an organization leveraging DLP can establish rules to monitor email traffic and block the transmission of sensitive information like personally identifying numbers (such as passport numbers) or credit card data. If an employee attempts to send an email containing such information, the DLP system can immediately block the email and alert the security team. This rapid response significantly reduces the risk of data breaches by ensuring employees cannot send sensitive information to unauthorized recipients. Another way DLP reduces risk is by scanning and protecting endpoints such as laptops and mobile devices. If an employee tries to copy sensitive files to a USB drive, the DLP system can block it.
DLP solutions also help mitigate the risk of data exfiltration. Conceptually, DLP works by identifying sensitive data through various means, such as pattern matching, fingerprinting, and contextual analysis. Once the data is identified, DLP solutions can apply policies to control and monitor its usage and movement. Network-based DLP solutions can monitor network traffic for unauthorized data transfers. By inspecting data packets, these solutions can identify sensitive information being transmitted over the network and take appropriate actions such as blocking the transmission or redirecting it for further analysis.
Data Discovery
Data discovery describes the process of identifying and cataloging data across an organization. It requires locating structured and unstructured data stored in databases, file systems, cloud environments, or on endpoints like laptops, desktops, and mobile devices. Without first performing data discovery, it is difficult to sufficiently protect it using data loss prevention tools.
The discovery process locates and classifies data by applying tags based on data types, such as personally identifiable information (PII), financial records, intellectual property, or any other type of regulated or sensitive data. Additionally, continuous data discovery approaches ensure that DLP systems maintain near real-time insight regarding changes in the data environment.
Data at Rest
Data at rest identifies that the data is in some sort of persistent storage media. Examples of types of data that may be at rest include financial information stored in databases, archived audiovisual media, operational policies, and other management documents, system configuration data, and more. In this state, it is usually possible to encrypt the data, using techniques such as whole disk encryption, database encryption, and file- or folder-level encryption. AES is an example of a method to protect data at rest. On Microsoft Windows computers, this can be accomplished by using BitLocker.
Data in Transit
Data in transit (sometimes referred to as data in motion) is described as the state when data is moved, for example data transmitted over a network. Examples of data that may be in transit include website traffic, remote access traffic, data being synchronized between cloud repositories, files moving between a client and server, and more. TLS or IPSec are examples of methods designed to protect data in transit. Another common application of protecting data in transit is through the use of VPN. VPN protects data in motion but should also leverage to verify that the endpoints are trusted/pre-authorized prior to authentication.
Third-party integrations in an IT infrastructure are essential for enhancing functionality and efficiency by connecting external systems, applications, and services. However, these integrations can introduce significant risks which must be carefully managed. Before integrating third-party services, organizations should perform thorough security assessments and due diligence, including a review of the third party's security posture, policies, and processes to avoid integrating with insecure or unreliable services.
Authentication and Authorization
One of the primary controls focuses on authentication and authorization, designed to ensure that third-party systems are authenticated and authorized before accessing internal systems. Data encryption is another crucial control that protects sensitive information from unauthorized access.
Continuous Monitoring
Continuous monitoring of third-party integrations is also crucial to detect and respond to suspicious activities. Service Level Agreements (SLAs) and contracts with third parties define clear obligations regarding data protection, security measures, and protocols and are legally binding and enforceable, which helps drive third-party compliance with regulatory requirements and establish accountability in the event of a security incident.
Data Minimization
Establishing data minimization and segmentation as critical controls is essential. These controls are designed to limit the amount of data shared with third parties to the minimum necessary. Techniques such as tokenization and anonymization help to reduce sensitive data exposure and ensure that third-party integrations comply with relevant laws, regulations, and industry standards, such as , , and .
Network Protections
Network security controls, including firewalls, intrusion detection/prevention systems (IDS/IPS), and network segmentation, protect internal systems from threats originating from third-party integrations. These measures address risks such as network-based attacks, the spread of malware and viruses, and unauthorized network access.
Measuring the effectiveness of security controls involves several techniques designed to help organizations ensure that security measures function as intended or identify improvement requirements.
Assessments
One approach is conducting assessments, such as assessments and penetration testing. assessments systematically identify and evaluate security weaknesses in a system. For example, an organization might use automated tools like Nessus or OpenVAS to scan its network for known vulnerabilities and then analyze the results to prioritize remediation efforts based on the CVSS. Penetration testing simulates real attacks to determine if identified vulnerabilities are exploitable and evaluate the effectiveness of existing defenses.
Note:
The Common Scoring System (CVSS) is a standardized framework for assessing the severity of security vulnerabilities in software. It provides a numerical score ranging from 0 to 10, with higher scores indicating more severe vulnerabilities. This score is derived from several factors, including the ease of use, impact, and scope.
Metrics
Metrics play a crucial role in measuring and monitoring security control effectiveness. Organizations can gain quantitative insights into their security practices by defining and tracking specific security metrics. Common metrics include the number of detected vulnerabilities, the time taken to remediate issues, and the number of security incidents over a given period. For example, an organization might track the mean time to resolve (MTTR) security incidents, aiming to reduce this time as part of its continuous improvement efforts. Another useful metric could be the rate of false positives in intrusion detection systems, helping to refine and enhance the accuracy of these systems.
Some additional example metrics frequently used to measure security program performance:
Patch management metrics to track the percentage of systems updated within a specified time frame.
time to measure the time taken from detection to resolution of security incidents.
User awareness and training metrics to evaluate the effectiveness of security training programs.
Access control metrics monitor unauthorized access attempts and access rights changes.
System uptime and availability measure the operational time of critical systems.
Backup and recovery metrics track the frequency and success rate of backups and recovery tasks.
Security policy compliance metrics measure adherence to security policies, including policy violations.
Security incident frequency tracks the number of incidents by type.
Security control coverage measures the percentage of critical assets covered by mandatory controls.
For example, a security team conducts assessments using a tool like Nessus, which identifies critical issues (as determined by CVSS score) in a web application and database server. After addressing the identified vulnerabilities, additional penetration testing reveals a SQL injection in the web application. To quickly address the SQL injection , a WAF rule is created to detect and block any attempts to exploit the injection . Metrics such as Mean Time to Resolve (MTTR) detected vulnerabilities provide insight into the effectiveness of existing efforts to maintain a safe and secure environment and support continuous process improvement initiatives.
Exam Objectives Covered
To maintain operation resilience, several design considerations should be considered. Considerations for availability and integrity are fundamental to ensuring that systems remain operational and data remains accurate and unaltered. Network traffic inspection plays a critical role in monitoring and analyzing data packets for signs of malicious activity, while network access control and VPNs provide secure access points and encrypted communication channels for users. Specialized components, such as scanners and Content Delivery Networks, further enhance the security architecture by providing targeted protection against specific threats. Proxies add an additional layer of security by acting as intermediaries between users and the internet, filtering requests and responses to prevent unauthorized access. Collectively, these work in concert to create a robust and resilient network environment.
As you study this lesson, answer the following questions:
How do availability and integrity design considerations contribute to a secure and reliable IT infrastructure?
What roles do network access control and VPNs play in regulating network access and providing secure channels for remote connections?
Why is network traffic inspection important for monitoring data flows and detecting malicious activities in real time?
How do specialized components like firewalls, intrusion detection systems, and proxies enhance the security of an organization's IT infrastructure?
Load Balancer
Load balancers are generally associated with the management of web traffic. Generally, a load balancer is a special purpose device, or appliance, containing specialized software allowing the configuration of traffic management rules. Load balancers, like many other devices, can also be implemented as virtual machines while still offering the same features and services as their hardware counterparts.
A load balancer is placed in-line of the traffic destined for a web application. The web traffic is inspected by the load balancer and then sent to one of several web servers (all of which host a copy of the web application) based on matching the traffic to a pre-configured rule or profile. A common implementation of load balancers is to distribute traffic among one of many web servers to better handle high-volume workloads. Another common implementation is for fault tolerance, whereby the load balancer is able to determine if a particular web server in a group is inoperable so that traffic can be re-directed automatically to a different server, avoiding an outage.
Load Balancing
Load balancing is a technique for distributing network traffic across multiple servers to ensure that no single server becomes overwhelmed and that services remain highly available. Load balancers distribute traffic based on several different algorithms, such as round-robin or least connections, and are most closely associated with managing web traffic. Load balancing is essential for maintaining high availability and scalability.
Recoverability
Recoverability describes a system's ability to restore functionality after a failure or other type of disruption. Important considerations include regular data backups, disaster recovery planning, and failover techniques. The goal of recoverability is to minimize downtime and data loss. Effective recoverability strategies ensure systems can quickly return to normal operations after an incident
Creating, implementing, and testing BCDR capabilities is absolutely essential in order to provide assurance of the safe and reliable operations of information systems, but it is also often a requirement to demonstrate this capability from a legal or regulatory viewpoint. In the period since the September 11th terrorist attacks in New York, the number of regulations and standards with provisions impacting BCDR, or that contain explicit BCDR requirements, has significantly expanded.
Some examples of standards and regulations with descriptions of BCDR capabilities include:
, Health Insurance Portability and Accountability Act
SOX, Sarbanes-Oxley Act
GLBA, Gramm-Leach-Bliley Act
FISMA, Federal Information Security Modernization Act
GASB, Governmental Accounting Standards Board
FFIEC, Federal Financial Institutions Examination Council
ISO 27031, Guidelines for information and communication technology readiness for business continuity
ISO 9001, Quality Management
Interoperability
Interoperability is vital in heterogeneous IT environments where multiple systems, often from different vendors, must exchange data and work seamlessly to provide a unified service effectively. Interoperability is achieved by implementing standardized protocols, APIs, and predefined data formats. For example, using RESTful APIs allows web services to interact with different clients regardless of the underlying technology. More details about RESTful APIs can be reviewed at https://restfulapi.net
In practical terms, interoperability is achieved through the use of numerous technologies that have gained widespread adoption and expanded reach in the past decade. APIs (Application Programming Interfaces), middleware solutions (like enterprise service buses (ESBs) and message brokers) containerization technologies like Docker, orchestration tools like Kubernetes, and open standards such as REST, JSON, XML, GraphQL, and OpenAPI, and many others, all work together to enable practically seamless interoperability. Additionally, modern, cloud-centric Identity and Access Management () solutions facilitate cross-platform access control and underpin the accessibility of otherwise isolated systems.
Geographical Considerations
A collection of multiple national flags from different countries, mounted on flagpoles and waving against a clear blue sky.
Image © 123rf.com
Organizations are very likely to use multiple vendors located in many geographically diverse locations across the world. Globalization of the economy is a fascinating and dynamic topic, and in terms of cybersecurity presents many unique challenges. The most apparent issues when working with a vendor located in a different country include time zone differences, language barriers, social and moral norms, as well as legal jurisdiction. It is the latter issue that becomes much more pressing when considering the use of cloud service providers. While a more straightforward vendor relationship requires careful management of team interactions and the governance of data access, remote access, contracts and service level agreements, cloud service providers increase the complexities and risk of geographical considerations in a very unique way.
A cloud service provider arrangement requires an organization to relocate its core information technology applications, data, and infrastructure to the CSP. Handing over much of the control of these items presents many tactical risks, but from a geographic viewpoint, legal jurisdiction becomes much more complicated as the customer and CSP are most often located in different cities, regions, and/or countries. Determining which laws are applicable in various scenarios, defining boundaries around how and where cloud services can be provisioned, and training staff on these requirements becomes much more critical.
The United States, Europe, Asia, South and Central America, Australia, and New Zealand all have divergent laws protecting intellectual property, privacy, the use of encryption, and law enforcement cooperation.
Vertical vs. Horizontal Scaling
Vertical scaling, or scaling up, involves adding more resources to an existing server, such as upgrading its CPU, RAM, or storage capacity. While vertical scaling improves the performance of individual servers, it has limitations attributed to physical and cost constraints. In contrast, horizontal scaling, or scaling out, involves adding more servers to a system, thereby distributing workloads across multiple machines. Horizontal scaling is much more flexible than vertical scaling and often provides greater fault tolerance and redundancy. In cloud architectures, horizontal scaling supports dynamic resource allocation for irregular workloads.
Persistence vs. Non-persistence
Persistence refers to the attribute of data that remains after executing the program that created it. Persistent data is generally stored in databases, file systems, storage buckets, or other storage media, ensuring it remains available for future use. Non-persistence, in contrast, refers to temporary data that is discarded after use. Examples of non-persistent data include session data or cache data, typically stored in memory, that does not need to be preserved long-term.
Containers, such as those managed by Docker or Kubernetes, are typically ephemeral, meaning their file systems do not persist. In this context, persistence refers to the ability of data to outlast the container's operation. External storage volumes must be used to achieve data persistence in a containerized application. The volumes must be independent of the container life cycle, and data written to them must remain intact even if the container is destroyed or recreated.
In virtualized environments, non-persistence is often associated with stateless virtual machines (VMs) such as desktops. Stateless VMs are designed to revert to a predefined state after use, meaning any changes the user makes are not saved to the VM (although they may save to a different, persistent storage location separated from the VM.) Non-persistence is frequently used in virtual desktop infrastructure (VDI) deployments.
Firewall
Typically placed at the network perimeter or between network segments, a firewall controls incoming and outgoing network traffic based on predetermined rules. Firewalls base allow or block decisions on IP address, port number, and protocol. Modern, next-generation firewalls can perform deep packet inspection, for example, analyzing the content of OSI layer seven protocols such as HTTP.
Intrusion Detection System (IDS)/(NIDS)/(WIDS)
Network intrusion detection system (NIDS) is a system designed to monitor traffic on a specific segment of a network and look for signs of suspicious activity. A NIDS inspects traffic and analyzes it to determine the presence of potentially rogue activity in order to generate alerts upon detection. A NIDS can detect any unknown or unrecognized devices or rogue machines.
To detect suspicious activity, a NIDS can use one of several analysis techniques:
Signature-based, comparing observed traffic to known attacks which are defined by a signature
Anomaly-based, comparing observed traffic to typical protocol activity, such as amount, or volume, of a particular protocol or typical characteristics of a protocol's operation
Behavior-based, comparing observed traffic to the traffic obtained during a learning period whereby the NIDS determines typical network traffic patterns and volumes within a specific setting. Anything that deviates from the patterns determined during the learning period is flagged as suspicious.
NIDS are essential for providing early warning of suspicious activity by analyzing enormous volumes of network traffic, in near real time, which would be a practically impossible task by any other means. To accomplish this, NIDS are typically deployed using a NIDS Server and several NIDS Sensors. The NIDS Server is capable of high-volume work and contains many processors, a high amount of RAM and storage. Sensors placed throughout an enterprise collect and forward network traffic to the NIDS Server so that it can be analyzed in realtime and also archived for more detailed inspection at a later time if warranted.
Taps
Network taps are placed at strategic points in a network to capture traffic for monitoring and analysis, most commonly as part of an IDS deployment. Taps are specialized devices designed to connect to enterprise-grade switches and collect network traffic for analysis without impacting network performance. Taps are categorized as passive or active. Passive taps are the most common; they do not need an external power source and safely divide a network signal to avoid introducing a single point of failure, making them highly reliable. Active taps are less common and generally only used when circumstances require them, such as when copper connectivity is the only option (versus fiber) or when signal strength is weak and must be amplified. Active taps require an external power source and generally represent a single point of failure as a result.
Intrusion Prevention System (IPS)/(NIPS)/(WIPS)
A network intrusion prevention system (NIPS) is an extension of a NIDS in that it that monitors suspicious network traffic and sends a warning if suspicious activity is observed but then reacts in real time to block the suspicious activity. A NIPS can block traffic by dropping unwanted data packets or resetting connections. To accomplish this, a NIPS must be placed in-line with traffic so that it flows through the NIPS.
Like NIDS, NIPS are placed throughout an enterprise environment. NIPS are susceptible to false positives if not carefully configured and customized to a particular environment. NIPS false positives have a much more harmful impact as a false positive alert will result in blocking legitimate traffic, reducing availability.
Similarly, a wireless intrusion prevention system (WIPS) is used to identify and block identified suspicious activity contained within a wireless network.
Network Access Control
To protect a network by limiting access to only trusted devices, Network Access Control (NAC) allows the creation of policies designed to evaluate connected devices and determine whether to allow them access to a network environment. Network access control can be used to force simple endpoint authentication by passing credentials or providing digital certificates, or to perform more advanced endpoint evaluation to include not only authentication but also health checks designed to verify the presence of active, updated antivirus software patch levels and properly configured firewalls. NAC is often coupled with VPN solutions to ensure that devices connected via VPN pass security criteria before gaining access to the enterprise.
Screenshot of the PacketFence web interface showing the configuration of scan engines, with a dropdown menu open to select a scan engine, highlighting "OpenVAS."
Screenshot used with permission from packetfence.org
A common approach is to develop NAC policies that define a quarantine network. In a quarantined network, devices that do not meet enterprise security standards are routed to a specific network, via dynamic VLAN assignment, in order for them to perform necessary updates, while being segmented from the rest of the network. This keeps a device in a controlled environment (sometimes called a VLAN "jail") until it is deemed fit for communication with the larger network.
Screenshot of the PacketFence administrator dashboard, focused on the Violations configuration page showing a list of violation rules and actions.
Screenshot used with permission from packetfence.org
NACs can accomplish these tasks in either an agent-based or agentless configuration. For agent-based implementations, software agents must be installed on devices in order for the NAC to carry out the required health checks. Agents are further sub-categorized as either permanent or dissolvable. A permanent agent stays on the device indefinitely, while a dissolvable agent is removed once the device is authenticated. Agentless NACs use network scanning and analysis techniques to ascertain health information without devices requiring specific software.
Virtual Private Network (VPN)
At the highest level, a virtual private network (VPN) performs two major tasks: the creation of a tunnel and protection of the data within it. Sometimes different protocols are used for each of these functions, for example an L2TP/IPSec VPN. L2TP is used to establish the tunnel, and IPSec is used to perform encryption. Some common VPN Protocols include the following:
OpenVPN
L2TP/IPSec
IKEv2/IPSec
WireGuard
SSTP
IPSec
PPTP
In an enterprise setting, VPN has two primary applications: enable people to connect to the enterprise from home, or other remote location, and to provide connectivity between branch locations. VPN concentrators should be strategically placed to handle high volumes of VPN traffic. Considerations for load balancing and redundancy are crucial to ensure availability and resilience. Implementing multiple VPN concentrators with load balancing can distribute the load evenly and prevent a single point of failure. Additionally, configuring failover mechanisms ensures continuous operation if one concentrator goes down. VPN solutions are used most widely to allow employees, vendors, and contractors to work remotely and social engineering attacks focused on these groups are a common means by which unauthorized VPN access is obtained.
VPN use has become widespread in recent years, and its inherent traffic protection features are being used in more scenarios, such as to hide traffic and obfuscate network connections. VPN Service providers of varying levels of integrity offer malicious users a mechanism to hide their true location and activities and to provide privacy to those concerned with surveillance by law enforcement, governments, and/or marketing and advertising companies.
Proxy
A standard proxy is a service placed between users and their access to internet-based resources. The proxy is an intermediary that forwards user requests to services such as http (websites). In a business setting, proxies are configured to enforce internet access policies, perform content inspection to defend against malicious content (malware), log user activity, and cache content to improve performance. Public proxies can mask the IP addresses of clients by replacing them with their own, obscuring a client's online activities by making their true location or identity less obvious. In this way, proxies can play a role in preserving privacy, but in a modern context, proxies are commonly used to bypass geographic restrictions implemented to restrict content access. In an enterprise setting, proxies are important controls designed to inspect and restrict web traffic and block access to websites and content that violates company policy.
Cloud-based proxies are increasingly popular as they offer advanced features and global access to mobile workforces. Zscaler (https://www.zscaler.com) and Cisco Umbrella (https://umbrella.cisco.com) are popular cloud-based proxy services.
Reverse Proxy
Reverse proxies are located between the Internet and a web server (opposite direction of traffic flow compared to a proxy). Generally, a reverse proxy distributes client requests to multiple backend servers to perform load balancing. Reverse proxies are highly adaptable and have many specialized adaptations, such as SSL acceleration and traffic inspection.
Apache and Nginx are popular web servers that can function as reverse proxies too. HAProxy is another option often reserved for high-performance, large-scale configurations.
Reverse proxies serve many purposes, a few are listed below:
Caching and Performance Optimization
Load Balancing
Web Application Firewall (WAF)
SSL Acceleration
URL Redirection
API Gateways
Web Application Firewall (WAF)
Aweb application firewallweb application firewall (WAF)is designed to protect web applications from attacks such as SQL injection, cross-site scripting (XSS), cross-site request forgery (XSRF), file inclusion, directory traversal, and a myriad of other common web-application attacks. It works as a reverse proxy but is purpose specific in that its design is focused on inspecting and protecting web traffic.
A WAF can be deployed in three different ways:
Network-based, a separate host, or virtual machine, configured to perform WAF functions. This is the most costly option to acquire and maintain but provides the greatest flexibility and performance.
Host-based, software that runs on the same host as the web application server. It is inexpensive to acquire and maintain but complicates the configuration of the web application and can require considerable computational resources. A very popular and widely implemented host-based WAF is ModSecurity, which is Apache licensed free software and compatible with a wide variety of platforms.
Cloud-based, WAF functionality provided by a service provider and delivered via a cloud platform. Less expensive than a network-based WAF, cloud-based WAF is a unique option in that it offers access to expertly configured WAF protection with minimal installation effort and very low maintenance requirements.
Scanner
scanners are designed to assess systems and networks for potential vulnerabilities. scanners can be deployed from a centralized management system or distributed across many network segments in a large environment. scanners evaluate endpoints for known vulnerabilities, misconfigurations, and other potential security issues. Regular scanning (and remediation) is crucial to maintaining a secure environment. Reports generated by the scanner help security teams prioritize remediation efforts based on the severity and possible impact of vulnerabilities. Scanners are "only as good as their last update" and must be carefully configured to ensure that scans use the most up-to-date information available in the scanning database.
Flowchart illustrating the steps in a management and remediation process, divided into two parallel columns listing key tasks.
Collectors
Collectors are part of a centralized monitoring and logging infrastructure. They aggregate logs and other data from many sources for analysis and support correlation. They are commonly associated with (Security Information and Event Management) systems.
Application Programming Interface (API) Gateway
An application programming interface (API) gateway operates as intermediaries that manage and secure requests between clients and backend services. They can perform routing, rate limiting, authentication, and load balancing functions and help centralize API management. In a typical implementation, an API gateway will authenticate incoming requests by verifying the credentials of users or applications before granting access to backend services. In this way, API gateways are a core component within a architecture. API gateways not only improve security but also streamline access control decisions. In a microservices architecture, the API gateway routes client requests to appropriate microservices, providing a single entry point to multiple backend services. This configuration simplifies client requests because all requests are directed to the API gateway rather than each individual API.
Diagram showing a web application using AWS services for tenant administration, with admin authentication via Cognito and JWT token, API Gateway for API access, Lambda functions, and DynamoDB for storage.
Content Delivery Network (CDN)
A Content delivery network (CDN) is a distributed network of servers designed to efficiently deliver web services to users by caching copies of content closer to end-user geographical locations. A CDN ensures faster load times and improved performance for websites and applications. CDNs also improve reliability and scalability. When a user requests content serviced by a CDN, the request is routed to the nearest edge server in the CDN rather than the origin server. CDNs can also inspect traffic to protect against malicious requests and bot traffic.
CDN is a major component of streaming services like Netflix, where video content must be delivered seamlessly to millions of users worldwide. CDN is also fundamental to large e-commerce websites like Amazon, where quick loading times are crucial to providing a positive user experience. Because CDNs distribute traffic across multiple, geographically dispersed servers, they also play a vital role in DDoS mitigation.
Exam Objectives Covered
There are many ways in which cloud infrastructure can be strengthened and secured. A Cloud Access Security Broker (CASB) is pivotal in enforcing security policies and monitoring cloud service usage, particularly in detecting and managing shadow IT, which refers to unauthorized applications and services used within an organization. The shared responsibility model delineates the security obligations between cloud providers and customers, ensuring clarity in roles and responsibilities. Continuous Integration/Continuous Deployment () pipelines, along with tools like Terraform and Ansible, automate and streamline the deployment of secure and compliant infrastructure. Package monitoring and container security are essential for safeguarding application components, while container orchestration and serverless architectures optimize resource management and scalability. API security is crucial for protecting the interfaces that facilitate communication between services. The distinction between cloud-managed and customer-managed environments influences the strategies for cloud data security and control. Effective cloud control strategies and secure customer-to-cloud connectivity are vital for seamless and secure cloud service adoption. Together, these tools form an architecture that can secure cloud operations at all times.
As you study this lesson, answer the following questions:
How do Ansible and Terraform contribute to automating the deployment and management of infrastructure, and what benefits do they offer?
Why is API security crucial in the context of cloud service integration, and how does it protect against unauthorized access?
What roles do Cloud Access Security Brokers (CASBs) and cloud control strategies play in ensuring data protection during cloud service adoption?
How does the shared responsibility model help clarify the division of security responsibilities between cloud providers and customers?
A Cloud Access Security Broker (CASB) secures cloud-hosted services by providing visibility, data security, threat protection, and compliance enforcement. CASBs identify and control access to shadow IT, prevent data leaks, and block various threats. They bundle several security technologies, such as data loss prevention (DLP) and identity management, to offer comprehensive cloud security. CASBs simplify cloud security management by integrating these capabilities into a single platform, ensuring regulatory compliance and enhancing data protection.
A Cloud Access Security Broker (CASB) is an intermediary between users and cloud service providers, ensuring secure access to cloud resources and enforcing relevant security policies. The primary purpose of a CASB is to provide visibility, compliance, data security, and threat protection when accessing cloud applications and services. By monitoring and controlling data traffic, a CASB helps organizations manage the risks associated with cloud adoption. It ensures that sensitive information is protected and regulatory requirements are effectively addressed. For example, a CASB can detect and block unauthorized access to sensitive data, enforce encryption, perform tokenization, and monitor user activities for suspicious behavior. Moreover, a CASB is instrumental in applying consistent security policies across different cloud platforms. It ensures that only authorized users can access specific cloud services and data.
A Cloud Access Security Broker (CASB) tokenizes data by intercepting traffic between users and cloud services, identifying sensitive information, and replacing it with non-sensitive tokens. These tokens, stored securely in a token vault, represent the original data without exposing its value. When authorized users need sensitive data access, the CASB de-tokenizes the data. This type of functionality is associated with API-based CASBs designed to integrate directly with cloud service APIs. This type of implementation allows them to monitor and control data in real time, provide deep insights into cloud application activities, support detailed auditing, and facilitate the use of granular security policies.
CASBs generally use API-based or proxy-based methods. Ease of deployment and performance characteristics are the greatest benefits of API-based systems, but they often face limitations because cloud service provider APIs only provide limited functionality. Proxy-based CASBs route traffic through a forward or reverse proxy server. Forward proxies are typically deployed on-premises and secure user access to cloud services, while reverse proxies are usually deployed in the cloud and protect access to on-premises applications from cloud users. Proxy-based CASBs provide real-time data protection and enforce security policies data directly. However, they can introduce latency, complicate existing network configurations, and sometimes face scalability issues in very large environments.
Shadow IT refers to the use of information technology (IT) systems, devices, or applications within an organization without the knowledge or approval of the IT department. Examples of Shadow IT include employees using personal devices or cloud services for work-related activities or departments implementing their own IT solutions without centralized oversight.
Shadow IT presents significant risks, particularly in the areas of security, compliance, integration, and support. Unauthorized devices or applications can create vulnerabilities that malicious actors can exploit, potentially compromising sensitive company data or granting unauthorized access to the company's network. To effectively address these risks, organizations must first detect shadow IT resources. Shadow IT detection is a crucial step in identifying and monitoring unauthorized IT systems, devices, or applications within the organization. This can be achieved through various methods, including network monitoring, log analysis, employee surveys, asset management, and continuous monitoring.
Network monitoring approaches typically leverage intrusion detection tools like Snort or Suricata. Network logs can be analyzed using a security incident and event management () platform to help identify unusual patterns or activities. For example, security analysts can use Elastic or Splunk to monitor login attempts, file access, and other log events. Additionally, the reach of the can be extended by integrating it with web activity management tools and asset management platforms to capture unauthorized devices and non-compliant internet use.
Employee surveys are simple but surprisingly effective and can gather information about employee technology use. They include questions about personal devices used for work, cloud services used for storage or collaboration, or software or applications installed on company devices. Implementing a Cloud Access Security Broker (CASB) can also help detect and monitor cloud-based shadow IT.
Organizations can implement tools like User Behavior Analytics (UBA), Endpoint Detection and Response (), and Data Loss Prevention (DLP) to identify unauthorized devices and applications. Integrating detection tools with Identity and Access Management () solutions controls access to IT resources. Automated alerts and reporting mechanisms enable quick responses to shadow IT activities. Fostering collaboration between IT and business units helps understand their needs and provides approved solutions, reducing reliance on unauthorized IT resources. By combining these strategies, organizations can mitigate the risks associated with shadow IT and maintain a controlled environment.
The shared responsibility model is a crucial framework that underpins the security of cloud computing. It fosters a collaborative approach to cybersecurity, distributing responsibilities between cloud service providers and their customers. This model is built on the principle that both parties bear the responsibility of safeguarding data and applications in the cloud.
Cloud service providers are responsible for ensuring the physical security of data centers, network security, and infrastructure resilience. They also manage the cloud infrastructure's security settings, patching, and addressing vulnerabilities.
Customers play a significant role in the shared responsibility model. They are not just passive users of cloud services but active participants in ensuring the security of their data, applications, and operating systems within the cloud. They manage user access, authentication, and authorization for their cloud resources, thereby contributing to the overall security of the cloud environment.
Both parties are responsible for ensuring adherence to regulatory requirements and industry standards and monitoring and responding to security incidents. The model emphasizes that providers and customers have a vested interest in protecting cloud resources, and by dividing responsibilities, they can work together to ensure the security and integrity of cloud-based data and applications.
Diagram illustrating the shared responsibility between cloud providers and customers across On-Premises, IaaS, PaaS, and SaaS models. The chart shows provider and customer responsibilities across various layers like hardware, network, OS, application security, and content.
In essence, the shared responsibility model is a partnership between cloud service providers and customers. Both parties work together to ensure the security and compliance of cloud resources, each contributing their expertise and resources to maintain a secure and trustworthy cloud environment.
Cloud Service Models
The shared responsibility model is represented in the three major cloud service models: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).
In IaaS, the cloud provider is responsible for securing the physical infrastructure, including data centers, servers, storage, and networking, as well as security configuration and patch management for the infrastructure. On the other hand, the customer is responsible for securing operating systems, applications, and data, as well as identity and access management for their resources.
In PaaS, the cloud provider's responsibilities expand to include the platform's security and runtime environment, such as middleware and databases, in addition to the physical infrastructure. The customer is responsible for securing applications and data, as well as identity and access management for their resources. PaaS provides a managed platform for building, deploying, and scaling applications by abstracting the underlying infrastructure and allowing developers to focus on writing code. Some examples include Heroku, Google App Engine, Microsoft Azure App Service, Amazon Elastic Beanstalk, Red Hat OpenShift, Salesforce, and Oracle Cloud Platform.
In SaaS, the cloud provider is responsible for securing the entire stack, including the physical infrastructure, platform, runtime environment, and application. The customer is responsible for securing data and user access and managing their users' identities and access.
Continuous Integration and Continuous Delivery () pipelines have revolutionized software development processes. Pipelines automate code integration and delivery and play a pivotal role in supporting secure coding best practices.
The Pipeline
A pipeline describes a series of automated steps that allow source code to be tested, integrated, and deployed. Everything happens seamlessly and automatically. pipelines operate at the core of DevOps practices. Pipelines consist of four broad stages:
Source Stage describes how code is retrieved from a version control system.
Build Stage is where code is compiled and built into an executable.
Test Stage is where the code undergoes various tests to ensure its correctness.
Deploy Stage describes how code is deployed and made "live."
Integrating Security into Pipelines
Security practices must be integrated throughout the software development lifecycle. Integrating security requirements into the pipeline (DevSecOps) ensures that security requirements are embedded into the development lifecycle.
Infinity-shaped DevSecOps pipeline diagram, showing eight stages from planning to response, divided into pre-production (Plan, Code, Build, Test) and production (Release, Deploy, Monitor, Respond) with security steps at each stage.
Automated Security Testing
pipelines can incorporate automated security tests at multiple stages. Static Application Security Testing (SAST) tools can analyze code for vulnerabilities, while Dynamic Application Security Testing (DAST) tools test functional security flaws. By integrating these tools into the pipeline, developers can more easily identify and remediate vulnerabilities during development.
Dependency Management
Modern software relies (depends) on third-party libraries and frameworks, but outdated or vulnerable third-party dependencies often represent substantial security risks. For example, pipelines can automate vulnerable dependency checks by leveraging OWASP Dependency-Check or Snyk.
Note:
OWASP Dependency-Check is a tool that automatically identifies vulnerable third-party libraries and frameworks in project dependencies. Snyk is a platform that automates the detection and remediation of vulnerabilities in code, open-source dependencies, containers, and infrastructure as code.
Continuous Monitoring
pipelines play a crucial role in supporting continuous monitoring requirements in DevSecOps by integrating real-time security and performance monitoring into all stages of the development and deployment process. Integration in this way ensures that security measures are checked on an ongoing basis (continuously.) By embedding monitoring tools within the pipeline, developers can observe the health and security of applications after deployment. The automated nature of pipelines ensures that monitoring is consistent and covers elements such as application performance, vulnerabilities, and compliance with security policies.
Environment Configuration
Ensuring that deployment environments are properly configured is critical to secure coding practices. Infrastructure as Code (IaC) tools, such as Terraform or Ansible, can be used within pipelines to automate the setup of environments designed to operate securely, reducing the risk of misconfigurations that could result in security incidents.
Terraform is an infrastructure-as-code (IaC) tool developed by HashiCorp that has revolutionized cloud resource management. It enables developers and operations teams to define and provision infrastructure using a high-level configuration language.
Note:
Infrastructure as code (IaC) describes the management and provisioning of infrastructure through machine-readable configuration files instead of physical hardware setup or user-interactive "point-and-click" configuration tools. This approach allows for automation and version control over configurations, making infrastructure management highly efficient and reliable.
Purpose of Terraform
At its core, Terraform is designed to automate infrastructure creation, modification, and versioning. Unlike traditional approaches that depend on manual setup and management, Terraform uses declarative configuration files written in HashiCorp Configuration Language (HCL) or JSON format to define the desired state of the infrastructure. This approach ensures consistency and reproducibility and thereby reduces the risk of human error. Terraform supports multiple cloud providers, including AWS, Azure, and Google Cloud, allowing organizations to manage their infrastructure across different platforms with a single tool.
Benefits of Using Terraform
One of Terraform's primary advantages is its ability to codify infrastructure. This makes it easier to track changes and collaborate on infrastructure, similar to the approaches used for application code. Administrators can use version control systems like Git to manage Terraform configurations, providing a precise history of changes and facilitating collaboration among team members.
Terraform enables administrators to create standardized configurations that can be shared across projects. This modular approach saves time and ensures that best practice configurations are consistently used.
Terraform state files store information about the infrastructure's current state, which allows Terraform to track changes and synchronize settings defined in configuration files with the deployed infrastructure. These files facilitate efficient updates and modifications by allowing Terraform to determine the necessary actions to achieve the desired infrastructure state. Terraform also provides a "plan and apply" workflow. Before making any changes, Terraform generates an execution plan that outlines what actions will be taken to achieve the desired configuration. This functionality allows administrators to review and approve changes before applying them, reducing the likelihood of unanticipated consequences.
Typical Use Cases for Terraform
Terraform is suitable for a wide range of scenarios:
Cloud Resource Provisioning, Terraform simplifies the provisioning of cloud resources, such as virtual machines, storage, and networking components. By using a single configuration file, resources can be easily deployed across multiple cloud providers.
Environment Management, Terraform can streamline the management of multiple environments (such as development, staging, production, etc.).
Continuous Integration/Continuous Deployment (), Integrating Terraform with pipelines automates the deployment process, ensuring that infrastructure changes are tested and deployed in a controlled and repeatable manner.
Terraform Commands
Terraform provides a set of commands for managing infrastructure as code. Understanding these commands and their purposes is important for effectively using Terraform.
The terraform init command is the starting point for any Terraform project. It initializes the working directory by downloading and installing any required provider plugins and preparing the environment for subsequent Terraform commands.
Following initialization, the terraform plan command creates an execution plan. This command helps detail what changes will be made to the infrastructure without actually applying the changes. It shows a detailed preview of Terraform's actions to reach the desired state defined in the configuration files.
Once the plan is reviewed and approved, the terraform apply command applies the changes needed to achieve the desired configuration state. This command executes the actions detailed in the execution plan, such as creating, modifying, or deleting infrastructure resources. It prompts for confirmation before making any changes, providing one final opportunity to review the plan.
The terraform destroy command is used for scenarios where resources defined in the configuration must be removed. This command reads the state and configuration files to determine what resources must be destroyed and removes them. It helps organize environments and ensure that any residual resources are fully removed.
Terraform uses the terraform state command, which provides several subcommands for inspecting and modifying the state file. This includes listing resources, showing specific resource attributes, and potentially removing or moving resources within the state. Managing the state file is crucial for maintaining the integrity and consistency of the infrastructure.
The terraform fmt command formats configuration files. It automatically updates configuration files to follow standard formatting conventions, making them easier to read and maintain. Consistent formatting is crucial in collaborative environments with multiple team members working on the same sets of configuration files.
The terraform workspace command helps manage different infrastructure sets, such as various test environments that utilize the same configuration. This command allows administrators to create, select, and switch between different workspaces, each using its own state file.
Finally, for debugging and troubleshooting, the terraform validate command checks the syntax and consistency of configuration files. It does not interact with remote services but ensures that configurations are syntactically valid and can be properly parsed.
The OpenTofu Alternative
HashiCorp originally released Terraform under the Mozilla Public License (MPL) but underwent significant changes in its licensing model in 2021. That year, HashiCorp transitioned Terraform and other core products to the Business Source License (BSL). The BSL allows free use of Terraform for non-production purposes and small-scale deployments but imposes restrictions on its use in larger production environments and for competitive services.
