[center][img]http://i.imgur.com/682ABw8.png[/img][/center][hr] Hello, and welcome to this guide. Although this is a roleplaying forum, I've taken to making random guides for subjects that I study for my course - it might help you create more depth in your roleplay, but honestly, I don't care. I just want to pass my exams. :brow :respek :rolleyes In this guide I will go over the brief principles of Cyber and Information Security. It might help those of us with a less than basic understanding of the concepts of security on and offline, and get them to understand terms like CIA Triad model, DOS attack, and MFA authentication techniques. [hr] [h2]What is cyber and information security? What is the difference?[/h2] Cyber security is the use of various technologies and processes to defend and secure networks, computers, programs and data from attack, damage or unauthorized access. Information security is described as protecting information and information systems from unauthorized access, use, disclosure, disrupton, modification or destruction. As you can see they seem very similar - that is because they are and they are heavily interlinked to the point where without information security, all your efforts in cyber security are more or less moot and vice versa. Imagine you have a computer and you have some valuable files on that (ex: photo's of your vacation with your grandfather and mother). You don't want someone to access this computer and files (ex: your deadbeat dad that can't stand your happiness because he broke up with your mother. Get over it Harry. He wants to delete your files). Applying information security would mean you need to protect your files against your deadbeat dad and his unauthorized access, but how are you gonna do that? Information security would mean something like an identification process that is not necessarily based on cyberspace. For instance, you lock your room so he cannot access the information system physically. But that isn't enough. Some people have learned to access systems from afar, and when you understand some concepts about internet and cyberspace among others, 'hacking' isn't nearly as hard as it's made out to be. Some files that are meant to be government-level top secret are accessible, freely floating on the internet, because nobody bothered to run a check on where the files were. So even if someone can't access the [i]physical location[/i] of your info, they can still access it digitally. So apply cybersecurity. There are numerous systems available for that - think passwords, firewalls, authentication sequences or something as simple as 'access levels.' Although the latter two are perhaps out of reach for a private user, they are possibilities for users as part of a corporation. Using both physical security and digital security, you should be able to protect your files. Take that Harry. [i]Footnote: primary reason for files being accessed by unauthorized people is human error. Placing a file in a location that is open-access to everyone is not the fault of the security system, it's human error. Having a password is a tool, not a solution - it's up to the user not to disclose the password and take good care of it. In the end, [b]you[/b] are the sole responsible for not disclosing information. The system is there to help, not to do the work.[/i] [hr] [h2]CIA Triad Model[/h2] Some data is worth more than others - unlike the farm animals in animal farm, certain documents have a higher importance, and thus worth, than other documents. (Ex: your bank details have a higher value than your 3rd grade science report) In order to determine the worth of a document you need to consider the following factors of the CIA triad model. [b]C[/b] - Confidentiality [i]Who is supposed to access this? Confidentiality discussion talks about protecting sensitive information from unauthorized disclosure. Determining the level of confidentiality determines also who should be able to access documents. Confidentiality controls who has a need to know and who does not. [b]Note; right to know =/= need to know. Even if you have a right to know, you are not guaranteed access.[/b] Without confidentiality, a file is worthless, because the wrong people have the file already.[/i] [b]I[/b] - Integrity [i]What are the files? Integrity harbors not the integrity of the user but of the files. It can be determined to be the practice of safeguarding the completeness, accuracy an timeliness of a file. A file with destroyed integrity is inaccessible, does not contain the right information, is inaccurate, or arrived too late to be meaningful, and therefore is worthless.[/i] [b]A[/b] - Availability [i]How to access the files? Availability is simply put the infrastructure that your files are on - if your IT services are not functioning properly, and I cannot access the files I need, then the files have no value to me because I cannot use them. The information and the vitalIT services need to be functional when required.