Amy McMullin, profile picture
Uploaded byAmy McMullin
PPT, PDF4,189 views

Chapter 4

The document discusses securing hosts, applications, and data. It describes securing the host by protecting physical devices, securing the operating system software, and using antimalware software. Securing the operating system involves developing security policies, baselining the OS configuration, configuring security settings, deploying security settings using tools like group policy, and implementing patch management. Antimalware software like antivirus, antispam, and firewall programs provide additional security for the host.

Embed presentation

Downloaded 422 times
CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition Chapter 4 Host, Application, and Data Security
© Cengage Learning 2015CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition Objectives • List the steps for securing a host computer • Define application security • Explain how to secure data 2
© Cengage Learning 2015 Securing the Host • Securing the host involves: – Protecting the physical device – Securing the operating system (OS) software – Using antimalware software CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 3
© Cengage Learning 2015 Securing Devices • Security control - any device or process that is used to reduce risk • Two levels of security controls: – Administrative controls - processes for developing and ensuring that policies and procedures are carried out – Technical controls - controls that are carried out or managed by devices • There are five subtypes of controls (sometimes called activity phase controls) described on the following slide CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 4
© Cengage Learning 2015 Securing Devices CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 5
© Cengage Learning 2015 External Perimeter Defenses • External perimeter defenses are designed to restrict access to equipment areas • This type of defense includes: – Barriers – guards – Motion detection devices CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 6
© Cengage Learning 2015 External Perimeter Defenses • Barriers – Fencing - usually a tall, permanent structure • Modern perimeter fences are equipped with other deterrents such as proper lighting and signage – Barricade - large concrete ones should be used • Guards – Human guards are considered active security elements – Video surveillance uses cameras to transmit a signal to a specific and limited set of receivers called closed circuit television (CCTV) CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 7
© Cengage Learning 2015 External Perimeter Defenses CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 8
© Cengage Learning 2015 External Perimeter Defenses • Motion Detection – Determining an object’s change in position in relation to its surroundings – This movement usually generates an audible alarm CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 9
© Cengage Learning 2015 Internal Physical Access Security • These protections include: – Hardware locks – Proximity readers – Access lists – Mantraps – Protected distribution systems for cabling CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 10
© Cengage Learning 2015 Internal Physical Access Security • Hardware locks – Standard keyed entry lock provides minimal security – Deadbolt locks provide additional security and require that a key be used to both open and lock the door – Cipher locks are combination locks that use buttons that must be pushed in the proper sequence • Can be programmed to allow a certain individual’s code to be valid on specific dates and times CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 11
© Cengage Learning 2015 Internal Physical Access Security • Recommended key management procedures – Inspect locks regularly – Issue keys only to authorized users – Keep track of issued keys – Master keys should not have identifying marks – Secure unused keys in a safe place – Establish a procedure to monitor use of locks and keys – Mark master keys with “Do Not Duplicate” – Change locks after key loss or theft CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 12
© Cengage Learning 2015 Internal Physical Access Security • Proximity Readers – Uses an object (physical token) to identify persons with authorization to access an area • ID badge emits a signal identifying the owner • Proximity reader receives signal – ID badges that can be detected by a proximity reader are often fitted with RFID tags • Badge can remain in bearer’s pocket CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 13
© Cengage Learning 2015 Internal Physical Access Security CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 14
© Cengage Learning 2015 Internal Physical Access Security • Access list – Record of individuals who have permission to enter secure area – Records time they entered and left • Mantrap – Separates a secured from a nonsecured area – Device monitors and controls two interlocking doors • Only one door may open at any time CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 15
© Cengage Learning 2015 Internal Physical Access Security CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 16
© Cengage Learning 2015 Internal Physical Access Security • Protected Distribution Systems (PDS) – A system of cable conduits used to protect classified information that is being transmitted between two secure areas • Created by the U.S. Department of Defense (DOD) – Two types of PDS: • Hardened carrier PDS - conduit constructed of special electrical metallic tubing • Alarm carrier PDS - specialized optical fibers in the conduit that sense acoustic vibrations that occur when an intruder attempts to gain access CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 17
© Cengage Learning 2015 Hardware Security • Hardware security - the physical security protecting the hardware of the host system – Most portable devices have a steel bracket security slot • A cable lock can be inserted into slot and secured to device and a cable connected to the lock can be secured to a desk or chair • Locking cabinets – Can be prewired for power and network connections – Allow devices to charge while stored CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 18
© Cengage Learning 2015 Hardware Security CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 19
© Cengage Learning 2015 Securing the Operating System Software • Five-step process for protecting operating system – 1. Develop the security policy – 2. Perform host software baselining – 3. Configure operating system security settings – 4. Deploy and manage security settings – 5. Implement patch management CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 20
© Cengage Learning 2015 Securing the Operating System Software • Develop the security policy – Security policy - a document(s) that clearly define organization’s defense mechanisms • Perform host software baselining – Baseline - the standard or checklist against which systems can be evaluated – Configuration settings that are used for each computer in the organization CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 21
© Cengage Learning 2015 Securing the Operating System Software • Configure operating system security and settings – Modern OSs have hundreds of different security settings that can be manipulated to conform to the baseline – Typical configuration baseline would include: • Changing insecure default settings • Eliminating unnecessary software, services, protocols • Enabling security features such as a firewall CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 22
© Cengage Learning 2015 Securing the Operating System Software • Deploy and Manage Security Settings – Tools to automate the process • Security template - collections of security configuration settings • Group policy - Windows feature providing centralized computer management; a single configuration may be deployed to many users CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 23
© Cengage Learning 2015 Securing the Operating System Software • Implement Patch Management – Operating systems have increased in size and complexity – New attack tools have made secure functions vulnerable – Security patch - software security update to repair discovered vulnerabilities – Hotfix - addresses specific customer situation – Service pack - accumulates security updates and additional features CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 24
© Cengage Learning 2015 Securing the Operating System Software • Patches can sometimes create new problems – Vendor should thoroughly test before deploying • Automated patch update service – Manage patches locally rather than rely on vendor’s online update service • Advantages of automated patch update service – Administrators can force updates to install by specific date – Administrators can approve updates for “detection” only; allows them to see which computers will require the update without actually installing it CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 25
© Cengage Learning 2015 Securing the Operating System Software • Advantages of automated patch update service (cont’d) – Downloading patches from a local server instead of using the vendor’s online update service can save bandwidth and time – Specific types of updates that the organization does not test can be automatically installed – Users cannot disable or circumvent updates CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 26
© Cengage Learning 2015 Securing the Operating System Software CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 27
