Cybersecurity Foundations — Notes
By: Amani Benaoun
Tags: Security, LinkedIn, Course, Learning, Cybersecurity

Today’s article is a collection of my notes while attending the LinkedIn course entitled “Cybersecurity Foundations”. It is the second of 12 course courses in the “Become an IT Security Specialist” learning path. The course is divided into 3 sections which are:

Frameworks and Controls.

Cyber Threats.

Managing Cyber Incidents.

Frameworks and Controls

The “Rainbow Series” is a series of books on the IT security requirements for the United States Department of Defense. The most know book of this series is the “Orange Book” which describes the security design of a computer that can be trusted to handle both unclassified and classified information, known as a multilevel secure or trusted computer. The “Orange Book” provides the technical criteria which are needed for the security design and subsequent security evaluation of the hardware, firmware, and application software of the computer. It introduces four key concepts in information security:

A reference monitor which mediates access to system resources. The reference monitor concept is an essential element of any system that provides multilevel secure computing facilities and controls. It enforces access controls between subjects and objects of the system.

The Bell-LaPadula scheme for managing multilevel information flows. The book presents 2 approaches to security. Discretionary access control DAC (is used for applying security within the same classification of information to provide a means of restricting information access on a need-to-know basis) and Mandatory access control MAC is (the scheme in which each user holds a certain level of access rights or clearance and an object is labeled at a certain level of sensitivity).

The trusted computing base TCB which contains all of the elements of the system responsible for supporting the security policy and supporting the isolation of objects on which the protection is based. The TCB includes hardware, firmware, and software critical to protection. It must be designed and implemented such that nothing outside the trusted computing base is sensitive or relevant to managing security.

The classification scheme. It provides 4 levels of assurance;

D1: Minimal Protection.

C1 — C2: Discretionary Protection.

B1 — B3: Mandatory Protection.

A1: Verified Protection.

The NIST (National Institute of Standards and Technology) Cybersecurity Framework is an action-oriented approach to security and consists of three elements. The Framework Core, the Framework Profile, and the Framework Implementation Tiers.

The Framework Core provides a set of activities to achieve cybersecurity, described in the five areas of Identify, Protect, Detect, Respond, and Recover.

The framework profile is used to align business outcomes and cybersecurity activities. Providing a view of risks and a development plan to breach the two.

The implementation Tiers are: partial tier, risk informed tier, repeatable tier, adaptive tier.

Cybersecurity is the management of risk related to internet connected businesses. This includes the threats of hackers and malicious software entering from the internet, the vulnerabilities of internet facing IT systems, and the attack countermeasures or controls, all of which affect how successful the business will be in meeting its desired outcomes.

Risk assessment considers the likelihood of threats, the possible vulnerabilities that threats can exploit and the impact of these threats on the business. Available Cybersecurity Risk Standards:

NIST SP 800–30 Guide for Conducting Risk Assessments.

ISO 27005 Information Security Risk Management.

Appendix E to the NIST Special Publication SP 800–30 is a recommended catalogue of threat intelligence. It provides representative examples of threat events expressed as Tactics, Techniques, and Procedures or TTPs. Another very useful source of TTPs is the MITRE ATT&CK site, which is used in MITRE’s cybersecurity resiliency framework. Veris provides an open community threat database, which can be used to support risk analysis. ThreatStream offers an open source cyber intelligence blog, which reports on contemporary activities and threat actors.

There are four possible treatments once an assessment has identified the risk.

Risk acceptance.

Risk avoidance.

Risk transfer.

Risk mitigation.

A key part of risk management is maintaining a record of the risks that have been identified and where relevant, tracking the progress of work to reduce the risk. The normal way to record risks is in a risk register. The term risk context refers to the risk bubble chart and the tables used to determine likelihood and impact. These tables are typically developed specifically for the business by its risk officer. The risk context should also include guidance on the actions required to be taken at each risk level, reflecting more urgent action and more intense oversight at the higher levels of business risk.