[/i] As you can see the value of a file is determined not by the presence of [i]some[/i] of these criteria but by all of them. A file can have a low level of confidentiality, but there needs to be a determination of that low level. A file that is intended as a low confidentiality file (ex: a code of conduct for employees will likely not contain sensitive information and can be freely shared) still has a label of some confidentiality. A file needs a description of confidentiality to be of any value. If a file is integer (the file is in working state and has not been changed) and available (the file can be retrieved) but no confidentiality, then the worth is instantly 0, because unauthorized users can retrieve the data and utilize it. Similarly, a file needs to have integrity to be of any value. If a file is confidential (the right people only can access it) and available (the file can be retrieved) but is not integer, then the worth is instantly 0, because the file can not be used. Once more, a file needs to be available to be of any value. If a file is confidential (the right people only can access it) and integer (it's in working state and has not been changed) but it is not available, then the worth is instantly 0, because the file cannot be retrieved. Maintaining the CIA triad model therefore means that your file will always be worth what it's supposed to be worth. [hr] [h2]Types of Attacks[/h2] Attacks are more common place than one thinks, but they have different purposes and therefore different types. Not all attacks are meant to deny service, for example. For the different purposes you need a different approach. These types of attacks typically target one or more elements of the CIA triad model. [b]Interruption[/b] [i]Interruption attacks are typically among the lines of DOS attacks. They interrupt the infrastructure and cause files to become unusable or unavailable. They are meant to disrupt the work of the target. They often affect availability but they can potentially affect integrity of the files as well.[/i] [b]Modification[/b] [i]Modification attacks are typically among the lines of unauthorized access. These attacks tamper with the assets of a target, such as editing files or processes. They almost always harm the integrity of assets, but also have the potential to represent an availability attack.[/i] [b]Interception[/b] [i]Interception attacks are typically among the lines of unauthorized access. These attacks similarly to modification access the assets of a target but do not modify assets. Instead they simply observe, allowing them access to assets, processes, or environments. They always harm the confidentiality of the accessed assets.[/i] [b]Fabrication[/b] [i]Fabrication attacks are typically among the lines of unauthorized access. These attacks also flow forth from unauthorized access but rather then observing or editing, generate new information. They generate data, processes or communications or other activities using the accessed system. These attacks typically threaten the integrity of data, but can also harm the availability of assets.[/i] [hr] [h2]Risk Management[/h2] [b]Threats use vulnerabilities, which results in exposure of assets, which translates to risk, which is mitigated by security controls, which protects assets that are endangered by threats.[/b] Using security controls therefore enables you to defend against threats. The process for risk management dictates that you must first dictate what the risks are, which is called a risk analysis; [list][*] Identify your assets [i]You must know what you want to protect before you can begin protecting it. Protecting [b]everything[/b] is economically unviable, which is why we determine assets to only be things of importance, whether it is economical or for the functioning of your company/private person. [b]An asset is whatever is of importance to the core purpose of your organization.[/b][/i] [*] Identify your threats [i]You must also know who or what can endanger your assets. This can be [b]human[/b] (corporate espionage, human error, disgruntled employees) or [b]natural[/b] (fire, flooding, earthquakes). Any asset is always at risk from something and there are infinite threats. For more detailed information, see; risk assessment. [b]A threat is anything that can damage or harm your assets in such a way that they sustain damage, permanent or temporary, that can potentially harm the core purpose of an organization.[/b][/i] [*] Assess vulnerabilities [i]Vulnerabilities exist in any process and consist of things that can be exploited by your threats to access or damage your assets. For example, a building that has an unsound structural integrity has a vulnerability (unsound structural integrity) to earthquakes (threat). A police station with inadequate oversight over the area in front of the police station has a vulnerability (inadequate oversight) to disgruntled civilians (threat) firebombing the police station. [b]A vulnerability is a weakness in the system and/or process that can be exploited by a threat to access and damage your assets.[/b][/i] [*] Assess risks [i]Assessing the risks means that you must assess the risk level of a threat taking action. Risk is calculated by a formulate that goes as follows: [b]risk = impact x probability (probability = threat x vulnerability).[/b] Most often levels are used for this, from low (1) to critical(4) with the steps in between being medium (2) and high (3). If the impact is critical (loss of life) and the probability is medium, then the score would be 4x2 = 8. Following that, a matrix is made that determines the meaning of these scores (which is dependent on the wishes of the company, as some companies are more accepting of high risks than others). [b]Risk is the assessment of an impact multiplied by the probability of the event occurring.[/b][/i] [*]Mitigate risks [i]Once you have determined what risks are important and which ones are not you can begin mitigating them. Typically this is done with security control measures. [b]These can be physical, mechanical or organizational.