© Cengage Learning 2015 Securing the Operating System Software • Security Through Design – OS hardening - tightening security during the design and coding of the OS – Trusted OS - an OS that has been designed through OS hardening CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 28
© Cengage Learning 2015 Securing with Antimalware • Third-party antimalware software packages can provide added security • Antimalware software includes: – Antivirus – Antispam – Popup blockers – Antispyware – Host-based firewalls CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 29
© Cengage Learning 2015 Antivirus • Antivirus (AV) - Software that examines a computer for infections – Scans new documents that might contain viruses – Searches for known virus patterns • Weakness of anti-virus – Vendor must continually search for new viruses, update and distribute signature files to users • Alternative approach: code emulation – Questionable code is executed in virtual environment to determine if it is a virus CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 30
© Cengage Learning 2015 Antispam • Spammers can distribute malware through email attachments • Spam can be used for social engineering attacks • Spam filtering methods – Bayesian filtering - divides email messages into two piles: spam and nonspam – Create a list of approved and nonapproved senders • Blacklist - nonapproved senders • Whitelist - approved senders – Blocking certain file attachment types CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 31
© Cengage Learning 2015 Pop-up Blockers and Antispyware • Pop-up - small window appearing over Web site – Usually created by advertisers • Pop-up blockers - a separate program as part of anti-spyware package – Incorporated within a browser – Allows user to limit or block most pop-ups – Alert can be displayed in the browser • Gives user option to display pop-up • Antispyware - helps prevent computers from becoming infected by different types of spyware CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 32
© Cengage Learning 2015 Host-Based Firewalls • Firewall - designed to prevent malicious packets from entering or leaving computers – Sometimes called a packet filter – May be hardware or software-based • Host-based software firewall - runs as a program on local system to protect it – Application-based CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 33
© Cengage Learning 2015 Securing Static Environments • Static environment - devices in which additional hardware cannot easily be added or attached • Common devices in this category: – Embedded system - a computer system with a dedicated function within a larger electrical system – Game consoles – Smartphones – Mainframes – In-vehicle computer systems – SCADA (supervisory control and data acquisition) CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 34
© Cengage Learning 2015 Securing Static Environments CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 35
© Cengage Learning 2015 Application Security • Besides protecting OS software on hosts, there is a need to protect applications that run on these devices • Aspects of application security: – Application development security – Application hardening and patch management CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 36
© Cengage Learning 2015 Application Development Security • Security for applications must be considered through all phases of development cycle • Application configuration baselines – Standard environment settings can establish a secure baseline – Includes each development system, build system, and test system – Must include system and network configurations CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 37
© Cengage Learning 2015 Application Development Security • Secure coding concepts – Coding standards increase applications’ consistency, reliability, and security – Coding standards allow developers to quickly understand and work with code that has been developed by different members of a team – Coding standards useful in code review process • Example of a coding standard: – To use a wrapper function (a substitute for a regular function used in testing) to write error- checking routines for preexisting system functions CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 38
© Cengage Learning 2015 Application Development Security • Errors and Exception Handling – Errors - faults that occur while application is running – Response to the user should be based on the error – The application should be coded so that each error is “caught” and effectively handled – Improper error handling in an application can lead to application failure CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 39
© Cengage Learning 2015 Application Development Security • The following may indicate potential error-handling issues: – Failure to check return codes or handle exceptions – Improper checking of exceptions or return codes – Handling all return codes or exceptions in the same manner – Error information that divulges potentially sensitive data • Fuzz testing (fuzzing) - a software testing technique that deliberately provides invalid, unexpected, or random data as inputs to a program CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 40
© Cengage Learning 2015 Application Development Security • Input Validation – A specific type of error handling is verifying responses that the user makes to the application – Improper verification is the cause for XSS, SQL, or XML injection attacks – Cross-site request forgery (XSRF) - an attack that uses the user’s web browser settings to impersonate the user • To prevent cross-site scripting, the program should trap for these user responses CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 41
© Cengage Learning 2015 Application Development Security • Input validation generally uses the server to perform the validation (server-side validation) – It is possible to have the client perform the validation (client-side validation) – In client-side validation all input validations and error recovery procedures are performed by the user’s web browser • An approach to preventing SQL injection attacks is avoid using SQL relational databases • NoSQL - a nonrelational database that is better tuned for accessing large data sets CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 42
© Cengage Learning 2015 Application Hardening and Patch Management • Application hardening – Intended to prevent attackers from exploiting vulnerabilities in software applications CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 43
© Cengage Learning 2015 Application Hardening and Patch Management • Patch management – Rare until recently – Users were unaware of the existence of patches or where to acquire them – More application patch management systems are being developed to patch vulnerabilities CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 44
© Cengage Learning 2015 Securing Data • Work today involves electronic collaboration – Data must flow freely – Data security is important • Big Data - refers to a collection of data sets so large and complex that it becomes difficult to process using traditional data processing apps • Data loss prevention (DLP) – System of security tools used to recognize and identify critical data and ensure it is protected – Goal: protect data from unauthorized users CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 45
© Cengage Learning 2015 Securing Data • DLP examines data as it resides in any of three states: – Data in use (example: creating a report from a computer) – Data in-transit (data being transmitted) – Data at rest (data that is stored on electronic media) CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 46
© Cengage Learning 2015 Securing Data • Most DLP systems use content inspection – A security analysis of the transaction within its approved context – Looks at security level of data, who is requesting it, where the data is stored, when it was requested, and where it is going • DLP systems can also use index matching – Documents that have been identified as needing protection are analyzed by DLP and complex computations are conducted based on the analysis CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 47
© Cengage Learning 2015 Securing Data • Three types of DLP sensors: – DLP network sensors - installed on the perimeter of the network to protect data in-transit by monitoring all network traffic – DLP storage sensors - designed to protect data at- rest – DLP agent sensors - installed on each host device and protect data in-use • When a policy violation is detected by the DLP agent, it is reported back to the DLP server – Different actions can then be taken CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 48
© Cengage Learning 2015 Securing Data CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 49
© Cengage Learning 2015 Securing Data CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 50
© Cengage Learning 2015 Summary • A security control is any device or process used to reduce risk • Hardware locks for doors are important to protect equipment • Hardware security is physical security that involves protecting the hardware of the host system • In addition to protecting hardware, the OS software that runs on the host also must be protected • Modern OSs have hundreds of different security settings that can be manipulated to conform to the baseline CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 51
© Cengage Learning 2015 Summary • OS and additional third-party antimalware software packages can provide added security • Protecting applications that run on hardware – Create configuration baselines – Secure coding concepts • Data loss prevention (DLP) can identify critical data, monitor and protect it – Works through content inspection CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 52

