- 3.0 Architecture and Design
- 3.1 Explain use cases and purpose for frameworks, best practices and secure configuration guides.
- 3.2 Given a scenario, implement secure network architecture concepts.
- 3.3 Given a scenario, implement secure systems design.
- 3.4 Explain the importance of secure staging deployment concepts.
- 3.5 Explain the security implications of embedded systems.
- 3.6 Summarize secure application development and deployment concepts.
- 3.7 Summarize cloud and virtualization concepts.
- 3.8 Explain how resiliency and automation strategies reduce risk.
- 3.9 Explain the importance of physical security controls.
(James Messer, Jason Dion, Mike Meyers)
- Industry-standard framework
- A security framework is a guide or plan for keeping your organizational assets safe. It provides guidance and a structure to the implementation of security for organizations. Security frameworks may be regulatory, nonregulatory, national, international, and/or industry-specific.(Stewart)
- Regulatory
- "Industries under governmental regulation frequently have an approved set of architectures defined by regulatory bodies." (Conklin)
- Examples:
- Sarbanes-Oxley Act (SOX)
- The Health Insurance Portability and Accountability Act (HIPAA)
- The Gramm-Leach-Bliley Act of 1999 (GLBA)
- Non-regulatory
- Strong suggestions
- Maybe have regulation in the works
- In your best interest
- Right thing to do
- National vs. international
- Industry-specific frameworks
- Process management: "Getting the IT 'product' to work best with the organization." (Messer)
- Best practices
- Examples:
- Control Objectives for Information and Related Technologies (COBIT).
- ITIL. (Information Technology Infrastructure Library) Multiple stages of the IT lifecycle.
- Benchmark
- A benchmark is a documented list of requirements that is used to determine whether a system, device, or software solution is allowed to operate within a secure management environment. Benchmarks may be platform- or vendor-specific or general-purpose.(Stewart)
- Platform/vendor-specific guides
- Web server
- Run server from non-privileged account
- Configure file permissions
- Prevent data leaks, unauthorized server access
- Configure SSL certs
- Monitor access and error logs
- Operating system
- Service packs, security packages
- User account passwords, account limitations
- Limit network access
- Provide ongoing monitoring
- Application server
- Not very common but some cases to provide runtime libraries etc.
- Usually sits between webserver and the database (middleware)
- Disable unnecessary services
- Install security patches
- Limit access from other devices
- Network infrastructure devices
- SWITCHES/ROUTERS/FIREWALLS/IPS
- Embedded OS , limited OS access
- Don't use defaults for authentication
- Security updates - check with the manufacturer
- Web server
- General purpose guides
- Defense-in-depth
- Mixture of technologies (layering of technology) to provide the security we need
- Defense in depth or layered security is the use of multiple types of access controls in literal or theoretical concentric circles or layers. Defense in depth should include vendor diversity and control diversity.(Stewart)
- Physical controls
- Locks, fences, cameras
- "Fencing acts as the first line of defense against casual trespassers and potential intruders." (uCertify)
- Card/badge access
- Security guard
- Locks, fences, cameras
- Vendor diversity
- "Having multiple suppliers creates vendor diversity, which reduces the risk from any single supplier... Having only a monoculture raises risks when something specific to that environment fails." (Conklin)
- Control diversity
- Administrative
- Policies and procedures
- Onboarding and offboarding
- Technical
- Hardware and software
- Firewalls, active directory authentication, disk encryption
- DMZ
- Hashing and salting passwords
- Intrusion prevention system
- VPN access
- Anti-virus, anti-malware software
- Administrative
- User training
- "The best defense is to implement a strong user training program that instructs users to recognize safe and unsafe computing behaviors. The best form of user training has proven to be user-specific training, training that is related to the tasks that individuals use computers to accomplish." (Conklin)
- DMZ (Screened Subnet)
- "An additional layer of security between the Internet and you." (Messer)
- A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall. (Stewart)
- Usually requires additional authentication, only allow access to authorized users
- Extranet
- Private DMZ
- An extranet is an intranet that functions as a DMZ for business-to-business transactions. Extranets let organizations offer specialized services to business partners, suppliers, distributors, or customers. (Stewart)
- "A private network for partners." (Messer)
- Intranet
- Private. Only available internally.
- Company business, documents, announcements. (Messer)
- No external access. Accessible internally or via VPN.