The change to BSL sparked concern among the open-source community and Terraform users, as it was seen as a move that could limit the openness and collaborative nature that had been a hallmark of Terraform's development and adoption. In response to these concerns, the Terraform open-source community decided to fork Terraform, creating OpenTofu. The fork was intended to preserve the principles of open-source development and ensure that the tool remained freely available for all types of use, including large-scale production deployments. By doing so, the community aimed to maintain a version of the tool that could be governed and developed under an open-source license, fostering continued innovation and broad community participation without the commercial restrictions imposed by the BSL. OpenTofu is managed by the Linux Foundation, supports various cloud providers, and is compatible with existing Terraform configurations.
In 2023, HashiCorp was acquired by IBM. Additional dialog regarding this history is available at https://linuxiac.com/opentofu-is-the-linux-foundations-response-to-hashicorps-moves/.
Ansible is an agentless, open-source automation tool designed to automate IT tasks such as configuration management, application deployment, and intra-service orchestration. Intra-service orchestration refers to coordinating and managing interactions between various components or services within an application or infrastructure. It allows the desired system state to be defined in playbooks, which are YAML files that describe the tasks to be performed and the order in which they should occur. They can also be version-controlled to ensure consistency across deployments.
Note:
More information regarding Ansible is available from https://www.ansible.com.
Ansible uses declarative language, making it accessible to those with limited coding experience. It also supports an extensive module library, which can help automate many different types of tasks. Ansible is common in environments that utilize DevOps practices because it can automate server provisioning, application deployment, configuration management, and updates. Ansible also integrates with other tools and platforms like Jenkins, Kubernetes, and cloud platforms such as AWS, Azure, and Google Cloud.
Note:
Kubernetes is an open-source platform for automating containerized application deployment, scaling, and management.
Ansible and Jenkins are complementary tools. In essence, Ansible automates systems management, and Jenkins manages . Put another way, Ansible deploys the systems needed by the software managed by Jenkins.
A package describes a collection of files and metadata bundled together to simplify adding new functionality to existing software. Packages range in complexity from small libraries offering a single function to extensive frameworks and promote reusability, maintainability, and ease of distribution by enabling easy sharing and integration into other software projects.
Software packages are critical for distributing, installing, and managing software designed for different operating systems. On Linux, packages are managed using tools such as apt for Debian-based distributions and yum or dnf for Red Hat-based systems, but many other package managers provide similar functionality based on the Linux distribution they are associated with. Apple's macOS uses Homebrew to manage packages and depends upon a community-driven repository of formulate, which are scripts that define how to install various software. Although there is no native package manager on Windows, packages can be managed with third-party tools such as Chocolatey, which leverages PowerShell to provide functionality similar to the Linux native package managers.
The Chocolatey project is a Windows package manager that simplifies installing, updating, and managing software packages using the NuGet .NET packaging infrastructure and PowerShell. Chocolatey is maintained and controlled by Chocolatey Software, Inc., under an open-source model. Its core functionality is available under the Apache License 2.0, which allows users to freely use, modify, and distribute the software, subject to certain conditions. Additionally, Chocolatey offers commercial versions with additional features and support for enterprise environments.
Node Package Manager (npm) is a widely used package manager for JavaScript, primarily serving the Node.js ecosystem. It allows developers to easily install, update, and manage project dependencies. npm simplifies the process of sharing and reusing code by providing a centralized repository where developers can publish and access packages. It also includes tools for managing version and dependency conflicts, ensuring that projects maintain consistent and reliable builds.
In addition to npm, several other package managers provide similar functionalities for different programming languages and environments. For instance, Yarn is another popular JavaScript package manager that offers fast, reliable, and secure dependency management. In the Python ecosystem, pip is the standard package manager used to install and manage libraries and dependencies from the Python Package Index (PyPI).pip simplifies adding and updating packages by automatically handling dependencies to ensure that projects have all the required components. Other similar package managers include Maven for Java projects, Composer for PHP, and Bundler for Ruby, to name a few.
Package monitoring aims to identify and mitigate security risks associated with software packages and is critical to maintaining the integrity and safety of software systems. Its goal is to ensure that the software components, including dependencies and libraries, are free from vulnerabilities and malicious code that could lead to a compromise. Package monitoring complements patch management by ensuring that software is up-to-date. It also supports by providing insight into any instances of software identified as actively targeted by threat actor groups. Tools like automated scanners and software composition analysis (SCA) tools play a crucial role. These tools continuously scan for vulnerabilities, monitor for changes and updates, and ensure compliance with relevant security policies. Integrating these tools into pipelines for automated scanning and updating is also possible.
Security Incidents with npm and pip Description
Event-Stream
A malicious actor gained control of the event-stream package by convincing the original maintainer to transfer ownership. The new maintainer introduced a dependency, flatmap-stream, containing malicious code designed to steal Bitcoin wallets.
coa and rc Pacages Compromise
Attackers injected malicious code to steal credentials and environment variables.
Python PyPl Typosquatting Multiple packages with names similar to popular libraries were uploaded to PyPI in 2017. The packages contained malicious code that ran after installation and attempted to collect sensitive information.
Dependency Confusion Attack Security researcher Alex Birsan demonstrated a technique called "dependency confusion," whereby packages with the same names as private internal packages used by organizations are uploaded to public repositories like PyPI. The result was that systems then downloaded and installed the malicious public versions instead of the intended ones.
Resources
The OWASP Software Component Verification Standard (SCVS) is a framework designed to help organizations ensure the security and integrity of software components, especially those sourced from third-party and open-source repositories. It provides a structured approach to assessing, managing, and verifying the components used in software development. The SCVS aims to standardize the process of verifying software components, improving the overall security posture of applications by identifying and mitigating risks associated with third-party components. https://scvs.owasp.org
OWASP Dependency-Track is an open-source platform designed to help organizations identify, track, and manage vulnerabilities in third-party and open-source software components. It provides comprehensive tools for continuous monitoring and risk management of software dependencies, ensuring that applications remain secure and compliant with security standards. https://dependencytrack.org
NIST Software Supply Chain Security Guidance provides a structured approach to managing the security of software components throughout their lifecycle. https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-supply-chain-security-guidance
NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provides comprehensive guidance on managing risks associated with the supply chain for federal information systems. https://csrc.nist.gov/pubs/sp/800/161/r1/final
While offering benefits such as lightweight virtualization and scalability, containers can introduce new and unique security challenges. Common vulnerabilities associated with containers include image vulnerabilities, runtime risks, and misconfigurations.
Container Image and Runtime Risks
A container image is a lightweight, standalone, and executable software package that includes everything needed to run a piece of software, including the code, runtime, libraries, environment variables, and configuration files. It serves as a template for creating a container, ensuring consistency across different environments by encapsulating the application's dependencies and configuration.
Containers are built from images, but when these images contain vulnerabilities, they propagate into the deployed container. The vulnerabilities generally include outdated software and unpatched libraries but may contain malicious code intentionally placed within the image. Another risk associated with containers is attributed to using images from unverified sources that may not provide sufficient levels of software assurance.
Runtime risks are associated with the container's interaction with the host system. Containers run on the same kernel as the host, which means that a compromise of the container can potentially lead to a compromise of the host. This issue is compounded when containers run with elevated privileges or contain greater capabilities than are needed, thereby increasing the . Poor isolation between containers and the host may lead to namespace escape attacks, where a container breaks out of its isolated environment. Misconfigurations are another common source of vulnerabilities, such as poorly configured container orchestrators. For example, if a container orchestration tool like Kubernetes is not properly secured, it can be exploited to gain control over the entire cluster.
Container Security Considerations
Several practical approaches can be implemented to provide assurance of container security. Foundational to these approaches is the use of trusted and verified images, which translates to sourcing images from reputable registries and continuously scanning them for vulnerabilities. Regularly updating images and applying patches is also fundamental to mitigating known vulnerabilities, although patching and updating containers has a different workflow than patching traditional systems. Updating a container starts by identifying the need for an update, possibly due to a new software version, security patches, or dependency updates. Once an update has been identified, the configuration file used to build the container image must be modified to change the base image to a newer version, update the application code, or adjust dependencies to their newer versions.
The next step involves rebuilding the container image and ensuring that the image is free from vulnerabilities. After testing and validation, the new container image can pushed to a container registry where the updated image is stored and versioned. Deploying the updated container requires pulling the new image from the registry and replacing old containers with new ones. This process can be managed manually but benefits greatly from automation using continuous deployment pipeline mechanisms, although securing the orchestrator is especially important. Orchestrator protections generally include role-based access controls (RBAC) to limit access to privileged operations, enabling audit logging to track changes and access attempts, and regularly patching the orchestration platform to mitigate vulnerabilities.
Another important security practice is implementing runtime security measures. This practice leverages tools like AppArmor or SELinux to enforce mandatory access control policies, limit the capabilities granted to containers, and ensure that containers do not run with elevated privileges unless absolutely necessary. Network security also plays a vital role in securing containers. Implementing network segmentation and enforcing strict network policies can prevent lateral movement within a containerized environment.
Container orchestration, such as that provided by Kubernetes and Docker Swarm, offers automated management, deployment, scaling, and networking of containers. One of the key benefits of container orchestration is enhanced security. It ensures that applications run in isolated environments, reducing their by minimizing interactions between different applications and services. Orchestrators also play a crucial role in enforcing security policies across all containers, ensuring compliance with organizational and regulatory mandates. Additionally, they facilitate secrets management, allowing sensitive information like passwords and API keys to be securely stored and accessed by containers without being hard-coded into applications.
Systems like Kubernetes and Docker Swarm provide robust capabilities designed for automating the deployment, scaling, and operation of containerized applications, a crucial function for Agile and DevOps-driven environments.
Kubernetes
Kubernetes, originally developed by Google and now maintained by the Cloud Native Computing Foundation (CNCF), is a widely adopted open-source container orchestration platform. It boasts extensive capabilities for managing containerized applications across clusters of machines. Kubernetes automates deployment, scaling, and maintenance tasks, ensuring that applications are always running as intended. It provides self-healing capabilities that support automatic restarts, rescheduling, and replication of containers in case of failures, thereby improving the reliability and availability of the applications they support. Kubernetes is highly flexible and extensible, supporting a wide range of workloads, and it can be deployed on-premises, in the cloud, or in hybrid environments. Information regarding the Kubernetes Project is available at https://www.cncf.io/projects/kubernetes/.
Docker Swarm
Docker's core open-source technologies, such as the Docker Engine, are governed by the Open Container Initiative (OCI). The OCI is a collaborative project under the Linux Foundation that establishes industry standards for container formats and runtimes. Docker, Inc. is the company behind Docker and is the primary entity responsible for developing and maintaining Docker technologies. Docker Swarm is Docker's native clustering and orchestration tool. It is designed to be simple to use and integrates seamlessly with the Docker ecosystem. Docker Swarm enables developers to manage a cluster of Docker engines as a single virtual system. Docker is generally a more appealing option for deployments where the complexity of Kubernetes might not be justified. Swarm provides features such as multi-host networking, service discovery, and load balancing to help simplify the management of containerized applications, and its integration with Docker CLI and Docker Compose enables simplified adoption to those already familiar with Docker. Information regarding Docker Swarm is available at the Docker documentation site https://docs.docker.com/engine/swarm/
These systems are increasingly important because they support modern application development practices, particularly those involving microservices and continuous integration/continuous deployment () pipelines. By abstracting the complexities of container management, Kubernetes and Docker Swarm allow developers to deploy code and new features with less regard for the underlying infrastructure on which they depend, resulting in faster development cycles, increased productivity, and more reliable and scalable applications.
Serverless is a modern design pattern for service delivery. It is strongly associated with modern web applications, most notably Netflix (aws.amazon.com/solutions/case-studies/netflix-and-aws-lambda), but providers are appearing with products to completely replace the concept of the corporate LAN. With serverless, all the architecture is hosted within a cloud, but unlike "traditional" virtual private cloud (VPC) offerings, services such as authentication, web applications, and communications aren't developed and managed as applications running on VM instances located within the cloud. Instead, the applications are developed as functions and microservices, each interacting with other functions to facilitate client requests. When the client requires some operation to be processed, the cloud spins up a container to run the code, performs the processing, and then destroys the container. Billing is based on execution time, rather than hourly charges. This type of service provision is also called function as a service (FaaS). FaaS products include AWS Lambda (aws.amazon.com/lambda), Google Cloud Functions (cloud.google.com/functions), and Microsoft Azure Functions (azure.microsoft.com/services/functions).
The serverless paradigm eliminates the need to manage physical or virtual server instances, so there is no management effort for software and patches, administration privileges, or file system security monitoring. There is no requirement to provision multiple servers for redundancy or load balancing. As all of the processing is taking place within the cloud, there is little emphasis on the provision of a corporate network. This underlying architecture is managed by the service provider. The principal network security job is to ensure that the clients accessing the services have not been compromised in a way that allows a malicious actor to impersonate a legitimate user. This is a particularly important consideration for the developer accounts and devices used to update the application code underpinning the services. These workstations must be fully locked down, running no other applications or web code than those necessary for development.
Serverless does have considerable risks. As a new paradigm, use cases and best practices are not mature, especially regarding security. There is also a critical and unavoidable dependency on the service provider, with limited options for disaster recovery should that service provision fail.
Serverless architecture depends heavily on the concept of event-driven orchestration to facilitate operations. For example, when a client connects to an application, multiple services will be called to authenticate the user and device, identify the device location and address properties, create a session, load authorizations for the action, use application logic to process the action, read or commit information from a database, and write a log of the transaction. This design logic is different from applications written to run in a "monolithic" server-based environment. This means that adapting existing corporate software will require substantial development effort.
Workloads
Workloads in a serverless environment are typically event-driven, triggered by events like HTTP requests, database updates, file uploads, and scheduled timers. The cloud service provider manages the execution environment and can automatically scale resources based on varying workload demands. This on-demand execution model is not just efficient in terms of resource utilization but also cost-effective, as fees are based on the code's actual compute time, not on idle server capacity. Serverless computing is ideal for short-lived tasks but can become expensive for long-running processes or applications with constant resource usage.
Functions
Functions in serverless computing, often referred to as 'functions-as-a-service' (FaaS), are the core units of execution. Each function, a small, stateless piece of code, is designed to perform a single task. The appeal of these functions lies in their flexibility. Functions can be written in any programming language supported by the cloud provider, such as JavaScript, Python, Java, or Go. When an event triggers a function, the cloud provider manages its execution, scaling, and availability needs. These functions are ephemeral, starting up quickly, running code, and then shutting down.
Resources
Resources in serverless architectures are managed dynamically by the cloud service provider, including CPU, memory, storage, and network resources. The serverless model leverages different cloud services to provide a complete application environment. For example, a serverless application might use API Gateway to handle HTTP requests, a database service like DynamoDB for data storage, and S3 buckets for file storage. The cloud provider ensures these resources are available, scalable, and integrated seamlessly with the serverless functions.
The primary purpose of an API is to enable different software to communicate seamlessly. By utilizing an API, software of one type can leverage the services and functionality provided by software of another type. The API allows software developed on different platforms and coding languages to cooperate, promoting code reuse and reducing development time. APIs also enable developers to build complex and feature-rich applications by integrating capabilities from various sources, such as third-party services, libraries, and other software systems. Some examples include:
By making a request to a weather service API, an application can obtain data like temperature, humidity, and weather forecasts, which it can then display to the user.
Using the VirusTotal API to query and retrieve information about suspicious files or URLs. By integrating this API with an , security analysts can enrich security alerts with detailed , supporting quicker and more informed responses.
Using the Nessus API to schedule scans, retrieve scan results, and automatically create tickets in an issue-tracking system (for detected vulnerabilities.)
Social media APIs allow developers to integrate social media functionalities into their applications, such as posting updates, retrieving user profiles, accessing social media feeds, and potentially many other types of information.
E-commerce platforms use payment gateway APIs (such as PayPal, Stripe, and others) to process credit card transactions. The payment gateway API handles the payment process, including verifying payment details and processing the transaction.
Operating System APIs allow applications to interact with operating system services, such as file management, memory allocation, and device handling.
Securing APIs
One fundamental aspect of API security is authentication and authorization. Ensuring that only authenticated and authorized users can access the API is crucial, typically achieved through methods such as , API keys, and JWT tokens. (Open Authorization) is an open standard widely used by services like Google, Facebook, and GitHub for access delegation. can grant websites and applications access to user information without exposing passwords. API keys are simple secrets included in API requests to identify the calling application or user. Lastly, JSON Web Tokens (JWT) are encoded tokens often used for user authentication and session management in APIs.
Encryption ensures that data transmitted between clients and servers remains confidential and secure. Using HTTPS to protect API data transmission is a standard practice to prevent eavesdropping and tampering.
Rate limiting and throttling are vital for protecting APIs from abuse and ensuring stability. By controlling the number of requests a client can make in a given time period, they help prevent denial-of-service attacks and ensure fair usage. Rate-limiting refers to restricting the requests a client can make to an API within a specific time frame. Rate is generally measured in requests per second, minute, or hour. The primary goal of rate-limiting is to protect the API from excessive use that could degrade performance or lead to denial-of-service (DoS).
Throttling, on the other hand, is a broader concept that encompasses rate-limiting, but it also describes mechanisms that control the rate at which clients can send requests. Throttling not only sets limits but also regulates the speed of request processing to mitigate malicious data exfiltration and prevent server overload. Throttling is often used to manage different types of clients differently, such as free-tier users versus premium users. For example, a free-tier user might be limited to 100 requests per minute, while a premium user might be allowed 1000 requests per minute. Throttling can also dynamically adjust limits based on current server load or time of day, providing more flexibility in managing API traffic.
Note:
49 Million Customer Records Stolen via Dell API abuse: https://www.bleepingcomputer.com/news/security/dell-api-abused-to-steal-49-million-customer-records-in-data-breach/
Strong input validation protects against injection attacks like SQL injection and cross-site scripting (XSS). Validating and sanitizing inputs ensures that only expected data formats are processed. Injection attacks are a significant threat to APIs because attackers insert malicious code into API input fields to manipulate backend systems, execute unauthorized commands, or access sensitive data. A primary defense against injection attacks is input validation and sanitization. These mitigations ensure that inputs to the API are validated against expected formats and other constraints before being processed. Sanitization describes how APIs can handle input data to remove potentially harmful content, such as the special characters used to perform SQL commands. In parallel, encoding converts input data before processing it to ensure that special characters are treated as data rather than executable code.
Additional API Protections
Implementing an API gateway and a Web Application Firewall (WAF) adds additional security protections. API gateways act as intermediaries between clients and backend services, supporting request validation methods, rate limiting, and more advanced capabilities like threat detection. WAFs can be configured to detect and block common injection patterns by analyzing incoming requests and responses. Some advanced WAFs can leverage machine learning algorithms to adapt and recognize new attack patterns to protect against emerging threats.
Logging and monitoring are crucial for detecting and responding to potential security incidents. These practices provide visibility into API usage, help detect anomalies, and facilitate troubleshooting. Comprehensive logging essentials involve capturing detailed information about request data, response data, authentication and authorization, and system events. Realtime logging focuses on continuously tracking the health and performance of the API and depends upon metrics such as performance, responsiveness, uptime, repeated authentication failures, unusual traffic patterns, and potentially user behavior analytics for deeper insight regarding "abnormal usage patterns." It is common for this log data to be provided to log aggregation and analysis platforms such as Elastic to help parse through all the data and transform it into useful visualizations.
Data Scraping Using APIs
Data scraping using APIs is a method of collecting data when a website or service provides an API to facilitate access to its data. This approach is more efficient and reliable than traditional web scraping because APIs are specifically designed for data access and often include mechanisms to ensure data integrity, security, and compliance. These two are well-known examples of API data scraping abuses, but there are many, many others!
Cambridge Analytica & the Facebook API: https://apiacademy.co/2018/06/how-the-facebook-api-led-to-the-cambridge-analytica-fiasco/
Hyp3r Data Scraping Instagram: https://www.zdnet.com/article/instagram-boots-ad-partner-hyp3r-for-mass-collection-of-user-data/
Cloud-managed encryption keys are managed by a cloud service provider (CSP). To protect these keys, CSPs generally employ robust security measures, including hardware security modules (HSMs) and stringent access controls. The CSP also handles key rotation, storage, and management, reducing the customer's operational burden and associated risks. Cloud-managed services can be a particularly advantageous value proposition because they ensure best practices in key management without requiring in-depth knowledge.
Note:
A Hardware Security Module () is a specialized physical device designed to securely manage, generate, and store cryptographic keys. It provides a tamper-resistant environment designed specifically to protect keys from unauthorized access and physical tampering. HSMs perform cryptographic operations such as encryption, decryption, and digital signing, all within the secure confines of hardware.
Examples of Cloud-Managed Solutions:
Amazon Web Services (AWS) Key Management Service (KMS)
Google Cloud Key Management Service
Azure Key Vault
IBM Cloud Hyper Protect Crypto Services
Oracle Cloud Infrastructure Key Management
The primary security concern with Cloud-managed encryption keys is the potential loss of control. Considering that the CSP has access to the keys, there is an obvious reliance on their security practices and policies. This type of reliance can be problematic for high-value target organizations. Additionally, regulatory compliance and data sovereignty rules dictate that encryption keys must be stored in the same geographic region as the data they protect. Some regulations mandate that organizations maintain rigorous control over key access, which puts additional emphasis on selecting the appropriate level of service from the CSP to ensure compliance with these rules.
In contrast, customer-managed encryption keys provide greater control, which can improve security and compliance under the proper circumstances. With customer-managed encryption keys, customers generate, store, and manage their encryption keys, typically using their own HSMs or key management solutions. This level of autonomy ensures that no third party has access to the keys, and offers greater flexibility in implementing security policies and procedures tailored to the organization's needs. However, customers must ensure proper key generation, rotation, backup, and disposal, which requires specialized knowledge and skills. Failure to manage keys correctly can be a source of several critical vulnerabilities.
Additionally, maintaining compliance with industry standards and regulations necessitates frequent audits and assessments, which are time and resource-intensive.
Licensing
Cloud and customer-managed licenses represent two approaches to software ownership and management, each catering to different needs and operational strategies. Cloud-managed licenses are generally associated with Software as a Service (SaaS) models, where a cloud service provider hosts, maintains and updates software. Customers access the software via a subscription model that includes updates, security patches, and performance/scalability handled by the provider. This approach reduces the operational burden on customers by removing the need to manage infrastructure or perform software maintenance tasks. In contrast, customer-managed licenses are associated with a customer purchasing software and then installing it on their systems. This model provides more control over the software environment, including customization, security, and update schedules. However, it also places the responsibility of maintenance, upgrades, and support on the customer. The choice between cloud and customer-managed licenses often depends on factors such as budget, IT capabilities, compliance requirements, and the desired level of control over the software.
Securing data in cloud environments introduces new risks and challenges, such as misconfiguration of cloud services, improper access controls, weak passwords, or publicly accessible storage buckets. The vast accessibility of cloud services via the Internet increases the risk of exposure. Put another way, mistakes in Public Cloud configurations equate to exposing data to the Internet, which is usually catastrophically bad. In fact, it is not uncommon to hear examples of data storage misconfigurations that lead to breaches within 3 minutes.
Additional reading related to data exposure in cloud environments:
Top 5 Security Misconfigurations Causing Data Breaches https://www.upguard.com/blog/security-misconfigurations-causing-data-breaches
TotalCloud Insights: Hidden Risks of Amazon S3 Misconfigurations https://blog.qualys.com/vulnerabilities-threat-research/2023/12/18/hidden-risks-of-amazon-s3-misconfigurations
VA investigates breach after federal contractor publishes source code https://fedscoop.com/va-investigates-breach-after-federal-contractor-publishes-source-code/
Microsoft AI researchers mistakenly leaked 38TB of company data https://www.engadget.com/microsoft-ai-researchers-mistakenly-leaked-38tb-of-company-data-094659079.html
Data exposure refers to the risk of sensitive information being accessed by unauthorized parties, either through unauthorized access to storage resources or data breaches, which can occur due to misconfigurations in cloud services, such as improper access controls, weak passwords, or publicly accessible storage buckets.
Data remanence is the residual data that remains on storage media even after it has been deleted or erased. Sensitive information that is not properly sanitized from storage resources before they are repurposed or disposed of can pose a significant risk. In a public cloud setting, risks can be particularly problematic because data is generally stored on shared infrastructure, and remnants may still be recoverable unless proper sanitization techniques are used. Cloud service providers typically offer mechanisms to delete data securely, but organizations must ensure these methods are adequate for their needs. Using encryption can also help, as encrypted data remnants are less likely to be usable if accessed.
Unsecured storage resources, such as unencrypted storage buckets or misconfigured access controls, can provide an easy entry point for access to sensitive information. Risks apply to both public cloud storage services and on-premises storage solutions connected to public cloud environments. Organizations must regularly audit storage configurations to identify and rectify misconfigurations or opportunities to improve access controls.
Data leakage in the cloud refers to the unauthorized release of sensitive information from cloud-based storage or the applications that can access it, which can be caused by malicious insiders, attackers, or accidental sharing.
An overarching approach to securing data in the cloud is to use encryption to make it unreadable to unauthorized parties. Encryption must be applied to data in transit and at rest. Organizations should also use key management services like Amazon Key Management Service (KMS) or Google Cloud Key Management Service (KMS) to support best-practice key management implementations. Equally important are strict access controls using identity and access management () policies to restrict access to cloud resources and data and multi-factor authentication () for user accounts.
Data loss prevention (DLP) techniques can detect and prevent sensitive organizational data from being exfiltrated or mishandled. DLP tools can identify sensitive data, such as personally identifiable information (PII) and intellectual property, and alert security teams to potential usage violations.
Employing robust backup and disaster recovery strategies is crucial for ensuring data availability and resilience. Cloud service providers offer several services designed to protect data, such as versioning, replication, and backup, but it is the customer's responsibility to ensure these services are properly implemented. It is also important to implement protections designed to defend against catastrophic loss of cloud resources, which is best highlighted by an incident that impacted the Australian organization UniSuper https://arstechnica.com/gadgets/2024/05/google-cloud-accidentally-nukes-customer-account-causes-two-weeks-of-downtime/. Regularly backing up data and having a well-defined disaster recovery plan protects against the impact of data breaches, system failures, and other catastrophic events.
Securing data in cloud environments involves a combination of strategies and practices designed to protect sensitive information from unauthorized access, breaches, and other security threats. The fundamental goal is to ensure data confidentiality, integrity, and availability while leveraging the benefits of cloud computing.
Cloud control strategies involve a comprehensive approach to managing and securing cloud environments, encompassing proactive, detective, and preventative measures.
Proactive cloud control strategies include regular assessments, patch management, and implementing cloud services in alignment with security best practices. Organizations should conduct risk assessments and implement architectures that leverage established controls such as multi-factor authentication, encryption, and network segmentation. Proactive measures also include employee training and awareness programs that focus on cloud-specific threats and ensure that both technical and non-technical employees understand the organization's policies and procedures associated with cloud resources.
Detective cloud control strategies include deploying cloud-centric monitoring and logging tools that provide real-time views regarding cloud activities. Security Information and Event Management () systems play a crucial role but may need to be customized or extended to provide adequate insight into public cloud platforms. Regular audits and continuous monitoring of network traffic, user activities, and performance can help detect potential incidents.
Preventative cloud control strategies include firewalls, intrusion prevention systems (IPS), and access controls. In a public cloud environment, firewalls are typically virtualized and integrated into the cloud provider's infrastructure. Cloud-native firewalls are more flexible and scalable than traditional hardware firewalls and are designed to protect virtual networks and instances. Intrusion prevention systems in the public cloud are often part of a broader security service offered by the provider. Preventative measures usually require the implementation of policy-based protections for data access and usage.
Diagram of a cloud network firewall architecture, showing traffic coming through gateways into a network firewall that inspects and filters traffic before entering a virtual private cloud with subnets, involving policy creation, blocking, monitoring, and log publication.
Various options are available for customers to connect to cloud services to ensure reliable access to cloud-hosted applications, data, and resources. The most common type of connectivity is the most simple: access directly via the Internet using a web browser. While convenient and widely available, this method can be susceptible to performance problems (like slower performance during peak Internet usage times) and security threats generally attributed to common Internet access. Many organizations opt for more reliable and secure connections to address these issues. Dedicated connections, such as AWS Direct Connect, Azure ExpressRoute, and Google Cloud Interconnect, provide private, high-bandwidth links between a customer's on-premises infrastructure and the cloud provider's data centers. Connections like these improve performance by reducing latency and increase security by isolating traffic from the public Internet.
A diagram showing two ExpressRoute connections from a customer's network through a partner edge to Microsoft edge. Red arrows indicate Microsoft Peering for Office 365, Dynamics 365, and Azure public services, while blue arrows indicate Azure Private Peering for Virtual Networks.
For smaller organizations, a more cost-effective solution is to use VPNs (Virtual Private Networks). VPNs create a secure, encrypted tunnel using standard Internet connectivity between the customer's network and the cloud provider. While not as high-performing as dedicated connections, this approach represents a practical and affordable option for organizations that may not be able to justify the costs associated with dedicated connections.
Cloud service integration, a powerful strategy, involves the combination of services offered by multiple cloud service providers or integrating cloud services with on-premises systems. This approach, when executed effectively, can help a company leverage the strengths of different platforms, such as integrating Amazon Web Services (AWS) with Microsoft Azure. Another example is integrating productivity suites like Google Workspace with on-premises Active Directory. By combining multiple cloud services or integrating cloud services with on-premises systems, an organization can efficiently access many different and unique service offerings.
However, it's crucial to be aware that cloud service integration, while beneficial, also introduces significant risks that must be carefully managed.
Integrating multiple cloud services may increase the organization's , making securing data and maintaining compliance more difficult.
Integrating different cloud services may lead to data inconsistencies and integrity issues, especially when data is stored in multiple locations.
Different cloud services may have incompatible APIs, data formats, or authentication protocols, making integration challenging.
Planning cloud service integration is essential to mitigate these risks and should focus on robust security controls, data management strategies, and interoperability testing.
Cloud service adoption refers to transitioning from traditional on-premises information technology (IT) infrastructure and applications to cloud-based services and platforms. This transition involves moving data, applications, and other business elements to cloud environments provided by third-party vendors like Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) to support operations, gain access to advanced cloud-centric capabilities, and improve efficiency. A significant driving factor behind cloud service adoption is the ability to access a wide range of services, including storage, computing power, databases, artificial intelligence (AI) voice assistants, large language models (LLM) and machine learning tools, without the need to manage physical infrastructure. Leveraging public cloud platforms allows companies to focus more on their core business activities and innovation rather than IT maintenance, at least on the surface. The reality is often that the same burdens attributed to on-premises still exist, just in a different context.
Cloud service adoption encompasses a myriad of factors. Some examples include:
Migrating servers and data to cloud infrastructure
Implementing cloud-based software applications and platforms
Integrating cloud services with existing on-premises systems
Developing and incorporating cloud-native applications and services
Cloud service adoption is a significant decision that requires careful consideration. It's crucial to address security, data privacy, compliance, governance, and the development of staff skillsets and processes to manage and optimize cloud resources effectively. This comprehensive approach can help mitigate potential risks and ensure a smooth transition.
Note:
Top 3 Cloud Migration Security Risks https://cloudsecurityalliance.org/blog/2023/09/26/top-3-cloud-migration-security-risk
Cloud migration plans can fail for various reasons, including inadequate assessment and planning, unrealistic expectations, and insufficient resources. One common issue is underestimating the complexity of the migration process, leading to poor execution and unforeseen challenges. Failure to accurately assess application compatibility and dependencies can result in unexpected downtime and data loss. Insufficient training and skills of IT staff can significantly hinder a successful migration and lead to devastating breaches attributed to misconfiguration. Failure to address security and compliance mandates can lead to significant legal trouble. Additionally, failing to understand the business case and return on investment (ROI) clearly can lead to a failed or ineffective migration project, resulting in wasted time, money, lost productivity, and frustration. Even worse, poorly planned cloud adoption strategies can result in catastrophic data breaches. Consider the following reading:
Common cloud migration challenges and how to manage them https://www.ibm.com/blog/cloud-migration-challenges/
10 Cloud Migration Challenges to Understand https://www.digitalocean.com/resources/article/cloud-migration-challenges
How Cloud Vendors Confront Cloud Migration Challenges <https://cloudsecurityalliance.org/blog/2021/11/29/how-cloud-vendors-confront-cloud-migration-challenges>
Exam Objectives Covered
Continuous authorization ensures that access permissions are dynamically evaluated and updated based on real-time context, enhancing security by adapting to changing conditions. Context-based re-authentication further strengthens this approach by requiring users to re-validate their identities when certain risk factors are detected. Network architecture plays a foundational role in structuring these security measures, providing the framework within which API integration and validation occur to ensure secure and reliable communication between systems. Effective asset identification, management, and attestation are critical for maintaining an accurate inventory of organizational resources and verifying their security status. Security boundaries define the limits within which these assets and communications are protected, while deperimeterization reflects the evolving nature of security in an endless environment, necessitating more granular controls. Defining subject-object relationships is essential for establishing clear access controls and ensuring that only authorized entities can interact with sensitive resources. These concepts together create a dynamic security posture for an ever-complex threat landscape.
As you study this lesson, answer the following questions:
Why are API integration and validation essential for ensuring secure and effective communication between different systems and applications?
How do asset identification, management, and attestation contribute to maintaining a secure IT environment?
What is the purpose of context-based reauthentication, and how does it enhance security by reducing the risk of unauthorized access?
How does deperimeterization reflect the shift in network security boundaries, and why is it important for protecting data and systems in an interconnected digital landscape?
Continuous authorization in Zero-Trust Architectures () enhances security by constantly verifying the identities and access rights of users and devices. Unlike traditional models that rely on one-time verification during initial access, continuous authorization maintains an ongoing assessment, meaning that even if a user or device has been granted access, their actions are continuously scrutinized to ensure they adhere to security policies and do not exhibit anomalous behavior. By continuously monitoring and reevaluating credentials, behaviors, and contexts in this manner, detecting and responding to suspicious activities can be accomplished in real time.
Note:
In relation to , context refers to the situational factors surrounding a user's access request, such as their location, device health (such as operating system update status, antimalware definitions, and configuration settings), time of access, and behavior patterns.
In a Zero-Trust Architecture context, continuous authorization supports the core philosophy of "never trust, always verify" because it enables an adaptive security posture. Permissions can be adjusted or revoked instantaneously in response to emerging threats and identified risks. Continuous authorization is generally implemented through a combination of identity and access management () systems, multi-factor authentication (), and machine learning algorithms that focus on user behavior. systems manage user identities and enforce access policies.
Imagine a scenario where a medical research institution must ensure that only authorized researchers can access highly confidential research data and that access is revoked immediately when a researcher's role or involvement in a project changes. In this example, continuous authorization would provide higher levels of assurance than traditional ones. While initial access is accomplished similarly to traditional methods, namely that researchers are granted access to research data based on their role or project involvement, continuous monitoring expands on this functionality by continuously monitoring researcher roles and project assignments, accessing patterns and behavior, and performing real-time reauthorization when changes or anomalies are detected. The continuous authorization system reevaluates the researcher's authorization in real time and revokes access immediately when detected changes warrant such action.
Machine learning (ML) is crucial in analyzing patterns and behaviors to detect anomalies. For example, if a user suddenly accesses sensitive data from an unusual location or at an odd time, the ML system can flag this activity for further investigation or automatically adjust access privileges. This type of continuous analysis, powered by machine learning, helps to identify potential threats that traditional static authorization methods would miss. Continuous authorization ensures that security controls can adapt in real time and support a proactive approach to threat detection and mitigation, making it a critical component of modern Architectures.
Example Products and Platforms
Google Cloud https://cloud.google.com/access-context-manager/docs/overview
Cisco DUO Continuous Identity Security https://duo.com/solutions/continuous-identity-security
Microsoft Entra Conditional Access https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-conditional-access
Okta Adaptive <https://www.okta.com/learn/adaptive-mfa/>
While integral to Architecture (), context-based reauthentication and continuous authorization have distinct focuses. Context-based reauthentication, for instance, is designed to re-verify user identity and device context at specific points during an active session or when specific risk factors are detected. This could involve re-checking credentials, device posture, or other contextual factors when pre-defined issues are detected or when a session attempts to access particularly sensitive resources. The aim is to ensure that every access request is legitimate by adjusting authentication requirements dynamically and based on the context of the request.
For example, if a user who typically accesses resources from an office network attempts to access them from an unfamiliar location or device, context-based reauthentication might trigger an additional verification step. It acts as a safeguard that prompts re-verification under specific circumstances, ensuring that any change in context triggers additional security checks.
Continuous authorization, on the other hand, plays a more proactive role in maintaining security. It does this by constantly monitoring and evaluating trust levels in real time, throughout the entire session. Rather than only re-authenticating after specific triggers, continuous authorization dynamically adjusts permissions and access rights based on ongoing analysis of behavior, context, and risk. This ongoing evaluation of trust, and the subsequent adjustment of access controls, is a key feature of continuous authorization.
In summary, context-based reauthentication focuses on re-validating identity and context at specific points based on detected risks or changes in context. Continuous authorization, however, maintains an ongoing evaluation of trust, adjusting access controls in real time based on continuous monitoring of user behavior, device status, and other contextual factors. Both approaches are crucial for maintaining robust security within a framework, but continuous authorization offers a more granular and proactive method of managing access control.
Implementing context-based reauthentication requires the integration of several advanced technologies, such as:
Multi-Factor Authentication ()
Behavioral Analytics
Device Posture Checks
Risk-Based Authentication
Several vendors offer products that support context-based reauthentication within a framework. For example, Microsoft Entra ID Conditional Access (https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-conditional-access) leverages user and device cues to enforce policies dynamically. Okta's Adaptive Multi-Factor Authentication uses contextual data such as location and device information to adapt access protections in real time (<https://www.okta.com/learn/adaptive-mfa/>).
Network Segmentation
Network segmentation is the technique of splitting a network and its nodes into several portions. A prominent segmentation technique is subnetting, which is the logical division of a network into multiple subnetworks.
