2. Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute
unwanted actions on a web application in which they’re currently authenticated.
With a little help of social engineering (such as sending a link via email or chat), an
attacker may trick the users of a web application into executing actions of the
attacker’s choosing. If the victim is a normal user, a successful CSRF attack can
force the user to perform state changing requests like transferring funds, changing
their email address, and so forth. If the victim is an administrative account, CSRF
can compromise the entire web application.
3. Description
CSRF is an attack that tricks the victim into submitting a malicious request. It
inherits the identity and privileges of the victim to perform an undesired function
on the victim’s behalf For most sites, browser requests automatically include any
credentials associated with the site, such as the user’s session cookie, IP address,
Windows domain credentials, and so forth. Therefore, if the user is currently
authenticated to the site, the site will have no way to distinguish between the
forged request sent by the victim and a legitimate request sent by the victim. CSRF
attacks target functionality that causes a state change on the server, such as
changing the victim’s email address or password, or purchasing something.
Forcing the victim to retrieve data doesn’t benefit an attacker because the attacker
doesn’t receive the response, the victim does. As such, CSRF attacks target state-
changing requests.
4. Synonyms
CSRF attacks are also known by a number of other names, including XSRF, “Sea
Surf”, Session Riding, Cross-Site Reference Forgery, and Hostile Linking. Microsoft
refers to this type of attack as a One-Click attack in their threat modeling process
and many places in their online documentation.
5. Code for Cross-Site Request Forgery
Issues:
CSRF is not the same as XSS (Cross Site Scripting), which forces malicious content
to be served by a trusted website to an unsuspecting victim. Injected text is
treated as executable by the browser, hence running the script. Used in Phishing,
Trojan upload, Browser vulnerability weakness attacks…..
Cross-Site Request Forgery (CSRF) (C-SURF) (Confused-Deputy) attacks are
considered useful if the attacker knows the target is authenticated to a web based
system. They only work if the target is logged into the system, and therefore have
a small attack footprint. Other logical weaknesses also need to be present such as
no transaction authorization required by the user
6. How They Work
CSRF attacks work by sending a rogue HTTP request from an authenticated user’s
browser to the application, which then commits a transaction without
authorization given by the target user. As long as the user is authenticated and a
meaningful HTTP request is sent by the user’s browser to a target application, the
application does not know if the origin of the request is a valid transaction or a
link clicked by the user (that was, say, in an email) while the user is authenticated
to the application. So, for example, using CSRF, an attacker makes the victim
perform actions that they didn’t intend to, such as logout, purchase item, change
account information, or any other function provided by the vulnerable website.
7. An Example below of a HTTP POST to a
ticket vendor to purchase a number of
tickets.
POST http://TicketMeister.com/Buy_ticket.htm HTTP/1.1
Host: ticketmeister
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O;) Firefox/1.4.1
Cookie: JSPSESSIONID=34JHURHD894LOP04957HR49I3JE383940123K
ticketId=ATHX1138&to=PO BOX 1198 DUBLIN 2&amount=10&date=11042008
8. The response of the vendor is to
acknowledge the purchase of the tickets:
HTTP/1.0 200 OK Date: Fri,
02 May 2008 10:01:20 GMT Server: IBM_HTTP_Server
Content-Type: text/xml;charset=ISO-8859-1 Content-Language: en-US X-Cache:
MISS from app-proxy-2.proxy.ie Connection: close
<?xml version=”1.0” encoding=”ISO-8859-1”?>
` Ticket Purchased, Thank you for your custom.
9. How to Locate the Potentially Vulnerable
Code
This issue is simple to detect, but there may be compensating controls around the
functionality of the application which may alert the user to a CSRF attempt. As long as
the application accepts a well formed HTTP request and the request adheres to some
business logic of the application CSRF shall work (From now on we assume the target
user is logged into the system to be attacked).
By checking the page rendering we need to see if any unique identifiers are appended
to the links rendered by the application in the user’s browser. If there is no unique
identifier relating to each HTTP request to tie a HTTP request to the user, we are
vulnerable. Session ID is not enough, as the session ID shall be sent anyway if a user
clicks on a rogue link, as the user is authenticated already.
