Three-tier architecture

client/server

browser/server

Balance of multiple control methods

Understand the boundaries between environmental controls and application controls

Balance of software functionality and security measures

Balance of functional requirements, security requirements and security mechanisms

usually inversely proportional to

Default installation does not guarantee security

Configuration security is not enabled (access should be denied by default)

Failure to follow the minimal installation principle

Post-patch installation

Clarify requirements and determine the basic safety objectives of the product

Risk analysis assessment, assessing threats and vulnerabilities, estimating the cost/benefit ratio of different security countermeasures

Risk Management

Risk Analysis

Safety requirements

The project development and requirements management team conducts complex analysis of current and likely future functional requirements to ensure the new system meets end-user requirements

Project team members will also review the documents output during the initial phase of the project and revise and update them as needed.

For relatively small projects, the above processes are often included in the initial stages of the project.

Security requirements should also be formed accordingly. (Security requirements are determined during the requirements analysis stage, and security personnel must participate in the requirements stage)

Software development as part of system design

Tools for describing user requirements and system internal behavior

design

security design approach

Questions to consider

The main work

Test type

Separation of environments and separation of responsibilities

verification

validation

Focus on how to use and operate the developed system or application

Certification

Accreditation or any (Accreditation)

Migrations and fixes

Correctly configure the security environment

Continuously conduct vulnerability testing, monitor system activity and audit events (when vulnerabilities are discovered during the maintenance phase, the action taken is reporting)

If major changes occur, perform a risk assessment and perform certification and accreditation processes (re-certification, re-accreditation)

Destroy data based on data sensitivity.

Destruction method

Management techniques that optimize design, manufacturing and support processes by integrating all necessary acquisition activities simultaneously using multi-discipline teams

IPPD facilitates meeting cost and performance targets from product concept to production, including on-site support

A key principle of IPPD is the multidisciplinary collaboration model of Integrated Product Teams (IPTs)

Representatives from all functional disciplines work with the Team Leader to build successful and balanced programs, identify and solve problems, and make sound and timely decisions

Team members may not necessarily contribute 100% of their time to the project, and a member may be on multiple IPT teams.

The purpose of IPTs is to specify that team decisions are based on real-time input from all teams (e.g., project management, engineering, manufacturing, test, logic, financial management, procurement and contract management) also including customers and suppliers

Team members for ITPs are composed of project manager-level members, including members from the enterprise and system/subsystem contractors

A typical IPT is at the program level and may, for example, consist of the following functional disciplines: Design Engineering, Manufacturing, Systems Engineering, Test and Evaluation, Subcontracting, Quality Assurance, Training, Finance, Reliability, Maintenance Lines, Support, Procurement , contract management, suppliers and customers.

concept

in principle

Individuals and interactions over processes and tools

Working software trumps thorough documentation

Customer cooperation takes precedence over contract negotiation

Responding to change over following a plan

Class Class defines the abstract characteristics of an object

A class defines the physical properties and what it can do (its behavior). The methods and properties of a class are called "members"

Object is an instance of a class

The system allocates memory space to objects but not to classes; Classes are abstract. It is impossible for the system to allocate space to abstract things. Objects are concrete.

Properties: describe the structure and status characteristics of an object

Method: A function or procedure that an object can perform

The simplest understanding of encapsulation is packaging, which means hiding the properties and implementation details of an object and only exposing the interface to the outside world, that is, the internal state of the object is transparent to the outside world.

means hiding object information

public members

private member

Is a mechanism for creating one or more subtypes from an existing class

Representation of logical relationships between data elements

scalar

linked list

hierarchical tree

cohesion

coupling

API is a connector for loT (Internet of Things), allowing devices to link to each other

Representational State Transfer(REST)API

REST security expert usage advice

Three safe paths for REST APIs

Security assessment begins with reconnaissance or information gathering

Web-based administrative interfaces (Administrative interfaces)

Authentication and access control

Input validation

Parameter validation

Session management

Assemblies that manage and control data access

Organize and store data and record files in a certain format, allowing users to access, manage and update

Focus: Data collection, storage, recovery

Most concerned with integrity, followed by availability, and finally confidentiality

metadata

Features:

database language

hierarchical database model

Network database model

relational database model

object-oriented database model

object-relational database model

rollback

submit

savepoint/checkpoint check point

Use locking mechanisms to deal with the threat of concurrent operations

Some pieces of information are not sensitive separately but are sensitive together.