[/b][/i][/list] However, there is not just 1 method of risk management (mitigation). Different actions can be taken dependent on your wishes. [list][*]Avoid [i]Avoiding the risk by not taking a certain action or using a certain tool[/i] [*] Accept [i]Accepting the risk, not taking any further action against the risk and hoping the risk doesn't manifest[/i] [*] Mitigate [i]Mitigating the risk by building security measures against the risk[/i] [*]Transfer [i]Transfering the risk management to someone else (ex: writing software code, there is a risk that there will be an error in the code. Contracting another company to write the code for you, and you make them responsible for any errors in the code, transfering risk and responsibility to them)[/i] [*]Exploit (not part of course material but I list it anyway) [i]Positive risks exist, such as having so much use of an application or product that your servers/sales people cannot deal with the sheer amount of requests. This is a possible thing and you should exploit this risk as much as you can. [/i][/list] [hr] [h2]Risk Mitigation Controls[/h2] So, you are ready to mitigate the risks you've assessed. Good. There are three forms of risk mitigation control (also called security control) that you can use. [b]Physical, logical/technical and organizational/administrative.[/b] [i]Physical security[/i] is the use of physical objects to secure your assets, such as fences, doors, locks, camera's and guards. Although not directly linked to information and cyber security, these can be used to limit access to areas that have assets that can be used to access other assets (like protecting a server room). [i]Logical/technical security[/i] is the use of more digital measures to secure your assets, such as passwords, firewalls, and the encryption of your data. [i]Organizational/administrative security[/i] is the creation and usage of administrative policy to help secure assets. These can include standard policies for security, routines, background checks, creating security awareness, and having set procedures. All of these are required, just like the CIA triad model. Removing one of these will endanger your assets because threats can use a variety of ways to access your assets. For example, you have a location with a server room that contains [i]highly[/i] important information, like the location of your favorite strip club. A threat (your spouse) wishes to access it to find out where the hell you're going when you say you're visiting your parents. If physical security and logical/technical security are both present, but there is no organizational/administrative security, then your spouse can exploit this weakness by, for instance, using the lack of guard routines and standard operating procedures to circumvent physical detection (guards have no routines -> she can sneak around the defenses unnoticed) and the mechanical/logical security (lack of security awareness -> ICT personnel leaves keycard laying around -> she can access the server room and bypass the firewall with her access on the keycard). If there is logical/technical and organizational/administrative security but no physical security, then your spouse can exploit the weakness by, for instance, using the lack of guards to take a ICT expert at gunpoint and force them to access the server for you. As there are no locks or anything present to stop you, and nobody to raise alarm, like a guard, you can freely access the server room, get the information, and leave. If there is physical security and organizational/administrative security, but no logical/mechanical security, then you don't need to access the room at all and you can access the server online or through hacking the server. Because there is a lack of control methods and alerting systems (IDS, intrusion detection system) or a prevention system (IPS, intrusion prevention system), you won't even be notified that someone accessed your servers. [hr] [h2]Identification, authentication, authorization[/h2] Although often used in a sequence, these three concepts are different. They form a process when used successfully, and most workplaces (yes, yours too!) will use these even if you don't directly notice. The sequence follows these steps: [list][*]Identification [i]The user confesses (claims) their identification. EX: 'I'm Odin.'[/i] [*]Authentication [i]The program runs a set of methods to determine the truth of my claim of identification. EX: login credentials are correct. [sub]Low-security websites as RPG with no real valuable data require only small proofs of authentication, and assume that only the owner of an account knows the login credentials. As always, you are responsible for maintaining that information as confidential.[/sub] Additional methods can be bio metrics, visual confirmation, face detection, a secret question that only that person knows the answer too, a codeword or sentence.[/i] [*]Authorization [i]The user claimed their identity and confirmed it's truth, authorization then determines the privileges of that person i.e. [b]none, read, write, read/write.[/b][/i][/list] [h3]Methods of Authentication: [b]passwords[/b][/h3] Passwords are currently the most used authentication method in the world. It is also the [b]weakest[/b] form. Passwords are difficult to guess and easy to remember, but they put the responsibility entirely in the users' hands. Vulnerabilities of the password are; [list][*] Having a weak password [i](password123)[/i] [*]Sharing and/or reusing your password [i]('Sure you can use my password? It's password123. Oh, I also use it on my bank account, and work related email! What do you mean I got hacked?')[/i] [*]Insecure transmission and/or storage [i](Somewhere between you and the receiver there was an interception of your password, or your password was stored insecurely either on your end or the server end.)[/i][/list] [b]So how do passwords get compromised?