Security+ SYO-601 → Threats, Attacks, & Vulnerabilities Notes

CVSS Score	Security Level	Scan Results
X < 4.0	Low	Pass
4.0 ≤ X < 6.0	Medium	Fail
6.0 ≤ X < 10	High	Fail
X = 10	Critical	Fail

Security+ SYO-601 → Threats, Attacks, & Vulnerabilities Notes

Here is what you need to know before you take the Security+ SYO-601 exam

Malware

Types - Propogation and Payload
- Viruses - Spread by human interaction - User education
- Worms - Spread under their own power by exploiting a vulnerabilities - Patching
- Trojan Horses - Disguises themselves and then pretends to be legitimate programs - Application Control
Malware Payloads -
- Adware - Popups that serve the interest of the malware author
- Spyware - Gathers information for the malware author
- Potentially Unwanted Programs (PUPs) = Adware + Spyware
- Ransomware - encrypts files and then selling the decryption key for ransom money
- Cryptoware - Mines cryptocurrency
Understanding Backdoors and Logic Bombs -embeds itself in other programs
- Backdoors - Provides workaround access
- Logic Bombs - Triggered events
Looking at advanced Malware -
- Rootkits - Uses root account or system account to execute payload
- Fileless Viruses - Operate completely in computer memory
Understanding botnets - Steal computing resources by doing the following:
1. Infect Systems
2. Convert to bots
3. Infect other systems
4. Check into the botnet operator's command and control network
5. Get Instructions from the command and control network
6. Deliver the payload
Malicious Script Execution -
- Shell scripts - run on command line
- Application - run within a software application
- Programming Languages - Allow the creation of general purpose code.

Understanding Attackers

Cybersecurity adversaries -
- Internal
- External
- Script kiddies
- Hacktivist
- Criminal Syndicates
Preventing insider threats - 51% of attacks
- Privilege Escalation -
- Shadow IT -
Attack Vectors -
- Email -
- Social Media -
- Removable media -
- Card Skimmers -
- Cloud Services -
- Unsecured network ports -
- Tampering with IT supply chain -
- Wireless networks -
Zero Days and the Advanced Persistent Threat - Apply security updates as soon as possible - Undiscovered vulnerabilities that are most often carried out by Advanced Security Threats (APTs), which are highly trained hackers.

Threat Intelligence

What is threat intelligence? - Information that allows teams to sty up to date on current risks
- Open Source Intelligence -
  - Security websites
  - Vulnerability databases
  - News media
  - Social media
  - Information sharing centers
  - File repositories
  - Code repositories
  - Security researchers
  - Dark web
- Email Harvesting - searching for valid emails
Managing Threat Indicators - Properties that describe a threat
- Cyber Observable eXpression (CybOX) - Not covered on SYOP-601
- STIX - part of CISA
- TAXII - part of CISA
- OpenIOC -
- Information Sharing and Analysis Centers (ISACs) - Go to https://nationalisacs.org/member-isacs for more information.
Threat Research - Uses threat intelligence to determine what the adversaries are up to
- Reputational Threat Research - Identify past IPs and domain names
- Behavioral Threat Research - Notice of behavioral patterns
Identifying Threats - Identifies and prioritizes threats
- Use a structured approach
  1. Asset Focus - asset inventory
  2. Threat Focus - how threats affects information
  3. Service Focus - identify impact of threats on services
- Automated approach - based on a code with built-in triggers
Automating threat intelligence - blacklisting of IP addresses from threat feeds
- Start in alert-only mode to assess accuracy
- Incident response is a very manual process
- Data Enrichment - Reconnaisance, related log records & trigger a vulnerability scan
- (SOAR) -
- Machine Learning -
Threat Hunting - An organized, systematic approach to seeking out indicators of compromise on our networks using expertise and analytic techniques
- Establish a hypothesis
- Identify Indicators of Compromise
- After discovering an incident, move into incident handling mode

Social Engineering Attacks - Education is key to prevention

What is social engineering? - Manipulating people into divulging information or performing an action that undermines security
- Authority - people defering to authority
- Intimidation - Scaring people
- Consensus - Herd Mentality
- Scarcity - Getting the last one
- Urgency - Time is running out
- Familiarity - We like to say yes to people we like
Impersonation attacks -
- Spam - unsolicited commercial email
- Phishing - Tricking users into giving out user credentials
  - Spear Phishing - Targeted phishing
  - Whaling - targeted phishing on senior leaders
  - Pharming - Using fake websites
  - Vishing - Voice phishing
- Smishing/SPIM - SMS and IM
- Spoofing - Fake identity
Identity fraud and pretexting - Stealing people's identities and then using them to get something they are not entitled to - See https://public.tableau.com/profile/federal.trade.commission#!/vizhome/IdentityTheftReports/TheftTypesOverTime for more information.
- Pretexting - Pretending to be the consumer whose identity got stolen
- Identity Fraud -
Watering hole attacks - Uses a common trusted website with vulnerabilities to lie and wait for their victims - Steps include:
1. Identify and compromise a highly targeted website
2. Choose a client exploit, and then bundle in a botnet
3. Place the malware on the compromised website
4. Sit back and wait for infected systems to phone home
Physical social engineering - Using physical means to get unauthorized information
- Shoulder surfing - Be aware of your settings and use screen filters.
- Dumpster Diving - Shred sensitive documents
- Tailgating - Slipping in behind someone into a secure area - Be aware of who might be following you. Don't allow them to follow you into a secure area.