Solution

Solution

ACID principles

OLAP is the main application of database warehouse systems

Suitable for decision-makers and senior managers

To achieve information retrieval and data analysis, multiple databases or data sources are combined into one large database

data mining

inference engine

knowledge base

timing

Storage

vandalism

financial fraud

privileged access

Stealing transaction information

theft of intellectual property

denial of service attack

SAML

Critical business resilience and continuity

Provide routine maintenance of various assets

Protect assets from damage

Maintain controls over user access to business-critical systems

Provide checks and balances for various accounts (especially privileged accounts) to ensure that these accounts become reasonable business needs

Change, configuration and issue management of IT services

Security-related programs, such as user allocation and help desk programs

Focus on reporting and service continuous improvement practices

due care due care

due diligence due deligence

Service account

The account that executes the script

The provisioning of users User configuration (provisioning activation)

managing their access across multiple systems managing their access across multiple systems

native access control systemslocal access control systems

need to know need to know

I east privilege least privilege

Privileged account

Normal or restricted user account

Definition: Breaking a key task into different parts, with each part being performed by a different person

Purpose

reason

System administrator

operator

security administrator

IT Help/Service Desk Staff

general user

Licensing, suitability and background checks

The following situations should not be granted access (e.g., based on IDS and firewall logs, access to an IP should be immediately blocked, but not; adjusting the clock or deleting logs, etc.)

Account ValidationAccount Validation

Job rotationsJob rotations

two-person operation (two mon rule)

Dual Control

Mandotory vacationsmandatory vacations

the difference

Security Administrator Responsibilities

A threshold should be set for the number of times a certain error occurs. If this threshold is exceeded, the relevant behavior will be suspect or prohibited.

The purpose of setting error alarm thresholds is to use threshold values, monitoring and auditing to detect problems in time and prevent greater losses.

unusual or unexplained events; Deviations from standards, security incidents that deviate from standards; Irregular initial program loading (restart) concerns innocently restarting devices; Asset representation and management. Asset management refers to understanding everything in the entire environment: hardware, firmware, operating system, language runtime environment, applications and different libraries; System control: ensuring instructions are executed in the correct context; Trusted recovery: The mechanisms and procedures required to ensure that failures and operational disruptions do not undermine the safe operation of the system; Input and output control: The input and output of the application are directly related, and task errors and possible behaviors in the control input need to be monitored; System enhancement: Jin Yong does not need components and services; system security configuration reinforcement; Remote access security: commands and data must not be transmitted in clear text, SSH should be used instead of telnet; management should be done locally rather than remotely; only a few administrators are allowed to perform this remote function; strong authentication should be implemented for any hanging activities; any Access by unauthorized persons.

The purpose of trusted recovery is to ensure that the security and functional functions of the system are maintained in the event of failures and operational interruptions; in order to achieve the above purposes, the system should incorporate a series of mechanisms to maintain a safe state when predefined failures or interruptions occur;

System restart: Shut down the system in a controlled manner. The data is still in an inconsistent state before restarting. Restart and enter the maintenance state to automatically perform recovery and bring the system to a consistent state;

System cold start: The automated recovery mechanism cannot bring the system to a consistent state, and the administrator manually intervenes to restore the system from maintenance mode to a consistent state; (a startup method used to defeat defeat attacks)

Enter single-user or safe mode

Fix problems and repair files

Identify critical files and operations

Lock the cabinet

Physical control Technical control

Make a hard copy image called Gold Master (GM) master disk

Focus on vulnerability detection and repair

Properly configure components

Unauthorized access, introduction of viruses and malicious code, etc.

Use VPN technology for secure network access

Data transmission is encrypted, even using VPN technology

Take strong authentication measures

Critical equipment is managed locally rather than remotely

Limit the number of administrators with remote access to a minimum

Controlling access to physical facilities, the first barrier to facility protection

Defense-in-depth

When choosing a security guard, it is more important to screen and choose reliable personnel.

1. Brand 2. Model 3. MAC address 4. Serial number 5. OS or firmware version 6. Location 7. BIOS and other hardware 8. Assigned IP address (if available) 9. Labels or barcodes for organizational asset management

1. Software name 2. Supplier 3. Password or activation code 4. License type and version 5. Number of licenses 6. Number of licenses 7. License consistency 8. Organization software library administrator or asset administrator 9. Contact person of the organization where the software has been installed 10. Upgrade, full or limited license

Security experts can quickly find and mitigate vulnerabilities related to hardware type and version

Knowing the type and location of hardware in the network can reduce the effort of identifying affected devices

Unauthorized devices on the network can be discovered through scanning

Logging and tracking configuration changes provides assurance of network integrity and availability

Regular checks to ensure unauthorized changes

Requests

Impact Assessment Impact Assessment

Approval/Disapproval Approval/Disapproval

Build and Test Build and Test

Notification notification

Implementation

Validation

Documentation record

Get verbal authorization

There must be appropriate testing and rollback plans.