All major standards and regulations, such as NIST standards, Federal Information Security Management Act (FISMA), and Payment Card Industry Data Security Standard (PCI DSS) recommend or require network segmentation. The basic principle behind network segmentation is to protect sensitive data and information by ensuring that an individual network segment's failure does not impact the larger enterprise network.
A common way to perform network segmentation is via Virtual LANs (VLANs) which logically segment endpoints in one network from endpoints in another. VLANs are defined via software running on switches and allow a single device to separate network traffic in the same manner as if multiple physical switches were used to perform the same task.
For example, databases containing sensitive enterprise transactions can be grouped in a VLAN separate from public-facing web servers grouped in a different VLAN. If an attacker launches a DoS against the web servers, it will be easier to restrict the attack and protect the availability of the databases in the other VLAN.
describes the capability of isolating workloads from one another and protecting them individually. This differs from a traditional network segmentation approach as it provides much higher levels of security granularity and flexibility. Traditional network segmentation is focused on protecting client-to-server interactions, sometimes referred to as "north-south" traffic, but in modern, cloud-centric environments, these types of traffic flows are not as common. Modern infrastructures support broad application integrations, and a large proportion of traffic flows between systems and applications in what is commonly referred to as "east-west" traffic. In a approach, policies are established and implemented through software-defined networks (SDN) to limit traffic between workloads.
https://www.paloaltonetworks.com/cyberpedia/what-is-microsegmentation
Virtual Private Network (VPN)
When integrating cloud and on-premises networks, virtual private networks (VPNs) provide secure, encrypted connections over the internet, ensuring that data transmitted between different network segments remains confidential and protected from interception. VPNs are a crucial bridge because they enable seamless, secure connectivity between a company's internal network and its cloud resources to ensure that data and applications hosted in the cloud can be accessed and utilized just as if they were part of the local network, facilitating hybrid cloud deployments and extending on-premises capabilities to the cloud. Software-defined Networks (SDNs) can enhance this integration by providing centralized control and automation capabilities. Administrators can use SDN controllers to define network policies, manage traffic flows, and ensure optimal performance across on-premises and cloud networks.
Always-On VPN
An always-on VPN is designed to ensure that a device maintains a constant, secure connection to a VPN. It improves security by controlling unprotected network traffic, which is particularly vital for mobile devices and remote work scenarios where the security of the network used by the device can be inconsistent.
In an enterprise setting, an always-on VPN helps enforce security policies by ensuring that all data transmitted from an endpoint device is encrypted and routed through the VPN. For organizations with a mobile workforce, an always-on VPN ensures that sensitive information is consistently protected, even when employees connect from public Wi-Fi or other unsecured networks.
In a architecture, API integration ensures that each API request is authenticated and authorized before it is allowed to make a request or submit data. Identity verification mechanisms such as , , or similar methods must be established so that requests sent to the API can include a token that is used to validate the requester's identity and associated permissions.
For example, a financial services organization may provide APIs for transaction processing. When a client attempts to interact with the API, it must first acquire a token from an identity provider. The identity token includes information about the client's identity and permission levels. API gateways are typically implemented to provide this level of functionality because they can help simplify the implementation of these types of granular controls and wide extensibility. The API gateway acts as a specialized intermediary that facilitates secure communication between clients and backend systems. The identity token includes information about the client's identity and permission levels. The API gateway, acting as a gatekeeper, validates the token for authenticity and checks if the client has the necessary permissions to perform the requested operation, it then routes the request to the appropriate backend service. Only after successful validation does the API gateway forward the request to the underlying service, which acts to "hide" the backend services from all unauthorized clients.
In a model, the API gateway must rigorously inspect API requests to prevent abuse and attacks, and can be accomplished by leveraging schemas and contracts. Schemas and contracts are crucial in defining the expected structure and content of API requests and responses. Schemas, such as JSON Schema, validate that incoming data conforms to a predefined format, assuring that only correctly structured data is processed. Contracts are defined in API specifications and establish the rules for API interactions, such as authentication requirements, allowed data types, and error-handling expectations. Implementing controls in this way helps to catch malformed or malicious requests before they touch critical backend services.
Implementing an API in alignment with principles necessitates a proactive approach to security. This includes continuous monitoring and logging of all API interactions. Every API call, with details such as the requester's identity, the nature of the request, and the response provided, must be logged. This granular level of detail is crucial and can be fed into platforms to support early detection and response to incidents and attacks. This proactive security measure is a key aspect of architecture.
Here are some popular payment gateway providers with links to their API documentation that describe how developers can implement these types of features at a detailed technical level.
Stripe supports various payment methods, including credit and debit cards, ACH transfers, and digital wallets like Apple Pay and Google Pay. https://docs.stripe.com/api
PayPal provides an extensive API suite that supports payments via PayPal accounts and credit and debit cards. PayPal's APIs include options for processing payments, managing subscriptions, and integrating with different shopping cart systems. https://developer.paypal.com/api/rest/
Square supports online payments, point-of-sale transactions, and e-commerce integrations. Square's APIs also include features for managing customer data, inventory, and employee access. https://developer.squareup.com/docs/payments-overview
Public cloud providers offer a range of popular API gateway services, several of which are listed here for further reading:
Amazon API Gateway supports RESTful and WebSocket APIs, integrates seamlessly with serverless applications, and supports traffic management, authorization, and monitoring. https://aws.amazon.com/api-gateway/
Google Cloud Endpoints supports OpenAPI and gRPC (a high-performance, open-source remote procedure call framework developed by Google), authentication via Google ID, and integration with many other Google services. https://cloud.google.com/endpoints/
Azure API Management provides a comprehensive developer portal and analytics dashboard and supports a range of security protocols. https://learn.microsoft.com/en-us/azure/api-management/api-management-key-concepts
IBM API Connect includes features for API discovery, self-service access, and policy enforcement and integrates with IBM's broader cloud service offerings. https://www.ibm.com/products/api-connect
Oracle API Gateway provides robust security features, traffic management, comprehensive analytics, and seamless integration with other Oracle services. <https://docs.oracle.com/en-us/iaas/Content/APIGateway/Concepts/apigatewayoverview.htm>
In a architectural model, asset identification, management, and attestation processes ensure the security and integrity of an organization's IT infrastructure.
Asset identification in a architecture involves continuously and accurately recognizing every device that accesses the network through a combination of approaches that typically include endpoint detection and response () systems, network access control (NAC) solutions, and other device management tools. These technologies collectively maintain an up-to-date inventory of all devices, such as laptops, desktops, mobile devices, IoT devices, and servers, using a unique identifier, such as a MAC address or a digital certificate, so they can be consistently tracked and monitored.
Managing assets within a model requires stringent controls over device configuration, software update installation, and compliance with security policies. These protections are enforced via configuration management systems, centralized patch management, policy enforcement via endpoint protection and software-defined networks, and a range of different monitoring and analytical approaches.
Asset attestation verifies that a device continuously meets required security measures before granting access to a network or other specific resources. This is accomplished via ongoing device "health checks" that validate endpoint protection software status, use of encryption, software patch level, firewall status, and many other attributes, as well as stringent authentication and authorization of users and their devices.
In a Zero-Trust architecture, context plays a pivotal role. Decisions about granting access are not based on a single factor but on a combination of factors, including the user's identity, the device's security posture, the sensitivity of the data being accessed, and the request's context (location, time, and behavior). This complex interplay of factors ensures that access is granted only when all the conditions are met, enhancing the system's security and integrity.
System components in a architecture describe parts that work together to enforce security policies and protect resources. The primary system components include identity management, endpoint security, network security, application security, and data security. Network security in a model shifts from traditional perimeter defenses to more granular controls. Micro-segmentation, for example, divides the network into small, isolated segments, each with distinct security policies designed to minimize the and restrict lateral movement within the network. In this context, network security often leverages secure access service edge (SASE) solutions, which combine several security controls into a unified cloud-delivered service, ensuring secure access regardless of user location.
In a architectural model, security boundaries are fundamentally redefined compared to traditional network security models. Instead of relying on a single, trusted internal network protected by a perimeter, operates on the principle that no network is inherently trusted regardless of its internal or external status, and is often referred to as deperimeterization. Data perimeters describe how data is prioritized as the primary asset to be protected. This means that security policies are enforced based on the identity of the user, the device, and other contextual factors rather than simply the location within a network, as would be the case in a traditional network model. Every access request must be authenticated, authorized, and continuously validated. Secure zones are micro-segmented environments where access can be tightly controlled and monitored. Each zone operates with its own set of security policies, and rigorous access controls govern interactions between zones. This level of micro-segmentation minimizes the because it limits an attacker's ability to move laterally across the network.
The relationship between security boundaries and secure zones is interconnected and complementary. Security boundaries represent the demarcations for enforcing access control policies and security measures. These boundaries are fluid and adaptable and focus on protecting data, applications, and services by verifying every access request. Secure zones, in contrast, are well-defined segments within a network architecture where specific resources, applications, or data are grouped based on similar security requirements. Every secure zone operates with its own set of security controls and policies, which are tailored to the sensitivity and criticality of the assets contained within it. In practice, security boundaries are applied at the edges of secure zones to enforce access controls and facilitate monitoring. When a request is made to access a resource contained within a secure zone, it must cross a security boundary that validates the request's identity, permissions, and context. The interplay between security boundaries and secure zones ensures that unauthorized movement to other zones is difficult, thereby reducing the risk of unauthorized access.
System Components in Architecture
In a security model, the secure boundary system components take on an even more critical and evolved role, emphasizing the principle of "never trust, always verify." Unlike traditional perimeter-based security, where trust is granted based on network location, assumes that threats can come from both inside and outside the network.
A infrastructure firewall is more granular and operates at the OSI application layer to enforce strict, context-aware policies. They focus on controlling access to specific resources rather than just securing the network perimeter. Intrusion Detection and Prevention Systems are integrated deeply into the architecture, continuously monitoring all internal and external traffic for suspicious activity. IDS and IPS are enhanced using advanced threat detection technologies, including behavioral analytics and machine learning, to identify anomalies indicative of a breach. Network segmentation turns into micro-segmentation, meaning that resources are divided into secure, isolated zones down to the application and workload levels to limit lateral movement. Virtual Private Networks (VPNs) are increasingly replaced or supplemented by secure access solutions like Software-Defined Perimeters (SDP) or Network Access (ZTNA), which enforce strict identity and device verification before granting access to any resource, regardless of the user's location.
Additionally, access control in a model is highly dynamic and based on continuous verification of identity, device posture, and context. Multi-factor authentication () becomes a mandatory requirement for all access attempts, and role-based access control (RBAC) is generally combined with attribute-based access control (ABAC) to enable fine-grained permissions based on real-time context.
Software-Defined Networking (SDN)
As networks become larger and more complex, it becomes more difficult to manage traffic flows and ensure that security controls are in place. With a vast array of devices to manage and configure, it is effective to use an abstracted model to define how the network operates. In a model such as this, network functions are divided into three "planes":
Control plane, Makes decisions about how traffic should be prioritized and secured, and where it should be switched
Data plane, Handles the actual switching and routing of traffic and imposition of access control lists (ACLs) for security
Management plane, Monitors traffic conditions and network status
A software-defined networking (SDN) application can be used to define policy decisions on the control plane. These decisions are then implemented on the data plane by a network controller application, which interfaces with the network devices using APIs. The interface between the SDN applications and the SDN controller is described as the "northbound" API, while between the controller and appliances is the "southbound" API. SDN can be used to manage compatible physical appliances but also virtual switches, routers, and firewalls. This architecture reduces the risks associated with managing a large and complicated network infrastructure. It also allows for fully automated deployment (or provisioning) of network links, appliances, and servers. These features make SDN a critical component driving the adoption of automation and orchestration technologies.
Software-Defined Networking
A software defined networking diagram shows data flow from a client on Internet through frontend to middleware applications and finally to backend.
Images © 123RF.com
Diagram of network segmentation, showing a three-layer SDN architecture. Here, the backend zone correlates with the control plane, the middleware correlates with the data plane, and the frontend zone correlates with the management plane. All zones have dedicated network components and security boundaries.
Different Approaches to SDN
Open SDN, Uses open standards and open source software as a strategy to reduce the risks of vendor lock-in
Hybrid SDN, Traditional and software-defined networks operating within the same environment
SDN Overlay, Allows the use of software to create and manage new virtual networks which leverage existing hardware. All network management and configuration is performed via software, and new virtual networking devices are defined within the software. This "overlay" moves data across existing physical network hardware, but the network hardware is no longer managed or configured directly; it simply moves the data controlled by the SDN.
Software-Defined Wide Area Network (SD-WAN)
SD-WAN, a network technology that simplifies the management and operation of a wide-area network, achieves this by separating networking hardware from control functions. It offers a flexible way to manage and control the flow of data across different types of connections, such as MPLS, broadband, and LTE. Centralized control, intelligent path management, and dynamic routing based on real-time conditions are hallmarks of SD-WAN, making it an appealing solution for network administrators.
Secure Access Service Edge (SASE)
SASE is a framework combining network security functions to support modern secure access requirements. By integrating technologies such as SD-WAN, secure web gateways, cloud access security brokers (CASB), and zero-trust network access (ZTNA), SASE can provide comprehensive security protections. The combination of features provided by SASE supports secure access to applications and data regardless of an employee's location, making it important for remote workforces and securing access to cloud-based applications. SASE enhances security posture by providing consistent policies and protection across all networks.
In the context of a security model, understanding and defining subject-object relationships is crucial. This ensures the enforcement of access controls and is a critical component of implementing this security model. The concept of subject and object is not unique to ; rather, it is a model that helps define the interactions between entities in an infrastructure. For example, a subject could be simply defined as a user attempting to access an object, such as a file stored in a file system. Subject-object interactions are governed by some type of security mechanism, the type of which can best be identified based on the specific subject and objects that comprise the environment.
A subject is an active entity that requests access to a resource and can be a user, device, service, or application. In a environment, subjects must be authenticated and authorized before being granted access to any resources. An object is a passive resource the subject desires to access, such as data, applications, services, or network devices. Each object has its own security policies and access controls that dictate how and when it can be accessed.
Exam Objectives Covered
AAA and are excellent ways to establish a secure framework for users. Provisioning and deprovisioning are critical processes for managing user access throughout their lifecycle, ensuring that permissions are granted and revoked as needed. enables seamless access across multiple systems and organizations by establishing trust relationships between identity and service providers. Conditional access policies enhance security by allowing access based on specific conditions, such as user location or device status. Policy decision and enforcement points are essential for implementing and enforcing these access controls. Various access control models provide frameworks for defining how permissions are granted, while logging and auditing ensure that all access activities are recorded for accountability and compliance.
Public Key Infrastructure () architecture underpins secure communications and authentication through the use of cryptographic keys. Access control systems, including subject access control and biometrics, provide additional layers of security by verifying user identities and managing access to resources. Secrets management is crucial for protecting sensitive information such as passwords and API keys. Cloud access and trust policies govern access in cloud environments, supported by robust logging and monitoring to detect and respond to security incidents. Privilege Identity Management (PIM) focuses on securing and managing privileged accounts, while authentication and authorization processes verify user identities and grant appropriate access levels. Together, these tools and approaches form a robust framework for managing user access, identification, and control.
As you study this lesson, answer the following questions:
How do access control models and systems form the foundation of an organization's access control framework, and what role do they play in structuring and enforcing access permissions?
What are the benefits of integrating biometrics into authentication and authorization processes, and how do they enhance security?
How do cloud access and trust policies ensure consistent access management across both on-premises and cloud resources?
Why are logging and auditing important for tracking access activities, and how do they contribute to compliance with security policies?
Provisioning and deprovisioning processes encompass creating, maintaining, and removing user accounts, access rights, and resources within an organization's IT infrastructure. Provisioning describes creating user accounts, assigning appropriate access rights, and allocating required resources to individuals (or sometimes systems.) Conversely, deprovisioning is the systematic removal of access rights, user accounts, and all associated resources when they are no longer needed, such as when an employee leaves or changes roles.
Provisioning and deprovisioning processes are crucial in maintaining security, compliance, and operational efficiency because they help organizations enforce the principle of least privilege. By implementing robust provisioning and deprovisioning processes, organizations can mitigate the risk of unauthorized access, data breaches, and insider threats by ensuring that access is granted and revoked systematically. Automating these processes through Identity and Access Management () systems enhances efficiency and reliability. Automation minimizes human error and provides audit trails, helping organizations monitor access changes and detect any anomalies that could indicate potential security issues. Self-provisioning allows users to request and manage access rights and resources within predefined limitations and requirements for completing various approval workflows. Self-provisioning can reduce the administrative burden on IT departments but requires careful implementation and oversight to maintain security and compliance standards.
Credential Issuance describes the creation and distribution of authentication credentials, such as usernames, passwords, smart cards, or biometric data, to verified users. It's important to note that credential issuance is not a one-time event but an ongoing process. Credentials must be managed throughout their lifecycle, including regular updates, renewals, and revocations. For example, passwords should be changed periodically, and smart cards must be reissued if lost or stolen. Organizations can only ensure the security of any given system via continuous management activities. Credential management systems (CMS) are often implemented to help automate and streamline the issuance process. These systems can generate, distribute, and manage credentials and reduce the likelihood of human error. CMS solutions can also integrate with systems to ensure credentials accurately represent different, pre-established user roles and access policies.
A non-exhaustive list of products associated with advanced identity and access management capabilities:
Microsoft Entra ID (Previously Azure AD) https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id
Okta https://www.okta.com/
SailPoint IdentityIQ https://www.sailpoint.com/products/identityiq/
OneLogin https://www.onelogin.com/
Ping Identity https://www.pingidentity.com/
RSA SecurID Suite https://www.rsa.com/products/securid/
CyberArk Access Management <https://www.cyberark.com/products/access-management/>
is the notion that a network needs to be accessible to more than just a well-defined group of employees. In business, a company might need to open parts of its network to partners, suppliers, and customers. The company can manage its employee accounts easily enough, but managing accounts for every supplier or customer poses significant problems. describes how the company can trust accounts created and managed by a different entity.
For example, allowing users to use an established Google account to access the protected regions of the organization's website. If Google and the website establish a federated association for authentication and authorization, then the user can log on to the website using their Google credentials. This association allows users to access content more efficiently while saving the organization the burdens and risks of establishing, storing, and protecting user credentials.
enables different cloud service providers and platforms to work together seamlessly. It allows a company's private cloud to interoperate with public cloud services in a hybrid cloud model or facilitate cooperation between different public cloud providers in a multi-cloud strategy. Federated identity management allows users to authenticate across different systems using a single set of credentials. In a cloud environment, can enable an enterprise to leverage the best services from various providers.
For example, an organization might use storage services from one cloud provider, compute services from another, and machine learning tools from a third. enables these services to work together seamlessly. The need for interoperability and flexibility drives the prominence of in modern architecture. As organizations adopt a broader range of technologies and cloud services, the ability to federate these components becomes essential for maximizing the value derived from each one.
Single Sign-On
With single sign-on (), users have only one set of credentials for accessing multiple resources, simplifying the login process and reducing password fatigue. This ease of access can increase productivity as users can swiftly move between different applications and services without repeatedly logging in. Additionally, centralizes authentication, allowing for more effective monitoring and control of user access.
While single sign-on () offers significant benefits, it also introduces potential risks. One of the major risks is that if an account is compromised, the attacker gains access to all connected applications and systems, making the account a prime target for cyberattacks. Additionally, the reliance on a single authentication mechanism means that any or failure in the system can potentially disrupt access to multiple services. It is important to increase protections for single sign-on accounts through the implementation of multi-factor authentication (.)
Conditional access is intended to restrict access to resources based on specific conditions. It helps ensure that only authorized users can access sensitive information or systems under predefined conditions. Conditional access policies are the mechanism used to enforce the rules and conditions that must be met before granting access.
When setting up conditional access, it's crucial to consider several important design considerations. The following non-exhaustive list highlights some important design considerations associated with configuring conditional access.
User Identity Verification - including requirements and integration with existing systems.
Device Compliance - such as defining device "health" requirements and device authentication methods
Location-based Access Controls - including rules that block or require additional authentication steps for logins from risky locations or unknown IP addresses.
User Risk Level - such as requiring additional verification steps for users flagged for unusual behavior or accessing sensitive resources for the first time.
Integration with Security Information and Event Management () - including tracking access trends to proactively adjust conditional access policies.
Usability - such as using adaptive authentication to challenge users only when necessary and based on risk profiles to lessen the effort required for employees to use systems productively.
User-to-device binding ensures that access to resources is only granted when the request comes from a specific device associated with the user. This method often involves registering devices through device certificates or mobile device management (MDM) platforms. Examples include multi-factor authentication (), where users must authenticate using a registered device, such as a smartphone with a one-time password (OTP) app, and corporate device policies, where access to resources is restricted to devices that meet specific pre-requisites and are registered through the organization's MDM platform. Binding users to specific devices can limit flexibility and cause inconvenience, especially for users who use multiple devices.
Geographic location-based access control restricts access to resources based on the user's physical location. This method typically uses IP address geolocation to determine the user's location and enforce policies accordingly. For example, country-based restrictions restrict access to services and data to users within specific countries. Employees who legitimately travel internationally for work may face access issues with country-based restrictions. Country-based restrictions are often bypassed through the use of VPNs.
Time-based access control restricts access to resources based on specific time frames. This method ensures users can only access systems and data during predefined periods. Examples include allowing access to systems only during standard work hours and temporary access windows where access is granted for a short period, after which access is revoked automatically.
An Identity Provider (IdP) creates, maintains, and manages user identity information. It authenticates users through passwords, biometrics, or multi-factor authentication methods and manages their identity data, including personal information, credentials, and all related attributes. Once a user is authenticated, the IdP issues assertions, like security tokens, to service providers (SPs) to confirm the user's identity.
A Service Provider (SP) is an entity that provides services, applications, or resources to users, relying on identity information from IdPs to secure access to these resources. SPs use the assertions from IdPs to make access control decisions and deliver services.
Attestations are statements made by IdPs about a user's identity, attributes, or actions. These can include identity assertions, which confirm that a user is authenticated; attribute assertions that describe specific attributes of the user, such as roles or personal information; and behavioral assertions that describe the user's actions or behavior. The IdP generates and shares these attestations with SPs to facilitate access control and service delivery.
In summary, IdPs authenticate users and generate attestations, which SPs rely on to grant access to services.
Attestation associated with Identity and Access Management () describes the formal process of verifying and validating user access rights within an organization's IT systems, ensuring compliance with all applicable security policies and regulatory mandates. The attestation process has a series of well-defined steps described below:
Initiation, Often triggered by an system, user access rights are reviewed on a recurring basis based on the organization's policies and regulatory mandates, such as monthly, quarterly, semi-annually, annually, etc.
Review, Managers, role owners, or other designated reviewers receive notification to review and attest to the access rights configured for the users they are responsible for.
Validation, Reviewers examine access levels to ensure they are appropriate, meaning that they provide only the level of access needed to complete job tasks. Any discrepancies are flagged for correction.
Approval or Revocation, Access rights are either approved or revoked based on the review.
Documentation and Reporting, The attestation process's results are documented, and reports are generated for auditing purposes.
In terms of managing the attestation process, solutions such as those offered by SailPoint, Okta, Microsoft Entra ID, and others can be beneficial as they provide a certain level of automation to lessen the administrative burden. They also incorporate workflow automation to guide the review and approval stages, ensuring timely completion and minimizing human error. The reporting and analytics capabilities within these tools can highlight patterns that support risk management and continuous improvement initiatives.
Policy Decision Points (PDP) make access control decisions based on predefined security policies. Policy Enforcement Points (PEP) represent where access decisions are applied. Essentially, PDP evaluates and decides, while PEP implements and enforces. The separation of Policy Enforcement Points (PEP) and Policy Decision Points (PDP) ensures that access decisions (PDP) are made based on comprehensive, context-aware policies and that these decisions can be uniformly enforced (PEP) across all access points. The core concept is the application of policies to define access instead of the static rules inherent to more traditional methods.
A policy decision point (PDP) determines access based on predefined policies. In a traditional security model, a PDP typically depends on network location (inside vs. outside) or simple user credentials. In a Architecture, multiple factors, including user identity, device health, location, and behavior, are evaluated.
Policy enforcement points (PEP) enforce the decisions made by the PDP. In a Architecture, PEPs are distributed throughout the network to ensure consistent application of security policies. This approach contrasts with traditional models, where enforcement might occur at a limited number of edge devices.
In a traditional edge protection model, security devices like firewalls and routers are typically deployed at the network perimeter. These devices act as the primary Policy Enforcement Points (PEP), controlling access based on evaluating incoming and outgoing traffic at the network's boundaries. This approach assumes that internal traffic is inherently trusted. In contrast, enforcement points are distributed throughout the network in a dispersed PEP model aligned with Architecture.
PEPs can be placed within the internal network to enforce policies at a granular level, segmenting the network into smaller, isolated zones. Each segment has its own PEPs, controlling access based on real-time policy evaluations.
PEPs can be integrated directly into endpoints (e.g., laptops, desktops, and mobile devices). Each device enforces security policies, such as requiring device health checks, user authentication, and adherence to corporate security policies before granting access to network resources.
In cloud environments, PEPs are integral to the cloud infrastructure. For example, microservices and virtual machines often have their own PEP, controlling access based on policies. Cloud-native security services such as AWS , Microsoft Entra ID (previously Azure Active Directory), or Google Cloud often provide this level of functionality.
PEPs can be integrated within applications, ensuring access to specific application features (or data) is controlled based on user identity, roles, and other contextual factors. For example, an application might enforce policies restricting access based on the user's current location or device compliance status.
Routers, switches, and other network devices also function as PEPs. For example, a switch might enforce VLAN policies, ensuring only authorized devices can communicate on specific network segments.
By dispersing PEPs throughout the environment, organizations establish multiple layers of defense, ensuring that security policies are applied regardless of where access attempts originate. Policy decision and enforcement points form the foundation of the model by ensuring that access decisions are dynamic and context-aware.
The distinction between PDP and PEP may not be as clear in traditional AAA systems, particularly those designed before the widespread adoption of principles. For example, decision-making and enforcement are often combined into a single service, such as a centralized RADIUS server or an LDAP directory service. These services authenticate users, authorize their access, and log their activities but do not explicitly separate the decision and enforcement functions.
Discretionary Access Control (DAC) is based on the discretion of the resource owner. The owner is typically the creator of a file or service, although ownership can be assigned to another user. The owner has full control over the resource and can modify its access control list (ACL) to grant rights to others. DAC is the most flexible model and is widely implemented. It is the model used by default for most UNIX/Linux distributions and by Microsoft Windows. As the most flexible model, it is also the weakest because it makes centralized administration of security policies the most difficult to enforce. It is also the easiest to compromise, as it is vulnerable to insider threats and abuse of compromised accounts.
Mandatory Access Control (MAC) is based on security clearance levels. Rather than defining ACLs on resources, each object and each subject is granted a clearance level, implemented as a label. In a MAC model, subjects are generally only permitted to access objects at their own clearance level or below. The labeling of objects and subjects depends upon pre-established rules and cannot be changed by any subject.
Role-Based Access Control (RBAC) adds more centralized control to the DAC model. Under RBAC, a set of organizational roles is defined, and subjects are allocated to those roles. Under this system, the right to modify roles is reserved to a system owner. Users gain rights implicitly (through being assigned to a role) rather than explicitly (by being assigned the right directly).
Attribute-Based Access Control (ABAC) is a security model that grants access to resources based on attributes associated with users, resources, and contextual conditions (time, location, device, etc.). The ABAC model evaluates policies that include attributes such as user roles, department, clearance level, resource type, sensitivity level, and environmental factors like time of access or location. When a user requests access to a resource, the ABAC system evaluates the attributes of the user, the resource, and the context of the request against predefined policies. This approach allows for fine-grained access control and can adapt to complex scenarios. Common uses of ABAC include controlling access in healthcare systems, where patient data is protected based on attributes like user role (doctor, nurse, administrator) and data sensitivity. In cloud computing, ABAC regulates resource access based on attributes like user identity, resource type, and context.
Rule-based Access Control can refer to any access control method where system-enforced rules rather than system users determine access control policies. Like the other models, rule-based access control principles can be implemented to supplement protections based on discretionary access control. An example would be a host-based firewall configured with rules to restrict connectivity to a server hosting a file share protected with discretionary access controls.
In general terms, logging and auditing play essential roles in supporting security operations, and events related to user authentication, authorization, and accounting (AAA) provide a broad history of user interactions with various systems. The near real-time evaluation of log data supports incident detection and response, whereas auditing describes the systematic examination of logs to ensure compliance with internal policies, legal requirements, and industry standards. While there is definitely some overlap in these approaches, they are both largely dependent on the presence of log data to help identify disparities, unusual patterns, and potential security breaches.
By continuously monitoring and analyzing logs, security teams can quickly identify suspicious activities, such as unauthorized access attempts or abnormal user behavior. Early detection enables swift response to potential threats, minimizing the impact of security incidents. Logging and auditing practices are mandated by regulations and standards such as , , , and many others. In fact, most regulations mandate that detailed records of user activities be retained for extended periods of time. Logging and auditing also facilitate post-incident analysis. After a security breach occurs, log data provides the information and details needed to reconstruct a timeline of events, identify the root cause, and assess the scope and impact of the event.
One common approach to leveraging log data is using Security Information and Event Management () systems. These systems employ advanced analytics and correlation rules to detect anomalies and potential security incidents and can process vast volumes of log data otherwise impossible for a human analyst to perform. Another method employs machine learning (ML) and behavioral analytics to establish baselines of normal user behavior over a defined training period, and this baseline of activity is then used to help identify deviations that might indicate malicious activity.
Additionally, intrusion detection systems (IDS) and intrusion prevention systems (IPS) can use this log data to locate attack signatures and patterns, providing real-time alerts and potentially automated responses designed to block malicious activities in near real time. Relying solely on log collection and analysis systems is not enough; regularly scheduled log reviews and audits are still critically important. Security teams must still manually review logs to identify suspicious activities that may not trigger automated systems and to validate that automated systems are operating effectively.
Malicious activities will go unnoticed without proper logging and monitoring practices, allowing attackers to maintain prolonged access to the environment and causing extensive damage. A lack of log data will also hinder the ability to conduct thorough post-incident analysis, thereby making it difficult to identify the cause and impact of a breach. This lack of information can also result in ineffective remediation and leave the organization vulnerable to future attacks of the same type.
If the consequences of poor are not significant enough, poor log management can further lead to non-compliance issues, resulting in significant legal penalties, fines, and reputable damage to the organization and its employees.
Implementing auditing for public cloud platforms forces some unique considerations compared to on-premises environments. While the fundamental principles remain the same, the cloud environment introduces specific challenges and a few opportunities. One key consideration is the shared responsibility model inherent to public cloud services. Unlike on-premises environments where organizations have complete control over their infrastructure, in the cloud, security responsibilities are divided between the cloud service provider and the customer. This separation necessitates a thorough understanding of the boundaries of these responsibilities to ensure comprehensive auditing. The distributed nature of cloud environments makes centralized log aggregation and analysis critically important. Cloud-native tools and services for log management can streamline this process by offering integrated logging services that automatically collect, store, and analyze log data within the cloud environment. However, this functionality must be balanced with data residency and compliance laws that mandate what levels of details can be collected and where the log data can be stored geographically.
A non-comprehensive list of cloud-centric logging services:
Amazon Web Services (AWS) CloudWatch https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html
Google Cloud Logging https://cloud.google.com/logging/docs/overview
Microsoft Azure Monitor https://learn.microsoft.com/en-us/azure/azure-monitor/overview
Splunk Cloud https://www.splunk.com/en\_us/products/splunk-cloud-platform.html
Elastic Cloud https://www.elastic.co/cloud/
Datadog https://www.datadoghq.com
Sumo Logic <https://www.sumologic.com>
Public Key Infrastructure () describes the set of software, services, and hardware that support the generation of digital certificates and capabilities of public-key encryption.
When sending confidential messages using , the public key encrypts the message. The message can then only be decrypted using the associated private key, which must be protected at all costs. helps facilitate communication using these methods and, when properly architected, increases security while maintaining ease of use.
A signature crafted with the private key is needed to authenticate a person, device, or software to others. The public key is made available (typically by communicating with services) and can be used by anyone who needs it to decrypt a signature and validate a sender's identity. Because the private key must be protected by the owner, anything decrypted with the associated public key offers proof of the communication source.
However, public and private keys alone are not enough to prove identity. A fundamental problem with public key cryptography is confidently identifying with whom you are communicating. This problem is particularly evident in untrusted networks, such as the Internet, but it also poses issues in modern infrastructures that often do not have clear boundaries delineating the "inside" from the "outside" of the network. For example, environments that have large remote workforces. The simple fact that a system distributes public keys to secure communications does not guarantee actual identity. aims to prove that the owners of public keys are who they claim to be. Under , any circumstance requiring public key encryption requires using a digital certificate guaranteed by a certificate authority (CA) to establish identity confidently.
Public Key Infrastructure () Deployment
On-premises , This approach provides full control over the infrastructure but requires significant resources and expertise to maintain security and compliance.
Managed Services, Managed services handle the setup, issuance, renewal, and revocation of certificates
Hybrid , This approach offers a balance between control and convenience.
Cloud-based , Utilizing cloud-based solutions allows organizations to manage certificates and keys through cloud platforms.
Integrating a Public Key Infrastructure () into existing infrastructure is a complex task that requires careful planning. It is important to first identify all devices, applications, and users that will interact with the , including servers, workstations, network devices, and mobile devices. The should be integrated with directory services, such as Active Directory, to facilitate user and device certificate issuance and management. Strict access controls must be implemented to protect the infrastructure and set up logging, monitoring, and auditing of PKI-related activities to ensure security. Applications may need to be modified to support PKI-based authentication and encryption. Additionally, educating users and administrators about , certificate usage, and security best practices is crucial to maintaining a secure and effective environment.
The certificate authority (CA) is responsible for issuing and guaranteeing certificates. Private CAs can be set up within an organization for internal communications. Most network operating systems, including Windows Server, have certificate services. For public or business-to-business communications, however, the CA must be trusted by each party. Third-party CA services include IdenTrust, Digicert, Sectigo/Comodo, GoDaddy, and GlobalSign. The functions of a CA are as follows:
Provide a range of certificate services useful to the community of users serviced by the CA.
Ensure the validity of certificates and the identity of those applying for them (registration).
Establish trust in the CA by users and government, as well as regulatory authorities and enterprises, such as financial institutions.
Manage the servers (repositories) that store and administer the certificates.
Perform key and certificate lifecycle management, notably revoking invalid certificates.
The registration authority accepts requests for digital certificates and performs various additional steps to validate the requestor. For example, requesting a certificate to use on a domain not belonging to the requestor would be denied. The following are types of certificates:
SSL/TLS, Secure websites by encrypting data exchanged between the server and the client.
Code Signing, Verify the authenticity and integrity of software or code.
Email (S/MIME), Secure email communications by enabling encryption and digital signatures.
Client, Authenticate individual users or devices to a server.
Server, Used to authenticate servers to clients and often utilized in conjunction with SSL/TLS certificates.
Document Signing, Allow for the digital signing of documents, verifying the signer's identity, and ensuring the document's integrity.
Certificate extensions provide additional information beyond the standard certificate fields and enhance the functionality and security of the certificate. They allow for the inclusion of a wide range of attributes, such as the intended purpose of the certificate (SSL/TLS, email protection, code signing), restrictions on usage, and details about the certificate issuer and subject. Extensions enable more granular control over how certificates are used and verified, improving trust management in public key infrastructure () systems.
Online Certificate Status Protocol (OCSP) stapling allows a web server to provide a certificate's revocation status directly to the client during a TLS handshake. Instead of the client contacting the Certificate Authority (CA) to check a certificate status, the server fetches the OCSP response from the CA at regular intervals and includes this response in the TLS handshake. This "stapled" response reduces latency, conserves bandwidth, and enhances privacy by preventing the CA from tracking which sites a user visits.
Certificate templates are predefined configurations used by certificate authorities (CAs) to streamline the creation and issuance of digital certificates. Templates specify the properties and policies certificates should comply with, such as key length, validity period, and extensions like key usage or subject alternative names. Templates ensure consistency and compliance with security policies, automate the certificate issuance process, and reduce the risk of human error.
Ultimately, designing Authentication, Authorization, and Accounting (AAA) systems requires a deep understanding of the specific security needs, operational context, and constraints of the environment and necessitates the creation of a framework to define adequately secure access to resources, user identification and authentication, permission checking, and activity tracking. The nature and circumstances of one implementation scenario to another can vary widely, impacting the approach and technologies used.
AAA systems must be designed to handle high-stakes scenarios in environments requiring robust security. Authentication typically involves multi-factor techniques, including biometrics, hardware tokens, and complex passwords. Authorization is managed through role-based access control (RBAC) or attribute-based access control (ABAC), ensuring that users have precise permissions based on their roles. Accounting in these environments must be thorough, including detailed log data and real-time monitoring to support rapid detection and response of any unauthorized activities.
In contrast, the AAA system should be simpler in less critical environments. Authentication might rely on single-factor methods like passwords. Authorization may depend upon basic role-based access, granting permissions based on broad user categories. Accounting may include simple log details and rely on less stringent monitoring time frames to balance security needs with resource constraints.
Note:
Physical access control restricts entry to physical spaces, such as buildings or rooms, using controls like locks, fences, or security guards. In contrast, logical access control limits access to digital assets, such as networks, software, services, or data, through controls like passwords, encryption, or firewalls. Put another way, physical access control protects tangible assets, while logical access control safeguards information and other "relatively intangible" resources.
Subject access control determines who or what can access resources within a system. The primary subjects in access control are users, processes, devices, and services, each requiring different approaches to limit and control access.
Access Control Description
User Access Control User access control necessitates authentication and authorization to determine appropriate access to resources. It is typically managed through usernames and passwords, biometric data, or multi-factor authentication.
Process Access Control Process access control is enforced through permissions and policies defining what resources a process can access and what operations it can perform. For example, a database management system (DBMS) process can read and write to a database but is restricted from executing scripts. This type of control is essential to prevent software processes from performing unauthorized actions.
