IAS 401 — Lecture Notes

Introduction to Information Assurance and Security

Information Assurance Concepts

• What you should know (a shared secret, such as a password, which both the user and the authenticator know)
• What you should have (a physical identification, such as a smartcard, hardware token, or identification card)
• What you are (a measurable attribute, such as biometrics, a thumbprint, or facial recognition) In addition, organizations may consider having
  an implicit factor such as a “where you are” factor.
• Physical location, such as within an organization’s office.
• Logical location, such as on an internal network or private network.
• A combination of those factors can be considered to provide different
  strength levels of authentication. This improves authentication and
  increases security.

• Public Key Infrastructure (PKI) is a system that provides authentication with certificates based on a public key cryptography method. Public key cryptography provides two independent keys generated together; one key is made public, and another is kept private. Any information protected by one key (public) can be opened only with another key (private). If one key is compromised, a new key pair must be generated.
• Smartcards can store personal information accessible by a personal identification number (PIN). An organization may consider smartcard implementation to provide another identification method via physical identification (physical security) and electronic identification (electronic access).

MSR Model of Information Assurance

• Transmission
• Storage
• Processing

Examples of Security Controls

• Conducting annual security awareness training for This helps remind staff about proper handling of private data. It also drives awareness of the organization’s framework of security policies, standards, procedures, and guidelines.
• Putting an IT security policy framework in A policy framework is like an outline that identifies where security controls should be used.
• Designing a layered security solution for an IT infrastructure. The more layers or compartments that block or protect private data and intellectual property, the more difficult the data and property are to find and
• Performing periodic security risk assessments, audits, and penetration tests on websites and IT infrastructure. This is how security professionals verify that they have properly installed the
• Enabling security incident and event monitoring at your Internet entry and exit This is like using a microscope to see what is coming in and going out.
• Using automated workstation and server antivirus and malicious software This is the way to keep viruses and malicious software out of your computer.
• Using more stringent access controls beyond a logon ID and password for sensitive systems, applications, and Logon IDs with passwords are only one check of the user. Access to more sensitive systems should have a second test to confirm the user’s identity.
• Minimizing software weaknesses in your computers and servers by updating them with patches and security This is the way to keep your operating system and application software up to date.
• Protecting private data is the process of ensuring data confidentiality. Organizations must use proper security controls specific to this concern. Some examples include the following:
• Defining organization-wide policies, standards, procedures, and guidelines to protect confidential These are instructions for how to handle private data.
• Adopting a data classification standard that defines how to treat data throughout your IT infra- This is the road map for identifying what controls are needed to keep data safe.
• Limiting access to systems and applications that house confidential data to only those authorized to use that
• Using cryptography techniques to hide confidential data and keep that data invisible to unauthorized
• Encrypting data that cross the public
• Encrypting data that are stored within databases and storage

What is the difference between NAT / Bridged / Host-Only networking?

• Host-Only: The VM will be assigned one IP, but it's only accessible by the box VM is running on. No other computers can access it. NAT: Just like your home network with a wireless router, the VM will be assigned in a separate subnet, like 192.168.6.1 is your host computer, and VM is 192.168.6.3, then your VM can access outside network like your host, but no outside access to your VM directly, it's protected.
• Bridged: Your VM will be in the same network as your host, if your host IP is 172.16.120.45 then your VM will be like 172.16.120.50. It can be accessed by all computers in your host network.

How Your Router Handles Requests and Uses Ports

Cryptographic Concepts

Cryptographic Concepts

• Plaintext(or cleartext)—an unencrypted message.
• Ciphertext—an encrypted message.
• Cipher—the process (or algorithm) used to encrypt and decrypt a message.
• Cryptanalysis—the art of cracking cryptographic systems.

Hashing Algorithms

• Secure Hash Algorithm (SHA)—considered the strongest algorithm.There are variants that produce different-sized outputs, with longer digests considered more secure. The most popular variant is SHA-256, which produces a 256-bit digest.
• Message Digest Algorithm #5 (MD5)—produces a 128-bit digest. MD5 is not considered to be quite as safe for use as SHA-256, but it might be required for compatibility between security products.