Common Attacks

Password Attacks - Usually stored in Hashed forms - Better to store in shadow files
- Brute Force - Guessing
- Cracking - Tries all possibilities (e.g., John the Ripper)
- Dictionary - Uses words in a dictionary
- Hybrid - A combination of brute force, cracking, and dictionary attacks
- Rainbow Table - Uses precomputed hash values
Password spraying - Uses a file with commonly used passwords
Credential stuffing - Exploits reused passwords
Adversarial artificial intelligence - Machine Learning which simulates human thought
- Descriptive Analytics - Describes the analytics being used for AI
- Predictive Analytics - Used to predict the outcome of future data input
- Prescriptive Analytics - Most commonly associated with optimization
- Adversarial AI - Fools the AI system - Build robust algorithms to prevent this kind of attack (e.g., manual override on self-driving cars)

Vulnerability Types - Confidentiality Integrity Availablity (CIA) describes a security professional's goals

Vulnerability impact - Considers the following risks:
- Financial - cost of a breach or incident
- Reputational - how the customers will trust the company
- Strategic - ability to meet major goals and objectives
- Operational - day-to-day operations
- Compliance - ability comply with laws, regulations, and policies (e.g., HIPAA)
Supply chain vulnerabilities -
- End of Sale - Vendor continues to support a product, but no longer sells the product
- End of Support - Vendor reduces or stops supporting a product
- End of Life - Vendor no longer supports the product
- Vendor failure to announce end of support - Mitigate with backups
Configuration vulnerabilities - Good patch management (OS, applications and firmware)
- Default passwords
- open ports
- System misconfigurations
- Cryptographic
  - Weak cipher suites
  - Weak cryptographic protocol implementations
  - Poor key management
  - Poor certificate management
- other security issues
Architectural vulnerabilities - Improperly designed systems
- Security - incorprate early
- System Sprawl - New devices connected to a network, but are not managed

Vulnerability Scanning

What is vulnerability management? - Software vendors patch with the following process:

The company learns of a vulnerability
Developers analyze the issue and develop a patch
The company releases the patch to customers
Customers apply the patch to remediate the vulnerability
Share warnings about vulnerabilities with other agencies

This involves three different types of scans, namely:

Network Vulnerability - Tests for vulnerable network services
Application - Tests for vulnerabilities in programs
Web Application - Tests for web application vulnerabilities

Identity scan targets - Looking for vulnerabilities

Asset Inventory - Provides the starting point for vulnerability scanning, namely:
- Assessing how vulneabilities will affact the systems, namely:
  - Impact - What is the highest data classification handled by the system?
  - Likelihood - Addresses the following questions:
    - What is the network exposure?
    - What services are exposed?
  - Criticality - What impact does the system have on business operations?
- Using vulnerabilities to generate system inventories
Software-based (e.g., Nessus or Qualis)

Scan configuration - Vulnerability Scan settings

Scan perspective - Network scan results that come as a result of the scanner in relation to its targets

Agent-based scans - Installs software on each target
Credentialed scanning - Searches configurations