[/b] [list][*]Guessing [i][b]Guessing[/b][/i] [i]is a standard technique and pretty low-tech but it does happen, especially with users who use low-security passwords (no numbers, predictable words, no upper and lower case letters)[/i] [*]Social engineering attacks [list][*] Impersonation [i]Impersonating a user to gain access to their accounts, by for instance pretending to have lost your credentials[/i] [*] Shoulder surfing [i]Looking over someone's shoulder as they enter their password[/i] [*] Dumpster diving [i]Looking through someone's trash (or perhaps their desk or notebook) to find their credentials[/i][/list] [*]Technical attacks [list][*] Keylogger [i]Program that is based on hardware/software that logs the keys a user enters and then either stores it for retrieval by hand or forwards it to the users' computer[/i] [*] Sniffing [*] Stealing and cracking ('recovering') stored passwords [i]Using password hashes to 'brute force' (attempt all combinations) or dictionary attack (using common words/password combinations) to crack a password [/i][/list][/list] [b]So what are recommended practices, for users and providers?[/b] [b]For users:[/b] [list][*] Use strong passwords [*] Don't re-use the same password for different systems [*] Change passwords periodically [*] Don't share passwords with others [*] Use password managers (can also provide risk with inadequate usage..)[/list] [b]For providers:[/b] [list][*] Use more complex hashing algorithms [*] Salt the passwords/hashes [*] Secure passwords at rest, and when they are in transit[/list] [h3]Methods of Authentication: [b]authentication factors[/b][/h3] When looking at authentication factors, there are 3 classes of authentication. [list][*] Something you know [list][*] Password [*] PIN [*] Codephrase/word[/list] [*] Something you have [list][*] Smartcard [i]Creditcard-sized cards that contain integrated circuit cards and store private keys and certificates (overlap with hard tokens)[/i] [*] Hard token [i]Hard tokens are hardware based 'tokens' such as a keycard that give you access to areas of a building or allow you to login[/i] [*] Soft token [i]Soft tokens are software based 'tokens' that are generated using software, providing a one-time PIN to use for logging in, typically used through smartphone apps[/i][/list] [*]Something you are [list][*] Biometrics [i]Biometrics are your person, so these can include your fingerprint, retina/eye scan, facial recognition...[/i][/list][/list] [h3]Applying authentication factors: [b]MFA/2FA[/b][/h3] MFA (multi factor authentication) and/or 2FA (two factor authentication) is what is considered to be a best practice in authentication security. It means that you combine two of the authentication sequences, such as; [list][*] password + token code [*] smartcard + PIN [*] fingerprint scan and token code[/list] [h3]Authorization[/h3] Authorization is what determines that the action or process you are trying to perform is possible according to your privileges and rights that are assigned to your authenticated identity. So, you need to have an identity and need to be authenticated. So, when you are logged in, you will have more privileges than when you are not logged in. Authorization typically operates on the '[i]Principle of Least Privilege[/i]' which means that a process, user, or program should only have the privileges that they need at a bare minimum to fulfill their duties. EX: a program that creates backups of your C:// drive only needs access to privileges relevant to backing up data, and does not need to install new programs. As such they only get access to privileges related to backing up data, and not for installing new programs. This typically occurs through ACL's (access control lists) which is a list of users, programs and processes on a network. Each of these then has the privileges attached to it, for example, read, write, read/write, or full access. For more complex processes additional privileges can be made, for example in a bank, a bank-teller doesn't need access to the vault, but the bank director might need access to it. On that principle, the bank-teller won't receive the access to the vault, but the bank director will, on the principle of least privilege. [hr] [h2]Access control methods[/h2] Alright, so you wanna limit the access of some users on the principle of least access (or, you're just a cunt and want people to not have any power). There are multiple ways you can accomplish this with different settings for the respective processes. [list][*] Discretionary Access Control (DAC) [i]Access is determined by resource owner i.e. the owner of a folder can assign access to users, processes and programs[/i] [*] Mandatory Access Control (MAC) [i]Access is controlled by the person that has the authority to do so (team leaders, etc) and whose privilege gives them that right[/i] [*] Role and Rule based access control (RBAC) [*] Attribute-based access control[/list] Are there multiple levels of importance? Then apply these: [list][*]Bell-La Padula model [i]Focuses on confidentiality, meaning you can't read upwards in the chain, and can't write downwards.[/i] [*]Biba model [i]Focused on integrity, meaning you can't write upwards and can't read downwards.