More Related Content

PPT
Chapter 12 Presentation
byAmy McMullin
 
PPT
Chapter 5 Presentation
byAmy McMullin
 
PPT
Chapter 7 Presentation
byAmy McMullin
 
PPT
Chapter 1 Presentation
byAmy McMullin
 
PPT
Chapter 3 Presentation
byAmy McMullin
 
PPT
Chapter 2 Presentation
byAmy McMullin
 
PPT
Information security Lecture slides .ppt
byMuhammadAbdullah311866
 
PDF
Network Security Fundamentals
byFat-Thing Gabriel-Culley
 
Chapter 12 Presentation
byAmy McMullin
 
Chapter 5 Presentation
byAmy McMullin
 
Chapter 7 Presentation
byAmy McMullin
 
Chapter 1 Presentation
byAmy McMullin
 
Chapter 3 Presentation
byAmy McMullin
 
Chapter 2 Presentation
byAmy McMullin
 
Information security Lecture slides .ppt
byMuhammadAbdullah311866
 
Network Security Fundamentals
byFat-Thing Gabriel-Culley
 

What's hot

PPTX
Security Policies and Standards
byprimeteacher32
 
PPTX
CompTIA Security+ Guide
bySmithjulia33
 
PPT
Chapter 9 PowerPoint
byAmy McMullin
 
PDF
Public key Infrastructure (PKI)
byVenkatesh Jambulingam
 
PPTX
Information security
byavinashbalakrishnan2
 
PPT
Network Security
byRaymond Jose
 
PPTX
Firewall in Network Security
bylalithambiga kamaraj
 
PPTX
Cryptography and Information Security
byDr Naim R Kidwai
 
PPTX
Network Security
byManoj Singh
 
PPT
Basics of Information System Security
bychauhankapil
 
PPTX
Information security
byLusungu Mkandawire CISA,CISM,CGEIT,CPF,PRINCE2
 
PPTX
System security
bysommerville-videos
 
PDF
Cisco Cyber Security Essentials Chapter-1
byMukesh Chinta
 
PDF
Cyber security and demonstration of security tools
byVicky Fernandes
 
PPTX
CISSP Chapter 1 Risk Management
byKarthikeyan Dhayalan
 
PPTX
SSL TLS Protocol
byDevang Badrakiya
 
PPTX
Vulnerability assessment and penetration testing
byAbu Sadat Mohammed Yasin
 
PDF
Authentication techniques
byIGZ Software house
 
PPTX
Cybersecurity Attack Vectors: How to Protect Your Organization
byTriCorps Technologies
 
PPTX
Threat Modeling In 2021
byAdam Shostack
 
Security Policies and Standards
byprimeteacher32
 
CompTIA Security+ Guide
bySmithjulia33
 
Chapter 9 PowerPoint
byAmy McMullin
 
Public key Infrastructure (PKI)
byVenkatesh Jambulingam
 
Information security
byavinashbalakrishnan2
 
Network Security
byRaymond Jose
 
Firewall in Network Security
bylalithambiga kamaraj
 
Cryptography and Information Security
byDr Naim R Kidwai
 
Network Security
byManoj Singh
 
Basics of Information System Security
bychauhankapil
 
Information security
byLusungu Mkandawire CISA,CISM,CGEIT,CPF,PRINCE2
 
System security
bysommerville-videos
 
Cisco Cyber Security Essentials Chapter-1
byMukesh Chinta
 
Cyber security and demonstration of security tools
byVicky Fernandes
 
CISSP Chapter 1 Risk Management
byKarthikeyan Dhayalan
 
SSL TLS Protocol
byDevang Badrakiya
 
Vulnerability assessment and penetration testing
byAbu Sadat Mohammed Yasin
 
Authentication techniques
byIGZ Software house
 
Cybersecurity Attack Vectors: How to Protect Your Organization
byTriCorps Technologies
 
Threat Modeling In 2021
byAdam Shostack
 

Viewers also liked

PPTX
A+ Chapter 3 Review
byAmy McMullin
 
PPT
Chapter 11 Presentation
byAmy McMullin
 
PPT
Chapter 6 Presentation
byAmy McMullin
 
PPTX
A+ Chapter 5 Review
byAmy McMullin
 
PPTX
A+ Chapter 4 Review
byAmy McMullin
 
PPT
Chapter 8 Presentaion
byAmy McMullin
 
PPT
Chapter 13
byAmy McMullin
 
PPT
Chapter 15 Presentation
byAmy McMullin
 
PPT
9781305094352 ppt ch08
byAmy McMullin
 
PPT
Intro to Security
byprimeteacher32
 
PPTX
What's New In CompTIA Security+ - Course Technology Computing Conference
byCengage Learning
 
PPT
Ch06 Wireless Network Security
byInformation Technology
 
PPT
hacker culture
byAmy McMullin
 
PPT
Ch01
byAlitta Aisyawati
 
PPTX
How to hack the web
byAmy McMullin
 
PDF
CompTIA Security+ ce certificate
byLuigi Cristiani
 
PPT
Ch01 Introduction to Security
byInformation Technology
 
A+ Chapter 3 Review
byAmy McMullin
 
Chapter 11 Presentation
byAmy McMullin
 
Chapter 6 Presentation
byAmy McMullin
 
A+ Chapter 5 Review
byAmy McMullin
 
A+ Chapter 4 Review
byAmy McMullin
 
Chapter 8 Presentaion
byAmy McMullin
 
Chapter 13
byAmy McMullin
 
Chapter 15 Presentation
byAmy McMullin
 
9781305094352 ppt ch08
byAmy McMullin
 
Intro to Security
byprimeteacher32
 
What's New In CompTIA Security+ - Course Technology Computing Conference
byCengage Learning
 
Ch06 Wireless Network Security
byInformation Technology
 
hacker culture
byAmy McMullin
 
Ch01
byAlitta Aisyawati
 
How to hack the web
byAmy McMullin
 
CompTIA Security+ ce certificate
byLuigi Cristiani
 
Ch01 Introduction to Security
byInformation Technology
 

Similar to Chapter 4

PPT
Chapter 5 cyber security in computer.ppt
byubaidullah75790
 
PPTX
Network Security of Data Protection
byUthsoNandy
 
PPT
Securitych1
byBhawani Rathore
 
PDF
CompTIA Security+ All in One Exam Guide, Fifth Edition (Exam SY0 501) 5th Edi...
byhadorngamid60
 