- Wireless
- 802.1X standard for connection.
- Use normal network login credentials.
- No shared passphrase.
- 802.1X standard for connection.
- Guest
- Meetings, demonstrations.
- Internet access only.
- Integrate with "captive portal"
- Require username/password
- Avoid unauthorized use
- Ad hoc
- Wireless without an access point
- Point to point communication
- e.g. AirDrop
- Difficult to manage
- MDM can allow, disallow, set parameters
- Honeynets, honeypots
- Attract hackers, bots
- Recon, intel on attempted intruders
- Honeypot: single-use/single-system
- Honeynet: group of honeypots
- Network Address Translation (NAT)
- NAT converts the IP addresses of internal systems found in the headers of network packets into public IP addresses. It hides the IP addressing scheme and structure from external entities. NAT serves as a basic firewall by only allowing incoming traffic that is in response to an internal system’s request. It reduces expense by requiring fewer leased public IP addresses, and it allows the use of private IP addresses (Stewart)
- IPv4 support being exhausted
- Not a security mechanism
- Unprotected NAT can be circumvented
- Combined with statement firewall for security
- Physical, logical or virtual segmentation
- Useful for performance (high bandwidth) speed, security, and compliance
- Physical
- Logical (VLAN)
- Separated logically instead of physically
- "Cannot communicate between VLANs without Layer 3 device / router." (Messer)
- Virtualization
- Instant and complete control
- Build new network programmatically
- Route between IP subnets
- Air gaps
- "Air gaps is the term used to describe when no data path exists between two networks that are not connected in any way except via a physical air gap between them." (Conklin)
- No shared components, no possible way to communicate to each other (SCADA/ manufacturing)
-
Site-to-site
- "Site-to-site communication links are network connections that connect two or more networks across an intermediary network layer." (Conklin)
-
Remote access
- "Remote access via a tunnel or VPN has the same effect as directly connecting the remote system to the network—it’s as if the remote user just plugged a network cable directly into her machine." (Conklin)
- Usually involve with VPN concentrator on cooperate network
-
VPN protocols.
- PPTP, L2TP, OpenVPN, and IPSec are VPN protocols.
-
Point-to-Point Tunneling Protocol (PPTP)
- PPTP is based on PPP, is limited to IP traffic, and uses TCP port 1723. PPTP supports PAP, SPAP, CHAP, EAP, and MS-CHAP v.1 and v.2
-
Layer 2 Tunneling Protocol (L2TP)
- L2TP is based on PPTP and L2F, supports any LAN protocol, uses UDP port 1701, and often uses IPSec for encryption.
-
OpenVPN.
- OpenVPN is based on TLS (formerly SSL) and provides an easy-to-configure but robustly secured VPN option.
- Sensors
- "Sensors are devices that capture data and act upon it... They can report on what they observe, they can use multiple readings to match a pattern and create an event, and they can act based on proscribed rules." (Conklin)
- IPS logs, firewall logs ect. usually raw data
- Collectors
- "Collectors are sensors, or concentrators that combine multiple sensors that collect data for processing by other systems." (Conklin)
- its collectors job to make sens of the data collected by sensors
- Correlation engines
- "Correlation engines take sets of data and match the patterns against known patterns." (Conklin)
- This is use to compare diverse sensor data
- Filters
- "Packet filters process packets at a network interface based on source and destination addresses, ports, or protocols, and either allow passage or block them based on a set of rules." (Conklin)
- usually on device or server , linux iptables
- Proxies
- "Proxies are servers that act as a go-between between clients and other systems; in essence, they are designed to act on the clients’ behalf." (Conklin)
- use to access control, caching, URL filtering, content scanning
- Forward proxy is to protect users from the internet
- Firewalls
- "Firewalls at their base level are policy enforcement engines that determine whether traffic can pass or not based on a set of rules." (Conklin)
- VPN concentrators
- "A VPN concentrator takes multiple individual VPN connections and terminates them into a single network point." (Conklin)
- Usually located on the edge of the network (internet facing)
- SSL accelerators
- "An SSL accelerator is used to provide SSL/TLS encryption/decryption at scale, removing the load from web servers." (Conklin)
- Load balancers
- "Load balancers take incoming traffic from one network location and distribute it across multiple network operations." (Conklin)
- DDoS mitigator
- "DDoS mitigators by nature must exist outside the area that they are protecting. They act as an umbrella, shielding away the unwanted DDoS packets." (Conklin)
- In cloud based DDOS mitigation all the users will filter through cloud based service
- Onsite tools include DDoS filtering in a firewall or IPS
- Aggregation switches
- "An aggregation switch is a switch that provides connectivity for several other switches. Think of it as a one-to-many type of device. It’s the one switch that many other switches connect to." (Conklin)
- Taps and port mirror