10. In short, the following principles should
be followed to defend against CSRF:
Check if your framework has built-in CSRF protection and use it
If framework does not have built-in CSRF protection, add CSRF tokens to all state changing
requests (requests that cause actions on the site) and validate them on the backend
For stateful software use the synchronizer token pattern
For stateless software use double submit cookies
Implement at least one mitigation from Defense in Depth Mitigations section
Consider SameSite Cookie Attribute for session cookies but be careful to NOT set a cookie
specifically for a domain as that would introduce a security vulnerability that all subdomains
of that domain share the cookie. This is particularly an issue when a subdomain has a
CNAME to domains not in your control.
Consider implementing user interaction based protection for highly sensitive operations
Consider the use of custom request headers
11. A cross-site request forgery is typically
executed in one of the ways described
below.
GET Requests
Some applications use HTTP GET requests to perform state changes, such as
changing a password. In this case, an attacker will send a malicious link (that
mimics an ordinary one). A script that triggers the browser to perform the request
is executed when a user visits the link
POST Requests
The main difference between using a GET and POST request for a CSRF is how the
request is submitted. Attackers use HTTP POST because state-changing requests
in applications are frequently made in this way.
12. An attacker may use the <form> element to submit this request, requiring the user to
submit the request manually. This can be achieved by tricking the victim into clicking
on a button on the malicious website to which they are led. Alternatively, the attacker
may embed JavaScript in the website, executing the form request automatically.
Other Requests:
Another way a CSRF can be successful is by using different HTTP elements such as PUT
or DELETE. These can be submitted as part of a JSON or XML string but are prevented
by modern browsers by default because of the same-origin policy (SOP) restrictions
and cross-origin resource sharing (CORS). For such a request to be allowed, these
restrictions must have been manually removed on a website, allowing it to receive
requests with different origins.
13. A CSRF can also be executed as part of a cross-site scripting (XSS) attack. In this
case, the CSRF will be part of the payload attached to the XSS, like with the
famous Samy worm used in MySpace.
14. How to Prevent Cross-Site Request
Forgery Attacks
To prevent CSRF injection attacks, you must ensure that an attacker cannot craft
an arbitrary request run in the security context of any other user and send from a
different website. This is one of the main conditions that need to be in place for a
CSRF attack to be successful
Token-based prevention
Common CSRF token vulnerabilities
Double-submit cookie prevention
Same-site cookie prevention
Custom request header
Django
Laravel
15. Token-based prevention
Cross-Site Request Forgery Prevention Cheat Sheet, the most common mitigation
technique for cross-site request forgery attacks is using a CSRF token (also known
as a synchronizer token or anti-CSRF token). These session tokens are
unpredictable and unique values generated by the application and sent to the
client. After that, they are sent back in the request made by the client to the server,
which verifies the request.
16. Common CSRF token vulnerabilities
Tokens are validated and used only when POST requests are made and not when
GET requests are made
Validation occurs only if the session token is present, and if it is omitted, validation
is also skipped
Tokens are not tied to the current user session but are compared to tokens issued
at any point by the application
Tokens are tied to a cookie but not one that is used to track the current session
17. Double-submit cookie prevention
A double-submit cookie token approach can be used if using a valid token on the
server side is impossible. In this cookie-based session handling, when a user visits
a website, the site generates a value that stores as a cookie on the user’s device,
apart from the cookie that serves as a session identifier.
When a legitimate request is submitted to the site, it must contain the same value
as included in the cookie. The server then verifies this, and the request parameter
is accepted if the values match.
18. Same-site cookie prevention
The same-site cookie approach restricts the origin from which a cookie can be
sent. Thus, CSRF exploits the possibility of making a cross-origin request (and
hence same-site cookies). Limiting requests so that they can only be sent from the
origin to which a cookie is related prevents the ability to send external requests to
an application.
19. Custom request header
A technique that is particularly effective for AJAX or API endpoints is the use of custom
request headers. In this approach, JavaScript is used to add a custom header.
Unfortunately, JavaScript can’t make cross-origin requests with a custom header
because of the SOP security restrictions.
Django
Django is similarly easy to protect any form by a CSRF-Token using the snippet within
the <form></form> tags.
To provide the token for use with JavaScript requests, retrieve it from its storage cookie
and add it to the request.
21. Laravel
To protect forms in Laravel, include the following code within the <form></form>
tags.
{{ csrf_field() }}
22. planning and policy
A cyber security plan specifies the security policies, procedures, and controls
required to protect an organization against threats and risk. A cyber security
plan can also outline the specific steps to take to respond to a breach
23. How To Develop & Plan An
Effective Cyber Security Strategy
What Is A Cyber Security Strategy?