PDF
(eBook PDF) Corporate Computer Security 4th Edition by Randall J. Boyle
byoscgbksaxg403
 
PDF
004_Cybersecurity Fundamentals Network Security.pdf
byDaraputriOktiara
 
PDF
Security in computer systems fundamentals
byManesh T
 
PPT
Cyber security Chapter 05 Network Defenses
byAzarHamid
 
PPTX
Chapter 12 - Securing a Network CompTIA Network+
bydaddodon18
 
PPTX
Security in Computer System
byManesh T
 
DOCX
SECIAMPA, CompTIA Security+ Guide to Network Security Fundam.docx
bygertrudebellgrove
 
PDF
The top 5 basics fundamentals of network security cyberhunter solutions
byCyberhunter Cyber Security
 
PPTX
Securing Networks and Operating Systems.pptx
bylionbitme
 
DOCX
SECIAMPA, CompTIA Security+ Guide to Network Security Fundam
byMikeEly930
 
PDF
Network Security Fundamentals presentation
byRosy G
 
PDF
PLNOG 8: Merike Kaeo - Guide to Building Secure Infrastructures
byPROIDEA
 
PDF
Toward Continuous Cybersecurity with Network Automation
byE.S.G. JR. Consulting, Inc.
 
PDF
Toward Continuous Cybersecurity With Network Automation
byKen Flott
 
PPT
Dos and Dont to be followed to protect information and technology
byssuser3baba2
 
DOCX
Security and Ethical Challenges Contributors Kim Wanders.docx
byedgar6wallace88877
 
Chapter 5 cyber security in computer.ppt
byubaidullah75790
 
Network Security of Data Protection
byUthsoNandy
 
Securitych1
byBhawani Rathore
 
CompTIA Security+ All in One Exam Guide, Fifth Edition (Exam SY0 501) 5th Edi...
byhadorngamid60
 
(eBook PDF) Corporate Computer Security 4th Edition by Randall J. Boyle
byoscgbksaxg403
 
004_Cybersecurity Fundamentals Network Security.pdf
byDaraputriOktiara
 
Security in computer systems fundamentals
byManesh T
 
Cyber security Chapter 05 Network Defenses
byAzarHamid
 
Chapter 12 - Securing a Network CompTIA Network+
bydaddodon18
 
Security in Computer System
byManesh T
 
SECIAMPA, CompTIA Security+ Guide to Network Security Fundam.docx
bygertrudebellgrove
 
The top 5 basics fundamentals of network security cyberhunter solutions
byCyberhunter Cyber Security
 
Securing Networks and Operating Systems.pptx
bylionbitme
 
SECIAMPA, CompTIA Security+ Guide to Network Security Fundam
byMikeEly930
 
Network Security Fundamentals presentation
byRosy G
 
PLNOG 8: Merike Kaeo - Guide to Building Secure Infrastructures
byPROIDEA
 
Toward Continuous Cybersecurity with Network Automation
byE.S.G. JR. Consulting, Inc.
 
Toward Continuous Cybersecurity With Network Automation
byKen Flott
 
Dos and Dont to be followed to protect information and technology
byssuser3baba2
 
Security and Ethical Challenges Contributors Kim Wanders.docx
byedgar6wallace88877
 

Recently uploaded

PPTX
Math 8 Quarter 4 Week 3 PRIMARY DATA.pptx
byshahanieabbat3
 
PDF
BP502T Industrial Pharmacy I (Theory) UNIT– I (Part 1)
byRushi Mandali
 
PDF
Workshop 29 Crystal Review All Students by YogiGoddess
by©LDMMIA, ©Reiki Yoga
 
PPTX
Greengnorance Toolkit Module 3 Shopping and Food
byKarl Donert
 
PDF
Family and Marriage __ Sociology __ Jhasketan Kuanar __ NURSING VIBE ONLY .pdf
byJK NURSING VIBES ONLY JHASKETAN KUANAR
 
PPTX
How to Add an Icon in Systray in Odoo 18
byCeline George
 
PPTX
Plato's Insight model teaching and learning.pptx
byNikhitaDS
 
PPTX
Greengnorance Toolkit Module1 Climate Change
byKarl Donert
 
PPTX
Renal Physiology- Functional anatomy of Kidney.pptx
byDisha Soriya
 
PDF
PHARMACOLOGY 1 ( BP 404 T) Unit 1 (Cology 1)
byChetan Mali
 
PPTX
How to Create_Generate Engineering Change Orders ECOs in Odoo 18
byCeline George
 
PDF
Chapter 05 Drugs Acting on the Central Nervous System: Anti-Depressant Drugs
bySandeshSul
 
PDF
Chapter 05 Drugs Acting on the Central Nervous System: Anticonvulsant (Antiep...
bySandeshSul
 
PDF
The Sheep and the Goat: Beckett’s Subversion of Divine Justice in Waiting for...
bysejadchokiya
 
PPTX
PRE TERM LABOR ( PREMATURE LABOUR IN PREGNANCY)
byMuthu Kumar
 
PDF
Judgement Regarding Land Acquisition Act not Applicable to Encroachers.pdf
byssuser9d8e4e
 
PPTX
Overview of How to set priority in Odoo 19 Todo
byCeline George
 
PDF
java full stack programming and interview questions
byrajuashokit
 
PPTX
Greengnorance Toolkit Module 2 Energy saving
byKarl Donert
 
PPTX
Problem and Solution (PowerPoint Game Template)
byacpaulite
 
Math 8 Quarter 4 Week 3 PRIMARY DATA.pptx
byshahanieabbat3
 
BP502T Industrial Pharmacy I (Theory) UNIT– I (Part 1)
byRushi Mandali
 
Workshop 29 Crystal Review All Students by YogiGoddess
by©LDMMIA, ©Reiki Yoga
 
Greengnorance Toolkit Module 3 Shopping and Food
byKarl Donert
 
Family and Marriage __ Sociology __ Jhasketan Kuanar __ NURSING VIBE ONLY .pdf
byJK NURSING VIBES ONLY JHASKETAN KUANAR
 