Make up records and formal authorization afterwards

ECAB (Emergency Change Advisory Board)

Failover failover

load balancing

What

Why

Important section

compensation

SLA is not transferable

How to verify SLA

Examples of usability metrics

Suitability review SLA

spare parts

redundant system

cluster

network computing

Redundant (or dual) power supplies

ups

Alternative energy sources (such as diesel generators)

SAN and NAS

RAID cheap redundant disk array

Direct access versus sequential access to storage devices

Redundant independent tape array RAIT

database shadowing (real time)

Backup and restore system

Staffing Flexibility

System available time

Provides a trusted interface for privileged user functionality

Provides means to ensure that communications using this path are not disrupted or corrupted

Typical measures

Automatically turns on in case of failure (e.g. power outage)

Concerned about life or system safety

Automatic locking in case of failure (e.g. power interruption)

Focus on blocking access in a controlled manner after a failure, when the system is in an inconsistent state

Hardware requires appropriate physical security measures to maintain the required confidentiality, integrity and availability

Access should be restricted to operator terminals and at work

Access to facilities should be restricted

Mobile assets should be protected

Printing facilities should be located at the Authorized User Annex

Network devices are core assets and need to be protected

A list of email addresses or IP addresses, etc., listed as "good" senders

A list of "bad" senders

It cannot be judged whether it is good or bad. Greylisting will tell the sending email server to quickly resend the email.

Non-profit organizations

Track the operations and sources of Internet spam

Provide real-time and effective spam protection for the Internet

Acts as a decoy server to collect information about attackers or intruders operating on the system

Software virtualization technology

Let programs and processes run in an isolated environment

Restrict access to other system files and systems

A replacement for traditional antivirus

Malware uses a variety of techniques to evade detection

installed on individual hosts,on systems deployed on individual hosts and systems

Unified Threat Management (UTM) security gateway

Continual updates Continuously update the virus database (updated every day)

monitored to ensure they are still active and effective Monitoring to ensure that anti-virus systems are still active and effective

automatic scanning for new media and email attachments. Deploy automatic scanning policy for media and email attachments

Scanning should be scheduled and accomplished on a regular basis. Scanning should be scheduled and accomplished on a regular basis.

environmental checks environmental monitoring

Dynamic application security testing Dynamic application security testing (DAST)

Establish a continuous configuration environment to protect operating systems and applications from known vulnerabilities

Many times, manufacturers do not give reasons and reasons for upgrading when upgrading versions.

Is it approved by management?

Comply with configuration management policies

Whether to consider bandwidth utilization

Whether to consider service availability

is a best practice for patch management

Virtualization technology makes it easier to set up a patch testing lab

Some control measures can mitigate the impact of software vulnerabilities, such as firewalls, IDS, etc., and allow us time to test patches.

Reverse Engineering PatchesReverse Engineering Patches

Security experts need to determine whether it is a vulnerability

Do you need to upgrade the patch?

Management and system owners determine whether to update patches

Update patches have been tested and residual risks have been addressed

After the update is completed, it needs to be verified in the production environment

Once deployment is complete ensure all appropriate machines are updated

Log all changes

Important section

Pacth Prioritization and SchedulingPatch priority and job scheduling

Breadth and depth of patch testing

The patch testing process begins with the acquisition of software updates and continuous acceptance testing after production deployment

Verification is required when obtaining patches

Test after patch verification is completed

Change is important at every step of patch management

Patching applications should include contingency and fallback plans

Include risk reduction strategies in your change management program

Change management program includes monitoring and acceptance plan

The deployment phase of patch management must have well-experienced administrators and engineers

Installation and deployment means that patches and updates to production systems are actually implemented

A technical factor affecting patch deployment is tool selection

Deploy security patches

Routine audits and assessments measure patch management success and extent

two questions

critical success factors

System discovery and auditing as part of the audit and assessment process

vulnerability scan

Vulnerability type

Host-based scanning

Apply security scan

Database security scan

general framework

Direct all incident-related activities and guide security personnel to a predefined and pre-authorized path to resolution

Describe the activities undertaken in relation to the roles and responsibilities of the parties involved in the incident.

virtual team

Dedicated team

Hybrid mode team

Outsourcing resources

Contains the practical sub-phases of detection, identification and notification;

Classify events according to their potential risk level, which is affected by event type, source (internal or external), growth rate, and error suppression capabilities;