Device Access Control Device access control, such as computers, smartphones, printers, and IoT devices, is managed through device authentication, network access control (NAC), and policies that govern what each device can access on the network. For example, a smartphone can only access internal network resources after verifying its security posture. Device access controls ensure that only secure devices can connect to and interact with the network.
Service Access Control Service access control refers to web services, APIs, and cloud services, to name a few. It is often enforced via API keys and tokens; for example, an API may require an API key and proper authorization to an external application to retrieve data. This ensures that only authorized services can communicate and exchange information.
Several factors drive the increased adoption of biometrics, each contributing to its growing prevalence. Traditional authentication methods such as passwords and PINs are repeatedly demonstrated as vulnerable to breaches and hacks. Biometrics, such as fingerprints, facial recognition, and voice patterns, offer a more robust alternative that is much more difficult to replicate or steal. This enhanced authentication assurance is a significant driver behind its adoption.
Another factor driving adoption is the convenience that biometrics can provide. Unlike passwords, which are often forgotten, lengthy, complicated, and require careful management, biometric authentication is relatively seamless and fast. Ease of use is especially appealing in the highly competitive consumer technology market, where user satisfaction is a major focus. Advancements in sensors, algorithms, and machine learning have made biometric systems more accurate and reliable, reducing error rates and increasing trust, further encouraging their adoption. Innovations in microelectronics, materials science, and manufacturing techniques have made producing high-quality sensors at a lower cost possible, and economies of scale have reduced their per-unit costs.
Biometric systems that require calibration are designed to maintain accuracy and reliability over time by periodically adjusting their sensors and algorithms. Calibration ensures that these systems account for changes in environmental conditions, user characteristics, and sensor performance. Some common examples of biometric systems that require calibration include facial, iris, voice, gait, and fingerprint recognition systems. Calibration is a common requirement for biometric systems in high-security, high-risk environments where accuracy is critical.
However, the frequency and complexity of calibration vary depending on the technology and usage scenario. In consumer devices like smartphones or laptops, biometric systems are typically designed to minimize the need for frequent calibration. In this scenario, biometric systems use advanced algorithms and adaptive technologies to help maintain performance without requiring frequent user intervention. While not all biometric systems require regular calibration, it is a standard practice in many advanced and high-security environments.
Implementing and maintaining biometric systems comes with challenges that can hinder broader adoption. Privacy concerns are paramount because biometric data is extremely sensitive and personal. Implementing and saving biometric authentication data introduces unique risks, the most significant being the potential for biometric data breaches. Unlike passwords, which can be changed if compromised, biometric data such as fingerprints or facial features are permanent. When this data is stolen, it cannot be changed or updated like a password, leading to long-term and significant issues for the affected individuals. Biometric data is deeply personal, and misuse of it can lead to serious privacy violations. These risks are compounded by the potential for biometric facial recognition data to be used for surveillance purposes. Technical issues can also introduce unique risks. Variability in lighting, positioning, and user changes such as aging, weight, and health conditions can affect the accuracy of biometric systems.
Additionally, integrating biometric systems into existing infrastructure can be costly and require specialized technical expertise, which might be a barrier for some organizations. User acceptance and trust are also critical factors. While some individuals are comfortable using biometrics for their personal devices, they can sometimes be apprehensive about using the same technology in the workplace. Despite the advantages of ease of use, some users may be reluctant to adopt biometric systems. Building trust through transparent practices and effective communication about the benefits of using biometric data, the protections to guard it, and a clear and easy-to-understand privacy policy can help encourage adoption.
Note:
In the European Union, the General Data Protection Regulation () includes provisions for processing biometric data that emphasize the need for explicit consent, impact assessments, and the implementation of specific security measures. https://iapp.org/news/a/processing-biometric-data-be-careful-under-the-gdpr/
Standards for Biometric Authentication Best Practices:
ISO/IEC 19795, Biometric Performance Testing and Reporting - https://www.iso.org/standard/73515.html
ISO/IEC 30107, Biometric Presentation Attack Detection - https://www.iso.org/standard/83828.html
NIST SP 800-76, Biometric Specifications for Personal Identity - https://csrc.nist.gov/pubs/sp/800/76/2/final
FIDO Alliance, FIDO Biometrics Requirements - <https://fidoalliance.org/specs/biometric/requirements/Biometrics-Requirements-v2.2-fd-20211206.html>
Secrets management encompasses the practices and technologies used to protect and manage sensitive information such as tokens, certificates, passwords, and cryptographic keys. Examples of the items included in secrets management policies and processes include tokens, digital certificates, passwords, and cryptographic keys.
Note:
A token allows systems and users to authenticate and access resources without directly exposing passwords or API keys. Tokens vary in appearance and structure depending on the format and technology used (e.g., tokens, API tokens, etc.)
Cryptographic key management practices include generating strong keys, secure storage, and regular key rotation. Rotation describes the periodic replacement of tokens, certificates, passwords, and keys. This practice significantly reduces the window of opportunity for attackers to exploit compromised secrets. Secrets deletion is equally crucial. When secrets are no longer needed, securely deleting them ensures they cannot be recovered and misused, and they are completely removed from backups and logs. This level of control over our secrets is a key part of our security strategy.
Note:
BitWarden has a great video walkthrough covering the setup and use of their secrets manager product. It provides a great overview of secrets management concepts and an implementation example. https://vimeo.com/856539989
A few examples of different products designed to support secrets management:
HashiCorp Vault https://www.hashicorp.com/products/vault
AWS Secrets Manager https://aws.amazon.com/secrets-manager/
Azure Key Vault https://azure.microsoft.com/en-us/products/key-vault/
Google Cloud Secret Manager https://cloud.google.com/security/products/secret-manager
CyberArk Workforce Password Management https://docs.cyberark.com/wpm/latest/en/Content/GetStarted/welcome-to-wpm.htm
Delinea Secret Server https://delinea.com/products/secret-server
1Password https://1password.com/developers
BitWarden <https://bitwarden.com/products/secrets-manager/>
Cloud Identity and Access Management () and on-premises solutions serve the same fundamental purpose: managing user identities and controlling access to resources. However, they differ significantly in their implementation, flexibility, scalability, and integration with cloud services.
Cloud is explicitly designed to control access to cloud-based resources. It is inherently scalable and flexible and integrates seamlessly with cloud platforms to support advanced features like federated identity management, multi-factor authentication (), and automatic synchronization with other cloud services. On-premises solutions, in contrast, have certain limitations. They are often more static compared to their cloud-based counterparts and are tightly coupled with the organization's network and server infrastructure. This can hinder scaling and integration with cloud services, which may be a crucial consideration for some organizations.
Cloud offers robust security advantages. It leverages the cloud provider's security infrastructure, including regular updates, patches, and compliance with industry standards. This ensures that security and compliance are effectively handled, relieving the organization of these responsibilities. Additionally, cloud solutions are typically designed with support for the newest identity standards, such as , , and , to facilitate integrated authentication and authorization across various cloud services.
Roles and policies form the basis of access control in cloud . Roles define a set of permissions, and policies bind roles to identities. Identities can represent users, groups, or services. Trust policies define the conditions under which a particular identity can assume a role. Trust policies are crucial in multi-account environments where roles access resources in different environments. Trust policies enable secure communication and delegation of permissions between entities, ensuring that only authorized access is granted.
For example, consider a scenario where an organization has multiple cloud accounts for different environments and wants to allow the development team to access only specific resources and actions in the production environment. To achieve this, they can create a trust policy establishing the relationship between the development and production accounts. The trust policy defines the permissions and conditions under which the development accounts can access resources in the production environment. For example, the trust might allow read-only access to specific storage buckets or allow specific compute instances to launch in pre-determined subnets. This approach provides granular access to the necessary resources without compromising security or risking unauthorized access to sensitive data.
Logging and monitoring activities with an Identity and Access Management () system are crucial for supporting security operations and compliance activities in an organization's infrastructure.
Logging and monitoring activities enable organizations to gain visibility into who is accessing systems and data. This level of visibility is essential for identifying security breaches and policy violations. Comprehensive logging also supports forensic investigations after a security incident has been detected. Detailed logs provide a historical record of all access-related activities, allowing security teams to trace an attacker's steps, understand the scope of the breach, and determine the root cause.
Many regulatory frameworks, such as , , and PCI DSS, mandate stringent logging and monitoring of access to sensitive data. By implementing robust logging practices, organizations can demonstrate compliance with these regulations and significantly simplify the audit and assessment process.
Example log data containing suspicious activity:
Timestamp: 2024-06-21 14:35:10
User: johndoe
Action: Login
Status: Success
Source IP: 192.168.1.5
Location: New York, USA
Device: Windows 10, Chrome Browser
-----------------------------------
Timestamp: 2024-06-21 14:37:25
User: johndoe
Action: Access Resource
Resource: FinancialReports2023.xlsx
Status: Success
Source IP: 192.168.1.5
Location: New York, USA
Device: Windows 10, Chrome Browser
-----------------------------------
Timestamp: 2024-06-21 15:20:42
User: johndoe
Action: Password Change
Status: Success
Source IP: 198.51.100.22
Location: Moscow, Russia
Device: Linux, Firefox Browser
-----------------------------------
Timestamp: 2024-06-21 15:25:10
User: johndoe
Action: Access Resource
Resource: CustomerData2023.csv
Status: Success
Source IP: 198.51.100.22
Location: Moscow, Russia
Device: Linux, Firefox Browser
-----------------------------------
Timestamp: 2024-06-21 15:30:00
User: johndoe
Action: Logout
Status: Success
Source IP: 198.51.100.22
Location: Moscow, Russia
Device: Linux, Firefox Browser
The sudden change in the location and source IP of the user "Johndoe" highlights the suspicious activity. Initially, the user logs in and accesses resources at 14:35:10 and 14:37:25 from New York, USA, with the source IP 192.168.1.5. At 15:20:42, there is a successful password change for the same user logged from source IP 198.51.100.22 and location of Moscow, Russia.
Additionally, initial activities are performed from a Windows 10 device using a Chrome browser, while password change and file resource access are later performed from a Linux device using the Firefox browser. Furthermore, the rapid transition from New York to Moscow within a short period is physically impossible, indicating a potential compromise of the user's account.
These discrepancies suggest that the user account may have been compromised, with an unauthorized actor gaining access from a different location and device. It is important to note that VPN use can cause "impossible travel," so the whole the account definitely appears to be compromised (especially because the device details also change), further analysis is justified.
Privilege identity management (PIM) is a crucial tool for managing and controlling the access rights of privileged accounts. It not only grants, manages, and revokes privileged access, but also monitors and audits the activities of these accounts. By doing so, PIM ensures that only authorized individuals have access to sensitive systems and data, significantly reducing the potential for misuse or abuse of privileged access. PIM's automation of privileged access management enhances operational efficiencies, while its visibility into privileged account activities helps organizations detect suspicious behavior more quickly.
A standard PIM workflow follows these broad steps:
Access Request, When a user needs elevated permissions for a specific task, they submit a request for privileged access. This request often includes details about the access needed, the duration, and the justification for the request.
Approval, The request for privileged access is routed to the appropriate approvers, who review it, considering factors like the user's role, the necessity of the access, and any associated risks. Based on their evaluation, they can approve or deny the request.
Grant Access, Upon approval, the PIM system grants the user the requested privileged access.
Monitor and Audit, While the user has privileged access, the PIM system monitors activities and logs all actions during the privileged session, capturing details such as commands run, files accessed, and any environment changes.
Access Revocation, The PIM system automatically revokes privileged access once the user completes the task (or the approved access period expires).
Reporting and Review, The PIM system generates detailed reports on all privileged access activities. These reports are used for auditing and compliance purposes, helping organizations demonstrate that they effectively manage and control privileged access.
A non-comprehensive list of PIM products:
Microsoft Entra Privileged Identity Management
CyberArk Privileged Access Security
BeyondTrust Privileged Account & Session Management
Delinea Secret Server
Authentication and authorization mechanisms are critical in protecting sensitive information and ensuring secure access to resources.
Security Assertions Markup Language ()
Security Assertions Markup Language () is an XML-based framework for exchanging authentication and authorization data between parties, particularly between an identity provider (IdP) and a service provider (SP). It supports single sign-on () capabilities.
OpenID
OpenID is an open standard and decentralized authentication protocol that allows users to be authenticated by cooperating sites (Relying Parties or RP) using a third-party service (an OpenID provider or OP), eliminating the need for different credentials for each site.
Multifactor Authentication ()
Multifactor Authentication () is a security system requiring multiple authentication methods to verify a user's identity. Methods might include:
Something the user knows (password).
Something the user has (security token).
Something the user is (biometric verification).
Single Sign-On ()
is an authentication process that allows a user to access multiple applications with one set of login credentials. Reducing the number of times a user has to log in improves user convenience, productivity, and security.
A is a partnership between multiple systems or organizations that share identities and authentication information. It allows users from one organization to access resources in another without needing to log in again. A is typically implemented using standards like or .
is a network authentication protocol that provides strong authentication for client/server applications using secret-key cryptography. It uses tickets supplied by a trusted third party, the Key Distribution Center (), to allow nodes to prove their identity securely.
Extensible Authentication Protocol ()
Extensible Authentication Protocol () is an authentication framework frequently used in wireless networks and point-to-point connections. It provides a variety of authentication mechanisms, such as token cards, , one-time passwords, and public key encryption authentication.
Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is a secure key establishment protocol used in wireless networks. It ensures mutual authentication between devices without pre-shared keys, and it is typically used in WPA3 (Wi-Fi Protected Access 3).
Privileged Access Management ()
Privileged Access Management () is associated with managing and monitoring privileged users' access to critical systems and information. This includes enforcing the principle of least privilege and implementing controls to monitor and audit privileged access activities.
Open Authorization ()
Open Authorization () is an open standard for access delegation. It is commonly used to grant websites or applications limited access to a user's information without exposing passwords. allows users to approve an application's ability to interact with another on their behalf without sharing their password.
Identity Proofing
Identity proofing describes verifying that a person is who they claim to be. It can use various methods, such as checking identification documents, biometric verification, or knowledge-based authentication questions.
Institute of Electrical and Electronics Engineers (IEEE)
IEEE is a network access control protocol for securing wired and wireless networks. It provides an authentication mechanism for devices attempting to attach to a LAN or WLAN.
In this module, you will learn the important aspects of security engineering. Ensuring robust cybersecurity is paramount for organizations of all sizes. Endpoint security plays a critical role in protecting end-user devices such as desktops, laptops, and mobile devices from cyber threats, safeguarding the entry points to an enterprise network. Complementing this is a well-designed network infrastructure, which includes the hardware, software, and protocols that facilitate seamless communication and data transfer within an organization. As cyber threats become increasingly sophisticated, security automation emerges as a vital component, leveraging technology to perform security tasks with minimal human intervention, thereby enhancing the efficiency and effectiveness of threat detection and response. At the core of many security measures lies cryptography, the science of encoding and decoding information to ensure data confidentiality, integrity, and authenticity. Together, these elements form a comprehensive approach to cybersecurity, addressing the multifaceted challenges of protecting sensitive information in an ever-evolving digital world.
In this module, you will:
Enhance endpoint security.
Configure network infrastructure.
Initiate security automation.
Apply cryptography concepts.
Exam Objectives Covered
With endpoint security, a comprehensive approach is essential to protect an organization's digital infrastructure, integrating various tools and methodologies to create a robust defense system. Endpoint detection and response () and endpoint privilege management are critical for real-time threat detection and access control, ensuring rapid response to potential security incidents. monitoring and reduction are crucial for identifying and mitigating potential vulnerabilities, especially in specialized and legacy systems that often have unique security challenges. Endpoint protection tools and application control measures work together to prevent unauthorized access and mitigate the risk of malicious software. Mobile device management (MDM) technologies address the security needs of mobile endpoints, which are increasingly integral to modern business operations.
Understanding and countering the evolving tactics, techniques, and procedures (TTPs) of threat actors is vital, as these adversaries continuously adapt their methods to exploit any weaknesses. Security and privacy considerations underpin all these efforts, ensuring that sensitive information is protected. Industry-specific challenges necessitate tailored security solutions to meet regulatory and operational demands, particularly for specialized and legacy systems. Event logging and monitoring provide a comprehensive record of system activities, facilitating incident detection and forensic analysis. Together, these elements form a cohesive cybersecurity strategy that is crucial for safeguarding organizational assets and ensuring operational resilience.
As you study this lesson, answer the following questions:
What are the key components of a comprehensive endpoint security approach, and how do they contribute to protecting an organization's digital infrastructure?
How can network segmentation and the implementation of firewalls enhance the security of an organization's network infrastructure?
What are some common use cases for security automation in cybersecurity operations, and how do these automated processes reduce the workload on security teams?
How does cryptography contribute to data security in modern IT environments, and what are the best practices for implementing cryptographic measures to protect sensitive information?
Endpoint Detection and Response () tools continuously monitor endpoints to detect and respond to potential threats in real time. Unlike traditional anti-malware tools that primarily focus on identifying and removing known malware, solutions offer a more advanced and proactive approach to endpoint security. solutions leverage advanced analytics, machine learning, and behavioral analysis to identify unusual or suspicious activities that may indicate a security issue and can identify threats that signature-based anti-malware tools may not recognize. Furthermore, provides detailed forensic data and visibility into endpoint activities, helping security teams to investigate incidents to understand their scope and impact more efficiently.
Traditional anti-malware tools rely heavily on signature-based detection methods. While effective at detecting known threats, anti-malware tools typically struggle to identify any new or evolving threat, such as a zero-day exploit or sophisticated, custom malware that utilizes evasion techniques. Additionally, anti-malware tools generally only offer basic remediation capabilities, such as quarantine or deletion, but lack the event timeline features associated with solutions.
systems continuously collect and analyze a wide range of data from endpoints, including process activity, network connections, file changes, and user behaviors. This enables to build a detailed baseline of normal activity and use it to detect anomalies that traditional tools would miss. systems also provide mechanisms to quickly contain and remediate threats, such as isolating infected endpoints from the network, terminating malicious processes, and rolling back malicious changes. Traditional anti-malware tools typically lack these advanced types of features.
A non-comprehensive list of solutions include:
Microsoft Defender
Trend Micro Vision One
Cybereason Defense Platform
Palo Alto Networks Cortex
Cynet
CrowdStrike Falcon Insight
Endpoint privilege management () refers to the processes, tools, and policies designed to control and monitor administrative privileges on endpoints such as desktops, laptops, and servers. The goal of is to reduce risk by limiting the access rights of users and applications to provide higher levels of assurance that only authorized individuals have the minimum permissions necessary to perform authorized actions on endpoints.
The driver for solutions is rooted in the principle of least privilege. By implementing , organizations can further mitigate the risk of privilege escalation attacks. solutions help to control who can install software, restrict access to system settings, and monitor the use of administrative privileges. For example, on an EPM-controlled endpoint, a user may be required to request elevated privileges to install a new application, which would then be granted, and the solution would log the action. Privileged access would then be automatically revoked after a specified period.
A non-exhaustive list of solutions includes:
CyberArk Privileged Access Management https://www.cyberark.com/what-is/privileged-access-management/
BeyondTrust Privilege Management https://www.beyondtrust.com/privilege-management
Delinea Privilege Manager https://delinea.com/products/privilege-manager
Osquery Endpoint Privilege Management (open source) https://osquery.io
Ivanti Application Control https://www.ivanti.com/products/application-control
Implementing requires both technical tools and policy definition and enforcement. The solution depends upon policies detailing who can have elevated privileges, under what circumstances privileges can be granted, and how the use of privileges will be monitored and audited.
monitoring and reduction describe practices aimed at minimizing potential entry points for attack or exploitation. The represents the sum of all possible vulnerabilities and access pathways an attacker could exploit to gain unauthorized access. Effective monitoring (and reduction) of the requires continuous assessment and mitigation efforts because the changes in parallel to the dynamic nature of software and systems in use within the organization.
monitoring includes monitoring networks, applications, endpoints, and other systems for potential vulnerabilities. By continuously scanning for vulnerabilities, organizations can detect and address security issues before attackers exploit them. Monitoring also includes tracking newly discovered vulnerabilities and applying patches or updates to mitigate them. monitoring and management are closely related concepts but have distinct focuses and methodologies. monitoring focuses on an organization's potential entry points, including all systems, applications, network components, and physical security.
By comparison, management specifically targets identifying and remedying software and hardware vulnerabilities, often via scanning and remediation efforts focused on known issues prioritized by CVSS score. monitoring is much more holistic and aims to understand the interdependencies and interactions between various assets to identify weaknesses and minimize potential attack entry points by eliminating unnecessary services, strengthening configurations, and fortifying defenses based on informed analysis of possible risks. Some common approaches to this end include application hardening, network segmentation, endpoint security/hardening, and regular audits and assessments supporting these efforts.
A non-exhaustive list of vendor products designed to support management include:
Qualys External Management https://www.qualys.com/apps/external-attack-surface-management/
Tenable Management https://www.tenable.com/products/attack-surface-management
CrowdStrike Falcon Exposure Management https://www.crowdstrike.com/platform/falcon-exposure-management/
CyCognito Management https://www.cycognito.com/platform/attack-surface-management.php
Axonius <https://www.axonius.com>
Many different tools with distinct properties and approaches to security must work cohesively to improve endpoint resilience. While the benefits of endpoint protection software are easy to understand, integrating and using these tools present many challenges, including verifying compatibility with existing systems and applications, overcoming user resistance to changes and restrictions, providing adequate training, avoiding performance degradation, developing effective and balanced security policies, and scaling solutions sufficiently to handle growth without overcommitting budget funds needed elsewhere.
HIPS and HIDs
Host-based intrusion protection systems (HIPS) and host-based detection systems (HIDS) monitor and analyze a host's activities to detect suspicious behavior. HIDS and HIPS functionality is often provided by the same software tool, but the difference in detection versus prevention functionality is based on its configuration, i.e., operating in detect-only mode vs. detect and prevent mode. When configured to operate as an IPS, this software can identify and block threats in real time. For example, if a process attempts to alter a critical system file, HIPS/HIDS can detect this action and prevent the file from being modified.
Additional Reading and Resources Related to IDS:
What is HIDS?: https://sysdig.com/learn-cloud-native/what-is-hids/
What is HIPS?: https://www.zenarmor.com/docs/network-security-tutorials/what-is-host-intrusion-prevention-system-hips
Snort Rules: https://docs.snort.org/start/rules
Snort and Snort Rules Explained: https://www.crowdstrike.com/cybersecurity-101/threat-intelligence/snort-rules/
Antimalware
Antimalware tools continuously scan a system for known malware signatures and suspicious behavior patterns. Antimalware is designed specifically to identify and remove viruses, trojans, ransomware, and other malicious software. For example, if a user downloads a file, the antimalware tool scans it for malicious content before allowing it to execute, providing assurance that it is safe. While antimalware is critically important for defending against malicious software, it is by no means a perfect solution because it depends largely on identifying known malware.
Antimalware remains an essential component of a comprehensive security strategy. However, its effectiveness against modern threats is becoming increasingly limited. To ensure adequate protection, organizations must implement additional security measures, such as network segmentation, intrusion detection and prevention systems, security awareness training, and routine assessments. Antimalware is still essential, but one part of a layered security strategy instead of being relied upon as the sole defense against malware and attacks. Established benefits of anti-malware include:
Antimalware forms the first line of defense, blocking common and known malware threats.
Constantly monitors system activity, files, and network traffic.
Signature databases and detection algorithms are regularly updated to address new and emerging threats.
Many modern antimalware solutions offer various layers of protection, including behavior-based analysis, sandboxing, and cloud-based intelligence.
In addition, there are shortcomings of antimalware in the face of modern attacks and exploits, including:
Antimalware generally struggles to detect malware strains not identified and added to signature databases.
Polymorphic and metamorphic malware (malware that constantly changes internal code and structure) is difficult for signature-based detection to identify accurately.
Traditional file-scanning techniques struggle with fileless malware that operates entirely in memory.
Highly sophisticated attacks often use customized malware and exploit specific vulnerabilities, making it difficult for generalized antimalware solutions to detect them.
Many successful attacks trick users into clicking on malicious links or downloading infected files that are crafted to bypass antimalware protections.
Consider the following additional reading:
Malware Protection: Strategies and Tools: https://www.bitdefender.com/business/infozone/malware-protection.html
Security-Enhanced Linux (SELinux)
Security-Enhanced Linux (SELinux) enforces strict access controls based on predefined security policies. Security policies define what actions users and applications can perform to help limit the potential impact of a security breach. For example, if a web server is compromised, SELinux policies can prevent the attacker from accessing sensitive files or executing unauthorized commands. In essence, SELinux defines what interactions can occur within the operating system at a very granular level. Consider additional reading:
SELinux User's and Administrator's Guide: https://docs.redhat.com/en/documentation/red\_hat\_enterprise\_linux/7/html/selinux\_users\_and\_administrators\_guide/index
SELinux Project Wiki: https://selinuxproject.org/page/Main\_Page
Gentoo Linux SELinux Wiki: https://wiki.gentoo.org/wiki/SELinux
Application Control
Application control ensures that only authorized and trusted applications can run on endpoints to reduce the risk of malicious software and unauthorized applications compromising them. A common approach used to accomplish this is allow-listing. This approach establishes and enforces a list of approved applications. Any application not on the list is blocked from running. Application control can also include block-listing, where known malicious or unauthorized applications are explicitly blocked, but everything else is allowed. While easier to manage and less prone to false positives than allow-listing, block-listing is less effective against new and unknown software threats.
Several products support application control. One popular example is Microsoft's AppLocker, which allows administrators to create rules that limit and restrict the software that can run on Windows hosts. AppLocker can control executable files, scripts, Windows Installer files, and DLLs. Microsoft Software Restriction Policies work similarly but offer less comprehensive and granular protections. Other examples include:
Broadcom (formally Symantec) Endpoint Protection https://www.broadcom.com/products/cybersecurity/endpoint (which includes application control as part of a broad suite of tools.)
Ivanti Application Control https://www.ivanti.com/products/application-control
Trellix Application Control https://www.trellix.com/products/trellix-application-control/
Application control is an effective tool for preventing ransomware attacks. For example, if a new (previously unknown) ransomware variant attempts to execute on an endpoint, application control policies will block the unknown application from running, preventing the ransomware from encrypting files. Application control can prove to be a crucial defense against ransomware, zero-day threats, and advanced persistent threats (APTs).
Host-Based Firewalls
Host-based firewalls control a device's incoming and outgoing network traffic based on predefined rules, just like a network firewall. Common configurations for host-based firewalls involve setting rules defining which applications can send and receive data, which ports can be accessed, and which IP addresses can initiate connections. These rules can be tailored to the specific needs of the host, providing granular control over network activity. Host-based firewalls are particularly effective for protecting against advanced attacks because they offer close control over the processes running on a device. They can prevent malware from communicating with command and control servers, block unauthorized users from accessing sensitive data, stop suspicious applications from establishing external connections, and help prevent an attacker from performing lateral movement within an environment.
Browser Isolation
Browser isolation prevents web-based threats from accessing a device's operating system or the network it is connected to. The fundamental idea behind browser isolation is to create a barrier between the operating system and potentially harmful web content by executing web browsing activities in a separate, isolated environment. This approach mitigates the impact of harmful content contained in websites. The primary purpose of browser isolation is to protect users from web-based threats, such as malware, ransomware, phishing attacks, and malicious scripts. Browser isolation provides a high level of protection against zero-day vulnerabilities and other sophisticated attacks that traditional antivirus solutions may not detect immediately.
Remote Browser Isolation (RBI) - The user's browsing session is executed on a remote server rather than on their device. The user's device never directly interacts with the web content, preventing malicious code from reaching the endpoint.
Local Browser Isolation - The browser runs in a contained environment, such as a virtual machine or a sandbox on the user's device. This method helps prevent malicious content from accessing the operating system.
Event Logging
Event logging and monitoring provide visibility into an organization's IT environment by collecting, analyzing, and interpreting logs generated by operating systems, applications, and network devices.
Event logging involves capturing detailed records of events that occur on an endpoint, such as login attempts, file accesses, application executions, and system errors. Each log entry typically includes information about the event type, time-stamp, source, and the user or process associated with the event. For example, a Windows-based system can generate log data detailing successful and failed login attempts, changes to system configurations, and record when specific programs run. By aggregating logs, security teams can view endpoint activity comprehensively, making it easier to identify potential security issues.
For example, an unusual spike in failed login attempts could indicate a brute-force attack, while unexpected changes to system files might suggest malware activity. Monitoring logs in real time allows organizations to detect and respond to security incidents as they occur. Security Information and Event Management () systems, such as Splunk or IBM QRadar, play a pivotal role in this process because they collect logs from many endpoints and centralize them for easier analysis. Modern solutions can leverage machine learning and behavioral analytics to identify suspicious patterns that might go unnoticed by human analysts, or maybe take longer to identify. Event logging and monitoring also support and forensic investigations. When a security incident occurs, logs provide valuable information about the sequence of events leading up to the incident, helping investigators understand how the breach happened, what was affected, and who was responsible.
Additionally, event logging and monitoring are crucial compliance requirements. Many regulatory frameworks, such as , , and , mandate the logging and monitoring of security events, so maintaining detailed logs helps organizations demonstrate compliance with these laws.
Enterprise Mobility Management
Enterprise Mobility Management (EMM) describes a suite of policies and technology tools designed to enable centralized management and control of mobile devices in a corporate setting. Whether corporate or personally owned, EMM governs the ways in which users interact with devices and how users, devices, and apps integrate with the organization's larger network so as to enable high levels of mobility while simultaneously ensuring information security. A subset of EMM, Mobile Device Management (MDM) focuses on the control of mobile devices to ensure compliance with an organization's security requirements. Some features include:
Application Control, Provides the capability to install, configure, block and/or remove apps from a device.
Passwords/Passcodes, Enforces password quality policies or password protection for individual apps. This includes enforcing pin-codes, patterns, and/or biometric authentication.
Requirements, Can be enabled and enforced to protect access to corporate resources from a managed device and also used during device enrollment to protect against unauthorized access. Using conditional access configurations, can be set as a requirement only under certain circumstances, such as the geographic location of the device.
Token-based Access, Associated with network access control (NAC), token-based access requires an enrolled device to provide a token issued by an solution in order to gain access to network resources.
Patch Repository, Managed devices can be centrally patched and device patches can be distributed to devices in a controlled and scheduled manner by the MDM.
Screenshot of the Microsoft Azure "Device enrollment - Apple enrollment" page in Microsoft Intune, highlighting the process to set up Apple MDM Push Certificate and showing additional options for device management.
Screenshot used with permission by Microsoft.
Configuration Management
Configuration management is a critical aspect of IT infrastructure management that involves maintaining and organizing the configuration of hardware, software, and other systems (such as cloud resources) to ensure they operate reliably and consistently. The primary purpose of configuration management is to establish and maintain consistency for a system's functional and security attributes throughout its operation. It helps organizations control and document system changes to reduce the risk of errors and improve compliance. Configuration management helps increase focus on stability and security and ensures that organizations adhere to industry standards and regulations. This is particularly crucial for large enterprises, financial institutions, healthcare organizations, and government agencies. By maintaining detailed records of configuration changes, organizations such as these can quickly identify what has been altered, by whom, and when to support easier troubleshooting, auditing, and rollbacks when necessary.
Configuration management also plays a key role in DevOps by automating the process of deploying and configuring systems. This automation ensures that development, testing, and production environments are consistent, reducing the likelihood of human error and deployment times. The efficiency gained from automation is a significant benefit of configuration management.
Note:
Some common examples of configuration management products include Puppet, Chef, and Ansible.
Threat-actor tactics, techniques, and procedures (TTPs) describe the methods attackers use to exploit systems. Tactics are the adversary's overarching goals or strategies, such as gaining initial access or exfiltrating data. Techniques are the general methods to achieve these goals, while procedures are the specific approaches or tools used.
Understanding the TTPs used by threat actors known to target a specific industry sector steers the design of effective endpoint security controls within that sector. Security analysts and architects can anticipate and mitigate potential threats by understanding how attackers operate. For example, recognizing that attackers often use credential dumping to steal passwords, including the specific tools and methods used to accomplish it, enables security architects to implement endpoint controls that can detect and prevent such attacks.
Common TTPs and Countermeasures
Injections include inserting malicious code into an application or system, resulting in the execution of unwanted commands. Injection attacks such as SQL injection, cross-site scripting, command injection, LDAP injection, XML injection, and others necessitate the use of protections like input validation, secure coding practices, and runtime protection to prevent unauthorized code execution.
Privilege escalation involves attackers gaining elevated access to protected resources, such as exploiting a that allows a standard user account to operate like an administrative one. Defensive protections include access controls, regular audits of user permissions, and user account activity monitoring (for signs of atypical activity.)
Credential dumping describes the extraction of authentication credentials from a system to gain unauthorized access. To be used, credentials must be stored in file systems and loaded into system memory. Credential dumping targets the mechanisms intended to safely store and use credentials. To counter credential dumping attacks, endpoint security controls must use strong encryption for stored credentials, require periodic password changes, and use tools to help monitor all attempts to access or export credential information.
Unauthorized execution is a general term that describes running software (such as malicious code) or commands without proper authorization. It can result from a successful privilege escalation attack, poorly configured access controls, or web applications that do not perform authorization checks prior to performing privileged actions. Controls designed to provide protection from unauthorized execution include execution policies, application allow lists, and activity monitoring to detect and block related activities.
Lateral movement describes an attacker's movement through a network to locate and access additional targets after an initial breach. Controls designed to protect against lateral movement include network segmentation, host-based firewalls, and internal traffic monitoring. Zero-trust architectural design principles are especially relevant in this context because they specifically address the need to validate and authorize all interactions between systems and software.
Diagram illustrating an attacker using lateral movement within a network to spread ransomware from an initially compromised server to additional systems.
Defensive evasion describes the methods attackers use to avoid detection and underscores the importance of continuous improvement. To effectively counter defensive evasion, endpoint security controls should incorporate advanced detection strategies like machine learning and behavioral analytics, defense in depth, and continuous intrusion detection signature updates to help thwart new evasion tactics.
The Internet of Things (IoT), System-on-Chip (SoC), embedded systems, wireless, and operational technology (OT) are all common in modern technology infrastructures. Each of these has unique characteristics, applications, and security challenges, though they often overlap and interconnect in complex ways.
Internet of Things (IoT) refers to interconnected devices that can communicate with each other and a specialized central service that is commonly Cloud-based. These devices range from home appliances and wearable technology to industrial machinery and city infrastructure. IoT aims to enhance efficiency, automate processes, and improve the user experience by enabling devices to gather and exchange data.
However, IoT devices are often vulnerable to security breaches due to their vast number, diverse nature, and frequently inadequate security measures, making them prime targets for hackers. Securing IoT devices generally requires strong authentication methods, such as long, complex, unique passwords and multi-factor authentication (), to prevent unauthorized access. Data encryption is crucial to protect data transmitted between devices and servers from being intercepted or tampered with. Regular software updates and patch management help address vulnerabilities and keep devices secure. Network segmentation isolates IoT devices from critical systems, reducing the impact of a potential breach. Additionally, monitoring and logging device activity can help detect and respond to suspicious behavior in real time.
A system-on-chip (SoC) integrates all the components of a computer into a single chip. These can include the central processing unit (CPU), memory, and input/output functions. SoCs are designed for efficiency and compactness and are ideal for mobile and embedded applications. While SoCs offer multiple benefits, including lower power consumption and reduced size, they present security challenges, such as susceptibility to hardware-level attacks and difficulties updating and patching their embedded firmware.
Embedded systems are specialized computing systems that perform dedicated tasks within larger systems. They are vital to many devices, ranging from consumer electronics to industrial machines. The design of embedded systems focuses on specific tasks, optimizing performance, power consumption, and reliability. Security protections for embedded systems can be challenging in ways that parallel the problems associated with IoT and SoC because they are often difficult to access physically. When supported by devices, is a mechanism that can help protect embedded systems by providing a method to validate software digital signatures during the boot process.
Additionally, support for data encryption at rest and in motion is a critically important feature of any embedded system. Negative testing and penetration testing (pentesting) are also important approaches for assessing the security of embedded systems. These testing methodologies help to identify vulnerabilities and ensure that security controls are active and working as expected. Negative testing describes providing the system with invalid, unexpected, or random inputs to test its behavior and evaluate the quality of its software from a security viewpoint.
Input validation testing tests how the system handles invalid inputs, such as malformed data, unexpected characters, or data of incorrect types.
Boundary value testing assesses values at the edge of acceptable input ranges to help ensure that the system handles minimum and maximum values correctly and does not result in overflow vulnerabilities.
Error handling verifies that the system responds appropriately to errors, such as failed connections, corrupted data, or unusual inputs.
Resource limitation testing attempts to deliberately exhaust system resources such as memory, storage, or processing to determine if the system can continue operating without crashing or failing to operate securely.
Wireless and radio frequency (RF) technologies are essential for a wide range of applications, including mobile communication, Wi-Fi networks, and IoT devices. However, wireless communication introduces security risks such as interception, eavesdropping, and jamming. Encryption and authentication mechanisms are paramount to secure wireless communication.
Securing Wi-Fi communications involves using encryption protocols like WPA3 to safeguard data transmissions from unauthorized access. Strong authentication methods, such as and EAP-TLS, help to ensure that only authorized users and devices can connect to the wireless network. Frequency hopping and spread spectrum techniques help minimize the risk of interception, interference, and jamming by continuously changing the frequency of the wireless signal. Regularly updating firmware and software addresses known vulnerabilities and keeps network equipment secure. Network segmentation can isolate wireless traffic from critical systems, limiting the impact of any potential breaches of the wireless network. Physical security measures, such as secure access points and shielding, prevent unauthorized access to wireless equipment.
Operational Technology (OT) describes the hardware and software that monitors and controls physical devices in an industrial environment. OT systems include SCADA, ICS, and HVAC systems. OT systems prioritize availability and reliability over security and are often vulnerable to attack as a result. Because OT systems increasingly depend on IT infrastructure, they become even more exposed to exploitation. Securing OT systems requires specialized strategies that address both cyber and physical security. Common controls include strict configuration controls, configuration monitoring, stateless packet filtering firewalls, and air-gapping.