- "Most enterprise switches have the ability to copy the activity of one or more ports through a Switch Port Analyzer (SPAN) port, also known as a port mirror. This traffic can then be sent to a device for analysis." (Conklin)
- "A Test Access Point (TAP) is a passive signal-copying mechanism installed between two points on the network. The TAP can copy all packets it receives, rebuilding a copy of all messages. TAPs provide the one distinct advantage of not being overwhelmed by traffic levels, at least not in the process of data collection." (Conklin)
- Port mirror (software based version of TAP) is use to port redirection
- SDN (James Messer)
- "Software-defined networking (SDN)... enables network engineers to reconfigure the network by making changes via a software program, without the need for re-cabling. SDN allows for network function deployment via software." (Conklin)
- Control plane - configuration
- Data plane - forwarding the frames, firewalls
- Orchestration
(Mike Meyers 1, Mike Meyers 2)
- FDE/SED (Mike Meyers)
- "Full disk encryption (FDE) and self-encrypting disks (SEDs) are methods of implement- ing cryptographic protection on hard disk drives and other similar storage media with the express purpose of protecting the data even if the disk drive is removed from the machine." (Conklin)
- FDE built in to the OS (MS Bitlocker, Apple FileVault)
- SED is a physical drive that you can buy thats doing encryption for you
- TPM
- "The Trusted Platform Module (TPM) is a hardware solution on the motherboard, one that assists with key generation and storage as well as random number generation. When the encryption keys are stored in the TPM, they are not accessible via normal software channels and are physically separated from the hard drive or other encrypted data locations." (Conklin)
- HSM
- "A hardware security module (HSM) is a device used to manage or store encryption keys. It can also assist in cryptographic operations such as encryption, hashing, or the application of digital signatures. HSMs typically are peripheral devices..." (Conklin)
- UEFI/BIOS
- "Unified Extensible Firmware Interface (UEFI) is the current replacement for BIOS. UEFI offers significant modernization over the decades-old BIOS, including the capability to deal with modern peripherals such as high-capacity storage and high-bandwidth communications." (Conklin)
- Secure boot and attestation
- Secure Boot
- "Secure Boot is a mode that, when enabled, only allows signed drivers and OS loaders to be invoked." (Conklin)
- Its a feature of UEFI
- "Secure Boot enables the attestation that the drivers and OS loaders being used have not changed since they were approved for use." (Conklin)
- Remote attestation
- is a way to verify if any of your hardware or software changed in large scale implementation
- devices provide an operational report to a verification server
- Encrypt and digitally signed with the TPM
- Changes are identified and managed before the OS boot
- Secure Boot
- Supply chain
- "In today’s world of global manufacturing with global outsourcing, attempting to identify all the suppliers in a hardware manufacturer’s supply chain, which commonly changes from device to device, and even between lots, is practically futile in most cases." (Conklin)
- Use trusted vendors, critical devices should not be connected to the outside before security in place
- Hardware root of trust
- "A hardware root of trust is a concept that if one has a trusted source of specific security functions, this layer can be used to promote security to higher layers of a system... Examples of roots of trust include TPM chips in computers and Apple’s Secure Enclave coprocessor in its iPhones and iPads." (Conklin)
- TPM, HSM designed to be the hardware root of the trust
- EMI/EMP
- "Electromagnetic interference (EMI) is an electrical disturbance that affects an electrical circuit. EMI is due to either electromagnetic induction or radiation emitted from an external source..." (Conklin)
- "An electromagnetic pulse (EMP) is a burst of current in an electronic device as a result of a current pulse from electromagnetic radiation." (Conklin)
- EMI Leakage - determine the date steams based on EMI emersion from keyboards, HDD, network connections
- Modifying the security by injecting EMI, change sensor data and other inputs
- Shielding against EMP to prevent this happening
- Types
- Network
- Server
- Workstation
- Appliance
- Kiosk
- Mobile OS
- Patch management
- Hotfix: "small software update designed to address a specific problem, such as a buffer overflow in an application that exposes the system to attacks." (Conklin)
- Patch: "more formal, larger software update that can address several or many software problems." (Conklin)
- Service pack: "large collection of patches and hotfixes rolled into a single, rather large package." (Conklin)
- Disabling unnecessary ports and services
- Least functionality
- "A system should do what it is supposed to do, and only what it is supposed to do." (Conklin)
- Secure configurations
- "Having systems properly configured prior to use can limit the number of user caused incidents." (Conklin)
- Fine tuning the OS, stay up-todate with patches, compromised systems are re-imaged, perform regular integrity checks.