[/i] [*]Clark-Wilson model [i]Commercial model of the integrity-based model[/i] [*]Brewer-Nash model (also called Chinese Wall) [i]Focused on preventing conflict of interest[/i][/list] [hr] [h2]Accountability[/h2] What is accountability? Accountability in cybersecurity means that you can trace activities in the environment back to the source. The benefits of accountability rest in non-repudiation (inability to contest a claim because of evidence), deterrence, intrusion detection & prevention, admissibility of records. This is accomplished by logging events. Logging events is the process of recording data about events to a log file or a database - what happened, where did it happen.. It is largely reactive and typically these files only get opened when something goes wrong. If logging is the action of recording events to a log, then monitoring is the action of reviewing and analyzing the logs. This way, you combine reactive with pro-active. It can be done manually (sifting through it yourself) or automatically (with a bot). [hr] [h2]Compliancy[/h2] Compliancy is also important for cybersecurity, which is the act of conforming or adhering to laws, rules, regulations, but also industrial standards. The USA has a lot more acts that are to do with the standards of cybersecurity, although the European laws are more centralized and contain most of the USA's standards in singular laws. [b]USA:[/b] [list][*]CFAA [i]Computer Fraud and Abuse Act[/i] [*]HIPPA Health Insurance Portability Act [*]FISMA [i]Federal inf. Sec. mgt. Act[/i] [*]DMCA [i]Digital millenium copyright act[/i][/list] [b]EU:[/b] [list][*]NIS directive [i]EU directive on network and information security[/i] [*]GDPR directive [i]New EU General Data Protection Regulation[/i][/list] [b]International:[/b] [list][*]ISO 2700x family [i]ISO standards for general safety and security[/i] [*]ISO 27001 [i]Requirements for ISMS[/i] [*]27005 [i]Information Security Risk Management Standards[/i][/list] [hr] [h2]Encryption, decryption, ciphers, keys...[/h2] When talking about encryption we typically focus on one thing: how to beat encryption. The study of beating encryption is called cryptoanalysis - the study of defeating codes and ciphers. Encryption is it's opposite, and is the act of giving data and info a certain kind of protection so that people that aren't allowed to open it don't have access. Decryption itself is not bad, in fact it is simply opening the encrypted message with a cipher or key - so, if you have the key given to you by the one sending the message, then you're all good. Keys are the pieces of information (parameters) that determines a functional output of a cryptographic algorithm. For encryption algorithms, a key specifies the translation of plaintext (your text) into ciphertext (the encrypted text) and then translates it back during decryption from ciphertext to plaintext. This encryption typically happens in one of two ways: symmetric and asymmetrical. Symmetric encryption only uses 1 key for both encryption and decryption. This key must then be shared by the sender to the receiver. Symmetric encryption.. [list][*]Is faster than asymmetric encryption [*]Can't cover nonrepudiaton [*]Has the issue of handing over the key [*]Has two types of cyphers - block (64 bits) and stream (1 bit) [*]Has well known algorithms: DES, 3DES, AES, CBC, OFB, CTR, TCB[/list] Asymmetrical encryption uses two keys; a public one and a private one on the end of the receiver. Asymmetrical encryptions... [list][*] are easy to commute in one direction [*] Extremely difficult to reverse [*] Advantage is that you no longer need to share your key over the phone or in person [*] Well known algorithms are: RSA ECC SSL, ECC, ECDSA, PGP, VoIP (voice over IP), DSS[/list] A third encryption method is the use of hashing, which you can envision as 'keyless cryptography'. Hashing generates a string of 'hashcode' that is largely unique to the message. Hashes cannot be used to discover the contents of a message, but can be used to verify that the message has not changed - as such, it is used to maintain integrity, but can not guarantee the confidentiality of the message (i.e. anyone can read the message as long as they don't alter it, and the hashcode will never alert you to it). So why use hash functions if everyone can read it? [list][*]Integrity Verification [i]Because the hashcode will change if you alter the message within, you can compare the original hashcode vs. the new hashcode and see if it has changed. That way you can verify that the sent message and receive message are the same.[/i] [*]File downloading [i]You can use it to verify that the file you downloaded is the same as the file that someone sent you, for example when downloading a videogame, to verify that the contents are not broken or unusable (or at least are meant to be functional).[/i] [*]Forensic evidence [i]Useful for verifying that forensic evidence hasn't been altered or changed[/i] [*]Anti-malware [i]Used for anti-malware purposes by reporting when a hashcode is different from what it is meant to be, which means that a malware program can be attached to a legitimate program[/i][/list] [b]Digital Signatures and Certificates[/b] Digital signatures allows us to sign messages and such, to enable detection of changes to the message, to ensure that the message was legitimately sent by the expected sender, and to prevent the sender from denying that he/she sent the message (nonrepudiation.. can't deny that you sent it if your signature is on it). Certificates are related to keys, and tie a publickey to a person. Typically these are used to identify particular people. As such, a CA is a certificate authority. [hr] [h2]Basic Network Security Threats[/h2] This is basically the cool stuff that we all wanna know about. When you think about 'hackers' like anonymous this is basically what they do (and it's far less complex and complicated.. kinda like 'even a monkey can do it' levels of uncomplicated). When looking at the internet, it is not 1 giant machine that generates 'internet' out of thin air. Rather, it's a system that consists of large amounts of systems and sub-systems. Most devices nowadays are tapped into one network, but are capable of communicating with large amounts of other networks. It works as follows: [list][*] You connect to your ethernet connection [*] Your ethernet connection connects to the ISP (internet service