How to Add an Icon in Systray in Odoo 18
byCeline George
 
Plato's Insight model teaching and learning.pptx
byNikhitaDS
 
Greengnorance Toolkit Module1 Climate Change
byKarl Donert
 
Renal Physiology- Functional anatomy of Kidney.pptx
byDisha Soriya
 
PHARMACOLOGY 1 ( BP 404 T) Unit 1 (Cology 1)
byChetan Mali
 
How to Create_Generate Engineering Change Orders ECOs in Odoo 18
byCeline George
 
Chapter 05 Drugs Acting on the Central Nervous System: Anti-Depressant Drugs
bySandeshSul
 
Chapter 05 Drugs Acting on the Central Nervous System: Anticonvulsant (Antiep...
bySandeshSul
 
The Sheep and the Goat: Beckett’s Subversion of Divine Justice in Waiting for...
bysejadchokiya
 
PRE TERM LABOR ( PREMATURE LABOUR IN PREGNANCY)
byMuthu Kumar
 
Judgement Regarding Land Acquisition Act not Applicable to Encroachers.pdf
byssuser9d8e4e
 
Overview of How to set priority in Odoo 19 Todo
byCeline George
 
java full stack programming and interview questions
byrajuashokit
 
Greengnorance Toolkit Module 2 Energy saving
byKarl Donert
 
Problem and Solution (PowerPoint Game Template)
byacpaulite
 

Chapter 4

  • 1.
    CompTIA Security+ Guideto Network Security Fundamentals, Fifth Edition Chapter 4 Host, Application, and Data Security
  • 2.
    © Cengage Learning2015CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition Objectives • List the steps for securing a host computer • Define application security • Explain how to secure data 2
  • 3.
    © Cengage Learning2015 Securing the Host • Securing the host involves: – Protecting the physical device – Securing the operating system (OS) software – Using antimalware software CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 3
  • 4.
    © Cengage Learning2015 Securing Devices • Security control - any device or process that is used to reduce risk • Two levels of security controls: – Administrative controls - processes for developing and ensuring that policies and procedures are carried out – Technical controls - controls that are carried out or managed by devices • There are five subtypes of controls (sometimes called activity phase controls) described on the following slide CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 4
  • 5.
    © Cengage Learning2015 Securing Devices CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 5
  • 6.
    © Cengage Learning2015 External Perimeter Defenses • External perimeter defenses are designed to restrict access to equipment areas • This type of defense includes: – Barriers – guards – Motion detection devices CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 6
  • 7.
    © Cengage Learning2015 External Perimeter Defenses • Barriers – Fencing - usually a tall, permanent structure • Modern perimeter fences are equipped with other deterrents such as proper lighting and signage – Barricade - large concrete ones should be used • Guards – Human guards are considered active security elements – Video surveillance uses cameras to transmit a signal to a specific and limited set of receivers called closed circuit television (CCTV) CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 7
  • 8.
    © Cengage Learning2015 External Perimeter Defenses CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 8
  • 9.
    © Cengage Learning2015 External Perimeter Defenses • Motion Detection – Determining an object’s change in position in relation to its surroundings – This movement usually generates an audible alarm CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 9
  • 10.
    © Cengage Learning2015 Internal Physical Access Security • These protections include: – Hardware locks – Proximity readers – Access lists – Mantraps – Protected distribution systems for cabling CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 10
  • 11.
    © Cengage Learning2015 Internal Physical Access Security • Hardware locks – Standard keyed entry lock provides minimal security – Deadbolt locks provide additional security and require that a key be used to both open and lock the door – Cipher locks are combination locks that use buttons that must be pushed in the proper sequence • Can be programmed to allow a certain individual’s code to be valid on specific dates and times CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 11
  • 12.
    © Cengage Learning2015 Internal Physical Access Security • Recommended key management procedures – Inspect locks regularly – Issue keys only to authorized users – Keep track of issued keys – Master keys should not have identifying marks – Secure unused keys in a safe place – Establish a procedure to monitor use of locks and keys – Mark master keys with “Do Not Duplicate” – Change locks after key loss or theft CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 12
  • 13.
    © Cengage Learning2015 Internal Physical Access Security • Proximity Readers – Uses an object (physical token) to identify persons with authorization to access an area • ID badge emits a signal identifying the owner • Proximity reader receives signal – ID badges that can be detected by a proximity reader are often fitted with RFID tags • Badge can remain in bearer’s pocket CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 13
  • 14.
    © Cengage Learning2015 Internal Physical Access Security CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 14
  • 15.
    © Cengage Learning2015 Internal Physical Access Security • Access list – Record of individuals who have permission to enter secure area – Records time they entered and left • Mantrap – Separates a secured from a nonsecured area – Device monitors and controls two interlocking doors • Only one door may open at any time CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 15
  • 16.
    © Cengage Learning2015 Internal Physical Access Security CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 16
  • 17.
    © Cengage Learning2015 Internal Physical Access Security • Protected Distribution Systems (PDS) – A system of cable conduits used to protect classified information that is being transmitted between two secure areas • Created by the U.S. Department of Defense (DOD) – Two types of PDS: • Hardened carrier PDS - conduit constructed of special electrical metallic tubing • Alarm carrier PDS - specialized optical fibers in the conduit that sense acoustic vibrations that occur when an intruder attempts to gain access CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 17
  • 18.
    © Cengage Learning2015 Hardware Security • Hardware security - the physical security protecting the hardware of the host system – Most portable devices have a steel bracket security slot • A cable lock can be inserted into slot and secured to device and a cable connected to the lock can be secured to a desk or chair • Locking cabinets – Can be prewired for power and network connections – Allow devices to charge while stored CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 18
  • 19.
    © Cengage Learning2015 Hardware Security CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 19
  • 20.
    © Cengage Learning2015 Securing the Operating System Software • Five-step process for protecting operating system – 1. Develop the security policy – 2. Perform host software baselining – 3. Configure operating system security settings – 4. Deploy and manage security settings – 5. Implement patch management CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 20
  • 21.
    © Cengage Learning2015 Securing the Operating System Software • Develop the security policy – Security policy - a document(s) that clearly define organization’s defense mechanisms • Perform host software baselining – Baseline - the standard or checklist against which systems can be evaluated – Configuration settings that are used for each computer in the organization CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 21
  • 22.
    © Cengage Learning2015 Securing the Operating System Software • Configure operating system security and settings – Modern OSs have hundreds of different security settings that can be manipulated to conform to the baseline – Typical configuration baseline would include: • Changing insecure default settings • Eliminating unnecessary software, services, protocols • Enabling security features such as a firewall CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 22
  • 23.
    © Cengage Learning2015 Securing the Operating System Software • Deploy and Manage Security Settings – Tools to automate the process • Security template - collections of security configuration settings • Group policy - Windows feature providing centralized computer management; a single configuration may be deployed to many users CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 23
  • 24.
    © Cengage Learning2015 Securing the Operating System Software • Implement Patch Management – Operating systems have increased in size and complexity – New attack tools have made secure functions vulnerable – Security patch - software security update to repair discovered vulnerabilities – Hotfix - addresses specific customer situation – Service pack - accumulates security updates and additional features CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 24
  • 25.
    © Cengage Learning2015 Securing the Operating System Software • Patches can sometimes create new problems – Vendor should thoroughly test before deploying • Automated patch update service – Manage patches locally rather than rely on vendor’s online update service • Advantages of automated patch update service – Administrators can force updates to install by specific date – Administrators can approve updates for “detection” only; allows them to see which computers will require the update without actually installing it CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 25
  • 26.
    © Cengage Learning2015 Securing the Operating System Software • Advantages of automated patch update service (cont’d) – Downloading patches from a local server instead of using the vendor’s online update service can save bandwidth and time – Specific types of updates that the organization does not test can be automatically installed – Users cannot disable or circumvent updates CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 26
  • 27.