The Risk management process begins with the preparation step then a 6 stage process; categorization, selection, implementation, assessment, authorization, monitoring. The prepare stage of the framework involves seven actions. They are assign people to risk management roles, prepare the risk management context, also known as the risk strategy, complete an organization-wide risk assessment, establish control baselines according to the standards relevant to the organization, identify common controls, prioritize them according to the potential impact of an attack and develop the plan for monitoring control effectiveness. The categorize step requires a full review of the systems characteristics, an identification of attack impact and business endorsements. The select stage is about control selection to mitigate all risks to the system that are beyond risk appetite. The implement phase is to implement the controls that have been identified for the system, and maintain the system’s security plans accordingly. The assess stage is about through life assessment of the system to ensure that the controls are effective and there is no evidence of a breach. The purpose of the authorize stage is to provide organizational accountability by requiring a senior manager to determine if the security and privacy risk represented by the overall set of risk management activities and plans is acceptable. The final stage is monitoring. It provides the ongoing situational awareness about the security and privacy posture of the information system and the organization in support of risk management decisions and includes some of the above stages.

One of the more important IT frameworks for the enterprise is COBIT, the Control Objectives for IT. COBIT is published by the Information Systems Audit and Control Association, ISACA, and its purpose is to ensure that enterprises have in place an effective and auditable set of governance and management processes for IT which deliver value for its stakeholders. COBIT is designed around a set of processes that are grouped into the four areas of plan, build, deliver, and monitor. The COBIT framework is used by the financial sector for carrying out IT general controls external audits.

Security Controls are used used to ensure cybersecurity. Controls can mitigate risk in different ways. By deterring attack. By preventing attack. By detecting attack. And by correcting or remediating the damage caused by an attack. Their main characteristics are:

Fit for purpose.

Demonstrably effective.

Don’t inhibit the organization’s ability to carry out its business.

Cost effective.

Generally don’t provide complete mitigation → there will be a small level of risk remaining called residual risk.

The Information Security Forum is an independent not-for-profit organization which brings together and shares the information security expertise of many corporations around the world. One of its main products for members is the Standard of Good Practice which is updated annually.

Cloud solutions may be deployed by the enterprise IT team or solutions may be deployed by business groups. In all cases, there’s a need for security controls to be used to protect the cloud solution, just as there is from an on premise solution. The International Standards Organization has produced an ISO 27000 standard for cloud, known as ISO 27017. This is based on ISO 27002 and includes an additional six controls. NIST has produced the SP 800–144, “Guidelines on Security and Privacy “in Public Cloud Computing,” which refers back to the SP 800–053 controls.

The internet of things is a term which means everything that’s connected to the internet that isn’t a standard laptop, workstation, or server. One of the first organizations to provide guidance on security for the internet of things was the IoT Alliance Australia, a part of the Australian Communications Alliance. The IoT Security Foundation has published the most comprehensive set of controls in their security guideline, which proposes 142 controls grouped into 13 areas of compliance.

Assurance is a process which starts prior to the launch of a system and then continues through life. There are a variety of basic assurance methods that are used by organizations to check their systems. The key ones are vulnerability scans which identify the services which can be accessed and check that they have all known patches applied. Security control audits, which pre-define a set of conditions based on the control and predict the expected results. And penetration tests, which use known exploits and exploit techniques to try to circumvent the control.

Cyber Threats

The cyber kill chain views an attack in seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and action.

Reconnaissance: the phase during which the attacker gathers as much information as possible on the target.

Weaponization: taking a known vulnerability and customizing it to a specific target or group of targets and integrating it to enable is to be run from an automated cyber attack platform.

Delivery: there are multiple ways to deliver malware; email attachment, flash disk, PDF,…

Exploitation: the infected item will exploit a vulnerability in the target software post delivery.

Installation: the payload is installed either in the memory or into the hard disk of the target system.