provider) [*] The ISP then connects you to billions of other devices and servers[/list] To facilitate this your device has an IP network - comparable to a home address for yourself. Typically they look like this in the IPv4 system - xxx.xxx.xx.xxx, where the first few numbers indicate regions or countries, although nowadays they more often represent networks and sub-networks. The hierarchy of the entire string is like so: [list][*]Country/network [*]Region/network [*]Subnetwork [*]Individual device [/list] However, we are currently transitioning to IPv6, which is a much longer string, comprised of 128 bits of information compared to the original 32... this is because the IPv4 system only allowed for 4 billion individual IP addresses - compared to the 340 undecillion addresses in IPv6 - yes that is a real number. However, it is impossible for your home address to know every other IP address in the world - that's where DNS servers come in. DNS servers translate the string of an IP address (000.000.00.000 for example) into a domain name and vice versa, and allowed you to search the internet. If you enter the website www.google.com then the DNS server translates that to whatever IP address that website might be using, and then take you to that IP address. That's where the first risk comes in; spoofing. Spoofing is when someone tags into a DNS server and changes the IP address that corresponds to a website. For example, if he finds the website 'www.google.com' he can change the IP from 000.000.00.000 to 111.111.11.111 which is his own website. If he sets this site up in a believable way he could convince people to log in on that website.. and spread their information to him. Or he could use it to install malware, or other kinds of tricks. [hr] [h2]Other network threats: [b](D)DOS[/b][/h2] (D)DOS or (Distributed) Denial of Service attacks are relatively simple attacks that are often carried out on a large scale, using botnets or large amounts of people participating. The attacks can be carried out relatively simply, manually by typing a ping request by hand over and over (very inefficient, however, and likely not to result in anything) or by using ready-for-use programs such as LoIC or HoIC. DDOS attacks target the accessibility of whatever network you are targeting and can 'hit people off' of their internet, if you target a specific IP. When playing a videogame, for example, you can find out the IP address of some player and then 'hit them off' the internet to have an easier time in the game. DDOS attacks can also target networks - a year or two ago, some teenagers used a botnet to DDOS the DNS servers of Ziggo, a ISP in the Netherlands, and on their own managed to DDOS the entire ISP's servers into nothing, cutting hundreds of thousands of Ziggo users off of their internet and causing millions worth of damage. Naturally, DDOSing is illegal. [hr] [h2]Other network threats: [b](Active) reconnaissance[/b][/h2] Reconnaissance is typically used in the military fashion for gathering information preliminary to an operation. In cyber security, it means much the same, except it implies that a user scouts for weaknesses in a system or network. In most cases that translated as 'port scanning' which is using a port scanner to find open ports. This type of attack is typically seen as a passive attack, as they are not exactly 'causing trouble' more so than that they are just looking for information. The way to deal with them is simply put to close your ports well enough and use an IPS (intrusion prevention system). [hr] [h2]Other network threats: [b]Sniffing[/b][/h2] Sniffing is the interception of internet packages, whole or partial amounts of it, in order to look through the data and find passwords or login info, or other info that can be used or is interesting enough. If you send a package from your computer to the server, such as when logging into RPG, you're sending a package to RPG with the info and the server then responds with 'okay that checks out, logging in' and lets you log in. If your packages are 'being sniffed' then that means that they are being intercepted mid-way through and sought through by malicious people, seeking to find your login data. [hr] [h2]Other network threats: [b]Man in the Middle[/b][/h2] A man in the middle attack is similar to the prior, sniffing, however differs in the fact that a communication occurs between two people but, unbeknownst to them, a third parties computer is between theirs. They intercept, read and can edit the communication if they wish, before the message ends at the receiving end. This way you can unintentionally spread confidential information, but the man in the middle could also send information that can endanger the two other parties. [hr] [h2]Other network threats: [b]Spreading Malware[/b][/h2] Malware are malicious types of software that gather private information, access private networks, or cause problems on the receiving end. However this is simply a gathering name for other malicious software, examples of which are: [list] [*]Trojan horses [i]Presents itself as a real piece of software while doing damage[/i] [*]Computervirus [i]Infects files and does a lot of damage[/i] [*]Computerworm [i]Spreads itself through the network without having to infect files and does a lot of damage, a better version of the virus[/i] [*]Backdoors [i]Allows people to enter software through a backdoor[/i] [*]Bootsectorvirus [i]Infects the boot drives of your computer and disables them, preventing you from booting up[/i] [*]Rootkit [i]Allows the sender complete control over the computer[/i] [*]Keylogger [i]Logs the keys that are being hit[/i][/list] [hr] [h2]How to prevent attacks[/h2] A first line of defense is often the firewall. A