    © Cengage Learning2015 Securing the Operating System Software CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 27
  • 28.
    © Cengage Learning2015 Securing the Operating System Software • Security Through Design – OS hardening - tightening security during the design and coding of the OS – Trusted OS - an OS that has been designed through OS hardening CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 28
  • 29.
    © Cengage Learning2015 Securing with Antimalware • Third-party antimalware software packages can provide added security • Antimalware software includes: – Antivirus – Antispam – Popup blockers – Antispyware – Host-based firewalls CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 29
  • 30.
    © Cengage Learning2015 Antivirus • Antivirus (AV) - Software that examines a computer for infections – Scans new documents that might contain viruses – Searches for known virus patterns • Weakness of anti-virus – Vendor must continually search for new viruses, update and distribute signature files to users • Alternative approach: code emulation – Questionable code is executed in virtual environment to determine if it is a virus CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 30
  • 31.
    © Cengage Learning2015 Antispam • Spammers can distribute malware through email attachments • Spam can be used for social engineering attacks • Spam filtering methods – Bayesian filtering - divides email messages into two piles: spam and nonspam – Create a list of approved and nonapproved senders • Blacklist - nonapproved senders • Whitelist - approved senders – Blocking certain file attachment types CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 31
  • 32.
    © Cengage Learning2015 Pop-up Blockers and Antispyware • Pop-up - small window appearing over Web site – Usually created by advertisers • Pop-up blockers - a separate program as part of anti-spyware package – Incorporated within a browser – Allows user to limit or block most pop-ups – Alert can be displayed in the browser • Gives user option to display pop-up • Antispyware - helps prevent computers from becoming infected by different types of spyware CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 32
  • 33.
    © Cengage Learning2015 Host-Based Firewalls • Firewall - designed to prevent malicious packets from entering or leaving computers – Sometimes called a packet filter – May be hardware or software-based • Host-based software firewall - runs as a program on local system to protect it – Application-based CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 33
  • 34.
    © Cengage Learning2015 Securing Static Environments • Static environment - devices in which additional hardware cannot easily be added or attached • Common devices in this category: – Embedded system - a computer system with a dedicated function within a larger electrical system – Game consoles – Smartphones – Mainframes – In-vehicle computer systems – SCADA (supervisory control and data acquisition) CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 34
  • 35.
    © Cengage Learning2015 Securing Static Environments CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 35
  • 36.
    © Cengage Learning2015 Application Security • Besides protecting OS software on hosts, there is a need to protect applications that run on these devices • Aspects of application security: – Application development security – Application hardening and patch management CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 36
  • 37.
    © Cengage Learning2015 Application Development Security • Security for applications must be considered through all phases of development cycle • Application configuration baselines – Standard environment settings can establish a secure baseline – Includes each development system, build system, and test system – Must include system and network configurations CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 37
  • 38.
    © Cengage Learning2015 Application Development Security • Secure coding concepts – Coding standards increase applications’ consistency, reliability, and security – Coding standards allow developers to quickly understand and work with code that has been developed by different members of a team – Coding standards useful in code review process • Example of a coding standard: – To use a wrapper function (a substitute for a regular function used in testing) to write error- checking routines for preexisting system functions CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 38
  • 39.
    © Cengage Learning2015 Application Development Security • Errors and Exception Handling – Errors - faults that occur while application is running – Response to the user should be based on the error – The application should be coded so that each error is “caught” and effectively handled – Improper error handling in an application can lead to application failure CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 39
  • 40.
    © Cengage Learning2015 Application Development Security • The following may indicate potential error-handling issues: – Failure to check return codes or handle exceptions – Improper checking of exceptions or return codes – Handling all return codes or exceptions in the same manner – Error information that divulges potentially sensitive data • Fuzz testing (fuzzing) - a software testing technique that deliberately provides invalid, unexpected, or random data as inputs to a program CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 40
  • 41.
    © Cengage Learning2015 Application Development Security • Input Validation – A specific type of error handling is verifying responses that the user makes to the application – Improper verification is the cause for XSS, SQL, or XML injection attacks – Cross-site request forgery (XSRF) - an attack that uses the user’s web browser settings to impersonate the user • To prevent cross-site scripting, the program should trap for these user responses CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 41
  • 42.
    © Cengage Learning2015 Application Development Security • Input validation generally uses the server to perform the validation (server-side validation) – It is possible to have the client perform the validation (client-side validation) – In client-side validation all input validations and error recovery procedures are performed by the user’s web browser • An approach to preventing SQL injection attacks is avoid using SQL relational databases • NoSQL - a nonrelational database that is better tuned for accessing large data sets CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 42
  • 43.
    © Cengage Learning2015 Application Hardening and Patch Management • Application hardening – Intended to prevent attackers from exploiting vulnerabilities in software applications CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 43
  • 44.
    © Cengage Learning2015 Application Hardening and Patch Management • Patch management – Rare until recently – Users were unaware of the existence of patches or where to acquire them – More application patch management systems are being developed to patch vulnerabilities CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 44
  • 45.
    © Cengage Learning2015 Securing Data • Work today involves electronic collaboration – Data must flow freely – Data security is important • Big Data - refers to a collection of data sets so large and complex that it becomes difficult to process using traditional data processing apps • Data loss prevention (DLP) – System of security tools used to recognize and identify critical data and ensure it is protected – Goal: protect data from unauthorized users CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 45
  • 46.
    © Cengage Learning2015 Securing Data • DLP examines data as it resides in any of three states: – Data in use (example: creating a report from a computer) – Data in-transit (data being transmitted) – Data at rest (data that is stored on electronic media) CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 46
  • 47.
    © Cengage Learning2015 Securing Data • Most DLP systems use content inspection – A security analysis of the transaction within its approved context – Looks at security level of data, who is requesting it, where the data is stored, when it was requested, and where it is going • DLP systems can also use index matching – Documents that have been identified as needing protection are analyzed by DLP and complex computations are conducted based on the analysis CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 47
  • 48.
    © Cengage Learning2015 Securing Data • Three types of DLP sensors: – DLP network sensors - installed on the perimeter of the network to protect data in-transit by monitoring all network traffic – DLP storage sensors - designed to protect data at- rest – DLP agent sensors - installed on each host device and protect data in-use • When a policy violation is detected by the DLP agent, it is reported back to the DLP server – Different actions can then be taken CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 48
  • 49.
    © Cengage Learning2015 Securing Data CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 49
  • 50.
    © Cengage Learning2015 Securing Data CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 50
  • 51.
    © Cengage Learning2015 Summary • A security control is any device or process used to reduce risk • Hardware locks for doors are important to protect equipment • Hardware security is physical security that involves protecting the hardware of the host system • In addition to protecting hardware, the OS software that runs on the host also must be protected • Modern OSs have hundreds of different security settings that can be manipulated to conform to the baseline CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 51
  • 52.
    © Cengage Learning2015 Summary • OS and additional third-party antimalware software packages can provide added security • Protecting applications that run on hardware – Create configuration baselines – Secure coding concepts • Data loss prevention (DLP) can identify critical data, monitor and protect it – Works through content inspection CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition 52