A cyber security strategy is a plan that involves selecting and
implementing best practices to protect a business from internal and external
threats
1.Defense In Depth Strategy:
To effectively manage emerging threats and risks today, the cyber security strategy
should consider implementing defense in depth.
The goal of implementing this strategy encompasses the layering of security
defenses.
24.
25. Zero Trust Security + Defense In Depth
Layering multiple tools to create defense in depth is a solid approach towards
laying the foundation for a sound security strategy, however, a company must
have resources available to support and monitor the functionality of the tools.
to address this issue, a zero trust model should be implemented as well.
Zero trust implies, never trust, always verify.
Multifactor authentication and machine learning are components of zero trust,
which provides the company with visibility on who and how the assets are being
utilized within the network.
26.
27. 3.Inform your employees about your cybersecurity policies.
Set up IT cybersecurity practices and policies for your employees. This includes
requiring strong passwords and establishing appropriate Internet usage guidelines
that comprehensively discuss your business cybersecurity policies.
4. Update your software.
Cybercriminals can enter your computer network through outdated apps with
known vulnerabilities. Make sure you regularly install software updates and
patches for applications and operating systems as soon as they’re available
28. 5.Place a firewall.
One of the first lines of defense in a cyberattack is a sturdy firewall. We
recommend that all small to medium-sized businesses set up a firewall to create a
barrier between your data and cybercriminals. Installing internal firewalls is also an
effective practice to provide additional protection
6.Back up all your data regularly.
Always back up all your business data including those stored in the cloud. To have
the latest backup, check your on-premise and cloud servers regularly to ensure
that it is functioning correctly.
29. 7.Install anti-malware software.
Anyone can be a victim of data breach, no matter how vigilant one is. Since
phishing attacks center on installing malware on the employee’s computer, it’s
imperative to have anti-malware software installed on all devices and in your
network.
8.Implement strong data protection procedures.
Running your office machines on the latest software, web browsers and operating
systems are the best defense against cybersecurity threats. Devise and follow a
business data protection strategy that encompasses strong security measures
centered around the restriction of access.
30. Network Protocols and Service Models
Network protocols incorporate all the processes, requirements and constraints of
initiating and accomplishing communication between computers, servers, routers
and other network-enabled devices. They must be confirmed and installed by the
sender and receiver to ensure network/data communication and apply to software
and hardware nodes that communicate on a network.
31. Network protocols are developed and
published by several groups according to
certain industry standards.
World Wide Web Consortium (W3C)
International Telecommunication Union (ITU)
International Organization for Standardization (ISO)
Internet Engineering Task Force (IETF)
The Institute of Electrical and Electronics Engineers (IEEE)
32. Broad Types of Networking Protocols
- Network Communication Protocols
Communication protocols allow basic data communication between network
devices. Their purposes range from transferring files between computers or via the
Internet, to exchange text-based messages, and establishing communication
between routers and external or IoT devices.
Examples of communication protocols are: Bluetooth Protocols, FTP, TCP/IP, And
HTTP.
33. Types of Network Protocols
The most important protocols for data transmission across the Internet are TCP
(Transmission Control Protocol) and IP (Internet Protocol). Using these jointly
(TCP/IP), we can link devices that access the network; some other communication
protocols associated with the Internet are POP, SMTP and HTTP
The OSI model (Open System Interconnection) conceptually organizes network
protocol families into specific network layers. This Open System Interconnection
aims to establish a context to base the communication architectures between
different systems.
34. Common types of communication protocols include the following:
Automation: These protocols are used to automate different processes in both commercial and
personal settings, such as in smart buildings, cloud technology or self-driving vehicles.
Instant messaging: Instantaneous, text-based communications on smartphones and computers
occur because of a number of different instant messaging network protocols.
Routing: Routing protocols permit communication between routers and other network devices.
There are also routing protocols specifically for ad hoc networks.
Bluetooth: Ever-popular Bluetooth devices — including headsets, smartphones and computers —
work due to a variety of different Bluetooth protocols.
File transfer: If you have ever moved files from one device to another, either via a physical or
medium, you’ve used file transfer protocols (FTP).
Internet Protocol: Internet Protocol (IP) allows data to be sent between devices via the internet.