Handling false-positive events/false positives is the most time-consuming;

If it is a real event, classification (based on the needs of the organization) and classification (determining the level of potential risk or the criticality of the event) are required

Directly deals with analysis, interpretation, response, and recovery of events;

Investigation involves the appropriate collection of relevant data, which will be used in analysis and subsequent stages;

Management must determine whether law enforcement is involved in the investigation, gathering evidence for prosecution, or simply patching the loophole;

Contain incidents and reduce their impact;

Exhaustion strategy (example: cutting off the infected host from the network and taking control of it)

Mitigation measures should be based on the type of attack, the assets affected by the incident, and the criticality of those assets;

Conduct digital forensics to preserve forensic evidence

Collect more data (logs, videos, system activity, etc.) during the analysis phase to try to understand the root cause of the incident and determine whether the source of the incident was internal or external, and how the intruder penetrated;

Security experts need a combination of real training and real-world experience to properly explain, and often don’t have enough time;

Tracking often goes hand-in-hand with analysis and inspection, and requires weeding out sources of false leads or deliberate bullying;

Also important is what needs to be done once the root cause is identified and traced back to the true source.

The purpose is to get the business back up and running, return affected systems to production, and be consistent with other activities

Make necessary repairs to ensure this does not happen again;

recover

Policies and procedures Policies and procedures must be defined

The most important and easily overlooked stage is the reporting and feedback stage;

Organizations often learn a lot from events and move from mistakes to success;

Debriefing requires all team members, including representatives from each team affected by the incident;

The advantage is that this phase can develop or track response team performance from collecting meaningful data;

Measurement indicators can determine budget allocation, staffing needs, baselines, and demonstrate prudence and rationality;

The difficulty lies in producing statistical analysis and metrics that are meaningful to the organization.

One disadvantage of system logs is that they provide a view into that single system. The disadvantage of system logs is that they can only provide a single system perspective and cannot provide logs and information about related events involving multiple systems.

Provide a common platform for log collection, collation, and analysis in real time Provide a common platform for log collection, collation, and real-time analysis.

provide reports on historical events using log information from multiple sources

Log management systems are similarLog management systems are similar

maintain a disciplined practice of log storage and archiving maintain strict log storage and archiving discipline

Modern reporting tools can also be used to transform security event information into useful business intelligence. Modern reporting tools can also be used to transform security event information into useful business intelligence.

The choice of recovery strategy must meet organizational needs

Recovery Time Objective (RTO) Recovery Point Objective (RPO)

Backup method

Dual Data Center dual data center (redundant site)

hot siteshot sites

Warm Site

Cold Site Cold War

mobile sitemobile site

Reciprocal agreementsReciprocal agreements

outsourcing outsourcing

DR includes response, people, communication, assessment, recovery and training

The process must be recorded

Organizational level continuous testing strategy

Test strategy and plan

Document recovery in response to various incidents

Documentation should be stored in all recovery facilities

The document should be detailed enough for the technical recovery operation so that people with relevant skills can still complete it for the first time.

Test the recovery plan each time and update as needed

Notify the centralized communications team of incidents after they occur

response plan

Executive Emergency Management Team

emergency management team

Disaster recovery team

command center

initial response plan

personnel

Notify employees

Stakeholders

how to say

Security professionals need to establish problem reporting and management processes

conference bridges

In an incident, the impact of the incident needs to be determined

tiers or categories

The last part of the plan is about restoring the main environment and migrating to normal operation (reconstruction)

Other parts of the organization are concerned with the recovery of the backup site organization

Part of the focus is on what needs to be done to get back to the main facility production environment

You will need to contact your legal department and insurance company before restoring your primary site.

The migration plan must document the process and details of how to migrate

Asset replacement

No matter how good a plan is, it won't work if no one knows about it

leading a team

Technical team

employee

testing strategy

Test strategy contains test goals and scope

Test strategy includes test plan

Test scope and goals

Verify RTO and RPO through testing

testing strategy

business recoverybusiness recovery

disaster recoverydisaster recovery

Distribute copies of BCP/DRP to managers of each key business unit

Ask them to review portions of the plan that are appropriate for their department

As a tool for planning initial testing

Target

Features

Contains more content than the tabletop walkthrough

Participate in this selection of specific event scenarios to apply in BCP

The main purpose is to determine whether critical systems can be restored at a backup processing station (DRP) if personnel apply the procedures specified in the BCP.