Security Content Automation Protocol (SCAP) - NIST standard for discussing vulnerabilities and security issues
- Common Vulnerability Scoring System (CVSS) - Assigns vulnerabilities on a 10-point system to describe the exploitability of a vulnerability, based on the following scoring metrics:
  - Attack Vector (AV) - How an attack executes
    - Physical (P) - Physical touch/manipulation is required
    - Local (L) - Physical or logical console access is required
    - Adjacent Network (A) - Local network access is required
    - Network (N) - Remotely exploitable vulnerability
  - Attack Complexity (AC) - How difficult a vulnerability is to exploit
    - High (H) - Hard (Requires specialized conditions)
    - Low (L) - Easy (Does not require specialized conditions)
  - Privileges Required (PR) - What level of access is necessary to exploit a vulnerability
    - High (H) - Requires administrative control
    - Low (L) - Requires Basic user privileges
    - None (N) - Does not require any prior privileges
  - User Interaction (UI) - Is user interaction necessary to exploit a vulnerability?
    - Required (R) - Requires a user to take some action
    - None (N) - Does not require any user intervention
  and assesses the impact of a vulnerability when an attacker exploits the vulnerability through the following Confidentiality Integrity Avalability (CIA) triad metrics:
  - Confidentiality (C) - Describes how much sensitive information can an attacker get
    - High (H) - All
    - Low (L) - Possibly some
    - None (N) - None
  - Integrity (I) - Describes how much information an attacker can change
    - High (H) - All
    - Low (L) - Possibly some
    - None (N) - None
  - Availability (A) - Describes how much influence an attacker can take
    - High (H) - All (the system is shutdown)
    - Low (L) - Some (degraded performance)
    - None (N) - None
  and assesses how much potential damage exploitation would result, namely:
  - Scope (S) - Describes what affect the exploitation has
    - Changed (C) - Can affect other components
    - Unchanged (U) - Only affects resources managed by the same security authority
  - Common Configuration Enumeration (CCE) - Gives us a consistent language for sharing system configuration
  - Common Platform Enumeration (CPE) - Gives us a consistent language for describing products and versions and a standard for naming them
  - Common Vulnerabilities and Exposures (CVE) - Gives us a consistent language for describing vulnerabilities
  - EXtensible Configuration Checklist Descrription Format (XCCDF) - Gives us a consistent language for creating and sharing checklists
  - Open Vulnerability and Assessment Language (OVAL) - Gives us a a consistent language for describing testing procedures in a programatic fashion
- Analyzing scan reports - Preparing cybersecurity reports -
  - Prioritization
    - Vulnerability Severity -
    - System Criticality -
    - Information Sensitivity -
    - Remediation Difficulty -
    - System Exposure -
  - Validation - Threat confirmation that can include the following results:
    - False positive - Indicates a threat that does not actually exist
    - True positive - Indicates a threat that actually exists
    - False Negative - Indicates no threat when a threat that actually exists
    - True Negative - Indicates no threat when there is no threat
- Correlating scan results - Consult industry standards, best practices, and compliance requirements
  - PCI DSS CVSS Scores - Specifies the following:
    
    CVSS Score Security Level Scan Results
    
    X < 4.0 Low Pass
    4.0 ≤ X < 6.0 Medium Fail
    6.0 ≤ X < 10 High Fail
    X = 10 Critical Fail
    where X is the CVSS score.
  - Technical Information Sources - Documentation about the technology which can include:
    - Configuration Management Systems
    - Log Repositories
    - Other Data Sources
  - Trend Analysis - Noticing patterns to establish a baseline - Helpful for verifying scan results
Penetration Testing and Exercises
- What is penetration testing? - Putting security professionals in the role of an attacker to find vulnerabilities - The goal is to successfully defeat security controls - Make sure you have permission from appropriate management before doing this! Therefore, you need to know the Rules of Engagement (RoE), which should be written before beginnng a test, namely:
  - What are you allowed to test?
  - What is the scope of the test?
  - What are you allowed to do during the test?
  These tests can be in the following forms:
  - White Box - Attackers have full access to information before testing - Simulates an insider attack
  - Gray Box - Attackers have some access to information before testing - Roughly equal to an attack from a former coworkers (combination of white and black)
  - Black Box - Attackers do no have any access to information before testing - Simulates an external attack
  NIST recommends looping back and forth between the attack phase and the discovery phase when doing penetration testing by the following process:
  - Discovery Phase - Using active and passive reconnaisance attacks, open-source tools and wardriving to discover vulnerable wireless networks. Warflying is the use of drones and UAVs for wardriving.
  - Attack Phase - Executing an attack by doing the following:
    - Gain access
    - Escalate Privileges
    - Browse Systems
    - Install additional tools
    During the attack phase, attackers may do the following:
    - Pivot - Using a base system to target other systems on the same local network
    - Persistence - Installing tools on the system to allow for future access (back door) - even when the initial vulnerability is corrected
    Once testing is done, penetration attackers should clean-up any traces of their attacks and return those systems to the same state they were in before they started the tests. Penetration tests provide valuable insights, but are labor intensive
- Bug Bounty - Open security testing in which outside attackers are allowed to conduct authorized attacks to find vulnerabilities for authorized purposes and then report them to authorized security professionals on the network. Most smaller organizations will use a vendor who generates vulnerability reports for this purpose.
- Cybersecurity Exercises - Pitting penetration testers (red team) with their defense counter-parts (blue team), with the observers and judges who act as referees to manage the exercise (white team) to accomplish the following:
  - Identify vulnerabilities
  - Provide participants with hands-on experience with attacking and securing systems → Usually the blue team is allowed a head start to beef up security on their systems before the red team tests those security measures. Once testing is complete, the red and blue teams often join to become the purple team who share what they learned from each other. These exercises usually take place in a sandbox (not on a production system).
Here are the navigation options for this page:
- Go to our home page
- Go to the main training page
- Go to the main Security+ review page