- Trusted operating system
- "A trusted operating system is one that is designed to allow multilevel security in its operation. This is further defined by its ability to meet a series of criteria required by the U.S. government." (Conklin)
- Application whitelisting/blacklisting
- "Application blacklisting is essentially noting which applications should not be allowed to run on the machine... Application whitelisting is the exact opposite: it consists of a list of allowed applica- tions." (Conklin)
- Disable default accounts/passwords (guest/root/mail)
- Wireless keyboards / Wireless mice
- communicate in clear , use propitiatory wireless protocols over 2.4 Ghz
- Inject keystrokes and mouse movements
- Vulnerability called
keySniffer - use kbs with AES
- Displays - EM
- WiFi-enabled MicroSD cards
- Printers/MFDs
- External storage devices
- Digital cameras
- Secure staging
- Secure staging is the controlled process of configuration and deployment for new systems, whether hardware or software. The goal of a secure staging process is to ensure compliance with the organization’s security policies and configuration baselines while minimizing risks associated with exposing an insecure system to a private network or even the Internet. (Stewart)
- Sandboxing
- "Sandboxing refers to the quarantine or isolation of a system from its surroundings... Virtualization can be used as a form of sandboxing with respect to an entire system." (Conklin)
- Environment
- Development
- Test
- Staging
- "The primary purpose of staging is to serve as a sandbox after testing, so the test sys- tem can test the next set, while the current set is deployed across the enterprise." (Conklin)
- Production
- Secure baseline
- "This process of establishing software’s base security state is called baselining, and the resulting product is a secure baseline that allows the software to run safely and securely." (Conklin)
- Firewall settings, patch levels, OS file versions
- Integrity measurement
- "Integrity measurement is the measuring and identification of changes to a specific system away from an expected value." (Conklin)
- Check against baseline to see if the application maintain the minimum secure baseline requirements
- Operate and Maintain phase (uCertify):
- Ensure that all baselines are met.
- Complete internal and external audits.
- Complete tasks outlined in the blueprints.
- Manage service level agreements as outlined in the blueprints.
- Completing audits is not part of any of the other phases.
- Embedded systems
- An embedded system is a computer implemented as part of a larger system. The embedded system is typically designed around a limited set of specific functions in relation to the larger product of which it’s a component. (Stewart)
- SCADA/ICS
- "SCADA is an acronym for supervisory control and data acquisition, a system designed to control automated systems in cyber-physical environments." (Conklin)
- "A SCADA system is also known by names such as distributed control system (DCS) and industrial control system (ICS), the variations depending on the industry and the configuration. Where computers control a physical process directly, a SCADA system likely is involved." (Conklin)
- No access from the outside
- Smart devices/IoT
- Wearable technology
- Home automation
- HVAC: heating, ventilation, and air conditioning
- SoC
- "System on a chip (SoC) refers to a complete computer system miniaturized on a single integrated circuit, designed to provide the full functionality of a computing platform on a single chip." (Conklin)
- rPi2
- difficult to update hardware, limited off the shelf security options
- RTOS
- "Real-time operating systems (RTOSs) are designed for systems where the processing must occur in real time and data cannot be queued or buffered for any significant length of time." (Conklin)
- Breaks of cars, military eqp for example , no time to wait for other process
- Non trivial systems, need to always be available, difficult to know what type of security is in place
- Printers/MFDs
- "Printers and multifunction devices (MFDs), which combine a printer, scanner, and fax, have embedded compute power to act as a print server, manage the actual printing or scanning process, and allow complete network connectivity." (Conklin)