Compare the running results of the backup site with the running results of the primary site

Switch to backup site

Any team has an obligation to participate in the change control process

Planning documents and all related procedures are reviewed every three months

Formal audit of program at least once per year

Plans must version control

From project to program

computer forensics, digital forensics, and network forensics to electronic data discovery, cyber forensics and forensic computing computer forensics, digital forensics and network forensics, electronic data discovery, network forensics and forensic computing.

Based on methodological, verifiable and auditable procedures and protocols

Identifying Evidence Identifying Evidence

Collecting or Acquiring Evidence Collecting or Acquiring Evidence

Examining or Analyzing the EvidenceExamining or Analyzing the Evidence

Presentation of FindingsPresentation of Evidence

1. Identify the scene

2. Protect the environment

3. Identify evidence and potential sources of evidenceIdentify evidence and potential sources of evidence

4. Collect evidenceCollect evidence

5. Minimize the degree of contamination

physical environment

virtual environment

dynamic evidence

motivation

Chance

Way

Commonly used methodsMO

Rocca's Law of Exchange

When dealing with digital evidence, all common forensic and procedural principles must be applied

The act of grabbing evidence cannot change the evidence

When it is necessary for a person to access a Fellow's digital evidence, that person needs to be trained for this purpose

All activities related to the seizure, access, storage or transmission of digital evidence must be fully documented, retained and available for review inspection.

When digital evidence is in someone's possession a person must be responsible for all activities related to the digital evidence

Any organization responsible for capturing, accessing, storing and transmitting data evidence is responsible for compliance with these principles,

What it refers to is that evidence media must have clear records (Document) and accountability (Accountability) from the initial collection and identification to transportation, use, intermediate custody, and final storage and archiving to ensure the original evidence media. There is absolutely no chance of contamination (Contaminate) and tampering (Tamper);

Throughout the life cycle of evidence, it is all about the processing of evidence: who, what, when, where, and low;

Ensure the authenticity and integrity of evidence with the help of Hash (SHA-256) and digital signatures;

The most delicate part of the investigation is the interviewing of witnesses and suspects;

Interviews must be preceded by reviewing strategy, notifying management, and contacting company legal counsel;

Do not conduct the interview alone. If possible, record the entire interview process as evidence;

Evidence classification

Evidence characteristics

computer logs

Any action taken as a result of the investigation shall not alter data on the storage medium or digital device;

People accessing data must be qualified to do so and able to explain their actions

Audit trails or other records suitable for third-party audits and applied to the process should be generated and protected, and each step of the investigation should be accurately documented

Those responsible for the investigation must be fully accountable for ensuring the procedures mentioned above and complying with government laws

Regarding the behavior of people grabbing data, they must not change the evidence.

When necessary personnel have access to original evidence, this must be legally qualified

Actions related to the capture, access, storage or transmission of digital evidence must be carefully recorded, preserved and made available for audit

When digital evidence is held by someone, that person must carefully record, preserve and make it available for audit

When digital evidence is held for someone, that person must be fully responsible for actions taken with respect to the evidence

Media Analysis: Recovering information or evidence from information media

Web Analysis: Analysis and examination of web logs and web activity used as potential evidence

Software analysis: analyze and inspect program code (including source code, compiled code and machine code), use decoding and reverse engineering techniques, including author identification and content analysis, etc.;

Hardware/embedded device analysis: should include analysis of mobile devices;

Providers commit several small crimes in the hope that they combined into a larger crime will not attract attention

There was manipulation when entering data

Capture passwords sent between computers

The attacker does not want others to know his real address, so he changes the IP address of the packet so that it points to another address.

Look through other people's trash cans to find discarded documents, information, and other valuable items that could be used against that person or company.

A passive attack, the tools used to eavesdrop on communications can be wireless phone scanners, radio receivers, microphone receivers, voice recorders, network sniffers, etc.

This refers to someone purchasing a domain name with the goal of using a similar domain name to damage a company or to extort money.

T&E's expertise is to provide early understanding of system strengths and weaknesses during the development process during the system life cycle.

Awareness required to manage risk

Empirical data for validating models and simulations

Testing of technical performance and system maturity

Determination of operation and maintenance efficiency, adaptability and production capacity

Identify, manage and reduce risks

What you need to know to manage risk

Empirical data for validating models and simulations

Testing of technical performance and system maturity

Determination of operation and maintenance efficiency, adaptability and survivability

Work with sponsoring organizations to establish or evaluate T&E strategies to support program acquisition/development;

Provide T&E methods that can deeply manage risks;

Monitor T&E processes and changes that may be required

Evaluate and provide recommendations for suitability of test plans and procedures for development testing or operational testing;

It is further expected to understand the rationale behind acquisition/development procedures for establishing and executing T&E strategies;