WIXLIB

Non discretionary access controls ‐ centrally managed and controlledFagan inspections for code review:o Planning ‐ Overview ‐ Preparation ‐ Inspection ‐ Rework ‐ Follow‐upStatic is looking at code, uncompiled. Dynamic is analyzing it during runtimeFuzzing types:o Mutation fuzzing (dumb) ‐ modifies known inputs to generate synthetic inputso Generational fuzzing (intelligent) ‐ develops inputs based on models of expected inputsSegregation of duties separation of duties least privilegeSecurity impact analysis stepso Request ‐ Review ‐ approve/reject ‐ Test ‐ Schedule ‐ DocumentPatch Management Programo Evaluate ‐ Test ‐ Approve ‐ Deploy ‐ Verify deploymentJob rotation and separation of duties prevent fraud not collusionIncident is an event that has a negative effect on the CIA of an organization's assetsIncidence response steps:o Detection ‐ Response ‐ Mitigation ‐ Reporting ‐ Recovery ‐ Remediation ‐ LessonsLearnedFail‐open/fail safe grants access after failing. Fail‐secure will default to a secure state after failing.Incremental only backups files that have changed, and resets archive bit. Differential does thesame but does not reset archive bit (Only needs full 1 differential to restore).Software escrow is to get copies of source code if SLAs are not met or on other conditionsRecovery ‐ Bringing ops and processes back to working condition, Restoration ‐ bringing facilityand environment back to working conditionDR Plans ‐ Read‐Through, Structured Walk‐through, Simulation, Parallel, Full‐interruptionTakes about 12 hours for warm site to be ready after disaster80% of states are at moderate to very high risk of seismic activity.Electronic Discovery Reference Model: Information Governance ‐ Identification ‐ Preservation ‐ Collection ‐ Processing ‐ Review ‐ Analysis ‐ Production ‐ PresentationAdmissible Evidence Requirements: Must be relevant, fact that the evidence seeks to determinemust be material (related to case), and competent (obtained legally).Types of evidence: Real (physical objects or conclusive like DNA), Documentary (written items,"best evidence rule" states that documents should be original, "Parol evidence rule" no verbalagreements may modify written agreement), Testimonial evidence (testimony of someone incourt or written in a disposition).Chain of Evidence required info: Description, time and date collected, location collected from,name of person collecting, and relevant circumstances surrounding collection.ISC 2 code of ethics preamble: Safety and welfare of society and the common good, duty to ourprincipals and to each other requires that we adhere, and be seent o adhere, to the highest ethicalstandards of behavior. Therefore, strict adherence to this Code is a condition of certification.Code of Ethics Canons:o Protect society, the common good, and necessary public trust and confidence and theinfrastructure.o Act honorably, honestly, justly, responsibility and legallyo Provide diligent and competent service to principalso Advance and protect the professionTen commandments of computer ethicso Thou shalt not use a computer to harm peopleo Thou shalt not interfere with other people's computer work

Thou shalt not snoop around in other people's computer filesThou shalt not use a computer to stealThou shalt not use a computer to bear false witnessThou shalt not copy proprietary software which you have not paid forThou shalt not use other people's computer resources without authorization or propercompensation.o Thou shalt not appropriate other people's intellectual outputo Thou shalt think about the social consequences of the program you are writing or thesystem you are designingo Thou shalt always use a computer in ways that ensure consideration and respect for yourfellow humansWhen developing sound systems, you should have these development processes:o Conceptual definitiono Functional requirements determinationo Control specs developmento Design Reviewo Code Review walk‐througho System Test Reviewo Maintenance and Change ManagementCMM vs IDEAL Model (I. I, Dr. Ed Am Lo(w)o Initiating vs initiatingo Diagnosing vs repeatableo Establishing vs Definedo Acting vs managedo Learning vs optimizedPERT ‐ Program Evaluation Review Technique is a project scheduling tool that calculates thestandard deviation for risk assessment.Change management process, 3 basic components: Request, Change, and Release controlConfiguration management components: Identification, control, status accounting, and Audit.In a relational database,o The cardinality is the rows,o Degrees are the columnso Domain is the allowable values that attribute can takeo Candidate key is subset of attributes that can be used to uniquely identify any record in atable (Each table can have one or more).o Primary key is selected from set of candidate keys and used to uniquely identify the recordsin a table(Each table can only have one).o Foreign Key is used to enforce relationships between two tables (AKA Referntial integrity).o Database normalization is to create well‐organized and efficient databases, three forms 1NF,2NF, 3NF. Reduces redundancy, higher levels are more efficient.Database transactions have four characteristics (ACID MODEL):o Atomicity ‐ "all or nothing affair"o Consistency ‐ Begin and complete operating in an environment that is consistent withdatabase ruleso Isolation ‐ Transactions must operate separately from each othero Durability ‐ Database transactions must be durable and preserved.Multilevel Security Databases ‐ contains information at different classification levels through theuse of labels or viewsooooo