The internet could not operate as it currently does without IP.
35. Network Protocol Example
Here are a few examples of the most commonly used network protocols:
Hypertext Transfer Protocol (HTTP): This Internet Protocol defines how data is
transmitted over the internet and determines how web servers and browsers should
respond to commands. This protocol (or its secure counterpart, HTTPS) appears at the
beginning of various URLs or web addresses online.
Secure Socket Shell (SSH): This protocol provides secure access to a computer, even if
it’s on an unsecured network. SSH is particularly useful for network administrators who
need to manage different systems remotely.
Short Message Service (SMS): This communications protocol was created to send and
receive text messages over cellular networks. SMS refers exclusively to text-based
messages. Pictures, videos or other media require Multimedia Messaging Service
(MMS), an extension of the SMS protocol.
36. - Network Security Protocols
Security protocols implement security over network communications by
guaranteeing that data transferred over a network cannot be accessed by
unauthorized users. Security is established through various means, such as via the
use of passwords, authentication protocols, or data encryption. Data can be
cryptographed and protected during transportation between devices, and access
can be denied to unknown or unauthorized devices or users.
Examples of security protocols include: HTTPS, SSL, SSH, And SFTP.
37. HTTPS
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure (https) is a combination of the Hypertext
Transfer Protocol (HTTP) with the Secure Socket Layer (SSL)/Transport Layer
Security (TLS) protocol. TLS is an authentication and security protocol widely
implemented in browsers and Web servers.
SSL: Secure Sockets Layer
Secure Sockets Layer (SSL) is a standard security technology for establishing an
encrypted link between a server and a client—typically a web server (website) and
a browser, or a mail server and a mail client (e.g., Outlook)
38. SSH/ SFTP
SSH or Secure Shell is a network communication protocol that enables two
computers to communicate (c.f http or hypertext transfer protocol, which is the
protocol used to transfer hypertext such as web pages) and share data
Secure File Transfer Protocol (SFTP) is a network protocol for securely accessing,
transferring and managing large files and sensitive data. Designed by the
Internet Engineering Task Force as an extension of Secure Shell (SSH), SFTP
enables access, transfer and management of files over a network.
39. FUNCTIONS:
Encryption: Encryption protocols protect data and secure areas by requiring users
to input a secret key or password in order to access that information.
Entity Authentication: Entity authentication protocols create a system that
requires different devices or users on a network to verify their identity before
accessing secure areas.
Transportation: Transportation security protocols protect data while it is
transported from one network device to another.
40. - Network Management Protocols
Network management protocols provide network governance and maintenance
by defining the procedures required to operate a network. They are applied on all
devices operating in a given network — such as servers, routers, and computers —
to coordinate them in an efficient way. Network management protocols ensure
that each device is connected to the others and to the network itself, and
guarantee the stability of these connections. They are often used for
troubleshooting purposes and to assess the quality of the network connection.
Examples of network management protocols include: SNMP, and ICMP.
41. The functions of network management protocols include the following:
Connection: These protocols establish and maintain stable connections between
different devices on the same network.
Link aggregation: Link aggregation protocols allow you to combine multiple
network connections into one link between two devices. This works to increase the
strength of the connection and helps sustain the connection should one of the
links fail.
Troubleshooting: Troubleshooting protocols allow network administrators to
identify errors affecting the network, evaluate the quality of the network
connection, and determine how administrators can fix any issues.
42. SNMP, and ICMP.
Simple Network Management Protocol (SNMP) is an application-layer protocol
for monitoring and managing network devices on a local area network (LAN)
or wide area network (WAN).
ICMP is a network level protocol. ICMP messages communicate information
about network connectivity issues back to the source of the compromised
transmission. It sends control messages such as destination network unreachable,
source route failed, and source quench.
43. Cybersecurity Model Definitions
Managed Security Service Provider (MSSP)
The Managed Security Service Provider (MSSPs) monitors networks and systems, and
analyzes threats through a subscription model. MSSPs focus primarily on remote
device management, like intrusion detection, prevention systems, and configuring
firewalls. Their services are not as focused on continuous threat detection and
response.
Managed Detection and Response (MDR)
A Managed Detection and Response approach typically involves a security platform
that offers fundamental security activities like cloud-managed security. They tend to
combine threat intelligence with human expertise and data analytics around incident
investigation and response.