Types of Operational Technology
Supervisory Control and Data Acquisition (SCADA) systems monitor and control industrial processes, collecting data from sensors and sending commands to control equipment. These systems are common in the critical energy, water, and transportation infrastructure sectors. SCADA systems usually operate in real-time environments, where downtime can have significant consequences.
Industrial Control Systems (ICS) refer to control systems and the instrumentation used for industrial process control. These include distributed control systems (DCS), programmable logic controllers (PLC), and other types of automation systems. ICS are fundamental to the operation of critical infrastructure and manufacturing processes. The primary security challenges for ICS include protecting against attacks that could disrupt operations or cause physical damage to equipment and facilities.
A close-up view of an industrial programmable logic controller (PLC) system installed within a control panel, showing multiple connected modules and cables.
Image © 123rf.com
Heating, Ventilation, and Air Conditioning (HVAC) and environmental systems maintain comfortable and safe indoor environments. These systems are increasingly automated and connected, allowing remote monitoring and control. Large-scale, modern HVAC systems are integrated with IT networks to support remote management and control, exposing them to threats. In extreme cases, compromised HVAC systems can lead to operational disruptions, energy inefficiencies, and even physical harm. In the case of the Target breach in 2014, attackers used the HVAC environment to gain access to the Point of Sale environment and steal customer credit card data.
The Internet of Things (IoT), System-on-Chip (SoC), embedded systems, wireless, and operational technology (OT) are all common in modern technology infrastructures. Each of these has unique characteristics, applications, and security challenges, though they often overlap and interconnect in complex ways.
Internet of Things (IoT) refers to interconnected devices that can communicate with each other and a specialized central service that is commonly Cloud-based. These devices range from home appliances and wearable technology to industrial machinery and city infrastructure. IoT aims to enhance efficiency, automate processes, and improve the user experience by enabling devices to gather and exchange data.
However, IoT devices are often vulnerable to security breaches due to their vast number, diverse nature, and frequently inadequate security measures, making them prime targets for hackers. Securing IoT devices generally requires strong authentication methods, such as long, complex, unique passwords and multi-factor authentication (), to prevent unauthorized access. Data encryption is crucial to protect data transmitted between devices and servers from being intercepted or tampered with. Regular software updates and patch management help address vulnerabilities and keep devices secure. Network segmentation isolates IoT devices from critical systems, reducing the impact of a potential breach. Additionally, monitoring and logging device activity can help detect and respond to suspicious behavior in real time.
A system-on-chip (SoC) integrates all the components of a computer into a single chip. These can include the central processing unit (CPU), memory, and input/output functions. SoCs are designed for efficiency and compactness and are ideal for mobile and embedded applications. While SoCs offer multiple benefits, including lower power consumption and reduced size, they present security challenges, such as susceptibility to hardware-level attacks and difficulties updating and patching their embedded firmware.
Embedded systems are specialized computing systems that perform dedicated tasks within larger systems. They are vital to many devices, ranging from consumer electronics to industrial machines. The design of embedded systems focuses on specific tasks, optimizing performance, power consumption, and reliability. Security protections for embedded systems can be challenging in ways that parallel the problems associated with IoT and SoC because they are often difficult to access physically. When supported by devices, is a mechanism that can help protect embedded systems by providing a method to validate software digital signatures during the boot process.
Additionally, support for data encryption at rest and in motion is a critically important feature of any embedded system. Negative testing and penetration testing (pentesting) are also important approaches for assessing the security of embedded systems. These testing methodologies help to identify vulnerabilities and ensure that security controls are active and working as expected. Negative testing describes providing the system with invalid, unexpected, or random inputs to test its behavior and evaluate the quality of its software from a security viewpoint.
Input validation testing tests how the system handles invalid inputs, such as malformed data, unexpected characters, or data of incorrect types.
Boundary value testing assesses values at the edge of acceptable input ranges to help ensure that the system handles minimum and maximum values correctly and does not result in overflow vulnerabilities.
Error handling verifies that the system responds appropriately to errors, such as failed connections, corrupted data, or unusual inputs.
Resource limitation testing attempts to deliberately exhaust system resources such as memory, storage, or processing to determine if the system can continue operating without crashing or failing to operate securely.
Wireless and radio frequency (RF) technologies are essential for a wide range of applications, including mobile communication, Wi-Fi networks, and IoT devices. However, wireless communication introduces security risks such as interception, eavesdropping, and jamming. Encryption and authentication mechanisms are paramount to secure wireless communication.
Securing Wi-Fi communications involves using encryption protocols like WPA3 to safeguard data transmissions from unauthorized access. Strong authentication methods, such as and EAP-TLS, help to ensure that only authorized users and devices can connect to the wireless network. Frequency hopping and spread spectrum techniques help minimize the risk of interception, interference, and jamming by continuously changing the frequency of the wireless signal. Regularly updating firmware and software addresses known vulnerabilities and keeps network equipment secure. Network segmentation can isolate wireless traffic from critical systems, limiting the impact of any potential breaches of the wireless network. Physical security measures, such as secure access points and shielding, prevent unauthorized access to wireless equipment.
Operational Technology (OT) describes the hardware and software that monitors and controls physical devices in an industrial environment. OT systems include SCADA, ICS, and HVAC systems. OT systems prioritize availability and reliability over security and are often vulnerable to attack as a result. Because OT systems increasingly depend on IT infrastructure, they become even more exposed to exploitation. Securing OT systems requires specialized strategies that address both cyber and physical security. Common controls include strict configuration controls, configuration monitoring, stateless packet filtering firewalls, and air-gapping.
Types of Operational Technology
Supervisory Control and Data Acquisition (SCADA) systems monitor and control industrial processes, collecting data from sensors and sending commands to control equipment. These systems are common in the critical energy, water, and transportation infrastructure sectors. SCADA systems usually operate in real-time environments, where downtime can have significant consequences.
Industrial Control Systems (ICS) refer to control systems and the instrumentation used for industrial process control. These include distributed control systems (DCS), programmable logic controllers (PLC), and other types of automation systems. ICS are fundamental to the operation of critical infrastructure and manufacturing processes. The primary security challenges for ICS include protecting against attacks that could disrupt operations or cause physical damage to equipment and facilities.
A close-up view of an industrial programmable logic controller (PLC) system installed within a control panel, showing multiple connected modules and cables.
Image © 123rf.com
Heating, Ventilation, and Air Conditioning (HVAC) and environmental systems maintain comfortable and safe indoor environments. These systems are increasingly automated and connected, allowing remote monitoring and control. Large-scale, modern HVAC systems are integrated with IT networks to support remote management and control, exposing them to threats. In extreme cases, compromised HVAC systems can lead to operational disruptions, energy inefficiencies, and even physical harm. In the case of the Target breach in 2014, attackers used the HVAC environment to gain access to the Point of Sale environment and steal customer credit card data.
Securing specialized and legacy systems in critical industry sectors such as utilities, transportation, healthcare, manufacturing, financial services, and government/defense is a complex problem. These environments often depend on outdated technology, making them vulnerable to attack. Each sector faces unique problems when attempting to balance the need for continuous operation, regulatory compliance, and the integration of security controls.
Utilities and Transportation
In the utilities sector, the primary challenge lies in securing critical infrastructure systems, which are often outdated and not designed initially with modern cybersecurity threats in mind. These systems, including SCADA (Supervisory Control and Data Acquisition) and ICS (Industrial Control Systems), are crucial for operating power grids, water treatment facilities, and other essential services. Securing these systems is complicated because they are integrated with physical processes and need to operate continuously. This makes it challenging to apply security patches and updates. Furthermore, the dispersed nature of utility assets makes centralized security management and monitoring more difficult.
Transportation systems, encompassing railways, aviation, maritime, and road transport, face significant challenges due to the reliance on a combination of modern and legacy systems. These systems often include critical components such as signaling systems, communication networks, and operational control centers, which must remain functional continuously. Integrating these systems with IoT (Internet of Things) devices and increasing demands for real-time data exchange increases their . Additionally, ensuring the security of these systems is complicated by the varying regulatory requirements and standards across regions and modes of transport, necessitating highly specialized approaches to cybersecurity.
Examples:
IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a
E-ISAC 2023 report highlights cybersecurity triumphs and challenges in electricity sector: https://industrialcyber.co/reports/e-isac-2023-report-highlights-cybersecurity-triumphs-and-challenges-in-electricity-sector/
50,000 security disasters waiting to happen: The problem of America's water supplies: https://www.nbcnews.com/tech/security/hacker-tried-poison-calif-water-supply-was-easy-entering-password-rcna1206
Healthcare and Manufacturing
Healthcare systems are particularly vulnerable due to the sensitive nature of the data they handle and the criticality of their operations. Legacy systems, such as outdated medical devices and hospital information systems, are often still in use due to high replacement costs and the risks associated with transitioning to new systems in an environment where health and safety represent the core of daily operations. Legacy systems are not realistically designed to withstand modern cyber threats, making them prime targets for attacks like ransomware, which can disrupt patient care and compromise sensitive health data. Furthermore, the healthcare sector faces strict regulatory requirements, such as (Health Insurance Portability and Accountability Act) in the United States, which mandate rigorous data protection and privacy measures, adding complexity to securing systems.
In the manufacturing sector, the primary challenge is protecting industrial control systems (ICS) and operational technology (OT) environments from cyber threats. These systems often run on legacy software and hardware that lack robust security features. Manufacturing environments also typically include a mix of proprietary and third-party systems, making it challenging to implement uniform security measures. Additionally, the interconnection of manufacturing systems with enterprise IT networks increases their attack vectors. Security controls in manufacturing must balance the need for availability and reliability with security requirements, as any downtime can lead to significant financial losses.
Financial and Government/Defense
The financial sector continues to depend on legacy systems and software that handle vast amounts of sensitive data and critical financial transactions. These systems are often integrated with newer technologies, creating a complex IT environment. The primary challenge is ensuring the security of these legacy systems while maintaining operational integrity and compliance with stringent regulatory requirements. Due to the high value of the data they handle, financial institutions are prime targets for attackers, necessitating robust security measures to protect against sophisticated threats.
Government and defense sectors face unique challenges in securing their systems due to the critical nature of their operations, the highly sensitive information they manage, and the sophistication level of the attackers they often face. Legacy systems in these sectors typically include outdated software and hardware that are difficult to update or replace due to budgetary constraints and the potential impact on mission-critical operations. Security architects must secure these systems against a wide range of threats, including nation-state adversaries and malicious insiders. Additionally, government and defense agencies must adhere to stringent security standards and protocols, such as those outlined in the NIST (National Institute of Standards and Technology) Cybersecurity Framework, while ensuring interoperability between diverse systems and other government agencies.
Specialized and legacy systems are often integral components in many industries, especially those with long-established infrastructure, such as banking, healthcare, and manufacturing.
Specialized systems are designed for specific, often critical, tasks. They often control industrial processes, manage financial transactions, or retain critical medical records. Legacy systems continue to be used despite the availability of more modern solutions because they are deeply integrated into the organization's operations, and replacing them is prohibitively expensive and complex.
Security Challenges
One of the most pressing security issues with specialized and legacy systems is that they can be fundamentally unable to secure. These systems were designed prior to the establishment of modern security standards, meaning they lack the architectural framework needed to support contemporary security measures. For example, they frequently do not support encryption or multi-factor authentication, and attempts to retrofit security solutions often fail due to incompatibility or may even introduce new vulnerabilities by exposing other parts of the system.
Obsolescence is a major concern for legacy systems as the hardware and software components that comprise these systems are no longer produced or supported, and updates to address new vulnerabilities are not available. These factors make them attractive targets for attackers who can exploit known vulnerabilities using different, well-established methods. Additionally, obsolete technologies are rarely compatible with newer, more modern systems and monitoring tools, creating significant gaps in security coverage.
Unsupported systems no longer receive vendor updates or technical support and present a significant security risk. Organizations cannot receive patches for newly discovered vulnerabilities without vendor support, leaving the systems exposed. This problem is exacerbated by the fact that legacy systems typically require specialized knowledge to maintain, and the expertise needed to secure and manage these outdated systems is difficult to acquire.
Highly constrained systems have limited processing power, memory, or storage capabilities. These constraints severely limit the ability to implement modern security measures, such as encryption, intrusion detection systems, and comprehensive logging. Additionally, the software running on these systems might be so highly optimized for performance that even minor changes can disrupt functionality in unacceptable ways.
Security Implications of Specialized and Legacy Systems
The security challenges associated with specialized and legacy systems are compounded by their critical roles in operations. In sectors like healthcare, the failure of these systems can be life-threatening, while in finance, breaches can result in significant financial loss and legal repercussions. Organizations must often rely on compensating controls, such as network segmentation, strict access controls, and rigorous monitoring, to mitigate the risks attributed to operating specialized and legacy systems.
Exam Objectives Covered
Addressing network infrastructure issues, such as network misconfigurations, is crucial as they can create vulnerabilities that are easily exploited by attackers. Issues with Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) further complicate the security posture, potentially allowing threats to go undetected or unmitigated. Observability plays a vital role in this context, providing comprehensive insights into system performance and security and enabling the identification and resolution of anomalies. Domain Name System (DNS) security is another critical aspect, as DNS is often targeted by attackers to redirect traffic or disrupt services. Email security is essential to protect against phishing and other email-based threats that can lead to data breaches. Cryptography issues, such as weak encryption algorithms or poor key management, can undermine the confidentiality and integrity of sensitive data. Resource exhaustion attacks, which deplete system resources, can lead to service disruptions and degrade system performance. Together, these elements form a cohesive cybersecurity strategy that is essential for maintaining the integrity and availability of an organization's digital assets.
As you study this lesson, answer the following questions:
What are the common challenges and limitations associated with Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) in network infrastructure, and how can organizations effectively address these issues?
How does email security integrate with network infrastructure to protect against phishing, malware, and other email-based threats, and what are the best practices for ensuring secure email communications?
What are the key vulnerabilities associated with DNS security in network infrastructure, and what measures can organizations take to protect against DNS-based attacks such as DNS spoofing and cache poisoning?
What are the common signs and symptoms of a resource exhaustion attack on a network or system, and how can administrators quickly identify and respond to such incidents?
Exam Objectives Covered
Addressing network infrastructure issues, such as network misconfigurations, is crucial as they can create vulnerabilities that are easily exploited by attackers. Issues with Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) further complicate the security posture, potentially allowing threats to go undetected or unmitigated. Observability plays a vital role in this context, providing comprehensive insights into system performance and security and enabling the identification and resolution of anomalies. Domain Name System (DNS) security is another critical aspect, as DNS is often targeted by attackers to redirect traffic or disrupt services. Email security is essential to protect against phishing and other email-based threats that can lead to data breaches. Cryptography issues, such as weak encryption algorithms or poor key management, can undermine the confidentiality and integrity of sensitive data. Resource exhaustion attacks, which deplete system resources, can lead to service disruptions and degrade system performance. Together, these elements form a cohesive cybersecurity strategy that is essential for maintaining the integrity and availability of an organization's digital assets.
As you study this lesson, answer the following questions:
What are the common challenges and limitations associated with Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) in network infrastructure, and how can organizations effectively address these issues?
How does email security integrate with network infrastructure to protect against phishing, malware, and other email-based threats, and what are the best practices for ensuring secure email communications?
What are the key vulnerabilities associated with DNS security in network infrastructure, and what measures can organizations take to protect against DNS-based attacks such as DNS spoofing and cache poisoning?
What are the common signs and symptoms of a resource exhaustion attack on a network or system, and how can administrators quickly identify and respond to such incidents?
Exam Objectives Covered
Addressing network infrastructure issues, such as network misconfigurations, is crucial as they can create vulnerabilities that are easily exploited by attackers. Issues with Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) further complicate the security posture, potentially allowing threats to go undetected or unmitigated. Observability plays a vital role in this context, providing comprehensive insights into system performance and security and enabling the identification and resolution of anomalies. Domain Name System (DNS) security is another critical aspect, as DNS is often targeted by attackers to redirect traffic or disrupt services. Email security is essential to protect against phishing and other email-based threats that can lead to data breaches. Cryptography issues, such as weak encryption algorithms or poor key management, can undermine the confidentiality and integrity of sensitive data. Resource exhaustion attacks, which deplete system resources, can lead to service disruptions and degrade system performance. Together, these elements form a cohesive cybersecurity strategy that is essential for maintaining the integrity and availability of an organization's digital assets.
As you study this lesson, answer the following questions:
What are the common challenges and limitations associated with Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) in network infrastructure, and how can organizations effectively address these issues?
How does email security integrate with network infrastructure to protect against phishing, malware, and other email-based threats, and what are the best practices for ensuring secure email communications?
What are the key vulnerabilities associated with DNS security in network infrastructure, and what measures can organizations take to protect against DNS-based attacks such as DNS spoofing and cache poisoning?
What are the common signs and symptoms of a resource exhaustion attack on a network or system, and how can administrators quickly identify and respond to such incidents?
Observability is a modern IT and software engineering concept that focuses on understanding and diagnosing systems by examining their outputs and behaviors. It extends beyond traditional monitoring by providing deeper insights into the internal states of complex systems. The goal is to make understanding what is happening inside a system easier, especially when issues or anomalies arise.
The Key Tenants of Observability
Observability starts with the instrumentation of code, which requires the implementation of code designed specifically to generate logs, metrics, and traces to help capture detailed information about a system's behavior and performance.
Traces provide a view of the system's operations by tracking requests propagating through various services and components. Distributed tracing helps identify bottlenecks, latencies, and failures in microservices architectures.
Logs must detail all events that occur within a system. Logs provide context and can be used to track execution flow, debug issues, and understand system behavior. High-quality logging requires time-stamped records of all relevant events, errors, and informational messages.
Metrics provide quantitative measurements of a system's performance and health, typically including CPU usage, memory consumption, request counts, and error rates. Metrics can be aggregated and visualized to identify trends and anomalies.
The Domain Name System (DNS) is a type of directory service that presents a hierarchical naming system for entities connected to a network, usually the Internet. DNS translates an easy-to-remember name of a domain into its corresponding host IP address. Applications also rely on DNS servers for name resolution. While Internet service providers (ISPs) maintain common DNS servers, enterprises provision their own DNS servers to control how domains and hosts are resolved internally.
DNS is a critical service and should be configured to be fault-tolerant. If an attacker can target the DNS server on a private network, it is possible to seriously disrupt the operation of that network.
To ensure DNS security on a private network, local DNS servers should only accept recursive queries from local hosts (preferably authenticated local hosts) and not from the Internet. It is also necessary to implement access controls on the server to prevent a malicious user from altering records. Similarly, clients should be restricted to using authorized resolvers to perform name resolution.
Attacks on DNS may also target the server application and/or configuration. Many DNS services run on BIND (Berkley Internet Name Domain), distributed by the Internet Software Consortium (isc.org). There are known vulnerabilities in many versions of the BIND server, so it is critical to patch the server to the latest version. The same general advice applies to other DNS server software, such as Microsoft's, and patching and updates to DNS must receive the highest level of priority.
DNS footprinting describes obtaining information about a private network by querying its DNS server directly by performing a zone transfer (extracting all the records for a namespace) using a tool such as nslookup or dig. You can apply an Access Control List to prevent zone transfers to unauthorized hosts or domains or to prevent the transfer of information about the private network architecture.
Domain Name System Security Extensions (DNSSEC)
Domain Name System Security Extensions (DNSSEC) is a suite of specifications designed to protect the integrity and authenticity of DNS data. Its primary purpose is to prevent attackers from manipulating or spoofing DNS responses. DNSSEC achieves this by adding cryptographic signatures to DNS records. When a DNS resolver queries a DNSSEC-protected zone, it can validate the response using these signatures to validate the integrity and source of the response.
DNS Poisoning
DNS poisoning occurs when attackers insert false DNS records into a resolver's cache to redirect users to fraudulent websites. For example, an attacker could make a legitimate domain name resolve to a malicious IP address and intercept sensitive information such as login credentials. DNSSEC helps mitigate this risk by ensuring that DNS responses can be verified for authenticity.
Sinkholing
When a domain is known to be associated with malware or other malicious activities, client DNS requests for the domain can be redirected to a safe alternative that can log and alert on the event, or simply provide an NXDOMAIN response. This technique helps reduce the impact of malicious domains by effectively neutralizing them. Below are some additional resources regarding sinkholing:
How DNS Sinkholing Works: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/use-dns-queries-to-identify-infected-hosts-on-the-network/dns-sinkholing
Quad9 DNS: https://www.quad9.net
Cloudflare DNS: https://www.cloudflare.com/application-services/products/dns/
What is NXDOMAIN: https://www.dnsknowledge.com/whatis/nxdomain-non-existent-domain-2/
Zone Transfers
Zone transfers replicate a DNS database across multiple DNS servers. There are two types of zone transfers: full (AXFR) and incremental (IXFR). A full zone transfer involves transferring the entire zone file, while an incremental zone transfer only updates the changes made since the last transfer. Zone transfers are critical for maintaining consistency and reliability across DNS servers, especially in larger networks. However, if not properly secured, they can expose sensitive information about the domain's structure to attackers. Proper configuration and access controls designed to limit where zone transfers can occur are necessary to ensure that only authorized servers can perform them.
Domain Keys Identified Mail (DKIM)
DKIM is an email authentication method that helps detect forged sender addresses by allowing the receiver to verify that an email claiming to come from a specific domain is authorized by the domain's owner. Validation is achieved by checking a cryptographic signature included in the email's header.
Common issues with DKIM include misconfigured DNS records, which can cause emails to fail DKIM checks and result in delivery problems. Public keys used in the DKIM configuration must be properly published in DNS, and any misconfiguration can cause verification failures. Other issues include using short keys, which are vulnerable to brute-force attacks, and not rotating keys to defend from compromise. Additionally, problems can occur when the domain in a DKIM signature does not match the domain in the "From" header of the email, leading to emails being marked as spam.
More details regarding DKIM are described at https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/
Sender Policy Framework
SPF is an email validation protocol designed to detect and prevent email spoofing. It specifies which mail servers are allowed to send emails on behalf of a domain and checks the sender's IP address against a list of authorized IP addresses published in the domain's DNS records.
Common SPF issues involve incorrect or incomplete SPF records, which can cause legitimate emails to fail SPF checks and be marked as spam. Additionally, SPF limits the number of DNS lookups to 10 per SPF check to prevent excessive DNS queries, which could lead to denial-of-service attacks or performance issues. Another challenge is the lack of support for SPF alignment, which ensures that the domain used in the SPF check matches the domain in the email's "From" header, thereby preventing email spoofing and phishing attacks. Even if an email passes SPF checks, it might fail DMARC checks if the domains do not align. SPF alignment can be either strict or relaxed. In strict alignment, the domain in the "Return-Path" (the domain that SPF validates) must exactly match the domain in the "From" header. In relaxed alignment, the domain in the "Return-Path" must be a subdomain of the domain in the "From" header. Some additional resources include:
What is an SPF Record? https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/
What is SPF (Sender Policy Framework)? https://proton.me/blog/what-is-sender-policy-framework-spf
Domain-based Message Authentication Reporting & Conformance (DMARC)
DMARC builds on SPF and DKIM by adding a reporting function that allows domain owners to receive feedback on email authentication failures. DMARC helps to protect against phishing and spoofing by specifying how to handle emails that fail SPF or DKIM checks.
Common DMARC issues include misconfigured policies that can result in legitimate emails being rejected or quarantined. Incomplete or incorrect DKIM and SPF configurations can also lead to DMARC failures. Additionally, the complexity of DMARC reports can make it challenging to identify and resolve authentication problems.
Analyzing DMARC reports can provide insights into authentication failures and help fine-tune the configurations. If legitimate emails are rejected due to DMARC failures, reviewing and adjusting the DMARC policy to a more relaxed setting can help. Also, ensuring that both DKIM and SPF are correctly configured and aligned with DMARC policies is essential. Some additional resources include:
Learn DMARC https://www.learndmarc.com
DMARC Academy https://www.dmarc-academy.com/
Secure/Multipurpose Internet Mail Extension
Secure/Multipurpose Internet Mail Extension (S/MIME) is a protocol for sending digitally signed and encrypted emails. S/MIME uses public key cryptography to encrypt email messages (the body) and create digital signatures.
Common S/MIME issues include certificate management problems, such as expired or revoked certificates, which prevent users from sending or receiving encrypted emails. Compatibility issues between different email clients can also pose challenges, as not all clients fully support S/MIME, and key exchange and storage are complex mechanisms to implement and support.
If users cannot send or receive encrypted emails due to certificate issues, ensuring that all necessary certificates are valid is essential. Verifying compatibility between different email clients and updating to versions that support S/MIME can help resolve compatibility issues. Additionally, using established public key infrastructures (PKIs) can help mitigate key management issues.
Transport Layer Security (TLS) errors generally occur due to misconfigurations, expired certificates, and mismatched TLS versions, ciphers, or protocols between a client and a server. For example, if a server's certificate expires, clients will receive a warning indicating the connection is insecure. Similarly, when a server uses an outdated or unsupported TLS version, handshake failures (when the initial negotiation process between a client and server fails) will occur. Verifying certificate status and ensuring the client and server support the same TLS versions are important troubleshooting steps.
One of the most common issues happens when the client and server do not support the same versions of TLS, resulting in a cipher mismatch. During the TLS handshake, the client and server exchange lists of supported cipher suites. If there are no common cipher suites, the handshake cannot be completed. This can happen if one side only supports older, less secure ciphers while the other only supports modern, more secure ones. For example, if a server only supports TLS 1.3, but the client only supports up to TLS 1.2 In this scenario, the handshake will fail and display an error in the browser. Outdated operating systems and browser software commonly cause these types of problems, but it can also happen when a modern, fully updated browser attempts to access an outdated or improperly configured web server.
Screenshot of Mozilla Firefox showing a "Secure Connection Failed" error with SSL\_ERROR\_NO\_CYPHER\_OVERLAP when accessing a website.
Screenshot used with permission by Mozilla Firefox.
Cryptographic Implementation and
Cryptographic implementation issues stem from inadequate encryption algorithms, insecure protocols, or incorrect implementation of cryptographic standards, resulting in vulnerabilities. For example, using a deprecated hashing algorithm like MD5 can expose systems to collision attacks. Issues can also occur when random number generators are not carefully selected, resulting in issues where an attacker can determine the private key.
Public Key Infrastructure () issues frequently involve improper certificate management, trust anchor problems, or incorrect certificate use. Common issues include certificates issued by an untrusted Certificate Authority (CA), improperly configured intermediate certificates, or compromised private keys. When a web server uses an untrusted certificate, browsers will initially block access to the site and display a warning.
Common Certificate Management Issues
Clients (browsers) will not trust expired certificates and will block access to the site. When certificates are not renewed before their expiration date, the secure connections they support become untrustworthy and generate errors.
Using the wrong certificate for a domain will result in connection failures. For example, if a certificate issued for CompTIA.com is used for CompTIA.org, browsers will reject the connection and display an error.
Browsers will not recognize certificates issued by untrusted (such as self-signed certificates) or compromised CAs, leading to trust warnings and connection errors. However, if the certificate is known to be trustworthy, the browser can be manually configured to trust it.
Certificates commonly rely on a chain of trust, from the root CA to intermediate CAs to the end-entity certificate. If the chain is incomplete or improperly configured, clients cannot verify the certificate's authenticity and will display error messages. More information regarding chain of trust concepts is available at https://www.ssldragon.com/blog/chain-of-trust/
When access to the private keys associated with digital certificates is not properly managed, the key could be exposed. Breaching a private key in this way could lead to successful person-in-the-middle (on-path) attacks because the encrypted communication between a client and server can be intercepted and decrypted by the attacker who now possesses the private key needed to protect it.
Certificates might need to be revoked before expiration due to factors such as private key exposure. If browsers (or other software such as an API) do not check for certificate revocation using CRLs (Certificate Revocation Lists) or OCSP (Online Certificate Status Protocol), they might continue to trust revoked (and therefore untrustworthy) certificates.
Transport Layer Security (TLS) errors generally occur due to misconfigurations, expired certificates, and mismatched TLS versions, ciphers, or protocols between a client and a server. For example, if a server's certificate expires, clients will receive a warning indicating the connection is insecure. Similarly, when a server uses an outdated or unsupported TLS version, handshake failures (when the initial negotiation process between a client and server fails) will occur. Verifying certificate status and ensuring the client and server support the same TLS versions are important troubleshooting steps.
One of the most common issues happens when the client and server do not support the same versions of TLS, resulting in a cipher mismatch. During the TLS handshake, the client and server exchange lists of supported cipher suites. If there are no common cipher suites, the handshake cannot be completed. This can happen if one side only supports older, less secure ciphers while the other only supports modern, more secure ones. For example, if a server only supports TLS 1.3, but the client only supports up to TLS 1.2 In this scenario, the handshake will fail and display an error in the browser. Outdated operating systems and browser software commonly cause these types of problems, but it can also happen when a modern, fully updated browser attempts to access an outdated or improperly configured web server.
Screenshot of Mozilla Firefox showing a "Secure Connection Failed" error with SSL\_ERROR\_NO\_CYPHER\_OVERLAP when accessing a website.
Screenshot used with permission by Mozilla Firefox.
Cryptographic Implementation and
Cryptographic implementation issues stem from inadequate encryption algorithms, insecure protocols, or incorrect implementation of cryptographic standards, resulting in vulnerabilities. For example, using a deprecated hashing algorithm like MD5 can expose systems to collision attacks. Issues can also occur when random number generators are not carefully selected, resulting in issues where an attacker can determine the private key.
Public Key Infrastructure () issues frequently involve improper certificate management, trust anchor problems, or incorrect certificate use. Common issues include certificates issued by an untrusted Certificate Authority (CA), improperly configured intermediate certificates, or compromised private keys. When a web server uses an untrusted certificate, browsers will initially block access to the site and display a warning.
Common Certificate Management Issues
Clients (browsers) will not trust expired certificates and will block access to the site. When certificates are not renewed before their expiration date, the secure connections they support become untrustworthy and generate errors.
Using the wrong certificate for a domain will result in connection failures. For example, if a certificate issued for CompTIA.com is used for CompTIA.org, browsers will reject the connection and display an error.
Browsers will not recognize certificates issued by untrusted (such as self-signed certificates) or compromised CAs, leading to trust warnings and connection errors. However, if the certificate is known to be trustworthy, the browser can be manually configured to trust it.
Certificates commonly rely on a chain of trust, from the root CA to intermediate CAs to the end-entity certificate. If the chain is incomplete or improperly configured, clients cannot verify the certificate's authenticity and will display error messages. More information regarding chain of trust concepts is available at https://www.ssldragon.com/blog/chain-of-trust/
When access to the private keys associated with digital certificates is not properly managed, the key could be exposed. Breaching a private key in this way could lead to successful person-in-the-middle (on-path) attacks because the encrypted communication between a client and server can be intercepted and decrypted by the attacker who now possesses the private key needed to protect it.
Certificates might need to be revoked before expiration due to factors such as private key exposure. If browsers (or other software such as an API) do not check for certificate revocation using CRLs (Certificate Revocation Lists) or OCSP (Online Certificate Status Protocol), they might continue to trust revoked (and therefore untrustworthy) certificates.
Exam Objectives Covered
Understanding security automation is critical in today's world. Hardware security technologies and features play a pivotal role in fortifying the foundational layers of an organization's cybersecurity posture, providing robust defenses against physical and firmware-level threats. These technologies are essential in countering threat-actor tactics, techniques, and procedures (TTPs), which often exploit hardware vulnerabilities through sophisticated scripting, scheduling, and event triggers. The advent of generative AI has further complicated the threat landscape, necessitating advanced solutions like Security Orchestration, Automation, and Response () to streamline and enhance processes. Workflow automation, auto-containment, and automated patching are integral components of , enabling organizations to swiftly and efficiently address vulnerabilities and contain threats without manual intervention. These interconnected elements collectively enhance an organization's ability to proactively defend against and respond to emerging threats, underscoring their critical importance in maintaining robust cybersecurity defenses.
As you study this lesson, answer the following questions:
What are some key hardware security features that can be integrated into computing devices, and how do these features contribute to the overall security posture of an organization?
How can organizations effectively monitor and analyze the Tactics, Techniques, and Procedures (TTPs) of threat actors to enhance their cybersecurity defenses and proactively mitigate potential threats?
How does the implementation of Security Orchestration, Automation, and Response () platforms enhance an organization's ability to manage and respond to security incidents, and what are the key features to look for when selecting a solution?
What are the primary benefits of workflow automation for an organization, and how can businesses identify which processes are best suited for automation?
Exam Objectives Covered
Understanding security automation is critical in today's world. Hardware security technologies and features play a pivotal role in fortifying the foundational layers of an organization's cybersecurity posture, providing robust defenses against physical and firmware-level threats. These technologies are essential in countering threat-actor tactics, techniques, and procedures (TTPs), which often exploit hardware vulnerabilities through sophisticated scripting, scheduling, and event triggers. The advent of generative AI has further complicated the threat landscape, necessitating advanced solutions like Security Orchestration, Automation, and Response () to streamline and enhance processes. Workflow automation, auto-containment, and automated patching are integral components of , enabling organizations to swiftly and efficiently address vulnerabilities and contain threats without manual intervention. These interconnected elements collectively enhance an organization's ability to proactively defend against and respond to emerging threats, underscoring their critical importance in maintaining robust cybersecurity defenses.
As you study this lesson, answer the following questions:
What are some key hardware security features that can be integrated into computing devices, and how do these features contribute to the overall security posture of an organization?
How can organizations effectively monitor and analyze the Tactics, Techniques, and Procedures (TTPs) of threat actors to enhance their cybersecurity defenses and proactively mitigate potential threats?
How does the implementation of Security Orchestration, Automation, and Response () platforms enhance an organization's ability to manage and respond to security incidents, and what are the key features to look for when selecting a solution?
What are the primary benefits of workflow automation for an organization, and how can businesses identify which processes are best suited for automation?
In modern hardware, several technologies are employed to improve and maintain security. Each of these technologies offers unique capabilities and often work together to create a robust security ecosystem.
Virtual hardware describes the emulation of physical hardware using software and is the enabling technology for virtual machines (VMs). Virtual hardware allows different operating systems and applications to run in separate VMs. Additionally, virtual hardware supports secure environments for testing and development without the risk of exposing physical hardware.
Self-healing hardware is designed to detect and repair faults or security vulnerabilities automatically and is crucial in maintaining integrity and availability. Self-healing hardware uses redundancy, error-correcting codes, and built-in diagnostic tools to help identify issues and trigger corrective actions. For example, if a hardware component shows signs of imminent failure, self-healing mechanisms can switch to a standby component or implement reconfigurations that bypass the faulty part. This capability is essential in critical systems, such as those used in healthcare, where downtime and data corruption can have literal life-or-death consequences.
Tamper detection and countermeasures describe the mechanisms for detecting and responding to unauthorized access attempts or hardware modifications. For example, physical sensors can detect when a device chassis is opened, voltage sensors can identify power supply tampering, and cryptographic methods verify firmware integrity. When tampering is detected, the system can trigger an alarm, write to an event log, turn off the device, or erase sensitive data to minimize exposure or damage. These technologies are useful in environments where hardware faces a high likelihood of physical attacks, such as ATMs, point-of-sale systems, and military equipment.
Host-based encryption encrypts data at the device level before transmitting or storing it. This approach ensures that data remains secure even if the device is lost or stolen. Host-based encryption can be implemented through hardware or software mechanisms and is particularly important for protecting sensitive information stored on laptops, tablets, and smartphones. Encrypting data at the source significantly reduces the risk of unauthorized access.
Self-encrypting drives (SEDs) are storage devices that automatically encrypt and decrypt data. SEDs use hardware-based encryption, which is often faster than software-based solutions and simultaneously reduces CPU load. Encryption keys are stored on the drive, which can enhance security by isolating them from the host operating system.
The adoption of these technologies is driven by the increasing prevalence of cyber attacks, the need to comply with regulatory standards, and the growing awareness of data privacy issues. For instance, financial institutions adopt Self-Encrypting Drives (SEDs) and host-based encryption schemes to adhere to data protection regulations such as and . Healthcare providers use self-healing hardware to maintain system availability and protect patient data, while government agencies utilize tamper detection to secure sensitive equipment from espionage or sabotage.
Threat actors utilize a variety of tactics, techniques, and procedures (TTPs) to compromise systems and data. Each technique exploits different elements of an environment (technical, physical, and human) to achieve adversarial objectives. The MITRE ATT&CK Framework provides a comprehensive library of threat actor groups and their TTPs. The following lists only a few common attacks focused on endpoint devices.
Firmware Tampering
Firmware tampering involves the unauthorized modification of a device's firmware. Attackers may insert malicious code into firmware updates or exploit firmware vulnerabilities to gain persistent system access. Typical security products and approaches are not well-equipped to identify firmware exploits, so this type of attack is particularly concerning because it often remains undetected for long periods.
The following is a non-comprehensive list of MITRE ATT&CK TTPs associated with firmware tampering:
T1195 Supply Chain Compromise https://attack.mitre.org/techniques/T1195/
T1542 System Firmware https://attack.mitre.org/techniques/T1542/
T1542.002 Component Firmware https://attack.mitre.org/techniques/T1542/002/
T1495 Firmware Corruption https://attack.mitre.org/techniques/T1495/
T1067 Bootkit): https://attack.mitre.org/techniques/T1067/
T1485 Data Destruction https://attack.mitre.org/techniques/T1485/
T1562 Inhibit Response Function https://attack.mitre.org/techniques/T1562/
BIOS/UEFI Attacks
The BIOS (Basic Input/Output System) and its modern successor, UEFI (Unified Extensible Firmware Interface), are specific types of firmware that control a computer's motherboard. They are responsible for initializing hardware, loading the operating system, and providing low-level system services. BIOS/UEFI attacks are a subset of firmware attacks. Due to the privileged nature of the BIOS/UEFI, successful attacks have severe consequences, such as compromising the boot process, turning off security features, or installing persistent malware.
For these reasons, compromising BIOS or UEFI allows attackers to gain deep control over a system, allowing them to install persistent malware that often survives operating system reinstalls and even hard drive replacements. Essentially, all of the TTPs listed for firmware attacks also apply to BIOS/UEFI.