Editor's Notes

  • #2 CompTIA Security+ Guide to Network Security Fundamentals, Fifth Edition Chapter 4 Host, Application, and Data Security
  • #3 Objectives List the steps for securing a host computer Define application security Explain how to secure data
  • #4 Securing the Host Securing the host involves: Protecting the physical device Securing the operating system (OS) software Using antimalware software
  • #5 Securing Devices Security control - any device or process that is used to reduce risk Two levels of security controls: Administrative controls - processes for developing and ensuring that policies and procedures are carried out Technical controls - controls that are carried out or managed by devices There are five subtypes of controls (sometimes called activity phase controls) described on the following slide
  • #6 Securing Devices Table 4-1 Activity phase controls
  • #7 External Perimeter Defenses External perimeter defenses are designed to restrict access to equipment areas This type of defense includes: Barriers guards Motion detection devices
  • #8 External Perimeter Defenses Barriers Fencing - usually a tall, permanent structure Modern perimeter fences are equipped with other deterrents such as proper lighting and signage Barricade - large concrete ones should be used Guards Human guards are considered active security elements Video surveillance uses cameras to transmit a signal to a specific and limited set of receivers called closed circuit television (CCTV)
  • #9 External Perimeter Defenses Table 4-2 Fencing detergents
  • #10 External Perimeter Defenses Motion Detection Determining an object’s change in position in relation to its surroundings This movement usually generates an audible alarm Table 4-3 Motion detection methods
  • #11 Internal Physical Access Security These protections include: Hardware locks Proximity readers Access lists Mantraps Protected distribution systems for cabling
  • #12 Internal Physical Access Security Hardware locks Standard keyed entry lock provides minimal security Deadbolt locks provide additional security and require that a key be used to both open and lock the door Cipher locks are combination locks that use buttons that must be pushed in the proper sequence Can be programmed to allow a certain individual’s code to be valid on specific dates and times
  • #13 Internal Physical Access Security Recommended key management procedures Inspect locks regularly Issue keys only to authorized users Keep track of issued keys Master keys should not have identifying marks Secure unused keys in a safe place Establish a procedure to monitor use of locks and keys Mark master keys with “Do Not Duplicate” Change locks after key loss or theft
  • #14 Internal Physical Access Security Proximity Readers Uses an object (physical token) to identify persons with authorization to access an area ID badge emits a signal identifying the owner Proximity reader receives signal ID badges that can be detected by a proximity reader are often fitted with RFID tags Badge can remain in bearer’s pocket
  • #15 Internal Physical Access Security Figure 4-4 RFID tag
  • #16 Internal Physical Access Security Access list Record of individuals who have permission to enter secure area Records time they entered and left Mantrap Separates a secured from a nonsecured area Device monitors and controls two interlocking doors Only one door may open at any time
  • #17 Internal Physical Access Security Figure 4-5 Mantrap
  • #18 Internal Physical Access Security Protected Distribution Systems (PDS) A system of cable conduits used to protect classified information that is being transmitted between two secure areas Created by the U.S. Department of Defense (DOD) Two types of PDS: Hardened carrier PDS - conduit constructed of special electrical metallic tubing Alarm carrier PDS - specialized optical fibers in the conduit that sense acoustic vibrations that occur when an intruder attempts to gain access
  • #19 Hardware Security Hardware security - the physical security protecting the hardware of the host system Most portable devices have a steel bracket security slot A cable lock can be inserted into slot and secured to device and a cable connected to the lock can be secured to a desk or chair Locking cabinets Can be prewired for power and network connections Allow devices to charge while stored
  • #20 Hardware Security Figure 4-7 Cable lock
  • #21 Securing the Operating System Software Five-step process for protecting operating system 1. Develop the security policy 2. Perform host software baselining 3. Configure operating system security settings 4. Deploy and manage security settings 5. Implement patch management
  • #22 Securing the Operating System Software Develop the security policy Security policy - a document(s) that clearly define organization’s defense mechanisms Perform host software baselining Baseline - the standard or checklist against which systems can be evaluated Configuration settings that are used for each computer in the organization
  • #23 Securing the Operating System Software Configure operating system security and settings Modern OSs have hundreds of different security settings that can be manipulated to conform to the baseline Typical configuration baseline would include: Changing insecure default settings Eliminating unnecessary software, services, protocols Enabling security features such as a firewall
  • #24 Securing the Operating System Software Deploy and Manage Security Settings Tools to automate the process Security template - collections of security configuration settings Group policy - Windows feature providing centralized computer management; a single configuration may be deployed to many users
  • #25 Securing the Operating System Software Implement Patch Management Operating systems have increased in size and complexity New attack tools have made secure functions vulnerable Security patch - software security update to repair discovered vulnerabilities Hotfix - addresses specific customer situation Service pack - accumulates security updates and additional features
  • #26 Securing the Operating System Software Patches can sometimes create new problems Vendor should thoroughly test before deploying Automated patch update service Manage patches locally rather than rely on vendor’s online update service Advantages of automated patch update service Administrators can force updates to install by specific date Administrators can approve updates for “detection” only; allows them to see which computers will require the update without actually installing it
  • #27 Securing the Operating System Software Advantages of automated patch update service (cont’d) Downloading patches from a local server instead of using the vendor’s online update service can save bandwidth and time Specific types of updates that the organization does not test can be automatically installed Users cannot disable or circumvent updates
  • #28 Securing the Operating System Software Figure 4-8 Automatic patch update service
  • #29 Securing the Operating System Software Security Through Design OS hardening - tightening security during the design and coding of the OS Trusted OS - an OS that has been designed through OS hardening Table 4-4 OS hardening techniques
  • #30 Securing with Antimalware Third-party antimalware software packages can provide added security Antimalware software includes: Antivirus Antispam Popup blockers Antispyware Host-based firewalls