44. Security Information and Event Management (SIEM)
A SIEM solution centrally collects data from multiple devices on a network and
proactively identifies security events that might not be detected by standalone
security technology. It logs security events, detecting attacks and directing
enterprise security controls to respond to perceived incidents
45. What is Transport Layer Security (TLS)?
Transport Layer Security, or TLS, is a widely adopted security protocol designed to
facilitate privacy and data security for communications over the Internet. A primary use
case of TLS is encrypting the communication between web applications and servers,
such as web browsers loading a website.
What is the difference between TLS and SSL?
TLS evolved from a previous encryption protocol called Secure Sockets Layer (SSL),
which was developed by Netscape. TLS version 1.0 actually began development as SSL
version 3.1, but the name of the protocol was changed before publication in order to
indicate that it was no longer associated with Netscape. Because of this history, the
terms TLS and SSL are sometimes used interchangeably.
46. What does TLS do?
There are three main components to what the TLS protocol
accomplishes: Encryption, Authentication, and Integrity.
Encryption: hides the data being transferred from third parties.
Authentication: ensures that the parties exchanging information are who they
claim to be.
Integrity: verifies that the data has not been forged or tampered with
47. How does TLS work?
For a website or application to use TLS, it must have a TLS certificate installed on its
origin server (the certificate is also known as an "SSL certificate" because of the naming
confusion described above). A TLS certificate is issued by a certificate authority to the
person or business that owns a domain. The certificate contains important information
about who owns the domain, along with the server's public key, both of which are
important for validating the server's identity.
The TLS handshake establishes a cipher suite for each communication session. The
cipher suite is a set of algorithms that specifies details such as which shared encryption
keys, or session keys, will be used for that particular session. TLS is able to set the
matching session keys over an unencrypted channel thanks to a technology known
as public key cryptography
48. During the TLS handshake, the user's device and the web server:
Specify which version of TLS (TLS 1.0, 1.2, 1.3, etc.) they will use
Decide on which cipher suites (see below) they will use
Authenticate the identity of the server using the server's TLS certificate
Generate session keys for encrypting messages between them after the
handshake is complete
49.
50. How to start implementing TLS on a
website
Cloudflare offers free TLS/SSL certificates to all users. Anyone who does not use
Cloudflare will have to acquire an SSL certificate from a certificate authority, often
for a fee, and install the certificate on their origin servers.
51. What is Network Security?
Network Security protects your network and data from breaches, intrusions and
other threats. This is a vast and overarching term that describes hardware and
software solutions as well as processes or rules and configurations relating to
network use, accessibility, and overall threat protection.
52. Types of Network Security Protections
Firewall
Firewalls control incoming and outgoing traffic on networks, with predetermined
security rules. Firewalls keep out unfriendly traffic and is a necessary part of daily
computing. Network Security relies heavily on Firewalls, and especially Next
Generation Firewalls, which focus on blocking malware and application-layer
attacks
53. Network Segmentation
Network segmentation defines boundaries between network segments where
assets within the group have a common function, risk or role within an
organization. For instance, the perimeter gateway segments a company network
from the Internet. Potential threats outside the network are prevented, ensuring
that an organization’s sensitive data remains inside. Organizations can go further
by defining additional internal boundaries within their network, which can provide
improved security and access control
54. What is Access Control?
Access control defines the people or groups and the devices that have access to
network applications and systems thereby denying unsanctioned access, and
maybe threats. Integrations with Identity and Access Management (IAM) products
can strongly identify the user and Role-based Access Control (RBAC) policies
ensure the person and device are authorized access to the asset.
55. Remote Access VPN
Remote Access VPN
Remote access VPN provides remote and secure access to a company network to
individual hosts or clients, such as telecommuters, mobile users, and extranet
consumers. Each host typically has VPN client software loaded or uses a web-
based client. Privacy and integrity of sensitive information is ensured through
multi-factor authentication, endpoint compliance scanning, and encryption of all
transmitted data
56. Zero Trust Network Access (ZTNA)
The zero trust security model states that a user should only have the access and
permissions that they require to fulfill their role. This is a very different approach
from that provided by traditional security solutions, like VPNs, that grant a user
full access to the target network. Zero trust network access (ZTNA) also known as
software-defined perimeter (SDP) solutions permits granular access to an
organization’s applications from users who require that access to perform their
duties.