Shimming
Shimming is a technique for inserting code between an application and an operating system. It allows modifications to be made without directly changing any original code by creating a "shim" between the application and the operating system it runs on. The Windows shim database, also known as the Application Compatibility Database, is a feature of the Windows operating system used to maintain backward compatibility with older applications. It contains instructions (shims) that modify the behavior of the operating system or an application to ensure compatibility with newer versions of Windows. Shims address issues associated with older applications running on newer Windows versions and are intended to support changes in API calls or system configurations. Shims are exploited on many operating systems, but the prevalence of the Windows operating system in large organizations makes it an appealing target.
The following is a non-comprehensive list of MITRE ATT&CK TTPs associated with shimming:
T1546.011 Event Triggered Execution: Application Shimming https://attack.mitre.org/techniques/T1546/011/
T1055 Process Injection https://attack.mitre.org/techniques/T1055/
T1574 Hijack Execution Flow https://attack.mitre.org/techniques/T1574/
Further Reading: Hunting for Application Shim Databases https://blog.f-secure.com/hunting-for-application-shim-databases/
USB-Base Attacks
USB-based attacks exploit the inherent trust that systems place in USB devices. Attackers use malicious USB devices to deliver malware, steal data, or gain control over a system. These attacks are effective because users typically trust USB devices. The Stuxnet worm is a historically significant example of a USB-based attack that used infected USB drives to spread malware targeting industrial control systems used to develop nuclear materials.
The following is a non-comprehensive list of MITRE ATT&CK TTPs associated with USB-based Attacks:
T1195 Supply Chain Compromise https://attack.mitre.org/techniques/T1195/
T1091 Replication Through Removable Media https://attack.mitre.org/techniques/T1091/
T1025 Data from Removable Media https://attack.mitre.org/techniques/T1025/
T1092 Communication Through Removable Media https://attack.mitre.org/techniques/T1092/
T1052.001 Exfiltration Over Physical Medium: USB https://attack.mitre.org/techniques/T1052/001/
Further Reading: Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon, by Kim Zetter (available from your favorite bookseller)
Memory Attacks
Memory attacks exploit vulnerabilities in memory management processes to execute arbitrary code, access sensitive data, or cause a system crash. Various buffer overflow techniques are used to exploit memory. The Spectre and Meltdown vulnerabilities exploited weaknesses in modern CPU memory handling capabilities to access protected memory areas, affecting nearly every modern processor at the time. Additional details regarding these vulnerabilities: https://www.cloudflare.com/learning/security/threats/meltdown-spectre/
The following is a non-comprehensive list of MITRE ATT&CK TTPs associated with memory attacks:
T1055.001 Process Injection: Dynamic-link Library Injection https://attack.mitre.org/techniques/T1055/001/
T1055.002 Process Injection: Portable Executable Injection https://attack.mitre.org/techniques/T1055/002/
T1055.009 Process Injection: Proc Memory https://attack.mitre.org/techniques/T1055/009/
T1055.013 Process Injection: Thread Execution Hijacking https://attack.mitre.org/techniques/T1055/013/
T1562.001 Impair Defenses: Disable or Modify System Firewall https://attack.mitre.org/techniques/T1562/001/
T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription https://attack.mitre.org/techniques/T1546/003/
T1068 Exploitation for Privilege Escalation https://attack.mitre.org/techniques/T1068/
T1543.003 Create or Modify System Process: Windows Service https://attack.mitre.org/techniques/T1543/003/
T1055 Process Injection https://attack.mitre.org/techniques/T1055/
T1562.006 Impair Defenses: Reflective Code Loading https://attack.mitre.org/techniques/T1562/006/
T1003.001 OS Credential Dumping: LSASS Memory https://attack.mitre.org/techniques/T1003/001/
Electromagnetic Interference and Electromagnetic Pulse
Electromagnetic interference (EMI) involves the disruption of electronic devices by introducing electromagnetic fields. While often considered a side effect of other activities, intentional EMI can be used to disrupt or damage electronic systems. For instance, attackers could use high-power EMI to disrupt critical infrastructure communication equipment or sensor systems.
Electromagnetic pulse (EMP) attacks are a more extreme form of EMI and involve high-intensity bursts of electromagnetic energy to cause widespread damage to electronic systems. EMP attacks can result from natural phenomena like solar flares or be manufactured through the detonation of a nuclear device at a high altitude. These attacks can debilitate electrical grids, communication networks, and virtually any electronic device, posing significant risks to national security. EMP poses a potential threat to power grids and is one of the many discussion points regarding the need to harden critical infrastructure against attack.
In security operations, automation is crucial for optimizing efficiency, reducing human error, and ensuring timely responses to potential threats. By combining different tools, security operations teams can achieve a high degree of automation that supports rapid detection and response. An integrated approach provides proactive and reactive benefits because it can address potential issues before they escalate and respond swiftly to newly identified issues.
Scripts can automate a wide range of activities, from simple log parsing to complex procedures. For example, a Python script can scan system logs for unusual activity patterns and generate alerts if suspicious behavior is detected. Security teams can create highly customized tools and responses designed to address their unique environment using scripting languages like Python, PowerShell, and Bash.
Bash is often used to create scripts that automate security checks and system hardening in Linux and Unix environments. For example, a script could be created to regularly scan a system for known vulnerabilities, check for the presence of unauthorized users, or verify the integrity of critical system files. Using cron, bash scripts can be scheduled to run at regular intervals, ensuring that security tasks are performed consistently and automatically. Bash can be integrated with system monitoring tools to perform pre-determined tasks in response to detected events, such as changes to critical system files or suspicious user authentication events. For example, a Bash script that triggers whenever the /etc/passwd file is modified. The script can capture the changes, log them, and alert the security operations team, allowing for quick detection of potential unauthorized modifications to user accounts.
PowerShell is generally associated with Windows environments and can be used similarly to bash for automating security tasks, such as managing user permissions, auditing event logs, or performing systems management tasks. PowerShell scripts can be scheduled using the Windows Task Scheduler to automate routine security tasks, such as updates or system scans. PowerShell can leverage the Windows Management Instrumentation (WMI) or Windows Event Log to identify and respond to specific security events. For example, a PowerShell script could trigger when the event log records multiple failed login attempts. The script could respond by locking the account, logging the event details, and sending a notification to the security operations team.
Python can also be used to develop sophisticated custom security tools and automate complex cybersecurity tasks, such as log analysis, threat detection, or , because of the extensive third-party ecosystem that exists to support and extend this programming language. For example, a Python script that analyzes firewall logs could be developed to identify unusual network traffic patterns, such as port scans or data exfiltration. The Python language is well-suited to parsing large volumes of logs, identifying potential threats by incorporating third-party libraries, and triggering numerous alert types to integrate more tightly with security infrastructure and supporting services.
Note:
Python for Blue Team: https://github.com/mrdraper/pythonforblueteam
For example, using an open-source database, a Python script could run daily to scan all endpoints for known malware signatures and report findings to a centralized logging platform or a .
Cron (Linux and Unix) and Windows Scheduled Tasks can run scripts at pre-determined intervals. Scheduled tasks are useful for routine maintenance and repetitive tasks. For example, a cron job might trigger a scan every night at midnight or update feeds every hour.
Event-based triggers respond to specific events in real time and are often configured using security information and event management () systems. When a detects an event that matches predefined criteria, such as multiple failed login attempts, an unauthorized change to a critical file, or malware detection, it can generate an alert to trigger automated responses. The response could be to run a script or trigger more sophisticated automation.
When these mechanisms are integrated, they provide a powerful framework for comprehensive security automation. For example, an event-based trigger can detect suspicious activity and execute a script that performs an initial analysis. Depending on the results, the script might then create a scheduled task to perform additional scans or collect more data at specific intervals, ensuring ongoing monitoring and mitigation of the threat. In a more complex scenario, a might detect a potential intrusion based on unusual network traffic patterns and trigger automation designed to quarantine the affected systems and gather forensic data.
Generative AI refers to artificial intelligence systems capable of creating new content, such as text, images, music, or code, that is often similar to content produced by people. Generative AI platforms have emerged from decades of artificial intelligence and machine learning advancements, specifically in neural networks and deep learning systems.
Generative AI will be highly disruptive across multiple sectors by transforming how people interact with technology, create content, and make decisions. It has tremendous potential to automate creative processes, generate realistic simulations, and enhance human-machine interactions. However, this level of disruption brings both significant opportunities and challenges, but the purpose of this discussion is to focus on how generative AI can support security automation. Put simply, there are very few areas in security operations where generative AI does not have a potential impact, although as of this writing, many of these items are still only potential.
Potential Impact Description
Threat Detection and Response Generative AI models can analyze network traffic patterns and user behaviors to search for threats within an organization's network proactively.
Automatically analyzing and correlating data from multiple sources to suggest or perform automated responses to detected threats, such as isolating compromised systems, blocking IP addresses, or deploying patches.
Security Policy Enforcement Assist in generating security policies based on best practices and observed behaviors within an organization and then continuously monitor for policy compliance, generate compliance reports, and alert when deviations are identified.
Identity and Access Management () Support through behavioral biometrics, verifying user identities based on observed interaction patterns and then dynamically adjusting access controls based on real-time risk assessments.
Security Training and Awareness Generate realistic phishing emails to test and train employees on recognizing and responding to phishing attempts and then create personalized security training tailored to individual employee needs.
Data Privacy and Protection Generate synthetic data sets that preserve the original data's statistical properties while protecting sensitive information. Additionally, AI can automatically identify and classify sensitive data.
Automated Document Creation Generate drafts of documents such as user manuals, API documentation, product guides, reports, proposals, and other business documents. Software development and project management teams can leverage generative AI to create real-time documentation, including progress reports, project documentation, and release notes based on real-time observations.
The application of generative AI for coding is particularly compelling. Some examples include:
Generate functions based on high-level descriptions.
Predict the next line or block of code.
Analyze existing code and suggest improvements for better performance.
Identify bugs and suggest fixes.
Generate unit and integration tests by analyzing existing code.
Translate code from one programming language to another.
Generative AI refers to artificial intelligence systems capable of creating new content, such as text, images, music, or code, that is often similar to content produced by people. Generative AI platforms have emerged from decades of artificial intelligence and machine learning advancements, specifically in neural networks and deep learning systems.
Generative AI will be highly disruptive across multiple sectors by transforming how people interact with technology, create content, and make decisions. It has tremendous potential to automate creative processes, generate realistic simulations, and enhance human-machine interactions. However, this level of disruption brings both significant opportunities and challenges, but the purpose of this discussion is to focus on how generative AI can support security automation. Put simply, there are very few areas in security operations where generative AI does not have a potential impact, although as of this writing, many of these items are still only potential.
Potential Impact Description
Threat Detection and Response Generative AI models can analyze network traffic patterns and user behaviors to search for threats within an organization's network proactively.
Automatically analyzing and correlating data from multiple sources to suggest or perform automated responses to detected threats, such as isolating compromised systems, blocking IP addresses, or deploying patches.
Security Policy Enforcement Assist in generating security policies based on best practices and observed behaviors within an organization and then continuously monitor for policy compliance, generate compliance reports, and alert when deviations are identified.
Identity and Access Management () Support through behavioral biometrics, verifying user identities based on observed interaction patterns and then dynamically adjusting access controls based on real-time risk assessments.
Security Training and Awareness Generate realistic phishing emails to test and train employees on recognizing and responding to phishing attempts and then create personalized security training tailored to individual employee needs.
Data Privacy and Protection Generate synthetic data sets that preserve the original data's statistical properties while protecting sensitive information. Additionally, AI can automatically identify and classify sensitive data.
Automated Document Creation Generate drafts of documents such as user manuals, API documentation, product guides, reports, proposals, and other business documents. Software development and project management teams can leverage generative AI to create real-time documentation, including progress reports, project documentation, and release notes based on real-time observations.
The application of generative AI for coding is particularly compelling. Some examples include:
Generate functions based on high-level descriptions.
Predict the next line or block of code.
Analyze existing code and suggest improvements for better performance.
Identify bugs and suggest fixes.
Generate unit and integration tests by analyzing existing code.
Translate code from one programming language to another.
Workflow automation leverages several modern technologies and practices to streamline and enhance critical and inherently risky processes. This approach requires the integration of several practices to enable a sophisticated automation approach that leverages modern platforms and tools to improve the efficiency and consistency of security operations.
Infrastructure as Code (IaC) is a practice where infrastructure is managed and provisioned through machine-readable files rather than physical hardware configuration or interactive configuration tools. Many tools used to enable IaC are covered in more depth in the Cloud Infrastructure lesson. To summarize, IaC enables the automation of infrastructure setup, scaling, and management and is especially well-suited to cloud infrastructure but is not limited to that platform. Tools like Terraform, OpenTofu, AWS CloudFormation, Ansible, and other similar products are the enablers of IaC. They allow developers, administrators, engineers, and architects to define infrastructure requirements in code to ensure consistent deployments. For example, developers can use Terraform scripts to automate the deployment of a secure web application built using microservices. The definitions for the deployment are often saved to YAML files. A great walkthrough describing how to use AWS Cloudformation to complete a task like this is available at https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/GettingStarted.html
Configuration files are crucial because they provide the parameters for deploying and managing applications and infrastructure. These files utilize formats such as YAML, JSON, TOML or XML and can be version-controlled similarly to source code.
YAML (YAML Ain't Markup Language) is a human-readable data serialization standard for configuration files and data exchange between languages with different data structures. It is known for its simplicity and ease of use, making it a popular choice for configuration management, such as in Docker Compose, Ansible, and Kubernetes. https://yaml.org/spec/1.2.2/
JSON (JavaScript Object Notation) is a lightweight data-interchange format that is easy for humans to read and write and for machines to parse and generate. It is based on a subset of the JavaScript programming language, but it is language-independent, making it a common choice for data exchange and configuration files. https://json.org/
TOML (Tom's Obvious, Minimal Language) is a configuration file format that's designed to be easy to read and write due to its simplicity and straightforward syntax. https://toml.io/en/
XML (eXtensible Markup Language) is a flexible text format for creating structured documents by defining custom tags widely used for configuration files, data exchange, and document representation. XML is both human-readable and machine-readable, making it highly versatile. https://www.w3.org/XML/
Cloud APIs and software development kits (SDKs) offer programmatic access to cloud services, enabling the integration of different tools and platforms within the security operations workflow. For example, enabling an application to check an identity against a Cloud-based product requires API integration. (Relatedly, webhooks perform similarly to APIs but are triggered into action by specific events; for example, a user creation event may trigger a webhook and be programmed to perform specific post-event asks.) Developing an application that must check identities against Cloud-based benefits from using an SDK with integrated capability supporting the creation of cloud-centric applications. APIs are the mechanisms that allow applications to interact with cloud services and can be used to automate important tasks such as provisioning resources, monitoring security events, and enforcing policies.
As described previously, IaC automates the deployment of Cloud resources; the IaC tools depend on APIs to authenticate and communicate with the Cloud platform. SDKs, on the other hand, provide libraries and tools that simplify the development of applications that interact with cloud services. For example, the AWS Boto3 CloudFormation SDK for Python can be used to automate tasks such as creating roles, managing security groups, and monitoring compliance with security policies. Other examples include the "terraform-exec" Go module and the "ansible-runner" Python library.
Containerization facilitates automation by enabling rapid deployment, scaling, and management of applications. Security operations teams can leverage containers to deploy and manage security tools in a scalable and isolated way.
A Continuous Integration/Continuous Deployment () pipeline is often used to support a development team building a microservices-based application deployed on a Kubernetes cluster. The development team is required to ensure that scanning and other compliance checks are integrated and automated throughout the pipeline.
The process starts when developers commit code to a version control system like Git. A CI tool like GitLab CI is triggered to begin the build process. This process includes containerizing the application using Docker or Podman (because Kubernetes does not containerize applications.) During the build stage, static analysis tools (SAST) perform checks to detect vulnerabilities within the code. If issues are detected, the build process fails, and developers are notified so they can mitigate the vulnerabilities. Once the build stage passes SAST checks, the container is scanned again using tools designed to locate vulnerabilities within the container, such as outdated software versions, libraries, or misconfigurations. As before, if critical vulnerabilities are found, the build fails to ensure that only secure container images are pushed to the container registry.
When all vulnerabilities are addressed and the container passes these preliminary checks, it can be deployed to a staging environment. Continuing with the Kubernetes example, Kubernetes admission controllers and policies, such as Open Policy Agent, can enforce security policies to further mitigate the risk of running images with known vulnerabilities. Additionally, compliance checks using tools like kube-bench can validate that configurations are aligned with industry security standards, such as CIS benchmarks. After successfully passing all preliminary tests and checks in the staging environment, the container image can be further evaluated using testing scripts and routines before promotion into the production environment, where security monitoring tools in the Kubernetes cluster continuously monitor for suspicious activities and policy violations and integrate with a Security Information and Event Management () platform to provide real-time problem detection.
Exam Objectives Covered
Understanding cryptography is essential for securely handling data. Post-Quantum Cryptography (PQC), Key Stretching, Key Splitting, and Envelope Encryption are advanced cryptographic techniques designed to enhance data security in the face of evolving threats, including those posed by quantum computing. and Secure Multiparty Computation enable secure data processing and sharing without exposing sensitive information, while Forward Secrecy and Mutual Authentication ensure that communication channels remain secure even if long-term keys are compromised. Authenticated Encryption with Associated Data (AEAD) combines encryption and authentication to protect data integrity and authenticity. Balancing cryptographic performance with security is crucial, as robust encryption mechanisms must not hinder system efficiency. Data security states, including data at rest, in transit, and in use, require tailored encryption and authentication mechanisms to ensure comprehensive protection. Blockchain and immutable records offer tamper-proof data storage, addressing data integrity and authenticity concerns. Legal and resource considerations, along with software integrity and provenance, play significant roles in implementing effective data protection and privacy strategies. Collectively, these elements form a multifaceted approach to safeguarding data.
As you study this lesson, answer the following questions:
Why is Post-Quantum Cryptography (PQC) essential for future-proofing data security, and what are the key challenges and considerations in transitioning to PQC algorithms?
How do key stretching, key splitting, and envelope encryption techniques enhance the security of cryptographic keys, and in what scenarios should each method be applied to protect sensitive data?
What are the most effective data protection techniques available today, and how can organizations determine the best combination of these methods to safeguard their sensitive information?
What are the different types of encryption techniques available, and how can organizations choose the most appropriate encryption method to secure their data based on specific use cases and regulatory requirements?
Post-quantum cryptography has rapidly grown into a critical field of study in response to the urgent and emerging threat posed by quantum computers. Quantum computers utilize quantum bits (qubits) rather than binary information processing, allowing them to perform complex calculations at unprecedented speeds. This capability threatens to make many current cryptographic systems, such as Diffie-Hellman and Elliptic Curve Cryptography (ECC), obsolete.
Diffie-Hellman and ECC are foundational elements of modern cryptographic protocols. Diffie-Hellman was introduced in the 1970s and allows two parties to exchange cryptographic keys over a public channel securely, and is based on the difficulty of computing discrete logarithms. Similarly, ECC is based on the algebraic structure of elliptic curves over finite fields. ECC offers strong cryptographic protections with comparatively short key lengths, making it efficient and leading to broad adoption.
The advent of quantum computing upends what has otherwise been a successful approach for many decades. Quantum algorithms such as Shor's algorithm can efficiently solve the discrete logarithm and integer factorization problems, which underpin the security of Diffie-Hellman and ECC. The ramifications are that once quantum computers become sufficiently advanced, they could crack these cryptographic schemes almost instantaneously.
Note:
More information about Shor's Algorithm is available at https://www.classiq.io/insights/shors-algorithm-explained
In response, post-quantum cryptography aims to develop cryptographic algorithms that are resistant to quantum attacks and based on mathematical problems that even quantum computers cannot solve efficiently. Lattice-based cryptography, hash-based cryptography, and multivariate polynomial cryptography are leading approaches in this quickly evolving field of study. Lattice-based cryptography relies on the computational hardness of complex geometric structures called lattices, hash-based cryptography uses hash functions to create secure digital signatures, and multivariate polynomial cryptography is based on the sums of products of multiple variables raised to various powers.
Several important considerations are required when designing cryptographic systems resistant to quantum decryption attacks. More specifically, the algorithms must provide security that scales with quantum advancements to ensure long-term data protection. However, they must also be practical in terms of performance and resource consumption by striking the ever-crucial balance between security and efficiency. These considerations directly impact design choices related to key size, computational overhead, and compatibility with existing infrastructure.
Thankfully, emerging implementations of post-quantum cryptography are already beginning to take shape. For example, the National Institute of Standards and Technology (NIST) in the United States is leading an international effort to evaluate and standardize quantum-resistant cryptographic algorithms. The initiative aims to identify algorithms that can be universally adopted to secure digital communications against future quantum threats. NIST has established a resource center for post-quantum located at https://csrc.nist.gov/projects/post-quantum-cryptography, and several publications are already available at <https://csrc.nist.gov/Projects/post-quantum-cryptography/publications>
Key stretching is a technique designed to strengthen a weak key through repeated hashing or the use of algorithms like PBKDF2, bcrypt, or scrypt. Key stretching significantly improves the security of cryptographic keys by effectively mitigating the risk posed by dictionary and brute-force attacks. The fundamental concept is to convert a potentially weak input, such as a user-chosen password, into a much stronger cryptographic key.
Key splitting describes how a cryptographic key can be split into multiple parts and distributed among different parties to ensure that no single entity has complete control over a key. This approach is useful in scenarios where trust is distributed among multiple stakeholders, such as with blockchain technologies. Key splitting improves security by ensuring that the entire key remains secure even if part of the key is compromised.
Envelope encryption is a sophisticated method of managing encryption keys. Data is first encrypted with a data encryption key (DEK), and then the DEK is encrypted with a key encryption key (KEK). The KEK is often stored in a hardware security module () or a dedicated key management service (KMS). By separating data encryption from key management, envelope encryption ensures that even if data is intercepted or otherwise accessed without authorization, it remains incomprehensible without the corresponding DEK. Only the KEK needs to be changed when it is time to rotate keys. The DEK is then re-encrypted with the new KEK, meaning the underlying encrypted data does not need to be decrypted and re-encrypted with a new key. The process of key-rotation is, therefore, much faster and less resource-intensive.
Key stretching plays a critical role in the initial stages of data security by transforming potentially weak keys into stronger ones and making brute-force attacks significantly more difficult. Key splitting distributes the control and trust associated with the keys by dividing them into multiple parts and distributing the parts among different entities. Envelope encryption provides an additional layer of security by simplifying key management tasks. When these practices are layered together, even if attackers gain access to encrypted data, they still need to overcome stretched encryption keys, reconstruct the split master key parts, and decrypt the DEKs protected by the KEKs.
is an advanced form of encryption that allows computations to be performed on ciphertexts, producing an encrypted result that, when decrypted, matches the outcome of operations as if they were actually performed on the plaintext. This technique enables secure data processing and computation without exposing the underlying data and maintains data privacy while allowing meaningful operations to be performed on sensitive data. The result is extremely compelling because it allows encrypted sensitive data to be shared with a third party, who can then process it without revealing any sensitive information! Applications range broadly from secure data storage and cloud computing to medical research and financial services.
Secure multiparty computation (SMC) is a cryptographic method that allows multiple parties to jointly compute a function over their inputs while keeping those inputs private. For example, each party inputs private data, and through a series of encrypted exchanges, they can collaboratively compute the desired result without revealing their private information to others. Applications of SMC include secret sharing, which describes a method of dividing data into parts and distributing it among various participants, and oblivious transfer, which is a cryptographic protocol where a sender has multiple pieces of information and a receiver chooses one of them to learn, without the sender knowing which piece was chosen.
and secure multiparty computation share the goal of preserving data privacy during computation. While focuses on enabling computations on encrypted data without decryption, SMC allows for collaborative computation among multiple parties without sharing their individual inputs. Both approaches offer solutions to privacy-preserving data analysis.
Forward secrecy, also known as perfect forward secrecy (PFS), ensures that past communications remain secure even if a long-term key is compromised. Forward secrecy is achieved by generating temporary session keys used for a single session and then discarding them once the session has been completed. This way, if an attacker obtains a session key, they can only access the data for that session, leaving previous and future communications protected. Forward secrecy depends upon key exchange protocols like Diffie-Hellman and Elliptic Curve Diffie-Hellman, which support the secure generation and exchange of session (ephemeral) keys. This attribute is essential in protocols like HTTPS, where maintaining confidentiality is crucial.
Mutual authentication is a process that builds trust between two parties by allowing them to verify each other's identities. In contrast to the more common one-way authentication method, where only the server is authenticated, mutual authentication requires both the server and the client to prove their identities. The mutual authentication process is typically dependent on the exchange of digital certificates, which play a pivotal role in verifying the identities of the parties. This process is used in environments requiring a high degree of trust and is foundational to Zero-Trust architectural design principles. Mutual authentication is sometimes referred to as two-way authenticaton and can be used to validate client and server endpoints in APIs or simple websites, device connectivity to physical or WiFi networks, VPN connections, and any other scenario where trust must be established in both directions.
Authenticated Encryption with Associated Data (AEAD) ensures that data remains private and also guarantees that data has not been altered. AEAD combines the functionalities of encryption and message authentication. In contrast to traditional encryption methods that often treat confidentiality and integrity tasks independently. AEAD algorithms do this by embedding authentication within encryption processes to ensure that any modification to encrypted data can be immediately detected. Integrity checks are achieved by using an authentication tag that accompanies the ciphertext. The tag is required for successful decryption, meaning that if the tag does not match after decryption, it indicates that the message has been altered and decryption fails.
AEAD also includes "associated data," which refers to additional information that must be authenticated but not encrypted, such as network communication headers. By incorporating associated data, AEAD can protect the integrity of network headers, ensuring that the headers and payload are trustworthy. AEAD addresses the risks associated with separating encryption and authentication mechanisms that are susceptible to cryptographic attacks such as person-in-the-middle (On-Path) and replay attacks. AEAD algorithms are recommended and widely used in modern cryptographic protocols, including TLS (Transport Layer Security) 1.3, and IPsec. The National Institute of Standards and Technology (NIST) also endorses AEAD algorithms, highlighting their importance in securing modern communication and data.
Cryptographic hardware improves the performance of cryptographic operations because it is designed specifically for processes cryptographic algorithms such as AES (Advanced Encryption Standard), RSA (Rivest-Shamir-Adleman), and ECC (Elliptic Curve Cryptography). A prime example of cryptographic hardware is the hardware security module (), which protects cryptographic keys.
Another example is the dedicated encryption/decryption features in modern CPUs, such as Intel's AES-NI (Advanced Encryption Standard New Instructions), which significantly improves the performance of AES encryption. Hardware acceleration drastically improves the performance of cryptographic operations, making them faster and less resource-intensive. This is critically important for applications requiring real-time data processing, such as online banking and VPNs (Virtual Private Networks). By offloading cryptographic tasks to dedicated hardware, the CPU can handle other tasks more efficiently. However, while hardware acceleration can improve performance, vulnerabilities in hardware can be significant. For example, the Spectre and Meltdown vulnerabilities are attributed to "speculative execution," which can bypass cryptographic protections when successfully exploited.
Note:
Introduction to Speculative Execution Side Channel Methods
Practically balancing performance and security involves rigorous testing and validation methods designed to ensure that hardware meets established security standards and is updated regularly to keep ahead of newly discovered vulnerabilities.
The Federal Information Processing Standards (FIPS) are fundamental in shaping the selection and evaluation of cryptographic hardware. Developed by the National Institute of Standards and Technology (NIST), FIPS ensures that cryptographic modules adhere to stringent security best practices and provide a benchmark for assessing their robustness. FIPS 140-2 establishes the security requirements that cryptographic modules must meet, encompassing aspects such as algorithm implementation, key protection, and the secure management of sensitive data. Organizations should prioritize FIPS 140-2 validated modules when selecting cryptographic hardware because the rigor of FIPS validation ensures that cryptographic hardware is secure and capable of defending against a myriad of threats.
Data at rest refers to information stored in filesystems on mass-storage devices (SSD, M.2, HDD, etc.), databases, and cloud storage. Encryption in the scenarios requires transforming the data using protocols such as AES (Advanced Encryption Standard). For example, if an attacker gains access to the physical storage devices used in a healthcare provider's database, the data stored on them would be unreadable.
The focus shifts to securing data as it moves across networks when considering data in transit. Data in this state can include a wide variety of types, like emails, web traffic, authentication requests, and any other data exchanged between devices. Encryption at this level ensures that data remains unreadable even if intercepted. TLS (Transport Layer Security) is ubiquitous for protecting data in transit (transport encryption) because it is very versatile. An important consideration for securing data in transit is validating the authenticity of endpoints, which is typically achieved using digital certificates.
Data in use/processing presents unique challenges because this data state applies to data actively used by applications. Because data must be decrypted before it can be processed, it exposes it to threats and unauthorized access and also hints at the value of memory-based attacks. specifically addresses this concern by allowing computations directly on encrypted data, with no decryption needed. holds promise for scenarios where data protection and privacy are paramount, such as in cloud computing, financial transactions, and medical research. For example, a medical research organization could provide health data to a third party to perform DNA analysis without ever revealing sensitive patient information.
Encrypted tunnels are essential for protecting data in transit, especially over potentially insecure networks. Without encryption, sensitive company resources and data transmitted over a public Wi-Fi network by remote workers could be intercepted by malicious actors. An encrypted tunnel, such as a Virtual Private Network (VPN), uses protocols like IPsec or SSL/TLS to create a secure, encrypted connection between the user's device and the company's server. Encryption ensures that data cannot be read even if it is successfully intercepted by an attacker, thereby preserving confidentiality and data integrity.
In a hybrid cloud environment, data and applications are distributed between on-premises data centers and public cloud platforms. This design provides flexibility and scalability but introduces risk for securing data as it moves between the cloud and on-premises environments. Encrypted tunnels ensure data remains safe and secure while enabling the two environments to connect seamlessly. It is important to note that encryption does not prevent traffic interception; it simply makes it unreadable.
Digital certificates provide a reliable method of verifying the identity of users, devices, and servers. Digital certificates are issued by Certificate Authorities (CAs) and contain public keys used for . Some practical examples of digital certificate use:
When visiting a secure website, the browser uses the site's digital certificate to authenticate the server's identity and the public key to share a session key securely.
Certificate-based authentication can replace or supplement traditional username and password methods for VPN access. Each user or device is issued a digital certificate, and when connecting to the VPN, the device presents its certificate, which the VPN server then verifies before establishing a secure connection. This technique ensures that only authorized devices can access the environment.
A financial services organization might use certificate-based authentication to ensure that only authorized applications can access sensitive financial data through an API.
Digital certificates can be stored on smart cards. When a user inserts their smart card into a reader, the system can use the certificate to authenticate the user.
Passwordless authentication is a popular mechanism for improving the rigor of authentication while also providing some convenience to employees and other users by eliminating the need for passwords. Because traditional passwords are highly vulnerable to phishing, brute force, and other attacks, passwordless authentication methods like biometrics and security tokens offer a secure and user-friendly alternative. Some examples include using biometrics instead of passwords, passkeys, and magic links.
Note:
More information about passkeys and magic links: https://blog.1password.com/passkeys-vs-magic-links-differences/
Non-repudiation is extremely important in legal and financial transactions. Digital signatures are commonly used to achieve this. When a person digitally signs a document, they use their private key to create a unique signature that can only be verified using their corresponding public key. This signature ensures that the document has not been altered and that the signer cannot later deny having signed it. For example, auditors can use digital signatures to verify the authenticity and integrity of contracts and establish a trail of accountability.
Encrypted email functionality depends on protocols such as PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) to encrypt email content and attachments. Using encryption in this way ensures that only the intended message recipient (who possesses the correct decryption key) can read the message. For example, an attorney handling confidential client information can leverage encrypted email to communicate securely with different clients to protect sensitive information from unauthorized access and exposure.
Data sanitization describes the process of permanently removing or concealing sensitive information to ensure it cannot be reconstructed or recovered and is especially important when disposing of hardware.
Cryptographic techniques play a significant role in meeting data sanitization requirements. For instance, if data stored on mass storage devices is encrypted, flawed sanitization attempts will result in exposing recovered data in an encrypted state. Hashing can also be used to store data in a representative state, replacing cleartext passwords or other sensitive data with a hash-based representation.
Data anonymization alters data to prevent the identification of individuals and is vital in contexts like medical research, financial services, customer analytics for e-commerce, telecommunications, education, social media, and government. For example, instead of recording individuals' exact ages, data might be grouped into age ranges. This technique helps prevent the identification of individuals because it obscures specific attributes.
A wide range of tools and practices are designed to help safeguard privacy in a digital environment. Privacy applications rely on cryptographic schemes like end-to-end encryption, Secure Multiparty Computation (SMC), and , which are covered in more detail in other lessons.
Blockchain and immutable databases are two modern technologies that rely heavily on cryptographic mechanisms to support security, integrity, and trust.
Cryptographic hashing plays a pivotal role in a blockchain. Hash functions like SHA-256 provide the digital fingerprint needed to identify tampering. This is particularly crucial for maintaining the integrity of transactions in a blockchain. For instance, in many blockchain implementations, each block (a set of data transactions or records) contains the hash of the previous block. This characteristic links blocks together, forming a digital chain. For an attacker to alter a transaction, they would need to alter the block containing it, including the hash of the block and the hash of all subsequent blocks, representing an insurmountable amount of computational work effort. also operates at the core of blockchain technology. For example, in a cryptocurrency transaction, the owner uses their private key to sign the transaction, and the network uses the corresponding public key to validate its authenticity.
The blockchain is recorded in a public ledger. The ledger does not exist as an individual file on a single computer. One of the most important characteristics of a blockchain is the fact that it is decentralized. The ledger is distributed across a peer-to-peer (P2P) network to mitigate the risks associated with a single point of failure, compromise, or abuse of the single centralized authority. Blockchain nodes trust each other equally. Another defining quality of a blockchain is its openness, every node has the same ability to view every transaction on the blockchain.
Diagram showing the simplified steps in a blockchain transaction process, from transaction request to permanent record in the blockchain.
An immutable database is one where data cannot be altered or deleted once written to ensure a permanent and tamper-proof record of all entries. They are ideal for scenarios requiring high levels of data integrity and auditability. Immutable databases depend upon cryptographic techniques to link records, which provide a transparent and verifiable history of all changes. These characteristics make them particularly well-suited to the finance, healthcare, and supply chain management industries.
Cryptographic techniques like digital signatures and hash trees (Merkle trees) are extremely important in immutable databases. Digital signatures guarantee data entries cannot be manipulated, supporting data integrity and non-repudiation requirements. Merkle trees enable efficient and secure verification of data integrity across large datasets. In practical terms, this means that systems can verify large amounts of data without reprocessing everything. For example, in a supply chain tracking system, each product's journey could be recorded in an immutable database, with digital signatures ensuring the authenticity of each entry and hash trees enabling rapid verification of data integrity.
Note:
More information about Merkle Trees is available at https://academy.binance.com/en/articles/merkle-trees-and-merkle-roots-explained
Zero-Knowledge Proofs (ZKPs) are becoming increasingly relevant for blockchains and immutable databases. ZKPs allow one party to prove to another that a statement is true without revealing any additional information. This characteristic is useful in privacy-focused applications, where sensitive data must be verified without exposing the data itself. In a digital voting system, for example, a ZKP could prove that a vote was valid without revealing who the vote was cast for to protect the integrity of the vote and the voter's privacy.
Note:
More information about Zero-Knowledge Proofs is available at <https://ethereum.org/en/zero-knowledge-proofs/>
It is critically important to understand the legal and regulatory frameworks governing the use of cryptography within a jurisdiction. For example, some countries mandate specific encryption standards for sensitive data, such as healthcare or financial information. Compliance with regulations like for healthcare data or the Gramm-Leach-Bliley Act for financial data is crucial in the United States. Similarly, the European Union's imposes strict requirements on data protection and necessitates robust encryption methods to safeguard personal information. Understanding these legal obligations is vital because non-compliance can lead to significant financial penalties.
The choice of cryptographic technique depends heavily on the nature of the data and the required level of security. methods, like AES, are great at encrypting large volumes of data, but managing keys (especially in large-scale systems) can pose significant challenges. , such as RSA, provides a solution for secure key exchange but comes with higher computational costs, which make it less suitable for encrypting large datasets. What is seen in practical terms is hybrid encryption, where symmetric and are used together to solve different parts of the cryptographic problem.
The computational overhead associated with different cryptographic methods can significantly impact system performance, especially in resource-constrained environments like mobile devices or embedded systems. In these cases, lightweight cryptographic algorithms designed to provide adequate security with lower resource consumption are often most appropriate. The complexity of cryptographic algorithms and protocols demands expertise in cryptographic best practices and is essential to avoid common pitfalls that can undermine security.
For example, improper implementation of seemingly minor details in encryption algorithms can lead to significant vulnerabilities. The role of a cryptographic specialist is becoming more crucial because they can implement and manage cryptographic systems and develop policies and procedures designed to ensure compliance with industry best practices and regulatory requirements.
It is critically important to understand the legal and regulatory frameworks governing the use of cryptography within a jurisdiction. For example, some countries mandate specific encryption standards for sensitive data, such as healthcare or financial information. Compliance with regulations like for healthcare data or the Gramm-Leach-Bliley Act for financial data is crucial in the United States. Similarly, the European Union's imposes strict requirements on data protection and necessitates robust encryption methods to safeguard personal information. Understanding these legal obligations is vital because non-compliance can lead to significant financial penalties.
The choice of cryptographic technique depends heavily on the nature of the data and the required level of security. methods, like AES, are great at encrypting large volumes of data, but managing keys (especially in large-scale systems) can pose significant challenges. , such as RSA, provides a solution for secure key exchange but comes with higher computational costs, which make it less suitable for encrypting large datasets. What is seen in practical terms is hybrid encryption, where symmetric and are used together to solve different parts of the cryptographic problem.
The computational overhead associated with different cryptographic methods can significantly impact system performance, especially in resource-constrained environments like mobile devices or embedded systems. In these cases, lightweight cryptographic algorithms designed to provide adequate security with lower resource consumption are often most appropriate. The complexity of cryptographic algorithms and protocols demands expertise in cryptographic best practices and is essential to avoid common pitfalls that can undermine security.