  • #31 Antivirus Antivirus (AV) - Software that examines a computer for infections Scans new documents that might contain viruses Searches for known virus patterns Weakness of anti-virus Vendor must continually search for new viruses, update and distribute signature files to users Alternative approach: code emulation Questionable code is executed in virtual environment to determine if it is a virus
  • #32 Antispam Spammers can distribute malware through email attachments Spam can be used for social engineering attacks Spam filtering methods Bayesian filtering - divides email messages into two piles: spam and nonspam Create a list of approved and nonapproved senders Blacklist - nonapproved senders Whitelist - approved senders Blocking certain file attachment types
  • #33 Pop-up Blockers and Antispyware Pop-up - small window appearing over Web site Usually created by advertisers Pop-up blockers - a separate program as part of anti-spyware package Incorporated within a browser Allows user to limit or block most pop-ups Alert can be displayed in the browser Gives user option to display pop-up Antispyware - helps prevent computers from becoming infected by different types of spyware
  • #34 Host-Based Firewalls Firewall - designed to prevent malicious packets from entering or leaving computers Sometimes called a packet filter May be hardware or software-based Host-based software firewall - runs as a program on local system to protect it Application-based
  • #35 Securing Static Environments Static environment - devices in which additional hardware cannot easily be added or attached Common devices in this category: Embedded system - a computer system with a dedicated function within a larger electrical system Game consoles Smartphones Mainframes In-vehicle computer systems SCADA (supervisory control and data acquisition)
  • #36 Securing Static Environments Table 4-5 Static environment defense methods
  • #37 Application Security Besides protecting OS software on hosts, there is a need to protect applications that run on these devices Aspects of application security: Application development security Application hardening and patch management
  • #38 Application Development Security Security for applications must be considered through all phases of development cycle Application configuration baselines Standard environment settings can establish a secure baseline Includes each development system, build system, and test system Must include system and network configurations
  • #39 Application Development Security Secure coding concepts Coding standards increase applications’ consistency, reliability, and security Coding standards allow developers to quickly understand and work with code that has been developed by different members of a team Coding standards useful in code review process Example of a coding standard: To use a wrapper function (a substitute for a regular function used in testing) to write error-checking routines for preexisting system functions
  • #40 Application Development Security Errors and Exception Handling Errors - faults that occur while application is running Response to the user should be based on the error The application should be coded so that each error is “caught” and effectively handled Improper error handling in an application can lead to application failure
  • #41 Application Development Security The following may indicate potential error-handling issues: Failure to check return codes or handle exceptions Improper checking of exceptions or return codes Handling all return codes or exceptions in the same manner Error information that divulges potentially sensitive data Fuzz testing (fuzzing) - a software testing technique that deliberately provides invalid, unexpected, or random data as inputs to a program
  • #42 Application Development Security Input Validation A specific type of error handling is verifying responses that the user makes to the application Improper verification is the cause for XSS, SQL, or XML injection attacks Cross-site request forgery (XSRF) - an attack that uses the user’s web browser settings to impersonate the user To prevent cross-site scripting, the program should trap for these user responses
  • #43 Application Development Security Input validation generally uses the server to perform the validation (server-side validation) It is possible to have the client perform the validation (client-side validation) In client-side validation all input validations and error recovery procedures are performed by the user’s web browser An approach to preventing SQL injection attacks is avoid using SQL relational databases NoSQL - a nonrelational database that is better tuned for accessing large data sets
  • #44 Application Hardening and Patch Management Application hardening Intended to prevent attackers from exploiting vulnerabilities in software applications Table 4-6 Attacks based on application vulnerabilities
  • #45 Application Hardening and Patch Management Patch management Rare until recently Users were unaware of the existence of patches or where to acquire them More application patch management systems are being developed to patch vulnerabilities
  • #46 Securing Data Work today involves electronic collaboration Data must flow freely Data security is important Big Data - refers to a collection of data sets so large and complex that it becomes difficult to process using traditional data processing apps Data loss prevention (DLP) System of security tools used to recognize and identify critical data and ensure it is protected Goal: protect data from unauthorized users
  • #47 Securing Data DLP examines data as it resides in any of three states: Data in use (example: creating a report from a computer) Data in-transit (data being transmitted) Data at rest (data that is stored on electronic media)
  • #48 Securing Data Most DLP systems use content inspection A security analysis of the transaction within its approved context Looks at security level of data, who is requesting it, where the data is stored, when it was requested, and where it is going DLP systems can also use index matching Documents that have been identified as needing protection are analyzed by DLP and complex computations are conducted based on the analysis
  • #49 Securing Data Three types of DLP sensors: DLP network sensors - installed on the perimeter of the network to protect data in-transit by monitoring all network traffic DLP storage sensors - designed to protect data at-rest DLP agent sensors - installed on each host device and protect data in-use When a policy violation is detected by the DLP agent, it is reported back to the DLP server Different actions can then be taken
  • #50 Securing Data Figure 4-9 DLP architecture
  • #51 Securing Data Figure 4-10 DLP report
  • #52 Summary A security control is any device or process used to reduce risk Hardware locks for doors are important to protect equipment Hardware security is physical security that involves protecting the hardware of the host system In addition to protecting hardware, the OS software that runs on the host also must be protected Modern OSs have hundreds of different security settings that can be manipulated to conform to the baseline
  • #53 Summary OS and additional third-party antimalware software packages can provide added security Protecting applications that run on hardware Create configuration baselines Secure coding concepts Data loss prevention (DLP) can identify critical data, monitor and protect it Works through content inspection