Encryption

• Key — random string of bits created specifically for scrambling and unscrambling data. These are used to encrypt and/or decrypt data. Each key is unique and created via an algorithm to make sure it is unpredictable. Longer keys are harder to crack. Common key lengths are 128 bits for symmetric key algorithms and 2048 bits for public-key algorithms.
• Private Key (or Symmetric-Key): This means that the encryption and decryption keys are the same. The two parties must have the same key before they can achieve secure communication.
• Public Key: This means that the encryption key is published and available for anyone to use. Only the receiving party has access to the decryption key that enables them to read the message.
• Cipher — an algorithm used for encryption or decryption. It is a set of steps that are followed as a procedure to encrypt information. There are two main types of ciphers, block ciphers, and stream ciphers.
• Algorithm — an algorithm is a procedure that the encryption process follows. The specific algorithm is called the cipher, or code. There are many types of encryption algorithms. The encryption’s goal and level of security determine the most effective solution. Triple DES, RSA, and Blowfish are some examples of encryption algorithms or ciphers.
• Decryption — the process of switching unreadable ciphertext to readable information.
• Cryptanalysis — the study of ciphers and cryptosystems to find weaknesses in them that would allow access to the information without knowing the key or algorithm.
• Frequency Analysis — a technique used to crack a cipher. Those trying to decrypt a message will study the frequency of letters or groups of letters in a ciphertext. Because some letters occur more often than others, the frequency of letters can reveal parts of the encrypted message. While this method was effective in cracking old encryption methods, it is ineffective against modern encryption.

Caesar Cipher

Social Engineering

Common Methods of Social Engineering Attacks

• Pretexting — an invented scenario is used to engage a potential victim to try and increase the chance that the victim will bite. It's a false motive usually involving some real knowledge of the victim (e.g. date of birth, Social Security number, etc.) in an attempt to get even more information.
• Diversion Theft — a 'con' exercised by professional thieves, usually targeted at a transport or courier company. The objective is to trick the company into making the delivery somewhere other than the intended location.
• Phishing — the process of attempting to acquire sensitive information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity using bulk email which tries to evade spam filters. Emails claiming to be from popular social websites, banks, auction sites, or IT administrators are commonly used to lure the unsuspecting public. It’s a form of criminally fraudulent social engineering.
• Spear Phishing — a small, focused, targeted attack via email on a particular person or organization with the goal to penetrate their defenses. The spear phishing attack is done after research on the target and has a specific personalized component designed to make the target do something against their own interest. Here is more about how they do it.
• Water-Holing — this technique takes advantage of websites people regularly visit and trust. The attacker will gather information about a targeted group of individuals to find out what those websites are, then test those websites for vulnerabilities. Over time, one or more members of the targeted group will get infected and the attacker can gain access to the secure system.
• Baiting — baiting means dangling something in front of a victim so that they take action. It can be through a peer-to-peer or social networking site in the form of a (porn) movie download or it can be a USB drive labeled “Q1 Layoff Plan” left out in a public place for the victim to find. Once the device is used or malicious file is downloaded, the victim’s computer is infected allowing the criminal to take over the network.
• Quid Pro Quo — Latin for 'something for something', in this case it's a benefit to the victim in exchange for information. A good example is hackers pretending to be IT support. They will call everyone they can find at a company to say they have a quick fix and "you just need to disable your AV". Anyone that falls for it gets malware like ransomware installed on their machine.
• Tailgating — a method used by social engineers to gain access to a building or other protected area. A tailgater waits for an authorized user to open and pass through a secure entry and then follows right behind.
• Honeytrap — a trick that makes men interact with a fictitious attractive female online. From old spy tactics where a real female was used.
• Rogue — also Rogue Scanner, rogue anti-spyware, rogue anti-malware or scareware, rogue security software is a form of computer malware that deceives or misleads users into paying for the fake or simulated removal of malware. Rogue security software, in recent years, has become a growing and serious security threat in desktop computing. It is very popular and there are literally dozens of these programs.
• Dumpster Diving — searching through trash or recycling bins to find confidential information such as passwords, account numbers, or other sensitive data.
• Impersonation — pretending to be someone else, such as a bank employee or government official, to gain access to sensitive information.

Review Notes: Social Engineering

• Social engineering is a technique used by hackers to manipulate or deceive individuals to gain access to their computer systems. The objective is to extract valuable information or access to information that can be used for fraudulent activities.
• Attackers use various methods to conduct social engineering attacks, including pretexting, diversion theft, phishing, spear phishing, water-holing, baiting, quid pro quo, tailgating, honeytrap, and impersonation. Understanding the different attack vectors is essential to prevent these crimes.
• Pretexting involves using a false motive to engage a potential victim to extract sensitive information. Diversion theft is used to trick a courier company into making deliveries to the wrong location. Phishing uses bulk email to acquire sensitive information, while spear phishing is a targeted attack on a particular person or organization. Water-holing targets websites that individuals regularly visit, while baiting involves dangling something in front of a victim to take action.
• Quid pro quo involves promising a benefit in exchange for information, while tailgating involves following an authorized user into a secure area. Honeytrap is a trick that involves making men interact with a fictitious attractive female online, while impersonation involves pretending to be someone else to gain access to sensitive information.
• Dumpster diving is a technique used to search for confidential information in trash or recycling bins. Rogue security software is a type of malware that misleads users into paying for the fake removal of malware.