57. Email Security
Email security refers to any processes, products, and services designed to protect your
email accounts and email content safe from external threats. Most email service
providers have built-in email security features designed to keep you secure, but these
may not be enough to stop cybercriminals from accessing your information.
Data Loss Prevention (DLP)
Data loss prevention (DLP) is a cybersecurity methodology that combines technology
and best practices to prevent the exposure of sensitive information outside of an
organization, especially regulated data such as personally identifiable information (PII)
and compliance related data: HIPAA, SOX, PCI DSS, etc.
58. Intrusion Prevention Systems (IPS)
IPS technologies can detect or prevent network security attacks such as brute force
attacks, Denial of Service (DoS) attacks and exploits of known vulnerabilities. A
vulnerability is a weakness for instance in a software system and an exploit is an attack
that leverages that vulnerability to gain control of that system
Sandboxing
Sandboxing is a cybersecurity practice where you run code or open files in a safe,
isolated environment on a host machine that mimics end-user operating environments.
Sandboxing observes the files or code as they are opened and looks for malicious
behavior to prevent threats from getting on the network. For example malware in files
such as PDF, Microsoft Word, Excel and PowerPoint can be safely detected and blocked
before the files reach an unsuspecting end user.
59. Hyperscale Network Security
Hyperscale Network Security
Hyperscale is the ability of an architecture to scale appropriately, as increased
demand is added to the system. This solution includes rapid deployment and
scaling up or down to meet changes in network security demands. By tightly
integrating networking and compute resources in a software-defined system, it is
possible to fully utilize all hardware resources available in a clustering solution
60. Cloud Network Security
Applications and workloads are no longer exclusively hosted on-premises in a
local data center. Protecting the modern data center requires greater flexibility and
innovation to keep pace with the migration of application workloads to the cloud.
Software-defined Networking (SDN) and Software-defined Wide Area Network
(SD-WAN) solutions enable network security solutions in private, public, hybrid
and cloud-hosted Firewall-as-a-Service (FWaaS) deployments.
61. Robust Network Security Will Protect
Against
Virus: A virus is a malicious, downloadable file that can lay dormant that replicates
itself by changing other computer programs with its own code. Once it spreads
those files are infected and can spread from one computer to another, and/or
corrupt or destroy network data.
Worms: Can slow down computer networks by eating up bandwidth as well as the
slow the efficiency of your computer to process data. A worm is a standalone
malware that can propagate and work independently of other files, where a virus
needs a host program to spread.
62. Trojan: A trojan is a backdoor program that creates an entryway for malicious
users to access the computer system by using what looks like a real program, but
quickly turns out to be harmful. A trojan virus can delete files, activate other
malware hidden on your computer network, such as a virus and steal valuable
data.
Spyware: Much like its name, spyware is a computer virus that gathers information
about a person or organization without their express knowledge and may send
the information gathered to a third party without the consumer’s consent.
63. Adware: Can redirect your search requests to advertising websites and collect
marketing data about you in the process so that customized advertisements will
be displayed based on your search and buying history.
Ransomware: This is a type of trojan cyberware that is designed to gain money
from the person or organization’s computer on which it is installed by encrypting
data so that it is unusable, blocking access to the user’s system.
64. What Does Wireless Network Security
Mean?
Wireless network security is the process of designing, implementing and ensuring
security on a wireless computer network. It is a subset of network security that adds
protection for a wireless computer network.
Wireless network security primarily protects a wireless network from unauthorized and
malicious access attempts. Typically, wireless network security is delivered through
wireless devices (usually a wireless router/switch) that encrypts and secures all wireless
communication by default. Even if the wireless network security is compromised, the
hacker is not able to view the content of the traffic/packet in transit. Moreover, wireless
intrusion detection and prevention systems also enable protection of a wireless
network by alerting the wireless network administrator in case of a security breach.
65. Some of the common algorithms and standards to ensure wireless network security are
Wired Equivalent Policy (WEP) and Wireless Protected Access (WPA).
Wi-Fi Protected Access (WPA) is a security standard for computing devices with
internet connections. It was developed by the Wi-Fi Alliance to provide better data
encryption and user authentication than Wired Equivalent Privacy (WEP), which was the
original Wi-Fi security standard.