- Camera systems, home monitoring
- they are IP devices, authenticate using specialized applications
- Privacy concerns
- Special purpose
- Medical devices
- Vehicles
- Aircraft/UAV
- Waterfall vs. Agile
- Waterfall: "This is a linear, sequential process, and the model discourages backing up and repeating earlier stages." (Conklin)
- "Agile methods rely on quick turns involving small increases in functionality." (Conklin)
- Security automation
- "Automating routine and extensive security processes allows fewer resources to cover more environment in a more effective and efficient manner." (Conklin)
- Continuous integration
- "Continuous integration is the DevOps manner of continually updating and improving the production code base." (Conklin)
- Baselining
- "Baselining is the process of determining a standard set of functionality and performance. This is a metrics-driven process, where later changes can be compared to the baseline to gauge their impact on performance and other variables." (Conklin)
- Immutable systems
- "An immutable system is a system that, once deployed, is never modified, patched, or upgraded. If a patch or update is required, the system is merely replaced with a new system that is patched and updated." (Conklin)
- Infrastructure as code
- "Infrastructure as code is the use of code to build systems, rather than manually configur- ing them via normal configuration mechanisms. It is a way of using automation to build out systems, reproducible, efficient and is a key attribute of enabling best practices in DevOps." (Conklin)
- Change control - a formal process for managing change
- Avoid downtime, confusion, and mistake
- The change management process
- Plan the change
- Estimate the risk associated
- Have a recovery plan
- Test before making the change
- Document all of this and get approval
- Make the change
- Provisioning / Deprovisioning
- Provisioning is preallocation. Provisioning is used to ensure that sufficient resources are available to support and maintain a system, software, or solution.
- Deprovisioning can focus on streamlining and fine-tuning resource allocation to existing systems for a more efficient distribution of resources. It can also focus on the release of resources from a server that is being decommissioned so that those resources return to the availability pool for use by other future servers.(Stewart)
- Secure coding techniques (James Messer, Mike Meyers)
- Proper error handling
- "During an exception, it is common practice to record/report the condition, including supporting information such as the data that resulted in the error... The worst case is when it is echoed to the user." (Conklin)
- Proper input validation
- "Considering all inputs to be hostile until properly validated can mitigate many attacks based on common vulner- abilities." (Conklin)
- Normalization
- "The step of creating the canonical form, or simplest form, of a string before processing." (Conklin)
- Stored procedures
- "Precompiled methods implemented within a database engine. Stored procedures act as a secure coding mechanism because they offer an isolation of user input from the actual SQL statements being executed." (Conklin)
- Code signing
- "Applying a digital signature to code, providing a mechanism where the end user can verify the code integrity." (Conklin)
- Encryption
- "You should not attempt to implement standard algorithms by yourself. Vetted, proven cryptographic libraries exist for all major languages, and the use of these libraries is considered best practice." (Conklin)
- Source code, data at transit and data at rest should be encrypted
- Obfuscation/camouflage
- "The hiding of obvious meaning from observation... Adding obfuscation or camouflage to a system to make it harder for an attacker to understand and exploit is a good thing." (Conklin)
- Code reuse/dead code
- "For some complex functions, such as cryptography, reuse is the preferred path. In other cases, where the lineage of a component cannot be established, then the risk of use may outweigh the benefit." (Conklin) , if original code has some security issues you will be spreading the problem.