Implementing Authentication Controls

Authentication General Guidelines

• Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end /middle-ware / DB) to any front-end user-interface
• Do NOT use the same authentication solution (e.g. IDP / AD) used internally for unsecured access (e.g. public access / DMZ)

• Password Length
• Minimum length of the passwords should be enforced by the application. Passwords shorter than 8 characters are considered to be weak (NIST SP800-63B).
• Maximum password length should not be set too low, as it will prevent users from creating passphrases. A common maximum length is 64 characters due to limitations in certain hashing algorithms, as discussed in the Password Storage Cheat Sheet. It is important to set a maximum password length to prevent long password Denial of Service attacks.
• Do not silently truncate passwords.
• Allow usage of all characters including unicode and whitespace.There should be no password composition rules limiting the type of characters permitted.
• Ensure credential rotation when a password leak, or at the time of compromise identification.
• Include password strength meter to help users create a more complex password and block common and previously breached passwords
• zxcvbn library can be used for this purpose. (Note that this library is no longer maintained)
• Pwned Passwords is a service where passwords can be checked against previously breached passwords. You can host it yourself or use API.

• Has a maximum input length, to protect against denial of service attacks with very long inputs.
• Explicitly sets the type of both variable, to protect against type confusion attacks such as Magic H ashes in PHP.
• Returns in constant time, to protect against timing attacks.

• User is authenticated with active session.
• Current password verification. This is to ensure that it's the legitimate user who is changing the password. The abuse case is this: a legitimate user is using public computer to login. This user forgets to logout. Then another user is using this public computer. If we don't verify current password, this another user able to change the password.

• It is acceptable (or even preferred) that the user only has access to the website from only a single computer/browser.
• The user is not easily scared by the process of installing TLS
  certificates on his browser, or there will be someone, probably from IT
  support, that will do this for the user.
• The website requires an extra step of security.
• It is also a good thing to use when the website is for an intranet of a company or organization.

• The user ID or password was incorrect.
• The account does not exist.
• The account is locked or disabled.

• First implementation using the "quick exit" approach
IF USER_EXISTS(username) THEN
password_hash=HASH(password)
IS_VALID=LOOKUP_CREDENTIALS_IN_STORE(username, password_hash)
IF NOT IS_VALID THEN
RETURN Error("Invalid Username or Password!")
ENDIF
ELSE
RETURN Error("Invalid Username or Password!")
ENDIF

• Second implementation without relying on the "quick exit" approach:
password_hash=HASH(password)
IS_VALID=LOOKUP_CREDENTIALS_IN_STORE(username, password_hash)
IF NOT IS_VALID THEN
RETURN Error("Invalid Username or Password!")
ENDIF

• The number of failed attempts before the account is locked out (lockout threshold).
• The time period that these attempts must occur within (observation window).
• How long the account is locked out for (lockout duration).

• Ensure that all failures are logged and reviewed
• Ensure that all password failures are logged and reviewed
• Ensure that all account lockouts are logged and reviewed

• Use standard HTML forms for username and password input with appropriate type attributes.
• Avoid plugin-based login pages (such as Flash or Silverlight).
• Implement a reasonable maximum password length, such as 64 characters, as discussed in the Password Storage Cheat Sheet.
• Allow any printable characters to be used in passwords.
• Allow users to paste into the username and password fields.
• Allow users to navigate between the username and password field with a single press of the Tab key.

Authentication Design Concepts

1. Password-based authentication: This is the most common form of authentication, where users provide a password to prove their identity. The password should be complex and kept secret to prevent unauthorized access. Examples include websites, email accounts, and mobile apps.
2. Two-factor authentication (2FA): This involves using two forms of authentication to verify a user's identity, typically a password and a code sent to the user's mobile phone or email. 2FA is more secure than password-based authentication alone and is commonly used in banking, e-commerce, and other sensitive applications.
3. Biometric authentication: This uses physical characteristics, such as fingerprints or facial recognition, to verify a user's identity. Biometric authentication is highly secure and is used in applications
   such as mobile phones, airports, and financial institutions.
4. Single sign-on (SSO): This allows users to access multiple applications or systems with a single set of login credentials. SSO improves convenience for users and can also improve security by reducing the number of passwords that users need to remember.
5. Multi-factor authentication (MFA): This involves using multiple forms of authentication to verify a user's identity, such as a password, fingerprint, and security token. MFA is highly secure and is used in applications such as banking, healthcare, and government.