Concurrency ‐ edit and view control so that info is always correctly written or read.Polyinstantiatiation ‐ when two or more rows in the same relational database seem to have thesame primary keys but different data for use at differing classification levels.NOSQL ‐ database or models that are not relationalo Key/Value stores ‐ store info in key/value pairso Graph Databases ‐ use nodes to represent objects and edges to represent relationshipso Document Stores ‐ store info in key/documents (more complicated than just values)Knowledge‐based AI system typeso Expert Systems Embody accumulated knowledge of experts and apply it in a consistent fashion todetermine future decisions Expert systems uses if/then statements to form decisions based on previousexperience of human experto Machine Learning Use analytic capabilities to develop knowledge from datasets without directapplication of human insight Type types: Supervised (correct answers known) and unsupervised learning (Correctanswers unknown).o Neural Networks Chains of computation units are used to imitate the biological reasoning process ofthe human mind.Dev, QA and IT Ops are three elements of DevOpsVirus Technologieso Multipartite Viruses ‐ use more than one propagation technique to infect victimso Stealth Viruses ‐ hides themselves by tampering with OS systemo Polymorphic Viruses ‐ modify code when travelling from one system to anothero Encrypted Viruses ‐ use crypto techniques to avoid detectionTime of check to time of use (TOCTTOU or TOC/TOU) ‐ make sure there is not a big delay betweenchecking access and resource requestsRootkits are used for privesc.Three ways to limit SQLi: Use prepared statements, perform input validation, and limit accountprivilegesXSS is only effective against reflected input

Fire Extinguisher types:

Stuff I learned from quizzes: Domain 1 (Security and Risk Mgmt):o CALEA? Yes communications assistance to Law Enforcement Act

final step of quant risk analysis is cost/benefitprudent man rule requires senior execs to take responsibility of due care.US Department of commerce implements us‐eu shield agreementGLBA is for financial stuffFISMA applies to gov contractors ‐ Federal Information Security Management Act ‐ Requiresfederal agencies to implement an ifosec program.o Economic espionage act fines and jails of those stealing trade secretso ACLs are used for determine user auth levelso MTO Maximum Tolerable Outageo RTO Recovery time objectiveo SOC 2 service organization control audit program includes business continuity controlso fourth amendment is to protect against privacyo electronic vaulting is part of disaster recovery, not business continuityo NIST is responsible for standard and guidelines for federal systemso project scope and planning includes 4 actions, structured analysis, creation of BCP,assessment of resources, and analysis of legal and regulatory landscapeo info disclosure attacks rely on revelation of informationDomain 2 (Asset Security)o clearing is preparing media for reuseo COBIT is needed for business owners to apply security controlso Classification levels for US Gov ‐ confidential for cause damage, secret is serious, top secretis grave damageo value of media often exceeds cost of the mediao erasing only removes link to file and is most risky, clearing and purging is more secure,degaussing is ok too.o How US Govt classifications relates to private companies: TOP secret confidential Secret private Confidential sensitiveo group policy monitors baselineso GDPR needs to protect data against accidental destruction but does not require data at restencryptiono encrypting and labelling is better for only sensitive emails.o issue is mishandling of drives by third party, not data remanence for when sending drives tobe shredded.o cost is not directly included in determining classification, but who can access is importanto California Online Privacy Protection Act (COPPA) is a law that needs privacy policies if theycollect info on California residentsDomain 3 (Security Architecture and Engineering)o Brewer Nash is for dynamic changed access controls, review all models like biba, etc.o DSA RSA and ECDSA are approved for DSSo MD5 has collisions but SHA256 is good.o ESP provides confidentiality and integrity for IPSECo Diffie Hellman allows for exchanging of symmetric encryptiono Protection Profiles (PPs) specify product security requirements for Common Criteriao Kerckhoff's principle says crypto system should be secure even if open sourceo Fair Cryptosystem key escrow requires 2 partieso ready state is for tasks prepared to execute but cpu not ready. Waiting is for blocked byexternalo EAL1 applies when functionally tested, lowest level of Common Criteriaooooo

