Unit 1: Summarize Fundamental Security Concepts, Compare Threat Types, Explain Cryptographic Solutions - Subjective Questions

Information security is the practice of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

The CIA triad forms the foundation of security:

• Confidentiality: Ensuring that information is accessible only to those authorized to access it. Achieved through encryption, access controls, and authentication.
• Integrity: Ensuring that information is accurate and complete and has not been tampered with. Achieved through hashing, digital signatures, and checksums.
• Availability: Ensuring that information and systems are accessible to authorized users when needed. Achieved through redundancy, backups, and DDoS protection.

Some models extend this to include Authentication, Authorization, and Non-repudiation (the AAA model and beyond).

The AAA framework governs how users interact securely with systems:

• Authentication: Verifying the identity of a user or system. Example: entering a username and password, or using a fingerprint scan.
• Authorization: Determining what an authenticated user is allowed to do. Example: a standard user cannot access admin settings.
• Accounting (Auditing): Tracking and logging user actions and resource usage. Example: logging which files a user accessed and when.

Non-repudiation is often associated with AAA, ensuring a user cannot deny having performed an action, typically enforced via digital signatures and audit logs.

Security controls can be classified by type (implementation) and function (purpose).

By Type:

• Technical (Logical): Implemented through technology, e.g., firewalls, encryption, antivirus.
• Managerial (Administrative): Policies and procedures, e.g., security policies, risk assessments.
• Operational: Carried out by people, e.g., security guards, awareness training.
• Physical: Tangible controls, e.g., locks, fences, CCTV.

By Function:

• Preventive: Stop an incident before it occurs (e.g., firewall, locks).
• Detective: Identify and record incidents (e.g., IDS, CCTV, logs).
• Corrective: Restore systems after an incident (e.g., backups, patching).
• Deterrent: Discourage attackers (e.g., warning signs, login banners).
• Compensating: Alternative measures when primary control is not feasible.
• Directive: Guide or mandate behavior (e.g., policies, acceptable use).

These three terms are often confused but are distinct:

• Threat: Any potential danger or event that could exploit a weakness to cause harm. Example: a hacker, malware, or natural disaster.
• Vulnerability: A weakness or flaw in a system that could be exploited. Example: unpatched software, weak passwords.
• Risk: The likelihood and potential impact of a threat exploiting a vulnerability. It is the intersection of threats and vulnerabilities.

The relationship can be expressed as:

Example: An unpatched server (vulnerability) targeted by ransomware (threat) creates a risk of data loss.

Threat actors are individuals or groups responsible for security incidents. Key types include:

• Script Kiddies: Low skill, use existing tools; motivated by curiosity or notoriety; limited resources.
• Hacktivists: Driven by political/social causes; moderate skill; motivated by ideology.
• Insider Threats: Employees or contractors with legitimate access; motivated by revenge, money, or negligence; high access level.
• Organized Crime: Well-funded, skilled; motivated by financial gain.
• Nation-State Actors (APTs): Highly sophisticated, extensive resources; motivated by espionage, warfare; use Advanced Persistent Threats.
• Unskilled Attackers / Shadow IT: Unauthorized use of systems within an org creating risk.

Attributes to consider:

• Internal vs. External
• Level of sophistication/capability
• Resources/funding available
• Intent/motivation (financial, espionage, chaos, revenge, ethical).

An attack surface is the total sum of all points (attack vectors) where an unauthorized user can try to enter or extract data from an environment. Reducing the attack surface is a key defensive strategy.

Common threat vectors (attack vectors):

• Message-based: Email (phishing), SMS (smishing), instant messaging.
• Image-based: Malicious code embedded in image files.
• File-based: Infected documents or executables.
• Voice call: Vishing (voice phishing).
• Removable devices: Infected USB drives.
• Unsecure networks: Wireless, wired, Bluetooth.
• Open service ports: Unnecessary running services.
• Default credentials: Unchanged factory passwords.
• Supply chain: Compromised vendors, MSPs, or hardware.

Attack surface reduction techniques include disabling unused ports/services, patching, and least-privilege access.

Social engineering is the psychological manipulation of people into performing actions or divulging confidential information, exploiting human trust rather than technical flaws.

Common techniques:

• Phishing: Fraudulent emails impersonating legitimate entities to steal credentials.
• Spear Phishing: Targeted phishing aimed at specific individuals.
• Whaling: Phishing targeting high-profile executives.
• Vishing: Voice-based phishing over phone calls.
• Smishing: Phishing via SMS text messages.
• Pretexting: Creating a fabricated scenario to obtain information.
• Baiting: Luring victims with something enticing (e.g., free USB drive).
• Tailgating/Piggybacking: Following authorized personnel into secure areas.
• Impersonation: Pretending to be someone with authority.
• Business Email Compromise (BEC): Spoofing executives to authorize fraudulent transfers.