Command and Control: once a payload has been installed, the first action it takes will be to connect back to the command and control server to register as a compromised host.

Action: it depends on the motives of the attacker.

Old and traditional fraud example are:

Ghost employees: have non existent employees on the payroll and embezzle money.

Salami shaving: take off the fractions in rounding calculations or changing transactions by taking a few cents from them.

Payment for non existent goods: raise a purchase order for non existent goods.

Denial of service attacks: making the servers unavailable to legitimate users.

To get more gain form cyber-crime attackers require automation to carry attacks on scale. The distribution of malware evolved from floppy disks, to internet downloads, USB drives, malicious websites and botnets. A botnet consists of a criminal known as the botmaster who runs a number of command and control systems. The botmaster will usually encrypt their command and control access and often disguise it to look like normal web traffic when accessing these systems. The botmaster runs the command and control servers, and each command and control system in turn controls a large number of computers known as zombies that have been infected with a backdoor. The most notorious botnets is the Zeus botnet construction kit. Zeus includes a command and control capability and a set of remote access trojans, or RATs. The Zeus code was leaked in 2010, and as a result it’s been used by many cyber criminals to carry out attacks and is the foundation of more advanced botnets such as Citadel, Ice IX, and GOZeuS.

People who penetrate systems with malware go out of their way to hide it once its on the target. It if can evade detection, it’s more likely to accomplish its intended goals. There are a number of ways to hide a malware like:

Using Windows methods to hide its activities.

Using an alternate data stream.

Using callbacks: It hooks the key that’s been pressed and then calls back after processing it to pass it on to its original destination.

Using the usual ways to hide a malware can be easy to detect. Hacker can use a more sophisticated way which is rootkits. Rootkits are installed by a dropper launched by hackers. A rootkit doesn’t exploit vulnerabilities, it’s designed to hide, operate, and carry out its mission using normal system functions. A rootkit is designed to bypass intrusion detection systems. It will also want to avoid detection by forensic analysts and the best place to hide is in the operating system kernel.

Advanced Persistent Threat APT is a malware directed at political and military targets, using multiple vectors to attack. APTs have a high degree of stealthiness, and can persist over a long period of time. It’s characteristics:

Customized code.

Focused objectives.

Has multi-threat capability.

Has some level of human intervention (not fully automated).

Operates in a low and slow manner to avoid detection.

In order to succeed, APT requires 5 key functions:

Command and controls: connects back to its command and control server, to look for tasking or to open an access pass for the adversary to gain direct control.

Process injection: APTs attach themselves to an existing application or process that’s running in memory.

Cloaking: stay stealthy.

Exfiltration: collect information and send it back to the server.

Reignition: an APT needs to restart when the system is rebooted, or if the system administrator attempts to remove it.

Instead of stealing information, ransomware encrypts files or storage systems on its targets to lock out their legitimate owner and then demands payment for the decryption key.

Managing Cyber Incidents

Being attacked by a malware is an inevitability these days due the large investment in cyber crimes and state-sponsored malware. When that happens the difference between inconvenience and disaster will be how well prepared the organization is to respond to the incident. NIST Cybersecurity Framework provides a set of control objectives under the functional area respond. This consists of five categories: planning, communicate, analysis, mitigation and improvement. the “Incident Handling Guide” was defined in the NIST Special Publication SP 800–61. The effort put into preparing for an incident will pay for itself many times over through a timely and effective response which contains the damage. Preparation involves establishing and training an incident response team, establishing and exercising processes, and acquiring the necessary tools and resources.

Detection and analysis phase in the NIST model of incident response is the nonstop process of monitoring for evidence of a cyber attack, and this is the job of the SOC analyst. During the detection phase, the SOC analyst is looking for evidence of malware or intrusive behavior coming into the organization from external sources. This will usually involve watching real time alerting screens which run 24/7. The analyst is also looking for evidence of malware that has succeeded in penetrating the organization by running file scans and monitoring for signals going out to the malware’s command and control servers.