For example, improper implementation of seemingly minor details in encryption algorithms can lead to significant vulnerabilities. The role of a cryptographic specialist is becoming more crucial because they can implement and manage cryptographic systems and develop policies and procedures designed to ensure compliance with industry best practices and regulatory requirements.
Tokenization involves replacing sensitive data with non-sensitive tokens. For example, a payment system can store tokens instead of real credit card numbers. The tokens have no intrinsic value but can be mapped back to the original credit card number through a secure tokenization system, such as cybersource (https://www.cybersource.com/en-ap/solutions/payment-acceptance/token-management-service.html) or fiserv (https://www.fiserv.com/en/solutions/card-services/tokenized-payments.html). This approach mitigates the risk of data breaches since no real credit card data is saved, only tokens representing them. While tokenization is common for payment card data, it can be used in other scenarios requiring the protection of sensitive data elements, like patient identifiers and insurance in healthcare, account numbers in financial systems, and many other applications.
Obfuscation is a technique that makes data or code difficult to understand or interpret and is frequently used to protect intellectual property or other sensitive information from being easily accessed. For example, code obfuscation describes altering the appearance and structure of code without changing its functionality to make it challenging to understand or reverse engineer. Code obfuscation is also common with advanced malware and is intended to mask or confuse how the code works to hinder reverse engineering attempts.
The challenge with obfuscation is balancing complexity with performance and maintainability because overly obfuscated code can become inefficient and difficult to support. Obfuscation can also be used to bypass DLP systems by performing data type conversion. The regular expression pattern-matching techniques DLP systems often depend upon do not work when data is transformed from ASCII to base64, for example. The imaginary credit card number 1111-2222-3333-4444 becomes MTExMS0yMjIyLTMzMzMtNDQ0NA== when converted into Base64; both formats represent the same value but have a very different appearance.
Cryptographic erasure, sometimes called cryptographic wipe, refers to how data can be made "destroyed" by erasing the cryptographic keys used to encrypt it. When data is deleted using cryptographic erasure, the encryption keys needed to decrypt the data are destroyed. Without these keys, the data becomes inaccessible. Even though the data is not technically deleted, it is effectively destroyed because the encryption key is no longer available. This approach is heavily dependent on the methods used to encrypt the data in the first place.
Serialization is a technique used to convert complex objects into a format easily stored or transmitted. Serialization is often described as a 2D blueprint that defines a 3D object; the 2D blueprint contains all the necessary information to reconstruct the original 3D object. When serialized data is not properly secured, it can be unintentionally exposed or a vector for exploitation. For example, improperly handled serialized data in web applications can be manipulated by an attacker to execute unauthorized actions within the system.
Note:
OWASP Deserialization Cheat Sheet <https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html>
Instead of storing plaintext passwords, a hashed version of the password should be used instead. When a user logs in, the entered password is converted into a hash and compared with the stored version. Storing hash values instead of real passwords protects the passwords from exposure, even if the system used to store them is compromised. However, it is not enough to simply convert passwords to hashes; they must also be "salted." A salt is a random value added to the input of a hash function before hashing occurs. This technique helps protect against such attacks as rainbow table attacks, which are precomputed hash values of common or previously exploited passwords. The hash table allows an attacker to perform hash value lookups, which will not work for salted hashes.
Hashing algorithms associated with password protection include:
bcrypt
PBKDF2
Argon2
scrypt
Hashing algorithms like MD5 and SHA1 are no longer considered secure for modern use cases.
Digital signatures extend the functionality of hashing by adding authenticity and non-repudiation features. A is an encrypted hash, where encryption is performed using a private key. This technique is frequently associated with emails but applies to other areas like financial transactions, healthcare records, and legal documents.
Code signing is a specific use case for digital signatures intended to verify the origin and integrity of software. When code is signed using a digital certificate, the certificate includes the developer's public key and the signature (another digital certificate) of a trusted third-party certificate authority (CA). This allows the software recipient to verify the signatures and validate the software's source (its developer) and integrity. For example, a signed software patch for the Windows operating system allows the recipient to determine that Microsoft authored the patch and is in its intended state. Practically, code signing allows an operating system to perform automatic checks to determine software's trustworthiness prior to running it. When the signature is valid, the installation proceeds. If not, the system can warn of potential risks to help prevent potentially harmful software from running.
Microsoft Windows User Account Control
User Account Control prompt asking if the user wants to allow the app "cherrytree\_1.0.4.0\_win64\_setup.exe" from an unknown publisher to make changes to the device, with "Yes" and "No" buttons.
Screenshot used with permission by Microsoft.
The image displays a Windows User Account Control (UAC) dialog box. The message at the top asks, "Do you want to allow this app from an unknown publisher to make changes to your device?" Below this, the application file listed is "cherrytree\_1.0.4.0\_win64\_setup.exe" with the publisher marked as "Unknown" and the file origin as "Hard drive on this computer." There is a "Show more details" link. At the bottom, there are two buttons: "Yes" and "No", which is currently highlighted. The dialog box has a yellow warning bar at the top, indicating caution.
Symmetric and Asymmetric Cryptography
Symmetric cryptography, or secret-key cryptography, requires using a single key for encryption and decryption. It is efficient and fast, and suitable for encrypting large amounts of data. Advanced Encryption Standard (AES) is a popular version attributed to its widespread support in both hardware and software. The primary disadvantage of symmetric cryptography lies in the "key distribution problem" because any mistakes in securely sharing a key between parties can lead to unauthorized access. is commonly used when speed is essential, such as encrypting data at rest in filesystems and databases or securing communications in private networks. It is important to note that is used to securely share a symmetric key, which is then used to protect network traffic.
Asymmetric cryptography, or public-key cryptography, uses a pair of keys: a public key and a private key. Each key can undo the actions performed by the other; for example, encryption performed with one key can only be decrypted using the other. The public key is openly shared, while the private keys must be carefully protected and never shared. provides additional functionality beyond data confidentiality, such as proof of origin; however, asymmetric algorithms are generally slower than symmetric algorithms, making them less suitable for encrypting large data volumes.
One-Time Pad
When used correctly, the one-time pad (OTP) is an unbreakable encryption technique. It involves a random key, or pad, with the same length as the message to be encrypted and is only used once. Each character in the message is combined with a character from the key using a mathematical operation like modular addition (https://brilliant.org/wiki/modular-arithmetic/), resulting in a very secure encrypted output. A practical drawback of OTPs is the requirement for the key to be as long as the message, which makes it impractical for most communication scenarios. Regardless, it is an important method used in national diplomacy, intelligence, and military scenarios.
Note:
The crypto museum has an interesting page dedicated to the one-time pad https://www.cryptomuseum.com/crypto/otp/index.htm
Lightweight Cryptography
Lightweight cryptography is an emerging field designed to provide security for resource-constrained devices, such as IoT devices, RFID tags, and embedded systems. Algorithms like the Simon and Speck block ciphers (https://github.com/nsacyber/simon-speck) are examples of lightweight cryptographic solutions. Lightweight cryptographic techniques are becoming more important as the proliferation of connected devices continues to grow.
In this module, you will analyze key tasks and operations when executing an . In today's rapidly evolving cybersecurity landscape, organizations must adopt a multi-faceted approach to safeguard their digital assets. plays a crucial role in identifying potential vulnerabilities and assessing the impact of various attack vectors. Complementing this, robust security monitoring systems are essential for real-time detection of suspicious activities. Understanding known attack methods and their associated mitigations allows organizations to proactively defend against common threats. Additionally, leveraging advanced threat-hunting tools and technologies enhances the ability to uncover hidden threats that evade traditional defenses. Finally, effective incident analysis and response protocols ensure that any breaches are swiftly contained and remediated, minimizing potential damage and facilitating a quick recovery.
In this module, you will:
Perform .
Examine security monitoring.
Analyze known attack methods and associated mitigations.
Apply threat-hunting tools and technologies.
Evaluate incident analysis and response.
Exam Objectives Covered
There are many ways to effectively monitor a system's security infrastructure. Security Information and Event Management () systems are essential for aggregating and analyzing vast amounts of security data from diverse sources, providing a centralized platform for monitoring and managing security events. By incorporating data from various endpoints, network devices, and applications, systems enable comprehensive visibility into an organization's security posture. Establishing behavioral baselines and utilizing advanced analytics from diverse data sources allows for the detection of anomalies and potential threats, enhancing the accuracy of threat identification. Effective alerting mechanisms ensure that security teams are promptly notified of suspicious activities, while robust reporting and metrics provide valuable insights into security trends and the effectiveness of implemented controls. Together, these components form a framework that enhances an organization's ability to detect, respond to, and mitigate security incidents.
As you study this lesson, answer the following questions:
How can organizations effectively integrate data from multiple sources and formats to create a unified and comprehensive data repository, and what tools or technologies can facilitate this integration?
What techniques and tools are commonly used for aggregate data analysis, and how can they be applied to identify trends, patterns, and correlations within large datasets?
What are the key components of an effective alerting system, and how can organizations ensure that alerts are both timely and actionable to minimize response times?
How can organizations ensure the accuracy and relevance of the data used in their security reports, and what best practices should be followed to maintain the integrity of reporting processes?
Security Information and Event Management () enables collecting and analyzing event data from diverse sources to help support a real-time awareness of potential security incidents. These systems play an integral role in cybersecurity operations because they can collect, interpret, and read immense volumes of log data in ways that are impossible for an individual to accomplish. A well-implemented , fed with data from infrastructure and supporting services, provides a powerful platform for identifying and responding to security events.
Event Parsing and Duplication
Event parsing describes the process of analyzing raw data collected from different sources to extract relevant information such as timestamps, source and destination IP addresses, and event type classification like logon/logoff, start/stop, warning, account creation, and many others. Effective event parsing is essential for accurate event correlation and analysis. It represents the ability of the to accurately identify the details contained in a data feed (log), which can vary greatly because different log formats include different types of information and are formatted very differently.
For example, Windows Event Log, journald, syslog, and flat-file logs created by a developer as output from a custom application all look very different. The job of the event parser is to interpret all of these formats into a unified version, which enables a security analyst to perform lookups. The analyst does not need to know the specifics for each log format; using the , they can simply search by date, hostname, username, or any number of other fields because they have all been pre-parsed by the .
Event duplication occurs when the same event is logged multiple times due to redundant logging configurations or multiple sensors detecting the same incident. It is common for platforms to have mechanisms that help identify and filter out duplicate events to avoid skewing data trend analysis or overwhelming security teams with multiple alerts for the same event.
Non-reporting Devices and Retention
Non-reporting devices are those that fail to send logs or data to the system for various reasons. Devices may report due to a communications failure, downtime, misconfiguration, or potential inability to integrate with the ; regardless, these devices represent security blind spots. It is crucial to develop mechanisms that enable the (or potentially a different monitoring solution) to identify and flag non-reporting devices so system administrators can investigate the underlying issues.
Retention refers to the duration for which logs and event data are stored in the . Practical limitations mean that data cannot be stored indefinitely; many different systems can generate many gigabytes of data an hour, and when this is multiplied across hundreds or hundreds of thousands of devices, the practical limitations quickly become apparent. A major consideration driving the decision regarding what must be stored and the duration it is kept is based on regulatory requirements that are typically incorporated into organizational policies. Other factors include the data's criticality and legal strategies organizations use to purposely include or exclude (zero logging) specific event types in anticipation of various forms of litigation. Effective retention strategies ensure that historical data is available for forensic analysis, compliance reporting, and trend analysis while balancing storage costs and performance.
False Positives and False Negative Events
False positives, These occur when the incorrectly identifies an event as an issue, leading to unnecessary work and alert fatigue among security teams.
False negatives, These are highly concerning as they represent instances where the fails to detect legitimate security incidents. They are also difficult to locate because there is no alert to analyze. A false negative may only be identified because an issue occurs later that is more impactful or damaging and, therefore, more obvious.
Balancing the sensitivity of alerts to minimize false positives while ensuring real issues are detected is a difficult task. A phrase to keep in mind is that "False positives are annoying; false negatives are a problem."
Operationalizing Data
A major strength of systems is their ability to integrate and analyze data from a wide range of sources, enriching security context and significantly improving detection capabilities. Operationalizing data refers to the process of taking raw data collected from various sources and transforming it into actionable insights that improve security operations.
The following are some examples of data sources often used by :
Third-party Reports and Logs, Include logs from external service providers, cloud platforms, and software developers. Incorporating these logs ensures that analysts can monitor third-party events to provide comprehensive insights into potential external risks.
Feeds, feeds provide real-time data on known and emerging cyber threats, including information on malicious IP addresses, domain names, malware signatures, and attack patterns. Groups like security vendors, open-source platforms, and governmental organizations provide these feeds. Integrating threat feeds into a helps to improve detection and response performance by enriching contextual information about events. For example, threat feed data helps identify whether a logon event happened from a public IP address associated with attackers or whether a specific sequence of events is an identifier associated with an active attack campaign.
Scans, Data from scanning tools is crucial for identifying and prioritizing security issues. For example, correlating data with feeds can identify which vulnerabilities are actively targeted by attackers. In the event of a security incident, data helps define the and highlight whether known vulnerabilities were present and potentially exploited.
Common Vulnerabilities and Exposures (CVE) Details, CVE databases provide standardized information on known vulnerabilities. SIEMs can use CVE data to identify systems and applications affected by specific vulnerabilities and correlate them with to add context regarding their significance.
Bounty Programs, Information from bounty programs provides early insights into vulnerabilities that may not yet be widely known. SIEMs can use this data to refine detection rules and signatures.
Data Loss Prevention (DLP) Data, SIEMs can use DLP data to identify suspicious activities, such as unauthorized data transfers or unusual access patterns. DLP data can also help the provide post-incident insights into the scope and impact of a data breach.
Endpoint Logs, Logs from endpoint security tools running on computers, smartphones, and tablets, help identify signs of malware infections, unauthorized access, or other suspicious activity.
Infrastructure Device Logs, Logs from network devices such as firewalls, routers, and switches provide information on traffic patterns, access attempts, DoS attacks, or lateral movement within the network. Analysis of infrastructure device logs is fundamental for performing network security monitoring and threat detection.
Application Logs, Application logs capture events within software applications and help the detect suspicious activities, such as unauthorized access attempts, unusual transactions, or exploitation of application vulnerabilities. They are necessary for detecting application-level attacks, like SQL injection and cross-site scripting (XSS).
Cloud Security Posture Management (CSPM) Data, CSPM tools provide visibility into the security configuration and compliance status of cloud resources. CSPM data helps SIEMs identify security misconfigurations in cloud services (such as overly permissive access controls) and monitor compliance with security policies and regulatory requirements.
Aggregate data analysis and behavior baseline analytics are complementary processes that provide a holistic understanding of business operations and guide decision-making to enhance operational security. Aggregate data analysis uses methods like correlation analysis to identify relationships and patterns within data that might remain hidden otherwise. Behavior baselines and analytics focus on the standard activity patterns across networks, systems, users, and applications. This analysis establishes baselines crucial for distinguishing between routine operations and potential issues.
For example, understanding normal network traffic patterns helps identify suspicious activities, such as data exfiltration. Similarly, by monitoring user behavior, organizations can detect unusual activities that might indicate problems. Combined, these two approaches provide a comprehensive view of an organization's data and operational landscape. Aggregate data analysis offers macro-level insights, highlighting broad patterns and trends, while behavior baselines and analytics work at the micro-level, focusing on the specifics of normal versus abnormal behavior.
Aggregate data analysis involves collecting and examining large data sets to uncover patterns, correlations, and trends and helps organizations make informed decisions based on data insights.
Correlation, A statistical measure that describes the relationship between two events. For example, if a large number of failed login attempts are followed by a successful login, correlation can help highlight this as a potential security breach. It's not just about the data points themselves, but about understanding the story they tell when combined.
Audit Log Reduction, Describes the process of reducing large volumes of log data by filtering "noise" to make it more manageable and easier to concentrate on the most relevant events, but requires care and skill to properly discard benign data while retaining critical information indicative of security incidents.
Prioritization, Describes the process of ranking data according to potential impact and likelihood. It helps to focus efforts on the most pressing issues and ensure they are addressed promptly.
Trends, Analyzing trends involves examining data over time to detect changes in attack patterns, such as an increase in phishing attempts or the emergence of new malware strains. This type of proactive approach supports the implementation of defensive strategies before threats fully materialize.
Behavior baselines and analytics describe the work done to understand the normal behavior of networks, systems, users, applications, and services to identify deviations indicative of security incidents.
Network Behavior, Network behavior analytics describes monitoring and analyzing traffic to establish a baseline of typical bandwidth usage, common access times, and regular communication channels.
Systems Behavior, Systems behavior analytics focuses on the operational patterns of hardware and software systems, including CPU usage, memory consumption, and process execution times. Establishing these baselines helps identify malicious activity that can consume system resources, predict system failures, and plan for capacity upgrades.
User Behavior, User behavior analytics tracks and analyzes how users interact with systems, including login times, access locations, and actions performed. Establishing a baseline of typical user behavior helps identify suspicious activities, such as an unusual login time or access from unexpected locations.
Applications and Services Behavior, Applications and services also have normal operating behaviors, which include typical usage patterns and performance metrics. Analyzing behavior includes monitoring response times, error rates, and transaction volumes to help detect issues like service disruptions or poor performance.
Aggregate data analysis and behavior baseline analytics are complementary processes that provide a holistic understanding of business operations and guide decision-making to enhance operational security. Aggregate data analysis uses methods like correlation analysis to identify relationships and patterns within data that might remain hidden otherwise. Behavior baselines and analytics focus on the standard activity patterns across networks, systems, users, and applications. This analysis establishes baselines crucial for distinguishing between routine operations and potential issues.
For example, understanding normal network traffic patterns helps identify suspicious activities, such as data exfiltration. Similarly, by monitoring user behavior, organizations can detect unusual activities that might indicate problems. Combined, these two approaches provide a comprehensive view of an organization's data and operational landscape. Aggregate data analysis offers macro-level insights, highlighting broad patterns and trends, while behavior baselines and analytics work at the micro-level, focusing on the specifics of normal versus abnormal behavior.
Aggregate data analysis involves collecting and examining large data sets to uncover patterns, correlations, and trends and helps organizations make informed decisions based on data insights.
Correlation, A statistical measure that describes the relationship between two events. For example, if a large number of failed login attempts are followed by a successful login, correlation can help highlight this as a potential security breach. It's not just about the data points themselves, but about understanding the story they tell when combined.
Audit Log Reduction, Describes the process of reducing large volumes of log data by filtering "noise" to make it more manageable and easier to concentrate on the most relevant events, but requires care and skill to properly discard benign data while retaining critical information indicative of security incidents.
Prioritization, Describes the process of ranking data according to potential impact and likelihood. It helps to focus efforts on the most pressing issues and ensure they are addressed promptly.
Trends, Analyzing trends involves examining data over time to detect changes in attack patterns, such as an increase in phishing attempts or the emergence of new malware strains. This type of proactive approach supports the implementation of defensive strategies before threats fully materialize.
Behavior baselines and analytics describe the work done to understand the normal behavior of networks, systems, users, applications, and services to identify deviations indicative of security incidents.
Network Behavior, Network behavior analytics describes monitoring and analyzing traffic to establish a baseline of typical bandwidth usage, common access times, and regular communication channels.
Systems Behavior, Systems behavior analytics focuses on the operational patterns of hardware and software systems, including CPU usage, memory consumption, and process execution times. Establishing these baselines helps identify malicious activity that can consume system resources, predict system failures, and plan for capacity upgrades.
User Behavior, User behavior analytics tracks and analyzes how users interact with systems, including login times, access locations, and actions performed. Establishing a baseline of typical user behavior helps identify suspicious activities, such as an unusual login time or access from unexpected locations.
Applications and Services Behavior, Applications and services also have normal operating behaviors, which include typical usage patterns and performance metrics. Analyzing behavior includes monitoring response times, error rates, and transaction volumes to help detect issues like service disruptions or poor performance.
Within the framework provided by Security Information and Event Management (), many factors define the effectiveness of its alerting capabilities, such as its integration capabilities, contextual understanding of events, and effective management and adaptation by skilled staff.
False positives occur when an alert for an event represents something that is not a threat, such as a legitimate software update flagged as malicious activity. An overabundance of these types of alerts leads to alert fatigue, where security teams become desensitized to alerts, drop their guard, and overlook genuine threats.
Note:
Combating Alert Fatigue https://www.microsoft.com/en-us/security/blog/2021/02/17/6-strategies-to-reduce-cybersecurity-alert-fatigue-in-your-soc/
Conversely, false negatives describe a real undetected threat, like the actions of an advanced persistent threat (APT) perceived as regular network traffic. False negatives are especially problematic because they represent a literal failure in the capability the was intended to provide, namely, the detection of security incidents.
Alert failures refer to flaws in alerting mechanisms, which can occur due to misconfigured detection rules, software bugs/glitches, resource limitations, or many other reasons. Additionally, the may fail to generate an alert because the alert threshold setting is too lenient, for example, alerting after ten consecutive failed login attempts within 30 seconds, which would fail to alert attackers using stealthy brute force techniques or when they can guess passwords with few (if any) attempts. A lower threshold, combined with contextual factors like IP address or geolocation, would be more effective.
Prioritizing responses is crucial, especially considering that a will generate a vast number of alerts, even in a well-tuned environment. Responding to alerts generated by a is different from working through tickets in a support system; first in, first out is ineffective for security events. Instead, factors such as the event's potential impact, the sensitivity of affected data, and the system's criticality should be used to measure what should be addressed first.
Criticality assessment evaluates impact, asset type, residual risk, and data classification associated with an alert.
Impact, The potential damage a threat could cause, such as data loss, financial harm, or reputational damage.
Asset Type, The nature of the affected asset, such as a public-facing web server or internal patient records database.
Residual Risk, In association with devices that cannot be fully remediated and are operating with risk exceptions, residual risk becomes an important measuring gauge. An analyst should treat an alert generated on a system with significant residual risk due to outdated software with higher urgency than a similar alert on a fully remediated system.
Data Classification, The sensitivity level of the data involved, such as public, proprietary, or confidential, would factor into the criticality of the alert.
Effective malware alerting capabilities ensure organizations can detect malware infections early, assess their severity, and take appropriate actions to protect systems. can leverage machine learning and AI to enhance detection capabilities and identify anomalies in system behavior, such as unexpected spikes in CPU usage, unusual file modifications, or strange network traffic patterns. These abnormalities may indicate the presence of malware, especially if they align with known attack patterns provided via feeds to which the has access.
A can help identify vulnerabilities more effectively than scanning alone by correlating data from scans with real-time . For example, a could detect a CVE in a web framework associated with an exploit observed in an active attacker campaign. While the CVSS (score) associated with the CVE may be low, the added context provided by the would increase the criticality of the based on the probability of attack.
Metrics collection, analysis, and reporting are foundational for understanding an organization's security posture. Reporting security posture requires compiling data from various sources, assessing risks, and presenting meaningful insights to various stakeholders.
The Role of Metrics
Metrics serve to evaluate the effectiveness of cybersecurity programs.
Measure Performance, Quantitative data can be used to measure the performance of cybersecurity initiatives. For example, tracking the time it takes to detect and respond to incidents helps assess the efficiency of a security operations center (SOC).
Identify Trends and Patterns, By analyzing metrics over time, organizations can identify important trends such as an increase in phishing attempts during certain months.
Allocate Resources, Metrics help allocate resources by identifying areas requiring more engagement or investment. If data shows that a particular attack is happening more frequently, leadership teams can approve additional resources to enhance protections in that area.
Compliance and Reporting, Many industry regulations mandate specific cybersecurity practices and reporting capabilities. Metrics are essential for demonstrating compliance and providing evidence of due diligence practices.
Visualizations and Dashboards
Graphs, charts, and heat maps help stakeholders understand complex data. For example, a dashboard displaying a heat map of attempted attacks by geographical region can quickly highlight malicious activity hotspots.
Dashboards can provide real-time updates, allowing organizations to monitor cybersecurity metrics as they evolve. Real-time insights support quick decision-making, especially during an attack where timely responses are crucial.
Visualizations can bridge the gap between technical teams and non-technical stakeholders. A well-designed dashboard can convey the state of cybersecurity to executives and board members who may not have a technical background.
Dashboards can be customized to track specific performance indicators over time, providing a view of how well the organization is meeting its cybersecurity goals.
A network traffic analyzer dashboard showing real-time metrics, including sources of traffic, top endpoints, top conversations, and top applications using line and pie charts.
Exam Objectives Covered
There are many known attack methods that malicious actors utilize. Vulnerabilities in software, hardware, and network systems present opportunities for attackers to exploit weaknesses and launch various types of attacks, ranging from data breaches to denial-of-service incidents. Understanding these vulnerabilities is crucial for identifying potential entry points and assessing the risk they pose to an organization. Mitigations, including patch management, configuration adjustments, and the implementation of security controls, are essential strategies for addressing these vulnerabilities and reducing the likelihood of successful attacks. By continuously monitoring for new vulnerabilities and applying timely mitigations, organizations can strengthen their defenses and minimize the impact of potential security incidents. The interplay between identifying vulnerabilities and implementing effective mitigations is vital for maintaining a robust security posture and protecting critical assets from evolving threats.
As you study this lesson, answer the following questions:
What are the key differences between SQL injection, cross-site scripting (XSS), and server-side request forgery (SSRF) attacks, and how do these vulnerabilities exploit different aspects of web applications?
What are the common cryptographic vulnerabilities, such as weak encryption algorithms and improper key management, and how can organizations identify and mitigate these vulnerabilities to ensure data security?
What role do code reviews and static analysis tools play in identifying and mitigating security issues during the development process, and how can teams ensure these practices are consistently applied across all projects?
How can organizations implement effective data access controls and encryption methods to safeguard data against unauthorized access and breaches, and what best practices should be followed to maintain these controls?
Injection Attacks
There are many different types of injection attacks, some more common than others. Examples include but are not limited to SQL Injection, Command Injection, LDAP Injection, XPath Injection, Code Injection, HTML Injection, XML Injection, Log Injection, SMTP Header Injection, and File Injection. Injection attacks share a common issue: they occur when data is provided as an input, and the receiver inherently trusts it. The inherent trust is the core problem, and it allows an attacker to provide specially crafted inputs that manipulate the intended operation of the software receiving it, for example, providing inputs that are not simply data but instead commands that are run by backend systems leading to unauthorized access or control over backend systems. For example, a web application with a user input field that received the input'; DROP TABLE users; -- which could delete the table named users in the database that backs the application.
Cross-Site Scripting (XSS)
XSS attacks involve injecting malicious scripts into a web application that are then processed by the server and delivered as content to web application users. It exploits the trust between the user and the website. A typical scenario is when a web forum (a platform where users can share information and interact with each other) does not properly escape user input. For example, posting <script>alert('XSS');</script> instead of the simple text-based inputs anticipated by the forum will cause the script to execute in other users' browsers. Cross-site scripting can be used for many purposes; the fact that inputs can be provided to a web app that are then executed by the server is limited only by the skill and creativity of the attacker. XSS is often the vector used to steal session cookies, perform keylogging, defacement, spread malware, and access sensitive data.
Note:
Cross-Site Scripting (XSS) https://learn.snyk.io/lesson/xss/
Server-SIde Request Forgery (SSRF)
SSRF vulnerabilities occur when an attacker can make HTTP requests from a server-side application to bypass network access controls and access internal systems otherwise protected from external access. The objectives of an SSRF attack are to access internal resources, enumerate available services, bypass firewalls, retrieve sensitive data, or execute remote code. SSRF vulnerabilities often stem from the application's acceptance of untrusted user input, which is used to construct or manipulate a request to a resource (such as a URL or IP address). For example, an application may take a user-provided URL and fetch its content to include in the response or for further processing. When an application fails to validate or sanitize input correctly, it allows an attacker to inject malicious or unexpected input, including internal IP addresses, local files, or even URLs pointing to sensitive services running within the organization's internal network.
Note:
Server-Side Request Forgery https://portswigger.net/web-security/ssrf
Cross-Site Request Forgery (CSRF)
CSRF attacks trick users into performing actions on a web application they are persistently authenticated to, but without their consent. The attack exploits the trust a site has established with the user's browser by inheriting the identity and privileges of the victim user . CSRF attacks are powerful and dangerous, leading to unauthorized actions such as changing user profile/account details, making purchases, transferring funds, or accessing sensitive data. For example, an attacker might be able to change the email address associated with a victim's account to one they control. This change can potentially allow the attacker to use the password reset feature to take control over the victim's account.
Note:
Cross-Site Request Forgery https://www.veracode.com/security/cross-site-request-forgery-guide-learn-all-about-csrf-attacks-and-csrf-protection
Poisoning and Confused Deputy
Data poisoning describes a class of attack in which false or misleading information is intentionally inserted into software or a dataset, compromising its integrity, accuracy, and trustworthiness. Poisoning attacks target DNS, data storage platforms, machine learning models, artificial intelligence, large language models, and many other areas.
The confused deputy problem describes a that occurs when a program mistakenly uses its authority to perform an unintended action on behalf of another, less-privileged program.
Unsafe memory utilization, including buffer overflows, occurs when a program writes more data to a buffer than it can hold. This problem is particularly relevant in low-level programming languages like C and C++, which have control over memory management. This class of can allow attackers to execute arbitrary code (run code of their choice on the target system) and is a critical security risk because it can lead to full system compromise.
Overflows describe when data exceeds the boundaries of the memory allocated to store it, leading to unexpected behavior, system crashes, escalating privileges, or gaining unauthorized access to data.
Note:
Buffer Overflows https://www.synopsys.com/blogs/software-security/detect-prevent-and-mitigate-buffer-overflow-attacks.html
Deserialization consists of a process in which a data structure or object is reconstructed from a series/string of bytes The process is used in applications to transfer data between different systems or communicate between services. Deserialization vulnerabilities occur when untrusted data is used to reconstruct objects in a program.
For example, when a user logs in, the server serializes the user's session data into a string or byte array and sends it to the user's browser as a cookie.
JSON format of user data on the server might look like the following.
{
"userId": "5887675399",
"username": "bigfoot",
"role": "user",
"sessionExpiry": "2024-08-01T23:59:59Z"
}
The server can serialize the JSON object representing the user into base64 and then store it in a cookie. The base64 version of the same data looks like this:
ew0KICAgICJ1c2VySWQiOiAiNTg4NzY3NTM5OSIsDQogICAgInVzZXJuYW1lIjogImJpZ2Zvb3QiLA0KICAgICJyb2xlIjogInVzZXIiLA0KICAgICJzZXNzaW9uRXhwaXJ5IjogIjIwMjQtMDgtMDFUMjM6NTk6NTlaIg0KfQ==
Deserialization attacks exploit vulnerabilities in the process of converting data back into objects. An attacker might send malicious serialized data to exploit a system's deserialization process. For example, a malicious executable file can be serialized and transmitted similarly.
Race conditions are a class of software vulnerabilities that occur when a system's behavior depends on the sequence or timing of events. Race conditions (vulnerabilities) occur when multiple operations, which must happen in a specific order, execute arbitrarily, leading to unpredictable and likely unsafe outcomes. Race conditions are particularly problematic in multi-threaded or distributed systems.
TOCTOU vulnerabilities are a specific type of race condition that occurs when a system checks a condition and then performs actions based on the condition without ensuring the state hasn't changed, which allows an attacker to exploit the time window between "checking" and "using."
Weak ciphers refer to cryptographic algorithms with known vulnerabilities or insufficient security resilience, making them inadequate for protecting sensitive data. Weak ciphers can lead to data breaches, unauthorized access, and compromised communications. Ciphers are determined to be inherently insecure due to flaws in their design, insufficient key lengths, or advances in computational power and cryptanalysis techniques that have rendered them obsolete. Examples of weak ciphers include DES/3DES, RC4, MD5, and SHA-1
Embedded secrets refer to sensitive data, such as API keys, passwords, tokens, or encryption keys, that are hardcoded into an application's source code or configuration files. This practice is considered insecure because it exposes these secrets to potential discovery and misuse, especially if the code or files are easily accessible. Examples of embedded secrets include
API Keys, used to access third-party services
Cloud Service Credentials, used to access cloud services like AWS, Azure, or Google Cloud.
Database Credentials, hard-coded usernames and passwords used to access a database
Encryption Keys, used to encrypt or decrypt data used by the application
Tokens, used for authentication such as tokens or JSON Web Tokens (JWT)
Misconfigured security settings can open doors for attackers and can occur at myriad levels, such as applications, databases, operating systems, networks, and cloud services. They are frequently the result of default settings, lack of hardening, or mistakes during deployment and maintenance. Problems attributed to unsecure configuration include:
Default credentials
Exposed admin control panels
Open network ports
Insecure/unencrypted protocols
Lack of logging
Missing patches
Misconfiguration (especially with cloud services)
Excessively permissive access controls
Using outdated applications, operating systems, or components like libraries and frameworks poses significant security risks because these outdated components will invariably contain known vulnerabilities that attackers can exploit.
End-of-life software is no longer supported by its maintainer/vendor and poses significant risks, primarily due to the lack of availability of patches and updates and the fact that any vulnerabilities discovered after the EOL date will not be addressed. Additionally, EOL software is not supported from an availability viewpoint, which means that unexpected downtime cannot be addressed using the help of the software vendor or maintainer.
Deprecated functions are internal coding/development structures like methods, built-in functions, and APIs that are no longer recommended for use and are tagged for removal in future releases. Deprecation is the formal process where developers identify specific, outdated features that should be replaced. Deprecated functions are not automatically removed from existing software versions, but they are marked for eventual removal and often replaced/removed as part of a major upgrade. The choice to deprecate software is driven by security problems, performance issues, obsolescence, platform changes, or compliance needs and generally represents changes that are not suitably addressed via patching. Using deprecated functions increases the risk of vulnerabilities, similar to using EOL software.
Directory services are critical for supporting authentication and authorization, and misconfigurations can result in unauthorized access, privilege escalation, or sensitive data exposure. Common directory service misconfigurations include:
Excessive and misconfigured privileges
Inadequate password policies
Allowing Anonymous Access
Lack of transport encryption
Poor maintenance and stale data
Vulnerable third parties refer to any external entities or service providers that provide products and services that an organization depends on for any reason. The security practices of third parties are critical because vulnerabilities in their operations can directly lead to breaches and other threats in the organization depending on them. Example third-party issues include:
Cloud Service Providers, Misconfigurations and insecure APIs can expose data and virtual systems to attack. Breaches at a cloud provider can expose all of an organization's systems and data to attackers. Outages at a cloud provider can make all the systems a customer depends upon unavailable.
Software Vendors, Vulnerabilities in third-party software applications and libraries can be exploited, compromising the customer's systems and data.
Managed Service Providers (MSPs), MSPs offer support services that often necessitate direct/VPN access to customer networks. A breach at an MSP can have dire consequences for customers, as attackers can access customer networks and use the privileged access intended for the MSP.
Payment Processors, A breach at a payment processor can expose customers' payment card information and other sensitive financial data. The payment processor customer is responsible for notifying affected individuals of the breach, covering identity protection costs, and defending customer lawsuits.
Supply Chain Partners, Manufacturer and supplier products can be tampered with, introducing rogue devices or malicious software that is used by the customer, leading to a breach, or incorporated into finished products and then sold to others.
Implants refer to covert, malicious hardware or software components placed into a system to gather intelligence, perform specific programmatic tasks, or provide a persistent foothold for attackers. Implants are often associated with espionage or sabotage operations. They are often introduced through supply chain attacks or direct physical access and are difficult to detect because they generally hide in firmware or as internal hardware components. Regularly audit hardware and software for anomalies, and maintain strict supply chain security.
Note:
Stuxnet is a historically significant example of this class of attack https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/
After understanding the potential risks associated with vulnerabilities like those previously reviewed, attention should then turn to understanding how they can be effectively mitigated. Addressing vulnerabilities requires a strategic approach incorporating broad protections to prevent successful attacks.
Input validation and output encoding are pivotal in mitigating common software vulnerabilities, such as SQL injection, Cross-Site Scripting (XSS), and other types of injection attacks.
Input validation checks whether data received from "outside" sources, such as users or other systems (via API, for example), matches expected formats and values ranges.
Type checking ensures input data matches the type anticipated by the receiving program, such as string, integer, boolean, or other programmatic data type.
Length validation ensures data does not fall out of a predefined range and helps prevent buffer overflow attacks.
Format validation ensures inputs match a predefined format, typically using regular expressions. For example, it checks that a provided number matches a phone number or that a given username contains valid characters.
Output Encoding converts data into a format that is safer to process, less likely to be misinterpreted as code instead of data, and can essentially neutralize malicious inputs.
Output encoding converts data into a safer format before it is processed or passed to another program to ensure that potentially harmful content is neutralized.
HTML Encoding converts special characters in HTML into their corresponding entity codes. For example, changing special characters in <script>alert('XSS');</script> converts it into <script>alert('XSS');</script>, neutralizing executable code by removing the special characters associated with execution.
URL Encoding converts special characters in a URL to prevent them from being misinterpreted by the server as SQL or operating system commands. As before, changing the special characters in <script>alert('XSS');</script> converts it into %3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E and ensures that the data is processed misinterpreting special characters as command delimiters.
Many modern programming languages provide built-in safe functions and other related features to help developers write secure code. Safe functions can be inherent to a programming language or created by the developer. The choice depends on the specific safe function type and the programming language used. There are three categories of safe functions: atomic, memory-safe, and thread-safe functions.
Atomic functions ensure that operations are completed entirely or not at all to prevent inconsistent states. Atomic functions, sometimes called indivisible operations, ensure data integrity and prevent race conditions, especially in concurrent and multi-threaded environments. An atomic function guarantees that its entire operation is executed as a single, uninterruptible unit. No other thread or process can observe or modify the data being acted upon by the atomic function while it's in progress. Database transactions are a practical approach to ensuring atomicity. If any part of a transaction fails, the entire transaction is rolled back to ensure data integrity persists. Read more about ACID https://www.techtarget.com/searchdatamanagement/definition/ACID
Memory-safe functions prevent common memory-related vulnerabilities such as buffer overflows and dangling pointers and can be accomplished by using languages like Rust (which enforces strict memory safety), or incorporating memory-safe libraries into C/C++ code ensure applications remain within defined boundaries.