- "Dead code is code that while it may be executed, the results that it produces are never used elsewhere in the program." (Conklin)
- Server-side vs. client-side execution and validation
- Server side validation - all checks occur on the server - help to protect against malicious users
- Client side validation - may provide additional speed to end user , may help to filter out legitimate user form bad guys
- Use both but especially server side
- "Never trust input without validation... The veracity of client-side execution actions cannot be guaranteed. Server-side execution of code can be secured making it the preferred location for sensitive operations such as input validation." (Conklin)
- Memory management
- "The actions used to control and coordinate computer memory, assigning memory to variables and reclaiming it when it is no longer being used." (Conklin)
- Buffer Overflow
- Use of third-party libraries and SDKs
- "Using these proven resources can reduce errors and vulnerabilities in code, making this a positive move for secure development." (Conklin)
- Data exposure
- "Data exposure is the loss of control over data from a system during operations... Exposed data can be lost to unauthorized parties (a failure of confidentiality) or, equally dangerous, can be changed by an unauthorized party (a failure of integrity)." (Conklin)
- Static code analyzers (SAST)
- "Static analysis involves examination of the code without execution." (Conklin)
- Help to prevent buffer overflow, database injections
- Dynamic analysis (e.g., fuzzing)
- "Dynamic analysis involves the execution of the code as part of the testing." (Conklin)
- Send random input to an application , fault injection, robustness testing, syntax testing, negative testing
- "Fuzzing (or fuzz testing) is a brute force method of addressing input validation issues and vulnerabilities. The basis for fuzzing a program is the application of large numbers of inputs to determine which ones cause faults and which ones might be vulnerable to exploitation." (Conklin)
- Stress testing
- "Load testing involves running the system under a controlled speed environment. Stress testing takes the system past this operating point to see how it responds to overload conditions." (Conklin)
- Applications might behave differently under stress, show unintended error msg, application details and kernel and mem dumps
- Sandboxing
- "The execution of computer code in an environment designed to isolate the code from direct contact with the target system." (Conklin)
- Model verification
- "The program results for a given set of inputs need to match the expected results per the system model... Verification is the process of checking that the software developed meets the model specification." (Conklin)
- "Compiled code is code that is written in one language, then run through a compiler and transformed into executable code that can be run on a system." (Conklin)
- In compiled code you dont see the source code , logical bugs can be identified at compile time
- There are no opportunity to find compile time errors on runtime code
- Proper error handling
(James Messer, Jason Dion, Mike Meyers)
- Hypervisor (Jason Dion)
- "A low-level program that allows multiple operating systems to run concurrently on a single host computer." (Conklin)
- Type I
- "Type I hypervisors run directly on the system hardware. They are referred to as a native, bare-metal, or embedded hypervisors in typical vendor literature." (Conklin)
- Type II
- "Type II hypervisors run on top of a host operating system." (Conklin)
- Application cells/containers
- "A container holds the portions of an OS that it needs separate from the kernel. So, in essence, multiple containers can share an OS, yet have separate memory, CPU, and storage threads, guaranteeing that they will not interact with other containers." (Conklin)
- VM sprawl avoidance (James Messer)
- "You can lose track of a VM among many others that have been created... An organization needs to implement VM sprawl avoidance through policy. It can avoid VM sprawl through naming conventions and proper storage architectures, so that the files are in the correct directory, making finding the correct VM easy and efficient." (Conklin)
- VM escape protection (James Messer)
- Escape: "Where software, either malware or an attacker, escapes from one VM to the underlying OS." (Conklin)
- Cloud storage
- Cloud deployment models (James Messer)
- SaaS (Mike Meyers)
- "The offering of software to end users from within the cloud." (Conklin)
- PaaS (Mike Meyers)
- "The offering of a computing platform in the cloud. Multiple sets of software working together to provide services, such as database services, can be delivered via the cloud as a platform." (Conklin)
- IaaS (Mike Meyers)
- "Rather than building data centers, IaaS allows firms to contract for utility computing as needed." (Conklin)
- Private
- "Essentially reserved resources used only for your organization—your own little cloud within the cloud." (Conklin)
- Public
- "When the cloud service is rendered over a system that is open for public use." (Conklin)
- Hybrid
- "Where elements are combined from private, public, and community cloud structures. When examining a hybrid structure, you need to remain cognizant that, operationally, these differing environments may not actually be joined, but rather used together." (Conklin)
- Community
- "Where several organizations with a common interest share a cloud environment for the specific purposes of the shared endeavor." (Conklin)
- SaaS (Mike Meyers)
- On-premise vs. hosted vs. cloud (James Messer)
- "On-premise means it is on your site. Hosted means it is somewhere else, a specific location. In the cloud refers to having it distributed across a remotely accessible infrastructure via a network, with specific cloud characteristics—scalability, etc." (Conklin)
- VDI/VDE (James Messer)
- "Virtual desktop infrastructure (VDI) and virtual desktop environment (VDE) are terms used to describe the hosting of a desktop environment on a central server. VDI refers to all the components needed to set up the environment. VDE is what the user sees, the actual user environment." (Conklin)
- Cloud access security broker (James Messer)
- "Act as security policy enforcement points between cloud service providers and their customers to enact enterprise security policies as the cloud-based resources are utilized." (Conklin)
- Take normal security policies and apply them to cloud applications
- This will give visibility, compliance, threat prevention
- Security as a Service (James Messer)
- "The outsourcing of security functions to a vendor that can offer advantages in scale, costs, and speed... Different security vendors offer different specializations, from network security, web application security, or e-mail security, to incident response services and even infrastructure updates." (Conklin)
(James Messer, Mike Meyers 1, Mike Meyers 2)
- Automated courses of action
- "A single script that has been tested and approved for use." (Conklin)
- Many problems can be predicted, have a set of automated responses.