firewall is a mechanism for controlling the entry of data packets into and out of your network. It's often just placed in a place where we see the trust change - the level of trust in an internal network is different than when a network communicates with the internet itself. There are a few types of firewalls, some 'better' than others, depending on your needs. [list] [*] Packet filtering firewalls [i]Looks at the contents of a package at a glance, then makes a large assumption whether it will be allowed to pass based on;[/i] [list][*] Source [*] Destination IP address [*] Port number [*] Protocol being used[/list] [*] Stateful packet inspection firewall [i]Operates at the same principle level of the packet filtering firewall, where they inspect packets. However, rather than only checking packages out of context, the stateful packet inspection firewall can check firewalls on a granular level - inspecting them at all times no matter where they are in the network[/i] [*] Deep packet inspection firewalls [i]These add another layer of intelligence to our firewalls - the first two can only look at the structure of the data, while the deep packet inspection firewall can inspect the contents and then reassemble it, so that it can look at what is being sent and where.[/i] [*] Proxy servers [i]A highly specialized form of firewall, it is more commonly known for it's other purposes, namely circumventing access restrictions through a proxy, or to circumvent IP-related bans. Proxies generate a new IP address that can be used to choke traffic, allowing us to filter it for unwanted messages (spam) or attacks. Similarly, it's purposes can also be nefarious - such as circumventing an IP ban. However, these purposes are usually done through unrefined 3rd party websites that are clumsy to use and can spread malware, because the users are not skilled enough to set up their own proxy server.[/i] [*]DMZ (Demilitarized zone) [i]A network design that puts two firewalls in place and then places parts of a network in between. Although it's not technically a firewall, it incorporates the firewalls into it's design. Imagine it like so: | Email server | Firewall A Email server Firewall B[/i] This way, outsiders can reach the email server through the initial firewall, but the email server itself is separated from the internal network, preventing bad stuff that got through the first firewall from passing through to the internal network.[/list] Other measures you can take against intrusions and risks are these: [list] [*]IDS (Intrusion detection system) [i]Imagine it as a program that is constantly attempting to detect intrusions into the system. These can be based on the host or network; HIDS and NIDS respectively.[/i] [*]IPS (Intrusion prevention system) [list][*] Signature based IPS [i]Intrusion detection that scans based on signatures - it has a database with known signatures of intrusions that it scans for. When it detects such a signature, the alarms go off. Typically it'll quarantine the detected intrusion, and wait for user input on what to do (typically, deleting the file). It's a good system but needs to be updated frequently, as new viruses use new signatures![/i] [*] Anomaly based IPS [i]Rather than use a database of signatures, this IDS establishes a baseline of 'normal' network usage and establishes what the norm is. Once it's done that, it'll look out for any deviations from that norm, and report it and quarantine whatever is causing the deviation.[/i][/list] [*]HTTPS [i]A more secure web communication protocol consisting of encrypted HTTP communications. This on top of SSL/TLS: secure sockets layer/transport layer security. [b]This is what RPG uses.[/b][/i] [*]VPN networks [i]Networks that tunnel directly to an internal network through a VPN, functioning almost identical to a proxy although a VPN is secured in a tunnel. It provides us with a solution for sending sensitive information over public networks, for example someone working from home.[/i] [*]Honeypot [i]Setting a trap for hackers, trapping them in a network, or for tracking hacking methods. If you use multiple ot honeypots on one network you make a honeynet. This strategy actively engages, and deceives, hackers.[/i][/list] [hr] [h2]Wifi, open, IOT[/h2] If you're at home, chances are you're on either ethernet or WiFi. Despite ethernet offering speed advantages, WiFi is popular because of it's mobility. However, there are risks involved in WiFi that cannot be prevented by programs - human error will be the prime reason of falling victim to these risks. WiFi uses either an open, WEP, WPA, or WPA2 security system. Only the last, WPA2, is considered 'safe' as the others are outdated or compromised. Common risks of using public WiFi are: [list][*] Sniffing [*] Evil Twin [i]Public networks that have the same name and setup as 'official' public wifi which they then use to look at your traffic [hider=evil twin][img]http://i.imgur.com/ruJCwr7.png[/img][/hider][/i] [*] Man in the Middle [*] Unauthorized access to shared files [i]Sharing files on your 'shared files' can result in people accessing them without you intending for them to do so[/i][/list] So, how to protect against these? Simple: [list][*]Use HTTPS, or VPN [*]Don't share files on your device [*]Caution and awareness, use common sense. If it feels bad, it's probably bad![/list] [hr] [h2]Understanding vulnerabilities[/h2] There are three types of vulnerabilities; [list][*] OS (Operating System) vulnerabilities [i]Vulnerabilities coming forth from OS, typically 'zero day' vulnerabilities though not always.