Multistate systems are for different security class simultaneouslycaesar cipher is a shift cipherverification process validates controls by third party, not accreditation which is more of aformal declaration to operate in a specific environmento If you must reuse an SSD, use encryption on the disko known plaintext attacker has copy of encrypted message with plaintext message. Chosen‐plaintext is when the attacker can obtain ciphertexts for chosen plaintexts. Chosen‐ciphertext is when you can obtain decryptions of chosen ciphertexts.o x509 is for digital certso multithreading is when multiple tasks are run within a processo transposition cipher does not change frequency distribution of english languageo heartbeat sensors sends alerts occasionallyo blowfish uses variable key lengthso RSA is asymmetric and therefore can be used for digital certso Halon uses a CFC suppressant and was banned as it depletes ozoneo TLS uses symmetric ephemeral session keyo When only executable code is given to a vendor, that's like a cloud environment, which isPAAS (IAAS gives you OS control too)o Ideal humidity in a server room should be 40‐60% due to static electricityo serial numbers are used by CRL (Certificate Revocation List)o covert timing example: rhythm of morse codeo Sometimes if the cost is too great to secure an remote access vulnerability, move it to asecure network.Domain 4 (Communication and Network Security)o ftp operates on 20 and 21 TCPo CHAP is used by PPP servers to authenticate, PAP does too but it is unencrypted.o RADIUS was designed to support dialup but supported for VPN. ESP and AH are IPsec and donot provide authenticationo # of zones protected behind firewall how many tierso DNS poisoning changes dns to ip mappings, dns spoofing just beats valid results from a DNSservero Screen scraping just copies display, does not allow for controlo Multilayer protocols may have covert channels, may bypass filters and logical boundaries(think serial SCADA link)o SPIT is spam over internet telephony and targets VoIPo PRI or primary rate interface can use 2‐23 64 kb channels with a max bandwidth of 1.544Mbpso FDDI or Fiber Distributed Data Interface is a token‐passing networker that uses rings withtraffic flowing in opposite directions (Token ring uses tokens but not in a dual loop). SONETdeals with fiber and sending multiple optical streams over ito PPTP, L2F, L2TP and IPSEC are the most common VPN protocolso Private branch exchange (PBX) systems are typically standard telephones and do not carryencryption, so physical security is best solution.o Firewalls will stop at the first matched ruleo A data streams are associated with app, presentation, and session. (Highest to lowest areData streams, segments, packets, frames, and bits)o servers may talk to each other within virtual environment, so you have to actively thinkabout packet loggingooo

T3 line is capable of 45 Mbps, T1 is 1.544Mbps , ATM is 155Mbps, ISDN is 64 or 128 KbpsBluetooth pins can only be 4 digits longPPP is used for dialup!teardrop uses fragmented packets to exploit how a system handles reassemblyethernet uses BUS topology as they can collideyes cat 3 provides 10MBPS, cat 5 is 100Mbps , 5e is 1000Mbps, cat 6 is 1000MbpsWEP is weak due to static common key and limited IV, does not use asymmetric encryptionDKIM allows domain identities to verify emailDomain 5 (IAM ‐ MY WORST SECTION)o Capability tables list privileges assigned to subjects and the objects they can access.o On‐prem 3rd party identity service can integrate with IDaaS solution, especially with AD.o Kerberos encrypts messages with secret keys.o Kerberos auth process: User provides auth, Client/TGS key generated, TGT is thengenerated, client/server ticket generated, then user accesses service.o A landline call is a somewhere you are, mobile is something you have.o Kerberos uses realms and proper type of trust for AD needs to connect to a K5 domain is arealm trust. Forest trust is a transitive trust between two forest root domainso TACACS AAA protocol is most commonly usedo AD Federation Services, Central Auth Services, and Kerberos are all SSO. Radius is not.o yes client in Kerberos logins use AES to encrypt user and passo Yes KDC uses user's pass to generate a hash and uses that to encrypt a sym key. Sends bothencrypted sym key and time‐stamped TGT to client.o Client needs to install TGT for use and needs to decrypt sym key user a hash of user'spassword before a TGT can be usedo Retina scans can reveal medical conditionso MAC systems are based on a lattice model, biba also is based on a lattice model/MACo Resource based access controls match permissions to resources like storage volumeso Radius uses UDP and encrypts passwords by defaulto AS authentication services in kerberos (TS does not exist)o Phishing is not a threat to access control mechanisms, it is a threat to users.o LDAP DN can have plus and commas, no semicolons.o A stored biometric factor is called a reference profile or template.o TLS for SAML provides confidentiality and integrity, with digital signatures authentication isalso provided.o Hybrid cloud and local auth system ensures outages are handled for availability purposeso Service Provisioning Markup Language (SPML) used to allow platforms to generate andrespond to provisioning requests.o Google's federation allows SSO but goes beyond it, including rights and cert management.o Yes port 636 is default for LDAPS (over SSL or TLS, normal LDAP is 389), 3268 and 3269(secure) are for global catalogso X.500 covers directory services, Kerberos is described in RFCso Active Directory Domain Services (ADDS) is based on LDAP, AD also uses kerberoso OpenLDAP stores passwords in the clearo Type 2 error is when an invalid subject is incorrectly authenticated (like to someone else'saccount, even if you have an account).o RADIUS uses TLS over TCP, not native UDPo MAC systems do not allow rights to lower class levels (secret cannot access unclass bydefault).oooooooo