- Continuous monitoring
- "A system that has monitoring built into it, so rather than monitoring being an external event that may or may not happen, monitoring is an intrinsic aspect of the action." (Conklin)
- Configuration validation
- "When you place a system into service, you should validate its configuration against security standards, ensuring that the system will do what it is supposed to do, and only what it is supposed to do, with no added functionality." (Conklin)
- "Master recipes for the building of objects, be they servers, programs, or even entire systems." (Conklin)
- "A pre-made, fully patched image of your organization’s systems." (Conklin)
- "When a change to a system is not permanent... This is useful for machines deployed in places where users can invoke changes, download stuff from the Internet, and so forth." (Conklin)
- Snapshots
- "Instantaneous save points in time on virtual machines. These allow you to restore the virtual machine to a previous point in time." (Conklin)
- "If a system crashed, restoring the snapshot would be the fastest way to restore the system." (uCertify)
- Revert to known state
- "The capability to produce a restore point, a copy of key files that change upon updates to the OS." (Conklin)
- Fall back to a previous snapshot many OS and DB support this
- Rollback to known configuration
- "Another way of saying revert to a known state, but it is also the specific language Microsoft uses with respect to rolling back the registry values to a known good configuration on boot." (Conklin)
- Dont modify the data but use a previous config
- Live boot media
- "An optical disc or USB device that contains a complete bootable system." (Conklin)
- Elasticity is the ability of a system to adapt to workload changes by allocating or provisioning resources in an automatic responsive manner.(Stewart) "The ability of a system to dynamically increase the workload capacity using additional, added-on-demand hardware resources to scale out." (Conklin)
- Scalability is the ability of a system to handle an ever-increasing level or load of work. It can also be the potential for a system to be expanded to handle or accommodate future growth. (Stewart)
- "Design element that enables a system to accommodate larger workloads by adding resources either making hardware stronger, scale up, or adding additional nodes, scale out." (Conklin)
- Compared: "Elasticity is related to dynamically scaling a system with workload, scaling out, while scalability is a design element that enables a system both to scale up, to more capable hardware, and to scale out, to more instances." (Conklin)
- The big difference between static scaling and elastic scaling, is that with static scaling, we are provisioning resources to account for the “peak” even though the underlying workload is constantly changing. With elastic scaling, we are trying to fine-tune our system to allow for the resources to be added on demand, while ensuring we have some buffer room.
- "Distributive allocation is the transparent allocation of requests across a range of resources. When multiple servers are employed to respond to load, distributive allocation handles the assignment of jobs across the servers... Distributive allocation directly addresses the availability aspect of security on a system." (Conklin)
- A distributive allocation creates a "technological scavenger hunt." so bad guys cant find everything in one place
- "Makes it more difficult to target and exploit an application instance." (Messer)
- Redundancy aides in providing availability.
- Power supplies may experience "surges, spikes, sags, brownouts, and blackouts" (Dion)
- Surge: "An unexpected increase in the amount of voltage provided." (Dion)
- Spike: "A short transient in voltage that can be due to a short circuit, tripped circuit breaker, power outage, or lightning strike." (Dion)
- Sag: "An unexpected decrease in the amount of voltage provided." (Dion)
- Brownout: "Occurs when the voltage drops low enough that it typically causes the lights to dim and can cause a computer to shut off." (Dion)
- UPS: Uninterruptible Power Supply.
- Can provide line conditioning.
- Backup generator
- Data redundancy (see RAID)
- Network redundancy
- Server redundancy
- Cluster
- Failover cluster
- Load-balancing cluster
- Cluster
- Site redundancy
-
Fault tolerance is when the overall system can tolerate the failure of a component without going into a dangerous state, but it won't necessarily maintain the safe state by having full functionality or fidelity. The system may operate in a degraded state, but it won't immediately be in a dangerous state.