[/i] [*] Browser vulnerabilities [i]Vulnerabilities in your web browser[/i] [*] Application weakness [i]Vulnerabilities in programs and applications that you are running. Can be crossed with browser vulnerabilities if an app/program runs in the browser. Usually, this comes from bad coding - not designed with security in mind. Common abuses of vulnerabilities are: [list][*]SQL Injections [i]Web-based applications often use SQL, which stores information about users. By entering data in a SQL command, such as [code]select * from list where information = 'a' or 'b' = 'b'[/code]. Because 'b' is always 'b' the SQL application will return [b]all[/b] the information in the list, which can include personal details, like names, phone numbers, credit card details, and so forth. [/i] [*]XSS (Cross Site Scripting) [i]A type of attack where the user can insert malicious scripts into a trusted website, typically web applications, which will then return that script to unsuspecting visitors. The script will then play out. [/i][/list][/i][/list] [hr] [h2]Malicious software[/h2] According to Europol, Malware (short for malicious software) is designed to infiltrate a computer system or mobile device without the knowledge or consent of the owner, to gain control over the device, steal valuable info, or damage the data. There are three categorizations in malware; [list] [*] Viruses [i]Attaches itself to legitimate communications or software [/i] [*] Worms [i]Exists on it's own, and is able to self-replicate[/i] [*] Trojans [i]Poses as a legitimate software, but is really a malicious one[/i][/list] These are common malware; [list][*]Ransomware [i]Software that takes your computer/device hostage and forces you to pay money to unlock the device again[/i] [*]Scareware [i]Software that replicates the above with false threats and scare techniques in an attempt to get the target to buy fake softwares to get rid of the scareware[/i] [*]Adware [i]Software that constantly plays ads and popups, usually coming from malicious and shady websites[/i] [*]Spyware [i]Software that simply spies on the target[/i] [*]Backdoors [*]Rootkits [*]Bot malware [i]Software that adds the target to a botnetwork[/i] [/list] [hr] [h2]What to do? [b]Hardening OS[/b][/h2] Hardening your OS means that you minimize the functions of your OS to limit the surface of vulnerability - the less programs an OS is using and/or running, the less vulnerabilities there are for malware to use. There are six steps to hardening an OS. [list][*] Remove all unnecessary software [*] Remove/disable unnecessary services [*] Change default accounts [*] Apply principle of least privilege [*] Apply software updates timely [*] Make use of logging and auditing[/list] [h3]Data security[/h3] The basics of data security for a company/organization are as follow: [list][*] Encryption [i]You must encrypt, when data is at rest or in motion, always encrypt[/i] [*] Physical security [i]You must also always have physical security as mentioned before - you need all 3 forms of security[/i] [*] Backups [i]If you have backups you can always restore your work[/i] [*] Have a BCP (Business Continuity Plan) [i]A plan that sets up how to continue your business when you are infected so that loss of money is minimized[/i] [*] DR (Disaster Recovery) [i]Know how to recover from disaster - be capable of resetting. First you should apply BCP - if that fails, use DR.[/i][/list] [hr] [h2]Other risks that aren't malware[/h2] [list][*]Social engineering [i]Social engineering is a type of attack where an attacker uses human interaction (social skills) to obtain or compromise information about an organization or it's computer systems.[/i] [*]Phishing [i]Typically uses email or other communications to pose as a legitimate website to retrieve information about users, like login details. Has numerous 'sub methods'. [list][*] Spear phishing [i]Targets specific people or organizations[/i] [*] Whaling [i]Targets high profile people like a CEO[/i] [*]Vishing [i]Uses voice instead of e-mail (scam calls)[/i] [/list][/i] [*] Other online scams and fraud schemes, i.e. Nigerian prince scam [*] Pretexting [i]When a person lies to obtain information about one person, in order to commit identity fraud and use that to access systems[/i] [*] Baiting [i]Just grab a USB or floppy disk, infect it with a virus, and label it something interesting then leave it where someone will find it. Someone, somewhere will use it[/i] [*] Tailgating [i]Following someone into an area they don't have access to by following someone that does have access directly behind them, to get through doors[/i][/list] [hr] [h2]Types of hackers[/h2] 7 types of (malicious) hackers: [list][*]Professional cyber criminals [*] Spammers and adware spreaders [*] Advanced persistent threat agents [*] Corporate spies [*] Hacktivists [*] Cyber warriors (more advanced version of keyboard warriors) [*] Rogue hackers[/list] However, there are also three other types of hackers; [list][*] Black hat hacker [i]Highly skilled hacker with malicious intentions[/i] [*] White hat hacker [i]Highly skilled hacker with good intentions, such as hacking corporations and alerting them to the vulnerabilities[/i] [*]Script kiddie [i]Typically younger teens that use ready-made programs that require no actual hacking skills. Very low skilled, usually bad intentions[/i][/list] [hr] [h2]Other ways the internet/devices can be used in malicious ways[/h2] [list][*] Cyberbullying [i]Bullying someone online[/i] [*] Cyberstalking [i]Stalking someone online, tracking their movements[/i] [*] Cyber harassment [i]Harassing people online[/i] [*] Cyber extortion and sextortion [i]Extorting people for money or sex online[/i] [*] ''Revenge porn''/nonconsensual pornography [i]Posting videos/pictures of someone who hasn't consented to it online, as a result of revenge or other reasons[/i] [/list]