Download to read offline
More Related Content
Similar to 501 ch 5 securing hosts and data
501 ch 5 securing hosts and data
- 1. Chapter 5 Securing Hostsand Data CompTIA Security+ Get Certified Get Ahead 1
- 2. Introduction • Implementing securesystems • Summarizing cloud concepts • Deploying mobile devices securely
- 3. Implementing Host Security • Leastfunctionality – Disabling unnecessary services • Improves security posture • Reduces attack surface – Reduces risks from open ports • Disabling unneeded applications • Disabling unnecessary accounts • Keeping systems up-to-date
- 4. Secure Operating Systems • Windows • MAC •Linux – Kiosks – Network – Appliance • Trusted OS
- 5. Using Master Images • Providessecure starting point • Reduces costs
- 6. Secure Operating Systems • Resiliency andautomation strategies – Automation, scripting, and templates – Group Policy • Standardize system configuration • Standardize security settings • Enforce strict company guidelines • Easily apply security settings to multiple computers Account Policies Local Policies System Services Software Restrictions
- 7. Secure Operating Systems • Three steps –Initial baseline configuration – Integrity measurements for baseline deviation – Remediation
- 8. Implementing Secure Systems • Patch management –Ensure that systems are up-to-date – Protects system against known vulnerabilities – Test patches in a test environment that mirrors the production environment – Automated deployment – Testing, deploying and verifying updates
- 9. Implementing Secure Systems • Change management –Helps ensure changes to IT systems do not result in unintended outages – Provides an accounting structure or method to document all changes – Changes are proposed and reviewed before implementation
- 10. Implementing Secure Systems • Unauthorized software –Can include malware • Compliance violations – Licenses
- 11. Whitelisting vs Blacklisting • Applicationwhitelisting – Identifies authorized software for workstations, servers, and mobile devices – Prevents users from installing or running software that isn’t on the list • Application blacklisting – A list of prohibited applications – Prevents users from installing or running software on the list
- 12. Secure Staging and Deployment • Sandboxing –Used for testing – Isolated area on a system • VMs – Isolated operating system • Chroot – Isolated area within a Linux OS
- 13. Secure Staging Environment • Development – Appcreated in a development environment • Test – App tested in a testing environment • Staging – Simulates production environment • Production – Final product
- 14. Peripherals • Wireless keyboards •Wireless mice • Displays • External storage devices • Digital cameras • Wi-Fi-enabled MicroSD card • Printers and other multi-function devices (MFDs)
- 15. Hardware and Firmware Security • Electromagneticinterference (EMI) – Interference from various sources • Motors • Power lines • Fluorescent lights • Electromagnetic pulse (EMP) – Short burst of electromagnetic energy • Electrostatic discharge (ESD) • Lightning • Military weapons
- 16. Hardware and Firmware Security • EMI –Electromagnetic interference – Interference from various sources – Motors – Power lines – Fluorescent lights • EMP – Electromagnetic pulse – Short burst of electromagnetic energy – Electrostatic discharge (ESD) – Lightning – Military weapons
- 17. Hardware and Firmware Security • Fulldisk encryption (FDE) – Can be software application • Self-encrypting drives (SED) – Includes the hardware and software to encrypt all data on the drive – Securely stores the encryption keys – Typically unlocked with user credentials
- 18. Hardware and Firmware Security • BasicInput/Output System (BIOS) – Firmware used to start a computer – Software stored on hardware chip • Unified Extensible Firmware Interface (UEFI) – Replacement for BIOS on most newer systems – Includes similar functions and some enhancements • Update BIOS and UEFI by flashing
- 19. Hardware-Based Encryption Characteristics TPMHSM Hardware Chip in motherboard (included with many laptops) Removable or external hardware device, (purchased separately) Uses Full disk encryption (for laptops and some servers) High-end mission-critical servers (SSL accelerators, high availability clusters, certificate authorities) Authentication Performs platform authentication (verifies drive not moved) Performs application authentication (only used by authorized applications) Encryption Keys Includes endorsement key (burned into chip) and storage root key Storage root key generates and protects other keys Stores RSA keys used in asymmetric encryption and can generate keys
- 20. Benefits of TPM and HSM •Secure boot process – Checks the files against stored signatures to ensure files haven’t changed – Attests that the files haven’t changed – Blocks boot process if files have been modified • Remote attestation – Sends information on files to remote system – Remote system verifies files haven’t changed
- 21. Benefits of TPM and HSM •Hardware root of trust – Known secure starting point – TPM/HSM ships with a unique private key burned into hardware – Matched with public key – Used during secure boot process
- 22. Hardware and Firmware Security • Additionalvulnerabilities – End of life systems • Sanitize before disposing • Lack of vendor support – No security updates – No technical support – Susceptible to security issues
- 23. Summarizing Cloud Computing • Accessing computingresources on another system • On-premise – Cloud resources owned, operated, and maintained by an organization for its employees • Hosted – Resources rented and managed by another organization – Typically accessed via the Internet
- 24. Summarizing Cloud Computing • Software asa Service (SaaS) – Applications provided over the Internet (such as web-mail accessed with a web browser) • Platform as a Service (PaaS) – Provides customers with a fully managed platform – Vendor keeps platform up-to-date • Infrastructure as a Service (IaaS) – Provides customers with access to hardware in a self-managed platform – Customers are responsible for keeping an IaaS system up to date
- 25.