Thread-safe functions ensure proper behavior in multithreaded and concurrent processing environments to avoid race conditions and deadlocks (where two or more threads cannot proceed because each is waiting for the other to release a shared resource.)
A security design pattern is a predefined (template) solution to a commonly occurring problem within software design. Design patterns encapsulate best practice approaches and strategies for mitigating a wide range of security risks and help ensure that systems are safe and resilient. They are comparable to recipes and developed to help produce consistent and repeatable outputs.
The principle of least privilege dictates that users and processes should have the minimum level of access necessary to perform their functions.
Least functionality describes the configuration of systems and applications to provide only the necessary functions and services to fulfill their intended purpose, disabling or removing all others to minimize the .
Defense in depth is a strategy for protecting systems and data against a wide range of threats. By implementing multiple layers of security controls, organizations can ensure that even if one control fails, others will continue to provide protection, making it more difficult for attackers to achieve their goals.
Dependency management is a systematic approach to managing all the external libraries, packages, and modules a software project relies on. It ensures that all dependencies are up-to-date, secure, and compatible with the project to mitigate potential vulnerabilities and stability issues. Version control can help track the versions of all dependencies used in a project and ensure compatibility, while dependency scanning tools can scan for vulnerabilities in dependencies.
Note:
OWASP Dependency Track https://dependencytrack.org
Code signing describes digitally signing software or code to confirm the author's identity and ensure that the code has not been manipulated since the developer signed it. Code signing is achieved using cryptographic techniques supported by public key infrastructure ().
The software developer generates a public and private key pair. The private key is kept secure, while the public key is shared.
The developer uses their private key to create a for their software, which is simply a hash of the code encrypted with the private key.
The is attached to the software along with the public key, or a digital certificate that contains the public key.
When users obtain and run the software, their system uses the attached public key to decrypt the and compare the decrypted hash with one created at runtime. If the hashes match, the code is considered authentic and unaltered.
Code signing protects against various types of threats, such as malware and code tampering, by ensuring that code comes from a verified source and has not been altered. It is important to note that a is not a guarantee of quality, but simply integrity and authenticity
Proactively managing vulnerabilities improves an organization's security posture by minimizing the and ensuring system integrity. Continuously addressing vulnerabilities mitigates many potential threats and ensures the organization can defend against current and emerging risks.
Updating and patching are crucial for mitigating risks because they address vulnerabilities attackers can exploit. Flaws and weaknesses inevitably emerge in a wide range of software and hardware, and the challenge often lies in efficiently identifying and addressing all patching requirements. Another important consideration regarding patching is the level of assurance that patches are valid and trustworthy, or, put another way, not malware masquerading as a patch. (Software assurance concepts are covered in a different lesson.) In addition to its security benefits, effective patch management is also a mandatory practice for legal and regulatory compliance.
Firmware updates are generally infrequent but are crucial for maintaining hardware security. Examples of hardware vulnerabilities include the Spectre and Meltdown vulnerabilities that affected CPU architecture and had a far-reaching impact. https://meltdownattack.com
Regularly updating the operating system is a fundamental practice, as it is core to the functionality of devices and software. Effective operating system patching addresses known vulnerabilities, fixes bugs and provides improvements like new features, better compatibility, and greater stability.
Hypervisors are highly specialized software that enable virtualization. Like any other software, they require updates to mitigate vulnerabilities that can allow attackers to perform incredibly damaging attacks. A single hypervisor is often a gateway to numerous virtual machines and the infrastructure supporting them. Exploiting a single hypervisor and deploying ransomware to the storage environment it can access is often a knock-out punch for an organization's operations.
Regularly updating and validating the system images used to deploy physical and virtual systems ensures that newly deployed systems are fully up-to-date and free from known vulnerabilities.
Application software represents the broadest category for patch management because it includes everything from desktop and smartphone apps to server services, middleware, web applications, web frameworks, databases, libraries, development tools, and many others. Identifying vulnerabilities in many of these items requires specialized tools that go above and beyond general-purpose scanners like Nessus and OpenVAS. Pen-testing engagements are often focused on testing and evaluating applications for this reason.
Secrets management describes the mechanisms implemented to securely manage passwords, API keys, tokens, encryption keys, and other credentials. Effective secrets management provides high levels of assurance that these data are stored, accessed, and rotated securely and systematically to mitigate risks attributed to unauthorized access. Fundamental secrets management capabilities include secure storage, auditability, and automated expiration and rotation of secrets.
Some examples of secrets management in action:
Replacing hardcoded database credentials stored in application code with API calls to a secrets management tool, such as a password vault, to retrieve the credentials at runtime.
Secure interactions between cloud services by using cloud-native secrets management services. For example, API keys can be stored in AWS Secrets Manager, which AWS Lambda Functions can retrieve as needed. A description of AWS Lamda Functions can be found at https://docs.aws.amazon.com/lambda/latest/operatorguide/intro.html
Integrating secrets management in automated deployment pipelines, which typically require access to numerous services, helps mitigate the risks of credentials being stored in pipeline configurations.
Key rotation is a critical security practice that requires cryptographic keys to be changed regularly to help mitigate risks associated with the vulnerabilities associated with cryptographic keys.
AWS Key Management Service (KMS), Google Cloud KMS, Azure Key Vault, and HashiCorp Vault can rotate keys automatically at pre-defined intervals.
Let's Encrypt automates the renewal of SSL/TLS certificates, which contain cryptographic keys, and ensures that keys are regularly rotated while also maintaining the validity of digital certificates. More information about Let's Encrypt is available at https://letsencrypt.org/about/.
Another important feature of automated key management tools is that they provide detailed audit logs regarding cryptographic key usage and all rotation activities to support monitoring and compliance reporting requirements.
Fail-secure and fail-safe mechanisms describe the state that a system will revert to in the event of a failure.
Failing secure means that the system defaults to a secure state in the event of a failure. For example, a firewall blocks all traffic in the event of failure.
Failing safe means that the system defaults to an open state. For example, in building automation, fail-safe might mean automatically closing all fire doors and unlocking all building exit points to ensure a safe exit during a fire event, prioritizing health and safety over all other concerns.
At the most fundamental level, encryption makes data unreadable to unauthorized users. This technique is crucial for protecting sensitive information from being accessed by malicious actors when other controls have failed. For example, access controls are generally enforced by an operating system, so if data can be accessed by bypassing the operating system, such as removing a mass storage device, then encryption becomes the protection of last resort.
Additionally, encryption supports the need to protect data under the assumption that unauthorized parties will access it, such as when communication traverses over untrusted networks. The strength and complexity of suitably-selected encryption algorithms ensure that when data is intercepted, it remains protected.
Encryption must be applied at multiple levels, including databases, securing communication channels, and protecting device filesystems. Additionally, auditing and updating encryption protocols regularly to ensure compliance with the newest standards are critical steps in maintaining sufficient levels of security.
Indexing describes creating data structures that improve the speed of data retrieval operations. In terms of security, indexing can also help with monitoring. For example, a large e-commerce platform might handle millions of transactions daily. By indexing transaction records, the platform can support quick identification of unusual activity from a single account. The index allows the platform to locate and retrieve relevant data without performing full database table scans.
Allow listing is a powerful control because it dramatically reduces the of any system. It restricts operation to only pre-approved applications, users, and processes, thereby blocking many forms of malware and attacks. By strictly controlling what is allowed, allow listing provides high security and control against known and unknown threats. Furthermore, it simplifies monitoring and management, as activities other than those defined by the allow list are immediately suspect. Allow listing can be difficult to implement in many scenarios because the dynamic nature of most applications, communications, and user activities are hard to define in a practical and enforceable way without causing problems.
Exam Objectives Covered
Having knowledge of available threat-hunting tools is an important security skill. Internal intelligence sources, such as logs and internal threat reports, and external intelligence sources, including threat feeds and industry reports, provide a comprehensive view of the threat landscape, enabling organizations to stay informed about potential risks. Counterintelligence and operational security measures are essential for protecting sensitive information and thwarting adversaries' attempts to gather intelligence on the organization. Platforms (TIPs) facilitate the aggregation, analysis, and dissemination of threat data, enhancing the organization's ability to respond to emerging threats. Sharing Indicators of Compromise (IoCs) with trusted partners and industry groups helps to collectively strengthen defenses by providing early warnings of malicious activity. Rule-based languages enable the automation of threat detection and response processes, while Indicators of Attack (IoAs) provide context for understanding the tactics, techniques, and procedures used by adversaries. Together, these elements form a robust framework that is critical for proactive defense and informed decision-making in cybersecurity.
As you study this lesson, answer the following questions:
What types of internal intelligence sources can organizations leverage to enhance their cybersecurity posture, and how do these sources contribute to threat detection and response?
What are the key strategies and best practices for implementing effective counterintelligence measures to protect sensitive information from adversaries?
How can organizations integrate platforms with their existing cybersecurity infrastructure to enhance real-time threat detection and response capabilities?
How can organizations effectively collect, analyze, and utilize Indicators of Compromise (IoCs) to detect and respond to potential security breaches?
What are the advantages and limitations of using rule-based languages for defining and enforcing security policies within an organization's cybersecurity framework?
Internal intelligence sources refer to information gathered within an organization's environment to identify potential security threats. Sources include system logs, user activity, incident reports, and data from internal threat detection systems. Ultimately, the goal is to analyze and correlate internal data to help detect malicious activities.
Adversary Emulation Engagements
Red teams often perform adversary emulation engagements to simulate the tactics, techniques, and procedures (TTPs) of known threat actor groups to test the blue team's ability to defend against them. These engagements are vital in improving an organization's cybersecurity preparedness and capabilities.
The primary purpose of adversary emulation is to create realistic scenarios that mirror the behavior of actual threat actor groups. This allows organizations to evaluate their defenses against the specific TTPs used by these adversaries. Additionally, these engagements play an important role in refining threat-hunting methodologies and help instill confidence in organizations regarding their capability to detect and respond to threats. By emulating real-world attacks, organizations can identify gaps in their detection and response capabilities, enhancing the quality of and ensuring that defenses evolve in response to new threats and tactics.
Common frameworks used to simulate adversary behaviors:
MITRE ATT&CK: https://attack.mitre.org/
Atomic Red Team: https://atomicredteam.io/
CALDERA: https://caldera.mitre.org/
Internal Reconnaissance
Internal reconnaissance is a strategic process that aims to map out and explore the internal network environment from an attacker's perspective. The primary goal is to identify key assets, resources, and configurations. This understanding is crucial for effective , as it allows defenders to anticipate and counter the tasks that an adversary may perform during internal reconnaissance.
Internal reconnaissance plays a pivotal role in an attack once the adversaries gain access to a network. It allows them to map the internal infrastructure, including the network layout, critical devices, servers, and communication patterns. This understanding helps attackers focus their efforts on identified security weaknesses, misconfigurations, and exploitable vulnerabilities specific to the environment, shaping the subsequent stages of the attack.
Threat hunters can develop specific detection capabilities by understanding the techniques used in internal reconnaissance. For example, unusual network scanning and unauthorized access attempts could indicate internal reconnaissance actions. Threat hunters can use knowledge of internal reconnaissance techniques to develop hypotheses about potential attacker behaviors and use this as the basis for searches of compromise that might otherwise go unnoticed.
Hypothesis-Based Searches
Hypothesis-based searches require security analysts to formulate educated guesses (hypotheses) about potential security breaches based on available data and intelligence. The hypotheses are then tested through targeted investigations and analysis of the environment to prove or disprove them. This method contrasts with purely reactive approaches, where organizations respond to known threats or indicators of compromise after they have been detected. Traditional security measures may miss sophisticated threats. Hypothesis-based helps fill in detection gaps by considering new or evolving tactics, techniques, and procedures (TTPs) that are not covered by existing security tools.
The first step in hypothesis-based is to formulate hypotheses and begins with understanding the organization's environment, reviewing reports, and considering recent incidents or trends. By aligning hypotheses with current , hunters can make educated guesses about what threats to look for. Hypothesis-based searches are a continuous learning process. If initial searches do not confirm a hypothesis, hunters may refine their hypotheses based on findings or adjust their search parameters.
Honeypots & Honeynets
Honeypots are decoy systems that look like valid production systems but serve no legitimate business purpose other than to capture evidence of suspicious activity. They go beyond intrusion detection capabilities, which are generally limited to known attack patterns, by providing rich contextual data regarding observed TTPs that may uncover evidence of a zero-day exploit. Honeypots allow security teams to study attack methods and gather intelligence that can be used to fortify "real" systems. Honeynets are networks of honeypots that simulate a complete environment.
User Behavior Analytics (UBA)
The primary goal of User Behavior Analytics (UBA) is to identify suspicious behavior patterns among employees that traditional security tools would miss. UBA provides insights into potential and emerging threats within the organization, including compromised user accounts.
UBA systems collect data from multiple sources, like network traffic, access logs, endpoint activities, and application usage logs.
The collected data establishes a baseline of normal behavior for each user. This baseline includes typical working hours, access patterns, commonly used applications, and typical interactions with systems and data.
The UBA system continuously monitors user activities and compares them against the established baseline. Any deviations from expected behavior are flagged as suspicious.
Suspicious behavior is analyzed to determine if it represents a threat. Analysis generally includes correlating the behavior with known attack patterns, contextual information, and additional data sources that may help to frame the activity.
If a threat is identified, the UBA system generates an alert for the security team to investigate manually, or it can perform automated responses to mitigate risks, such as locking accounts, revoking access, and isolating affected systems.
External intelligence sources help organizations anticipate, identify, and mitigate risks by providing timely and credible information on emerging threats and attacker tactics. For example, monitoring the dark web can reveal information regarding planned attacks, while ISACs share critical, curated threat data tailored to specific industry groups. External intelligence sources improve situational awareness while helping foster collaboration between industry groups and the overall security community.
Open-Source Intelligence (OSINT)
OSINT describes collecting and analyzing publicly available information to support intelligence. It includes data from any publicly accessible source, such as news/internet media, academic papers, social media, government reports, search engines, and many others. OSINT is valuable due to its easy access and breadth of available information.For a team, OSINT methods are valuable for gathering data on potential threats, adversaries, vulnerabilities, and other relevant cybersecurity information.
Social Media Monitoring, Used to track potential threats, identify malicious actors, and gather intelligence on emerging threats by monitoring platforms like Twitter, LinkedIn, Facebook, and other social media sites for mentions of the organization, its employees, or related keywords. Analysts often use tools like TweetDeck and Hootsuite or more sophisticated tools such as Maltego, which can automate many social media monitoring tasks.
Domain and IP Research, Used to uncover malicious domains or IP addresses used in phishing, malware distribution, or command-and-control (C2) activities by using domain registration lookup tools (WHOIS) to gather information on domain owners, reviewing DNS records, and analyzing historical domain information. feeds and reputation services can provide information regarding known malicious domains and IPs for reference. Analysts often use tools like WHOIS databases, DNSdumpster, VirusTotal, AbuseIPDB, Cisco Talos, and services like AlienVault OTX or ThreatCrowd.
Public Code Repositories and Paste Sites Monitoring, Used to detect the accidental or intentional leaking of sensitive information, such as credentials, API keys, or proprietary code, and accomplished by monitoring platforms like GitHub, GitLab, Pastebin, and other code-sharing sites for mentions of the organization or its internal tools and systems.
News and Blog Monitoring, Perhaps the least sophisticated method, but no less important. This type of monitoring seeks to stay updated on the latest threats, vulnerabilities, and incidents that could impact the organization by monitoring cybersecurity news websites, blogs, and forums for reports on new vulnerabilities, exploits, or breaches that could affect the organization or its industry. Tools like RSS feed aggregators, Google Alerts, and automated news monitoring tools like Feedly are a few common tools.
Dark Web Monitoring
The dark web is a part of the regular internet but is not readily accessible or indexed by traditional search engines. It is generally associated with anonymous communication and illegal activities, including the sale of drugs, weapons, and stolen data. Despite its bad reputation, the dark web has several legitimate and important purposes, such as supporting open journalism, providing open access to information to citizens in countries governed by oppressive regimes, providing anonymity to vulnerable individuals and communities, and protecting privacy in unique ways. The anonymity offered by the dark web is what makes it a haven for criminals. Monitoring the dark web helps to identify potential threats and mitigate associated risks, such as a threat actor group using forums to discuss plans to attack a specific industry sector. Knowledge of these plans helps to fortify defenses in anticipation of increased attack activity. Dark Web Monitoring is often accomplished via manual browsing with Tor, but specialized services exist to assist in this endeavor, including ZeroFox, Flare, DarkOwl, Recorded Future, and others.
Information Sharing and Analysis Centers (ISACs)
ISACs facilitate the sharing of data and security best practices among organizations within a specific industry. Their purpose is to enhance the collective security among their members while providing valuable insights to organizations that may not otherwise have access to them. ISACs help members stay informed about emerging threats, vulnerabilities, attack campaigns, observed TTPs, and relevant mitigation strategies. Some ISACs also provide highly subsidized services to help organizations with limited resources gain access to high-quality help.
The National Council of ISACs (NCI) coordinates various sector-specific ISACs, promoting collaboration and information sharing across critical infrastructure sectors.
The Multi-State Information Sharing and Analysis Center (MS-ISAC) serves state, local, tribal, and territorial (SLTT) governments across the U.S.
The Financial Services Information Sharing and Analysis Center (FS-ISAC) is one of the largest and most well-established ISACs. It is focused on protecting the financial services sector from cyber and physical threats.
The Health Information Sharing and Analysis Center (H-ISAC) is dedicated to safeguarding the healthcare industry, including hospitals, health plans, and pharmaceutical companies.
The Electricity Information Sharing and Analysis Center (E-ISAC) works to enhance the cybersecurity and physical security of the electric power grid.
The Information Technology Information Sharing and Analysis Center (IT-ISAC) protects the IT sector, covering software, hardware, and telecommunications companies.
The Aviation Information Sharing and Analysis Center (A-ISAC) is focused on securing the aviation industry, including airlines, airports, and manufacturers.
The Automotive Information Sharing and Analysis Center (Auto-ISAC) focuses on the automotive industry, addressing cybersecurity threats to connected vehicles and autonomous systems.
The Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC) protects the retail and hospitality industries, including restaurants, hotels, and retailers.
The Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC) safeguards the oil and natural gas sector, including exploration, production, and distribution.
The Surface Transportation Information Sharing and Analysis Center (ST-ISAC) is dedicated to the transportation sector, covering railroads, trucking, and mass transit.
Reliability Factors
Reliability factors shape the trustworthiness of information provided by different sources. They involve assessing the source's credibility, corroborating data across multiple sources, and evaluating the timeliness and relevance of information. Reliable intelligence helps organizations make informed decisions and effectively address genuine threats. In contrast, unreliable sources provide misleading data resulting in wasted time. Even worse, unreliable sources may also fail to provide insights on valid, active threats. Organizations can allocate resources more efficiently and improve security operations by identifying and prioritizing reliable sources.
Counterintelligence (CI) and Operational Security (OPSEC) are concepts associated with safeguarding sensitive information and ensuring the security of operations, especially in military and intelligence contexts.
Counterintelligence concerns the activities aimed at protecting an organization from espionage, sabotage, and other intelligence threats.
The goals of counterintelligence (CI):
Detect and Neutralize Espionage
Protect Sensitive Information
Conduct Counter-Espionage Operations
Identify Insider Threats
Operational Security (OPEC) is a risk management process that helps protect sensitive information and operations from being compromised. Counterintelligence is more focused on countering intelligence threats and adversary activities, whereas OPSEC is broader, encompassing the overall protection of operations. Additionally, counterintelligence often involves proactive measures designed to detect and neutralize adversarial actions, whereas OPSEC is more reactive by many measures.
The goals of Operational Security (OPSEC):
Identify Critical Information
Analyze Threats
Assess Vulnerabilities
Implement Countermeasures
Monitor and Adapt
platforms (TIPs) are essential tools that help organizations collect, analyze, and respond to threats. They support proactive defenses by providing valuable insights into potential and active threat actor activities.
Open-Source Platforms
Open-source platforms are cost-effective and highly customizable solutions that allow organizations to tailor threat detection and response capabilities. They benefit from community-driven development and open-source licensing but generally require substantial technical expertise to implement and maintain effectively, and official support may be limited. Additionally, integrating open-source TIPs with existing infrastructure can be complex and time-consuming, if possible.
MISP Open-Source and Sharing Platform
Screenshot of the MISP Threat Sharing platform displaying encrypted data, visualization graphs, dashboards with authentication failure data for usernames and IP addresses, and achievement notifications for sharing and tagging threat events.
Screenshot used with permission of MISP Project.
Third-Party Vendor (Proprietary) Platforms
Proprietary platforms (TIPs) offer comprehensive support and compelling features often unavailable elsewhere, making them user-friendly and highly practical. These platforms are designed for easier integration with existing infrastructure and have dedicated support services. However, this can come at a steep cost and often leads to vendor lock-in once the product is fully integrated. Many organizations adopt a hybrid approach, using both open-source and proprietary TIPs to leverage the strengths of each. However, regulatory requirements that mandate specific service features and reporting standards can limit the choice of TIPs. Financial constraints also play a significant role in the decision to use one platform over another.
Indicators of Compromise (IoCs) describe forensic data, such as data discovered in system logs or binary files, that identify potentially malicious activity on a system or within a network environment. IoCs are fundamental to and security operations because they are the markers of suspicious activity. IoCs help to fingerprint malicious activity so that security tools can use them to detect threats that have breached other defenses. Additionally, IoCs can often reveal information that identifies the threat group responsible for the attack.
Structured Threat Information eXchange (STIX) is both a language and a format used to share cyber (CTI). It establishes a comprehensive framework for representing threat information, including threat actors, Tactics, Techniques, and Procedures (TTPs), campaigns and threat reports, and Indicators of Compromise (IoCs).
Trusted Automated Exchange of Indicator Information (TAXII) is a suite of services that enable the automated sharing of CTI over HTTPS. TAXII supports hub and spoke and peer-to-peer communication. TAXII's automation capabilities ensure that security analysts can share critical threat information quickly and efficiently.
STIX and TAXII facilitate collaboration within the cybersecurity community by enabling organizations to more easily share with trusted partners, industry groups, and government agencies.
Indicators of Attacks (IoAs)
Indicators of Attack (IoAs) differ from IoCs because they focus on detecting ongoing attacks rather than identifying past events. IoAs provide context about an attacker's behavior by identifying the established Tactics, Techniques, and Procedures (TTPs) in use. They are generally derived from observing TTPs in action. By understanding TTPs, security teams can anticipate and mitigate attacks even if they change and evolve the methods used to execute them.
The Pyramid of Pain is a conceptual model that describes the different types of indicators used in cyber threat detection and response and their relative difficulty in terms of causing pain to adversaries when defenders can detect and respond to them.
Note:
Pyramid of Pain https://www.attackiq.com/glossary/pyramid-of-pain/
Understanding the relationship of the Pyramid of Pain to Indicators of Attack (IoA) can enhance the effectiveness of threat detection and mitigation strategies. IoAs focus on detecting behaviors and tactics indicative of ongoing attacks rather than static indicators of past compromises. By prioritizing IoAs, defenders can impose significant challenges on attackers, forcing them to alter their methods fundamentally.
Rule-based languages allow for codifying patterns and behaviors associated with malicious activity.
Sigma is a generic and open signature format for (Security Information and Event Management) systems. Sigma is designed to be flexible and SIEM-agnostic by supporting the creation of detection rules that can be easily converted into other formats.
Note:
Sigma https://sigmahq.io/docs/guide/about.html
Yet another recursive acronym (YARA) is a tool developed and maintained by VirusTotal intended to help malware researchers identify and classify malware samples. Security teams use YARA to scan files and memory for signs of malicious code, supporting real-time detection and post-incident forensic investigations. YARA's capacity to precisely define malware characteristics makes it a powerful mechanism for sharing detailed information among interested parties.
Note:
Yara https://virustotal.github.io/yara/
Real Intelligence Threat Analytics (RITA) is a network traffic analysis framework that emphasizes identifying Command & Control (C2) communications by focusing on behavioral analysis instead of the static indicators popular with many other tools.
Note:
RITA https://github.com/activecm/rita
Snort is an open-source network intrusion detection and prevention system (IDS/IPS) that analyzes network traffic to detect malicious activities using a unique rule-based language. Security teams can customize and update snort rules to match a wide range of scenarios but most commonly to track or identify targeted and evolving threats.
Note:
Snort https://www.snort.org
Rule-based languages support standardized descriptions of threat patterns to be shared across different organizations and system types, fostering a collaborative and community-focused approach to cybersecurity defensive operations. The ability to write, share, and implement rules that work in different tools ensures that security analysts can easily share data, leading to faster detection and response times.
Exam Objectives Covered
Incident analysis and response comprises a number of different security elements. Malware analysis and reverse engineering are critical processes for understanding the behavior and structure of malicious software, enabling security teams to develop effective countermeasures. Analyzing volatile and non-volatile storage, along with network and host data, provides a comprehensive view of an attack's impact and scope. Metadata analysis and hardware examination further enhance the understanding of how malware operates and propagates. Data recovery and extraction are essential for retrieving compromised information and supporting threat response efforts. Preparedness exercises, such as simulations and drills, help organizations refine their strategies and improve overall readiness. Timeline reconstruction and root cause analysis are vital for piecing together the sequence of events leading to a security incident and identifying underlying vulnerabilities. Cloud Workload Protection Platforms (CWPP) ensure that cloud environments are safeguarded against threats, while insider threat programs focus on detecting and mitigating risks posed by internal actors. Together, these elements form a comprehensive approach to cybersecurity, emphasizing the importance of thorough analysis and proactive measures in maintaining a robust defense posture.
As you study this lesson, answer the following questions:
How can organizations leverage automated malware analysis tools to enhance their ability to quickly identify and respond to new and evolving malware threats?
What are the most common tools and methodologies used in forensic analysis to investigate cyber incidents, and how do they help in reconstructing the sequence of events?
What are the key techniques and tools used in the detection and initial analysis of cybersecurity incidents, and how do they help in identifying potential threats early?
What strategies can organizations implement to foster a culture of continuous improvement in their cybersecurity practices, and how can these strategies enhance overall security posture?
What are the essential components of a comprehensive cybersecurity preparedness plan, and how can organizations ensure they are effectively prepared to handle potential cyber threats?
Malware analysis is critical to and supports multiple initiatives to manage and assess threats effectively. Analyzing malware reveals detailed information regarding its operation, including its payload, persistence mechanisms, and propagation methods. Additionally, analysis can determine the malware's intent, such as data exfiltration, system destruction, or credential theft. Extracting artifacts such as file hashes, IP addresses, domain names, and registry changes can be used to fortify defensive capabilities to detect additional instances that may be present elsewhere in the organization and block the malware from spreading further. Malware analysis helps to determine the scope of a breach, better assess the damage it has caused, and can potentially attribute the attack to a specific threat actor group by comparing artifacts with known samples. It also supports the creation of detailed and accurate incident documentation, which is crucial for post-incident reviews, insurance claims, and regulatory compliance.
Detonation describes running malware in a controlled and isolated environment to observe its behavior safely. Detonation helps reveal what the malware does, such as the changes it makes to an operating system, network connections it attempts to establish and files it accesses or modifies.
The following are two popular platforms for malware analysis:
Cuckoo Sandbox is an open-source automated malware analysis system. https://cuckoo.cert.ee
Joe Sandbox is an advanced, cloud-based malware analysis and detection platform. https://www.joesandbox.com
Indicators of Compromise () Extractions involve identifying artifacts or evidence that indicate a system has been compromised. IoCs can include IP addresses, domain names, file hashes, log file entries, specific event sequences, malware, registry keys, and many others. Learning about and referencing known Indicators of Compromise (IoCs) is crucial to cybersecurity operations, especially in and .
Sources for information attributed to IoCs include:
Feeds/Platforms
Vendor Published Security Reports
Information Sharing and Analysis Centers (ISACs)
Databases and Search Engines (VirusTotal, Joe Sandbox, AlienVault OTX, etc.)
Training and Education Courses
Cybersecurity Blogs and Forums
Computer Emergency Response Teams (CERTs) and
Law enforcement agency Public Information Notices (PIN)
Sandboxing describes running malware in a safe and protected environment that is specifically designed to deeply analyze its behavior without risking an organization's systems or environment. This technique helps understand the full extent of the malware's capabilities, its fingerprints, and potential impacts.
Code Stylometry involves analyzing malware coding style to attribute it to known threat actors or compare its similarity to other known malware samples using code-matching techniques.
Variant matching identifies different versions or variants of the same malware family to help understand how malware evolves.
Code similarity describes comparing the code in a malware sample to other samples to help attribute it to malware used by known threat actors.
Malware attribution attempts to determine the origin of a malware sample through analysis of coding style, infrastructure used, and behavior patterns. It helps expose the motives behind an attack and for developing targeted defensive strategies.
Reverse engineering provides deep insights into software by systematically deconstructing it to understand its components and behavior. Reverse engineering leverages various static and dynamic analysis and code inspection techniques.
Disassembly and decompilation are two techniques used in reverse engineering to understand software's inner workings. Both techniques convert executable code to help expose its operation, but they do so at different levels of abstraction. Disassembly translates machine code (binary code) into assembly language, whereas decompilation converts binary code or bytecode into the higher-level programming language, revealing the original source code.
Binary code is machine-specific, generated by a compiler from source code, and directly executed by hardware,
Bytecode is an intermediate form of code run by an interpreter or just-in-time (JIT) compiler, making it more portable but requiring a runtime environment.
Timeline reconstruction involves piecing together the sequence of events leading up to, during, and after a security incident. This process aims to create a clear, detailed timeline that outlines when specific actions occurred, such as system logins, file modifications, network connections, and more. By reconstructing the timeline, incident responders can identify patterns of behavior or anomalies indicative of malicious activity.
Data extraction describes identifying and isolating information from data sources, such as logs, databases, or network traffic, to understand an incident thoroughly. Extracted data is used to perform closer analysis, generate reports, and support decision-making during the process.
During or after a security incident, critical data may be lost, deleted, or corrupted. Data recovery aims to restore this data to its original state and can also provide valuable evidence that aids in understanding the nature and impact of the incident.
Binary Analysis Tool Description
hexdump The hexdump utility can also be used to extract data from binary files and can display the contents in hexadecimal, decimal, octal, or ASCII formats. hexdump inspection is often part of data recovery and/or reverse engineering processes. Issuing the command hexdump --canonical against a file of interest can reveal the file's MIME type, date of creation, date of access, and other pertinent information.
Ghidra An open source software tool originally developed by the NSA. Ghidra is written in Java and shares many of the same features and functionality found in the IDA Pro tool (which requires the purchase of a license). Ghidra is intended to be used for reverse engineering tasks and is most closely associated with reverse engineering malware. Ghidra is available from https://ghidra-sre.org/.
GNU Project debugger (GDB) GNU Project debugger (GDB) is a tool which can be used to identify what is occurring within an application while it is running. GNU Project debugger (GDB) can analyze programs written in several languages, including C/C++, Objective-C, Fortran, and Assembly. GDB can be used to analyze how code runs, at a low level, as well as identify shared libraries loaded by the program, including the address space that was used to load them. GDB can be used to step-through the flow of an application by using breakpoints and watchpoints to pause operation.
OllyDbg OllyDbg is a debugger, like GDB, but is focused on Microsoft Windows and includes a graphical user interface. OllyDbg can reveal information regarding the internal structures and operation of an application without having access to its source code.
readelf When compiled, source code produces an object file that is used to run the program defined by the code. The object file is read and executed by the computer by following structures within the object file. An example of the structures within the object file include ELF, Executable and Linkable Format, which can be read by readelf. readelf can identify important information about the file and how it was constructed and is useful for reverse engineering tasks.
objdump Similar to readelf, objdump can be used to analyze object files and includes a disassembler to reveal the assembler commands used by the program.
strace The strace tool can be used to identify interactions between processes and the Linux kernel. These interactions can be monitored and/or modified in order to deconstruct how an application operates when its source code is not available.
ldd The ldd utility can be used to display a program's dependencies. For example, issuing the command sudo ldd /sbin/poweroff displays all of the shared libraries required by the Linux poweroff command
file Aorensic Analysis simple but very useful command, file displays the type of a file by inspecting its content. All files include "magic bytes" which can accurately identify the type of a file. The file utility will compare the magic bytes of a file to a list of known magic bytes to determine its type. If the magic bytes do not clearly identify the type, file will examine the file to determine if it is a text file and identify if it represents a particular encoding format or programming language.
In the context of , analyzing storage and hardware components, metadata, network traffic, and hosts is critical for identifying, mitigating, and recovering from security incidents. Each analysis type offers unique insights that contribute to a comprehensive understanding of an incident.
Metadata
An email header contains metadata about the email, including information such as the sender, recipient, time of sending, routing information, and other technical details. It helps trace an email's origin, which is crucial information needed when investigating phishing, spoofing, or targeted attacks.
Image metadata includes details such as image capture date and time, capture device hardware information, GPS location of the image/device, and camera settings such as exposure and resolution. Image metadata helps verify the authenticity and origin of images, which can be crucial in cases of fraud or misinformation.
Metadata for audio and video files includes details such as codec (a tool that compresses and decompresses digital media files), bit rate (size and quality), creation time, software used for multimedia editing, and sometimes GPS location. Analyzing audio and video metadata helps determine whether an audio or video file is original or edited.
Filesystem metadata includes the date a file was created, the date it was last modified, access permissions, and ownership details. Understanding when a file was created, modified, or accessed can help reconstruct the sequence of events in an incident. In data loss or corruption incidents, metadata can be critical for recovery efforts.
Network Analysis
Network analysis involves examining network traffic, protocols, connections, and logs to detect, trace, and understand malicious activities within a network. It also identifies unusual patterns, unauthorized access, or suspicious communications that may indicate an attack or breach. Network analysis helps measure the extent of an incident by tracing the movement of threats throughout the network and can pinpoint the entry points and vectors used by attackers to infiltrate the network, facilitating targeted mitigation.
Volatile and Non-Volatile Storage Analysis
Volatile storage refers to data stored in temporary memory (RAM) that is lost when the device is powered off. During an incident, volatile memory contains active system processes, network connections, and sometimes encryption keys, which are not present on system mass storage devices. Analysis can reveal malware running in memory that has not written itself to disk, exposing signs of an ongoing attack using memory-resident malware or covert remote connections.
Non-volatile storage includes data stored on storage devices like hard disk drives (HDD), solid-state disks (SSDs), and M.2 flash drives. Data stored on these devices remains even after the system is powered off. Analysis of non-volatile storage helps recover lost or deleted data that could be crucial in understanding the incident and helps identify changes over time, such as unauthorized file modifications or deletions. Non-volatile storage analysis can also provide deep insights into computer activity by revealing usage details tracked and saved by the operating system on a user-by-user basis.
Host and Hardware Analysis
Host analysis describes the examination of individual system logs, processes, configurations, and files to identify signs of compromise or malicious activity. It provides a granular view of what happened on a specific host, including how it was affected and any persistence mechanisms used by attackers. Joint Test Action Group (JTAG) is a standard for testing and debugging hardware at the component level. It is used to evaluate embedded systems and microcontrollers. JTAG facilitates the extraction and analysis of firmware and is critical for understanding how a device works or was compromised. In scenarios where malware may be embedded within hardware, JTAG analysis can be used to detect and remove it.
Root cause analysis and threat response both directly support continuous process improvement. Root cause analysis ensures that an organization learns from incidents by identifying and correcting underlying issues, while threat response supports an organization's effectiveness in the face of new threats and challenges. This leads to an environment that continuously evolves, becoming more resilient, efficient, and effective over time.
Root Cause Analysis (RCA) is a systematic process used to identify the fundamental cause of an incident. Instead of simply addressing the problem, RCA aims to determine the underlying cause of the incident, which is often very difficult to pinpoint but facilitates the implementation of measures intended to prevent future occurrences.
Threat response describes the actions taken to mitigate a security threat during or after an incident, and includes activities such as containment, eradication, and recovery. The primary purpose of threat response is to manage and contain a threat to prevent further damage. It also includes efforts to restore normal operations as quickly as possible and to gather evidence for further analysis or legal proceedings if necessary. Through continual refinement of threat response processes, organizations can improve their overall security posture and reduce the likelihood that future threats will succeed.
Effective does not focus solely on reactive measures but instead requires a multifaceted approach that leverages preparedness exercises to support a robust defense. This enables organizations to respond swiftly and effectively to potential cyber threats before they escalate into devastating levels of impact.
Preparedness exercises are simulated scenarios that allow organizations to practice procedures in a controlled environment. These exercises typically range in complexity from relatively simple tabletop simulations to full-scale exercises that mimic real-world cyber attacks or physical disruptions. Selecting one method over another depends on the risk profile and resources available to the organization in question. Regardless of the format, these exercises help identify gaps in plans, including unclear roles, communication issues, and weaknesses in technical or procedural defenses. These exercises enhance coordination across departments by involving many different groups (such as IT, security, legal, and communications), ensuring everyone is clear regarding their responsibilities during a real incident.
Regularly conducting preparedness exercises builds team confidence, ensuring they are ready to act decisively under pressure, and repeated practice helps teams respond more quickly and efficiently during a real incident.
Insider threats refer to the risks posed by individuals within the organization, such as employees, contractors, and business partners, who have access to critical systems and data. Threats attributed to insiders can be intentional, such as malicious actions by disgruntled employees, or unintentional, such as accidental data breaches caused by negligence. Whether intentional or not, impacts caused by insiders can be devastating, and preparedness exercises should consider potential scenarios carefully.
Insider threat management strategies play a pivotal role in maintaining a secure work environment. By supporting early detection of suspicious behavior and policy violations, these strategies can potentially prevent incidents before they escalate. Common approaches, including technological measures and policy-driven approaches, help protect sensitive data from unauthorized access or exfiltration. This not only safeguards the organization but also maintains the trust of employees and partners, ensuring a secure work environment.
Cloud Workload Protection Platform (CWPP) is a security solution that simplifies the complexity of cloud security. Designed to protect workloads in cloud environments, including virtual machines, containers, and serverless functions, CWPPs provide a single platform for managing and securing all cloud-based workloads. They offer real-time threat detection and automated response capabilities, helping organizations meet compliance requirements by providing visibility into cloud workloads.