These attacks often leverage principles of influence: authority, urgency, scarcity, familiarity, and consensus.

Social engineers exploit human psychology using several principles of influence:

• Authority: People tend to obey figures of authority. Example: pretending to be IT support or a CEO.
• Urgency: Creating time pressure to force hasty decisions. Example: "Your account will be closed in 1 hour."
• Scarcity: Implying limited availability. Example: "Only 2 licenses left."
• Social Proof (Consensus): People follow the crowd. Example: "Everyone in your department already updated."
• Likeability/Familiarity: Trust from rapport or shared interests.
• Fear/Intimidation: Threatening negative consequences.
• Trust: Building a credible relationship over time.

Understanding these triggers helps organizations design security awareness training to counter manipulation.

Symmetric Encryption:

• Uses a single shared secret key for both encryption and decryption.
• Fast and efficient for large data volumes.
• Challenge: secure key distribution.
• Examples: AES, DES, 3DES, Blowfish, RC4.

Asymmetric Encryption:

• Uses a key pair: a public key (to encrypt) and a private key (to decrypt).
• Slower, used for key exchange and digital signatures.
• Solves the key distribution problem.
• Examples: RSA, ECC, Diffie-Hellman, ElGamal.

In practice, hybrid systems (e.g., TLS) use asymmetric encryption to exchange a symmetric session key.

RSA is an asymmetric algorithm based on the difficulty of factoring large prime numbers.

Key Generation Steps:

1. Choose two large primes and .
2. Compute (the modulus).
3. Compute Euler's totient: .
4. Choose public exponent such that and .
5. Compute private exponent such that .

Keys:

• Public key:
• Private key:

Encryption: For plaintext :

Decryption: For ciphertext :

The security relies on the computational infeasibility of factoring the large modulus back into and .

Hashing is a one-way cryptographic function that converts input data of any size into a fixed-size string (the hash or digest).

Key Properties:

• One-way: Computationally infeasible to reverse.
• Deterministic: Same input always produces the same output.
• Fixed-length output regardless of input size.
• Collision resistance: Hard to find two inputs with the same hash.
• Avalanche effect: A small input change drastically changes the output.

Common Algorithms: MD5 (deprecated), SHA-1 (weak), SHA-256, SHA-3.

Use Cases:

• Password storage (with salting).
• Data integrity verification (file checksums).
• Digital signatures (hashing before signing).
• Blockchain and proof-of-work.

Salting adds random data to inputs before hashing to defend against rainbow table attacks.

Public Key Infrastructure (PKI) is a framework of hardware, software, policies, and procedures used to create, manage, distribute, and revoke digital certificates and manage public-key encryption.

Key Components:

• Certificate Authority (CA): Trusted entity that issues and signs digital certificates.
• Registration Authority (RA): Verifies identity of entities requesting certificates before the CA issues them.
• Digital Certificates (X.509): Bind a public key to an identity.
• Certificate Revocation List (CRL): List of revoked certificates.
• OCSP (Online Certificate Status Protocol): Real-time certificate status checking.
• Certificate Repository: Storage for issued certificates and keys.

Purpose:

• Establish trust between parties.
• Enable secure communication (TLS/SSL).
• Support authentication, confidentiality, and non-repudiation.

PKI uses a chain of trust rooted in a trusted Root CA.

A digital certificate is an electronic document that binds a public key to the identity of its owner, signed by a trusted Certificate Authority (CA).

Standard X.509 Certificate Fields:

• Version: The X.509 version number.
• Serial Number: Unique identifier assigned by the CA.
• Signature Algorithm: Algorithm used to sign the certificate.
• Issuer: The CA that issued the certificate.
• Validity Period: Not-before and not-after dates.
• Subject: The owner/entity the certificate is issued to.
• Subject Public Key: The public key and its algorithm.
• Extensions: Such as Subject Alternative Name (SAN), key usage.
• CA Digital Signature: The CA's signature validating authenticity.

Types of Certificates:

• Wildcard certificates (e.g., *.example.com).
• SAN certificates (multiple domains).
• Self-signed certificates.
• Root, Intermediate, and Leaf certificates in the chain of trust.

A digital signature is a cryptographic mechanism that validates the authenticity and integrity of a message using asymmetric cryptography.

Signing Process (by sender):

1. The message is hashed to produce a digest.
2. The digest is encrypted with the sender's private key to create the signature.
3. The message and signature are sent to the recipient.

Verification Process (by receiver):

1. The receiver hashes the received message.
2. The signature is decrypted using the sender's public key to recover the original digest.
3. If both digests match, the signature is valid.

Security Services Provided:

• Integrity: Confirms the message was not altered.
• Authentication: Confirms the sender's identity.
• Non-repudiation: Sender cannot deny signing, as only they hold the private key.