WEP (Wired Equivalent Privacy) is the oldest and most common Wi-Fi security
It was the privacy component established in the IEEE 802.11, a set of technical
standards that aimed to provide a wireless local area network (WLAN) with a
comparable level of security to a wired local area network (LAN)
66. IOT and Cloud Computing Security
Threats
Internet of Things (IoT) security is the safeguards and protections for cloud-
connected devices such as home automation, SCADA machines, security cameras,
and any other technology that connects directly to the cloud.
Cloud security, also known as cloud computing security, is a collection of security
measures designed to protect cloud-based infrastructure, applications, and data.
These measures ensure user and device authentication, data and resource access
control, and data privacy protection.
67. Cloud Computing is the most important part of IoT which converges the servers,
analyzes information obtained from the sensors, increases processing power, and
provides good storage capacity. Cloud computing is integrated with smart objects
which use many sensors and helps IoT for large-scale development. IoT depends
on cloud computing and both computing technologies face security threats.
68. Security Threats facing IOT and Cloud
Computing
Data Threats
While transmitting data it is always important to hide from observing devices on the
internet. Data is a valuable resource to any organization and person, and the rate of
shifting data to the cloud is increasing every day. The biggest challenge in achieving
cloud-computing security is to secure data, this is because clients depend on the
service providers to ensure that the data is secure. The properties of data security
maintained by the cloud include confidentiality, integrity, authorization, data
availability, and privacy. Improper handling of data by the cloud may lead to data
threats, which include data breach, data loss, integrity violations, and unauthorized
access.
69. Data Breach
It involves leakage of user or organization data to an unauthorized user. This may
happen due to malicious attackers who access the system in an unauthorized way.
It can also happen accidentally due to infrastructure flaws, operational issues, and
insufficiency of authentication or audit controls.
Data Loss
It is a very sensitive issue related to cloud and IoT security. It happens when a
malicious attacker has unauthorized access to the system or network to
manipulate data. Malware attacks also cause data destruction.
70. Network Threats
Network security is an important factor in IoT and cloud, having weak network
security leads to attacks, which include man-in-the-middle attacks and denial of
service. IoT network security involves securing the communication network of
different IoT objects.
Man-in-the-Middle attack
It is a form of account hijacking where an attacker steals the credentials of the user
to get access to his account. The credentials are used to access and monitor the
network causing interference in communication between the nodes. For more
information on Man-in-the-middle attacks - feel free to read our article on the
subject.
71. Denial of Service
DOS attacks are done to prevent legitimate users from accessing the IoT and
cloud network, storage, data, and other computing services. DOS attacks also
cause a delay in operations because many requests are made thus consuming
more resources. For more information on Denial of Service attacks - please refer to
our other article on the subject.
72. Cloud Environment Threats
Insecure Interfaces and APIs
Application Programming Interface (API) enables the communication between
application and server. Cloud security depends on API security. Security threats are
likely to happen if there is a weak set of APIs.
Misuse of Cloud Services
Abuse of cloud services is involved with cloud users who violate their contracts
with the cloud platform. The malicious attackers are likely to launch brute force
attacks, Trojans, SQL injection, botnets, phishing, and DoS attacks. The service
providers are not able to detect the launched attacks on their networks because
they cannot generate attacks or block the attacks
73. Malicious Intruders
These people work on the cloud platform, have access to user’s data and
resources, and get involved in data manipulation.
74. The 6 Pillars of Robust Cloud Security
Granular, policy-based IAM and authentication controls across complex
infrastructures
The more extensive privileges, the higher the levels of authentication. And don’t
neglect good IAM hygiene, enforcing strong password policies, permission time-
outs, and so on
75. Zero-trust cloud network security controls
across logically isolated networks and
micro-segments
Deploy business-critical resources and apps in logically isolated sections of the
provider’s cloud network, such as Virtual Private Clouds (AWS and Google) or
vNET (Azure). Use subnets to micro-segment workloads from each other, with
granular security policies at subnet gateways
76. Enforcement of virtual server protection
policies and processes such as change
management and software updates:
Cloud security vendors provide robust Cloud Security Posture Management,
consistently applying governance and compliance rules and templates when
provisioning virtual servers, auditing for configuration deviations, and remediating
automatically where possible.
Enhanced data protection
Enhanced data protection with encryption at all transport layers, secure file shares and
communications, continuous compliance risk management, and maintaining good data
storage resource hygiene such as detecting misconfigured buckets and terminating
orphan resources.
