CYSE 101 midterm

What are we trying to protect in CYSE? - answer-Confidentiality, integrity and availability (of information, systems resources etc.) What is confidentiality? - answer-unauthorized users cannot access sensitive information What is integrity? - answer-Information is complete and uncorrupted What is availability? - answer-Authorized users can get to the information or resources What is vulnerability? - answer-a flaw, weakness or hole in a system or component What is a threat? - answer-Something (person, code, nature) that exploits a vulnerability to affect C,I and or A What is risk? - answer-Vulnerabilities + Threats What is an incident? - answer-realized risk What is Lodz Tram hack? - answer-Teen was switching railroad switch with a TV remote and causing derailment. Lodz tram hack Impact? - answer-Integrity - data accessed and used, by unauthorized users. Availability - authorized users did not have control/access Lodz tram hack vulnerabilities? - answer-Lack of authentication moderate sophistication Lodz tram hack threats? - answer-Juvenile Could have been: terrorists, cyber criminals (extortion) Lodz tram hack countermeasures? - answer-Authentication (encryption) Physical security What is Polycom HDX? - answer-Polycom firewall opened up to incoming traffic when call was received, hackers were sending false packets to gain control of the system Polycom HDX impacts? - answer-Confidentiality - could be listening/ watching getting info availability - can control the machine and who has access of it integrity - can change/modify the system Polycom HDX vulnerabilities? - answer-Access control content checking (does not) software flaw Polycom HDX threats? - answer-Cyber criminals Competitor businesses terrorists hackers foreign intelligence Polycom HDX countermeasures? - answer-Network fire wall control who can access application code review A mission requires (a) the right people (b) having access to (c) the right data - answer-a - confidentiality b - availability c- integrity What is the effect ("cost") of a mission-impacting event weighted by the probability that such an event will happen? - answer-risk What the tools and techniques we use to reduce risk (and hence provide greater mission capabilities and reliability)? - answer-countermeasures What are the three categories of countermeasures? - answer-Protect (block, prevent) - Detect (when something does happen, bad actor gets through, etc.) - React (respond to an adverse event quickly and to minimize mission impact) Why is it important to use/understand the offensive measures? - answer-our adversaries are in a similar position so we aim to disrupt their mission capabilities and/or collect intelligence and/or conduct operations via cyber means Why is it important to use /understand the deceptive measures? - answer-can be used defensively (to decrease our adversaries' attack effectiveness or increase his costs) or offensively (to further disrupt his mission capability or increase his costs) In communication (using lightbulb and battery one way) what does it mean if the light is on on computer B's side? - answer-A is connected and A can only talk to B What do an FM and AM waves look like? - answer- How do digital waves work? - answer-Send information using 0s and 1s How do networks work? - answer-Users connecting and website servers are loaded into a switch, which takes lots of connections. A handful of the connections are briefly switched into the router which links to the internet. What is Mirai Botnet? - answer-Used worms to infect the internet of things. Scanned Ip ranges for common passwords, avoided smart devices. Only infected memory. Removed other malware. The bots were connected to the same domain (which the operator could change). Used the bots to attack and crowd krebs, OVH, dynDNS (reddit) What is the internet of things? - answer-the idea that everything / every device could be given an ip address and put on the internet. Ex. using your phone to turn on your microwave generally does not include servers, laptops, smart phones etc Mirai Botnet impacts? - answer-Availability - of targets (took control of them) confidentiality (of systems that were botted) integrity(created false web requests to block availability to the sites) Mirai Botnet vulnerabilities? - answer-Weak authentication of things botted (same password for all) Lack of device access filtering (ridding the worms) Limited site bandwiths Lack of target filtering (filtering out the bots) Mirai Botnet threats? - answer-Cybercriminals (extortion) script kiddies (fun, fame) terrorists Mirai Botnet countermeasures? - answer-better authentication check for default passwords in firmware firewalls to filter access and attack increase network bandwiths use devices to detect attacks What is identification? - answer-Who are you? What is verification? - answer-Confirming who you are What is authentication? - answer-Proving who you are. Something you know, have, are, do, place What is authorization? - answer-What you can do How many possibilities per digit in a numeric password? How many possibilities for a four digit password? - answer-10. 10*10*10*10 = 10^4 (10k possibilities) What is biometrics? - answer-Something you are What is universality? - answer-Something everyone has What is uniqueness? - answer-Something that is different to everyone What is permanence? - answer-Does not change What is collectability? - answer-Something you can (easily) get What is performance? - answer-If it is fast and accurate What is acceptability? - answer-Will people allow you to get it? What is circumvention? - answer-How hard it is to fool What is False acceptance rate? - answer-false positive What is false rejection rate? - answer-false negative What are features (minutiae) of fingerprints? - answer-Type Orientation Spatial Frequency Curvature Position Crossover core bifurcation ridge ending island delta pore What are physiological types of biometrics? - answer-- Fingerprint - Hand (including knuckle, palm, vascular) - Face - Voice - Retina - Iris - DNA - Even Odor, Earlobe, Sweat pore, Lips Is voice the same as speech recognition? - answer-no • Considered physiological and behavioral • Popular and low-cost, but less accurate and sometimes lengthy enrollment • Capable of working over the phone What is the yahoo breach? - answer-went from 26 to 3 billion infected. names, dates of birth, email addresses and hashed passwords (some strongly hashed, some not), and security questions and answers were breeched. Spear phishing was used (sent