Note: Digital signatures do not provide confidentiality unless combined with encryption.

Both are symmetric encryption methods but differ in how they process data.

Block Cipher:

• Encrypts data in fixed-size blocks (e.g., 128 bits in AES).
• Uses modes of operation (ECB, CBC, GCM, CTR).
• Suitable for data of known size (files, databases).
• Examples: AES, DES, 3DES, Blowfish.

Stream Cipher:

• Encrypts data one bit or byte at a time.
• Uses a keystream XORed with plaintext.
• Faster and ideal for real-time/continuous data (streaming, voice).
• Examples: RC4, ChaCha20, Salsa20.

Padding is required in block ciphers when data is not a multiple of the block size.

Cryptography protects data across its lifecycle:

Data at Rest (stored data):

• Full Disk Encryption (FDE): e.g., BitLocker, LUKS.
• File/Folder-level encryption.
• Database encryption (Transparent Data Encryption).
• Hardware solutions: TPM, HSM, Self-Encrypting Drives (SED).

Data in Transit (moving data):

• TLS/SSL for web traffic (HTTPS).
• IPsec for VPN tunnels.
• SSH for secure remote access.

Data in Use (data being processed):

• Homomorphic encryption (compute on encrypted data).
• Secure enclaves / Trusted Execution Environments (TEE).

Supporting Technologies:

• Key management systems for lifecycle of keys.
• Tokenization to replace sensitive data with tokens.
• Obfuscation, masking, and steganography.

Key management encompasses the secure generation, distribution, storage, usage, rotation, and destruction of cryptographic keys. Poor key management undermines even the strongest algorithms.

Key Lifecycle Stages:

• Generation: Creating keys using secure random number generators.
• Distribution/Exchange: Securely delivering keys (e.g., via Diffie-Hellman).
• Storage: Protecting keys using HSMs, TPMs, or key vaults.
• Usage: Applying keys for encryption/signing with proper access controls.
• Rotation: Periodically replacing keys to limit exposure.
• Revocation: Invalidating compromised keys.
• Destruction: Securely deleting keys at end of life.

Key Technologies:

• Hardware Security Module (HSM): Dedicated device for key operations.
• Trusted Platform Module (TPM): Chip for key storage on devices.
• Key Escrow: Trusted third party holds copies of keys.

Proper key management ensures confidentiality, integrity, and availability of cryptographic operations.

The Diffie-Hellman (DH) algorithm allows two parties to securely establish a shared secret key over an insecure channel without ever transmitting the key itself.

Steps:

1. Both parties agree on public values: a prime and a generator .
2. Alice chooses a private secret and computes .
3. Bob chooses a private secret and computes .
4. They exchange and publicly.
5. Alice computes the shared key: .
6. Bob computes the shared key: .

Both arrive at the same value:

Purpose:

• Solves the key distribution problem of symmetric encryption.
• Security relies on the Discrete Logarithm Problem.
• Vulnerable to Man-in-the-Middle attacks without authentication, so it is often combined with digital signatures (e.g., in TLS). ECDHE provides forward secrecy.

Non-repudiation is the assurance that a party cannot deny the authenticity of their actions, such as sending a message or signing a document. It provides undeniable proof of origin and integrity.

How cryptography achieves it:

• Digital Signatures: The sender signs a message with their private key. Since only the sender possesses this key, they cannot later deny signing. The receiver verifies with the sender's public key.
• Hashing: Ensures the signed content was not altered.
• PKI: Binds the signing key to a verified identity through certificates, strengthening the proof.
• Timestamps and Audit Logs: Provide additional evidence of when actions occurred.

Importance:

• Critical in legal, financial, and e-commerce transactions.
• Supports accountability and dispute resolution.

Example: A digitally signed contract cannot be repudiated by the signer, as the signature is cryptographically tied to their private key.

These techniques protect data by hiding or substituting sensitive information:

• Obfuscation: Making data or code difficult to understand while preserving functionality. Example: obfuscating source code to deter reverse engineering. It is not true encryption but adds a layer of obscurity.

• Steganography: Concealing data within another non-secret medium so the existence of the message is hidden. Example: hiding text inside an image, audio, or video file. Unlike encryption (which hides meaning), steganography hides existence.

• Tokenization: Replacing sensitive data with a non-sensitive token that maps back to the original via a secure token vault. Example: replacing a credit card number with a random token for processing. Common in PCI DSS compliance.

• Data Masking: Obscuring specific data within a field while keeping it usable. Example: showing a credit card as **** **** **** 1234. Used in test/dev environments to protect real data.

Comparison:

• Encryption and tokenization are reversible with the right key/vault.
• Masking is often irreversible for displayed data.
• Steganography hides presence; obfuscation hides clarity.