-
Redundancy can be a way of providing fault tolerance in the larger system, but redundancy on its own does not guarantee fault tolerance, particularly against all kinds of faults. It's only redundancy if each separate way of accomplishing a goal can function without the other ways of accomplishing the same goal.
-
Fault tolerance is a result; redundancy is one way of achieving that result.
- This imply the system will be always available at any time. always on , always available.
- RAID 0: Striping without parity - one logical disk split across multiple physical disks
- RAID 1: Mirroring - one logical disk duplicated across two disks
- RAID 5: Striping with parity - uses incremental drive; "Fault taulerant, only requires an additional disk for redundancy"
- Requires at least three disks
- Fault resistant: RAID 1 or RAID 5
- Fault tolerant: RAID 1, RAID 5, RAID 6
- Disaster tolerant: RAID 10 or 0+1
- Combined types
- Stripe of mirrors: 1+0
(James Messer, Mike Meyers, Mike Meyers)
- Lighting
- Bad actors avoid
- Better for video recording
- Signs
- Warn people away from restricted areas
- Instructs visitors
- Fire exits
- Warn of dangers
- Informational
- Fencing/gate/cage
- Transparent or opaque
- Difficult to cut
- Prevent climbing
- Security guards
- Physical protection
- Validates identification of employees
- Guess access
- ID badge
- Alarms
- Circuit is opened or closed
- Door, window, fence
- Motion detection
- Radio reflection or passive infrared
- Duress
- Safe
- Protect tapes, laptops, drives
- Difficult to steal
- Secure cabinets/enclosures
- Challenge: aircooling
- Enclosed cabinets with locks
- Protected distribution/Protected cabling
- Protected distribution system (PDS)
- Physically secured cabled network
- Protect cable and fiber cuts and taps
- Sealed metal conduit
- Air gap
- Physical separation between networks
- Mantrap
- All doors normally unlocked
- Opening one door causses others to lock
- All doors normally locked
- Opening one door prevents others from being unlocked
- One door open / others locked
- When one is open, the other cannot be unlocked
- One at a time, controlled groups
- Managed control through an area
- All doors normally unlocked
- Faraday cage
- Blocks electromagentic fields
- Microwave oven windows
- "Known by some as TEMPEST, it is a DoD program designed to block Van Eck emissions. A computer’s monitor or LCD display produces electromagnetic radiation that can be remotely observed with the cor- rect equipment, called Van Eck emissions. TEMPEST was the code word for a National Security Agency (NSA) program to secure equipment from this type of eavesdropping." (Conklin)
- Blocks electromagentic fields
- Lock types
- Lock and key
- Deadbolt
- Electronic locks
- Token-based
- Magnetic swipe card or proximity reader
- Multi-factor
- Smart card and PIN
- Biometrics
- Fingerprint, iris, voiceprint
- Difficult to change
- Barricades/bollards
- Channel people through specific point
- Allow people, prevent vehicles
- Tokens/cards
- Smart card
- USB tokens
- SMS code to phone
- Environmental controls
- HVAC (Mike Meyers)
- Hot and cold aisles
- Fire suppression (Mike Meyers)
- Water is generally bad
- Halon: no long manufactured. Destroys ozone.
- Replaced with Dupont FM-200.
- Class A
- Type: Combustibles (wood, paper)
- Contains: Foam, water
- Class B
- Type: Liquids (gasoline, oil)
- Contains: CO2, foam, powder
- Class C
- Type: Electrical (electronic equipment)
- Contains: CO2
- Class D
- Type: Combustible metals (sodium, magnesium)
- Contains: Powder
- "Dry powder is a suppression method for a fire that has magnesium, sodium, and potassium as its elements." (uCertify)
- "Water or soda acid should be used to suppress a fire that has wood products, laminates, and paper as its elements." (uCertify)
- Cable locks
- Connect hardware to something solid
- Most devices have a standard connector. Reinforced notch.
- Screen filters
- Privacy filters
- Cameras
- CCTV
- Properties
- Focal length (shorter is wide angle)
- Depth of field (how much is in focus)
- Illumination requirements (see in the dark)
- Motion detection
- Logs
- Infrared detection
- Key management
- Manage physical and digital keys
- Formal process for generation
- Key breaches
- Protocol for when key is compromised