1. Password-based authentication: This is the most widely used authentication method where users enter a password to verify their identity. Passwords should be complex, kept confidential, and changed periodically to prevent unauthorized access.
2. Biometric authentication: This method uses physical characteristics of a user such as fingerprints, facial recognition, voice recognition, or iris scanning to verify their identity.
3. Two-factor authentication (2FA): This method requires the user to provide two forms of identification, typically a password and a security token or a biometric factor like a fingerprint, to confirm their identity.
4. Multi-factor authentication (MFA): This method requires the user to provide multiple forms of identification, such as a password, a biometric factor, and a security token, to confirm their identity.
5. Certificate-based authentication: This method uses digital certificates to verify the identity of a user. Certificates are issued by a trusted third-party and are used to encrypt data transmissions and
   verify digital signatures.
6. Single sign-on (SSO): This method allows a user to access multiple applications or systems using a single set of login credentials.
7. Federated authentication: This method allows users to access applications or systems using their credentials from a trusted third-party provider, such as social media platforms or a company's
   active directory.
8. Adaptive authentication: This method uses machine learning and risk-based analysis to determine the level of authentication required based on the user's behavior and activity.

Access Control and Authentication

Account Audits and Processes

Permission Levels

1. Administrator or Superuser: This is typically the highest level of permission, granting users complete access and control over all aspects of the system or application, including the ability to configure
   settings, create, modify, and delete accounts, and perform other administrative tasks.
2. Read-only or Viewer: This level of permission allows users to view or read the content or data within the system or application, but does not permit them to make any changes or modifications.
3. Editor or Contributor: This level of permission allows users to create, modify, and delete content or data within the system or application, but may not grant them administrative privileges or access
   to sensitive settings.
4. Restricted or Limited Access: This level of permission provides users with limited access to certain features or functionality within the system or application, based on predefined restrictions or rules.
5. Guest or Anonymous: This level of permission allows users to access certain public or non-sensitive content within the system or application without requiring them to log in or provide any credentials.

• Full Control
• Modify
• Read & Execute
• List Folder Contents
• Read
• Write

• read – The Read permission refers to a user’s capability to read the contents of the file.
• write – The Write permissions refer to a user’s capability to write or modify a file or directory.
• execute – The Execute permission affects a user’s capability to execute a file or view the contents of a directory.

Auditing, Testing, and Monitoring

1. Auditing: Auditing refers to the systematic examination of records, documents, processes, or systems to assess their accuracy, effectiveness, and compliance with established standards, policies, or
   regulations. Auditing is often conducted by independent professionals to provide an objective assessment. Examples of auditing include:
• Financial auditing: Auditing of financial statements to verify the accuracy and reliability of financial information, such as balance sheets, income statements, and cash flow statements, to ensure
  compliance with accounting principles and relevant laws and regulations.
• Information systems auditing: Auditing of IT systems, networks, and databases to evaluate their security, data integrity, and compliance with IT policies and standards.
• Compliance auditing: Auditing of an organization's activities, processes, and policies to ensure they comply with relevant laws, regulations, industry standards, or internal policies.
2. Testing: Testing involves the process of evaluating the performance, functionality, or quality of a product or system to identify defects, errors, or issues. Testing is typically performed during the development or implementation phase to detect and correct any problems before the product or system is released for production or use. Examples of testing include:
• Software testing: Testing of software applications to verify their functionality, usability, performance, security, and compatibility with different platforms and devices.
• Product testing: Testing of physical products, such as consumer goods or industrial equipment, to ensure they meet the required specifications, standards, and performance criteria.
• Performance testing: Testing of systems, such as websites or servers, to evaluate their performance under different conditions, such as high user loads or heavy data traffic.
3. Monitoring: Monitoring involves the continuous or periodic observation and measurement of processes, systems, or activities to track their performance, detect anomalies, and ensure compliance with established standards or requirements. Monitoring is typically ongoing and can be done manually or through automated systems. Examples of monitoring include:
• Network monitoring: Monitoring of computer networks to track traffic, identify security breaches, and optimize network performance.
• Quality monitoring: Monitoring of production processes or service delivery to ensure compliance with quality standards, identify defects, and improve quality control measures.
• Financial monitoring: Monitoring of financial transactions, records, and systems to detect fraud, unauthorized activities, or financial risks.