Simple Authentication and Security Layer (SASL) for ldap provides secure authenticationPhishing attacks could happen if relying party provides redirect to openID providerRecovery controls are like RAIDLDAP DNs should be most specific to least specific (ben, sales, example, com)if time is more than 5 mins out of sync Kerberos won't receive any new tickets.Kerberos, kryptoknight, and sesame are all SSO systems.Domain 6 (Security Assessments and Testing ‐ MY SECOND WORST SECTION)o mutation testing modifies programs in small ways to test if they will failo IPS is a mechanism like hardware, software, firmware based control system. Specs aredocuments like policies or designs.o type I audits do not cover period of time, only a single point in time unlike type IIo WPA2 enterprise uses RADIUS auth, not passwordso causing alarms on IPS with wireless scanning is intentional, not a problemo generational fuzzing relies on models. But mutational fuzzers are dumbo MTD is maximum tolerable downtime, not helpful with testing backups.o TCP connect scans can be done without packet creation privileges.o synthetic monitoring uses emulated or recorded transactions to monitor behavior.o Real user Monitoring is passive monitoring that captures user behavioro important part of app threat modeling is threat categorization. Assesses attacker goals andwhere controls should be placed.o passive scanning can help identify rogue devices by capturing MAC addresseso bluetooth active scans can determine both the strength of the PIN and what security modethe device is operatingo regression testing ensures that changes have not introduced new issues.o key indicators tell how risky an activity is and are used to monitor high risk areas.o how vulnerability data should be stored and sent is critical to address during planning for apen testo code coverage testing requires that every function, statement, branch, and condition becalled.o API, ui, and physical interfaces are important during software testing. Network interfacesare not.o CVE provides consistent reference for security vulnerabilitieso NIST 800‐53A (like SEA of controls) covers methods for assessing and measuring controlso TCP connect is 3 way handshake, TCP ACK disguises as active controlo ITIL is for IT service management.o NIST SP 800‐137 (like LE(E)T monitoring) outlines the process for organizations that aremaintaining an Infosec Continuous Monitoring (ISCM). Define, establish, implement,analyze, report, respond, review, and update.o Regression testing prevents recurrence of issues.o test coverage report measures how many test cases have been completed from a functionalperspective.o validation is necessary after vulnerability scanner finds an issue.o fagan inspection process: Planning, overview, preparation, inspection, rework, follow upo Not having enough log sources isn't a key consideration in log management systemso Common Platform Enumeration of SCAP provides a way to refer to OS and systemcomponents.o Rebooting a windows machine results in an information log entry.oooooo

Authenticated scans use a read‐only account to access config files, allowing for moreaccurate testingo shared sym key can lead to repudiation issues.o fuzz testers automatically generate input sequences to test an application.o statement coverage tests verify that every line of code was executedo after nmap you do more detailed vuln scanso x11, ssh open indicate linux instanceo nmap scans 1000 tcp and udp ports, not just "well known ports" by default.o manual code review is the best option to understand context and business logic.o misuse case diagrams use language like threatens and mitigates, which is beyond typical usecase diagrams.o specs are documents associated with system being auditedo when

CISSP Notes Pretty much everything hard that I read or every question I got wrong in my practice exams annual loss expectancy is AV asset value times exposure factor EF, times the annualized rate of oc