- 26. Understanding Cloud Computing • Security asa service – any services provided via the cloud that provide security services – Commonly viewed as a subset of Software as a Service (SaaS) • Cloud access security broker (CASB) – Software tool or service – Placed between organization’s network and the cloud provider
- 27. Cloud Deployment Models • Public –Available to anyone • Private – Only available within a company • Community – Cloud shared by two or more organizations • Hybrid – Combination of any two models
- 28. Mobile Device Deployment Models • Modelssupport connecting mobile devices to organization’s network – Corporate-owned – COPE (corporate-owned, personally enabled) – BYOD (bring your own device) • Bring your own disaster – CYOD (choose your own device) • Limits supported devices • VDI (virtual desktop infrastructure)
- 29. Mobile Device Connection Methods • Cellular •Wi-Fi • SATCOM • Bluetooth • NFC (near field communication) • ANT • Infrared • USB (Universal Serial Bus)
- 30. Mobile Device Management (MDM) • Applicationmanagement • Full device encryption • Storage segmentation • Content management • Containerization • Passwords and PINs • Biometrics • Screen locks
- 31. Mobile Device Management (MDM) • Remotewipe • Geolocation • Geofencing • GPS tagging • Context-aware authentication • Push notification services
- 32. MDM Enforcement / Monitoring • Unauthorizedsoftware – Third party app stores – Rooting and jailbreaking – Updates – Sideloading – SMS and MMS – SMS
- 33. Mobile Device Management (MDM) • Hardwarecontrol – USB OTG cables • Unauthorized connections – Tethering – Wi-Fi Direct – Ad hoc
- 34. Embedded System • Any devicethat has a dedicated function and uses a computer system to perform that function – Compare to desktop PCs, laptops, and servers • All use central processing units (CPUs), operating systems, and applications to perform various functions • Embedded systems – Use CPUs, operating systems, and one or more applications to perform specific functions
- 35. Embedded System • Security implicationsand vulnerabilities – Keep up-to-date • Implement patch management processes – Avoid default configurations
- 36. Comparing Embedded Systems • Smart devices •Internet of things (IoT) – Wearable technology – Home automation • HVAC • SoC • RTOS • Printers/MFDs • Camera systems • Special purpose – Medical devices – Vehicles – Aircraft/UAV
- 37. Protecting SCADA/ICSs • Redundancy anddiversity • Network segmentation • Security layers • Application firewalls • Manual updates • Firmware version control • Wrappers
- 38. Protecting Data • Data atrest – Any stored data – Hard drives, mobile phones, USB flash drives, external drives, databases. and backups • Data in transit – Data in motion – Any data traveling over a network
- 39. Protecting Confidentiality with Encryption • Software-based encryption –Full disk encryption – Database column encryption – File/folder encryption
- 40. Permission Issues & Access Violations • Principleof least privilege – Ensures users granted only the rights and permissions needed to perform assigned tasks or functions – Rights identify what a user can do, such as changing the system time or rebooting a system – Permissions define access to resources, such as being able to read or modify a file – Rights and permissions combined called privileges
- 41. File System Security • Linuxpermissions – Owner – Group – Others – Read (r) 100 (4) – Write (w) 010 (2) – Execute (x) 001 (1)
- 42. File System Security • Linuxpermissions – Owner – Group – Others – Read (r) 100 (4) – Write (w) 010 (2) – Execute (x) 001 (1)
- 43. File System Security • Linuxpermissions • Chmod
- 44. File System Security • Windowspermissions – Read – Read & Execute – Write – Modify
- 45. Data Loss Prevention (DLP) • Removablemedia • Data exfiltration – Unauthorized transfer of data outside an organization • Cloud-based DLP – Can protect PII and PHI
- 46. Chapter 5 Summary • Implementingsecure systems • Summarizing cloud concepts • Deploying mobile devices securely
Editor's Notes
- #37 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #38 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #39 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #40 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #41 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #42 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #43 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #44 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #45 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #46 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.
- #47 This comes across as a laundry list of peripherals in the objectives. Feel free to take the time to explain any that you think your audience may not understand. However, the key point is that they need to be kept up-to-date.