foreign [Music]
good evening everyone I'm Dr Mann and I'd like to welcome you to tonight's review session
for the Security Plus exam tonight's topic is threat actors and intelligence Parts one and two
okay our first question tonight involves attack vectors while adding a new employee
to the configured Network you realize that there is an additional Wi-Fi network configured that
you were not aware of as the system owner what term describes what has taken place
please take a few moments look over the answer choices and then let's see what you're thinking
okay so it looks like we've got a few votes for d Shadow I.T
and Shadow I.T is in fact the correct answer Shadow I.T refers to Information
Technology systems deployed by departments other than the central I.T Department
to perhaps work around perceived shortcomings or maybe actual shortcomings of the network
um this often introduces security and compliance issues um kind that we really don't need
the obviously incorrect answers here are going to be penetration testing
and pen testing or ethical hacking authorized simulated Cyber attack on systems
um it is not also industrial camouflage industrial camouflage is really the act of
designing buildings possibly even campuses so as to hide their true size and nature or purpose
and then automated indicators sharing um is basically um a mechanism that allows the sharing
of real-time threat information among communities such as cisa cyber security infrastructure agency
so it really leaves us with the best answer being Shadow I.T okay let's move to the next question
and it will be attack vectors too
okay a company's I.T specialist Joe is currently configuring the firewall settings
he is configuring it so that the web server which resides in the company server room only
allows HTTP connections additionally there are important customer data on the back end database
that is stored on the same post which of the following security problems best fit the scenario
again take a few moments look over the answers and let's see what you're thinking
okay so we have several votes for Choice a
and choice a indirect physical access Insider threat is not the correct answer now as we
look at these choices and let's say we have another vote in the okay we have vote for d
in the chat okay and so direct physical access Insider threat is the correct answer
um I think it's pretty clear that phishing doesn't really
have anything to do with the scenario so we can pretty readily eliminate choices B and C
so Joe who's the I.T specialist working for the company um is directly interacting with
firewall to only allow HTTP connections to the server and this action by job constitutes
an Insider threat because first of all by only allowing HTTP connections to the server
you know we're we're allowing unencrypted data to be transmitted between server and client
and so if there is anybody monitoring then you know they can intercept data and read it but um
this this Insider thread comes from the fact that the I.T specialist working for the company has
made what you might consider a grievous error but really it's it's a little more than that certainly
an I.T specialist is going to understand the ramifications of allowing HTTP connections through
the firewall so the best answer the security problem that best fits this scenario is direct
physical access inside or threat okay all right let's go to the next question
attack vectors pretty
one Infamous example of this type of security issue regarding attack vectors
is the target data breach which was made via targets HVAC supplier
okay take a moment and see what you think
okay that's good this did not take long let's see what you what you're thinking okay
so the majority of votes are for Choice D we supply chain and that is correct
the target data breach was an example of a supply chain attack
um this was way back in 2013 target was hit by one of the largest data breaches in the history
of retail industry and the attackers were able to exploit third-party access to export trade payment
information which ended up impacting more than 41 million customers so in supply chain attack
um it's in the tax strategy that targets an organization through vulnerabilities in its
supply chain these vulnerable areas are usually linked to vendors with poor security practices
a data breach through a third party vendors possible because vendors require access to
sensitive data to integrate with internal systems the choices the rest of the choices are not best
bits or even good fits so with social media the attack Vector of a big one a major one is phishing
um email so an example of an attack using email as the attack Vector would be spear phishing
and cloud-based attacks attacked or attacks that are focused on the cloud services provided to the
company so the choice that best describes this and is the most accurate is supply chain attack
okay
okay attack vectors for
an employee named Janice is on her way to work when she is walking into the office she stumbles
Upon A mysterious thumb drive the next day Janice's computer is filled with malware
even though her company's Network is not connected in any way to any external Networks
what most most likely caused the malware on her computer
see
okay was that b or d did you say d d yeah and let's see what's in the chat yes lots of votes
for deep so Janice connected the removable device to her computer and it was infected okay so that
is the clearly correct answer um and what is this type of attack known as what would you call this
anybody
I read the help once I got that so
so what what kind of attack I did not hear you clearly
okay that might have been ambient noise um so this type of attack is known as baiting
and um it really does play on human nature and our curiosity about things
um I've heard of it being done with you know Optical disks but the
probably the most expedient way to you know Commit This attack is to use something like
the flash drive okay so this is not clicking on email filled with malware
um it's not downloading a malicious file on a web browser or Wii credentials
um if you are talking about malicious files on web browsers we're talking by
Drive talking about drive by download tag um or if we are talking about weak credentials uh the
implication here is that um we're talking about some type of brute forcing attack
um and this obviously happens when you have weak credentials um such as a password um
that might be spelled uppercase P at symbol ssw0rd I know you've all seen this one over and over
so yeah this is a baiting attack description okay I don't know
okay attack vectors fifth question a blank will verify that a vulnerability exists then we'll
actively test and bypass security controls and will finally exploit vulnerabilities on the system
take a look at the choices which term describes the situation
okay we have answers coming into the chat
and it looks like the majority of them are for a we have some choices per d
okay hmm and one for C okay
so the correct answer here is a penetration test okay so colloquially known as pen test or ethical
hacking this is an authorized simulated Cyber attack on a computer system or network performed
to evaluate the security of the system and should not be confused with the vulnerability assessment
a cyber threat hunt or cyber threat hunting is a proactive cyber defense activity
it is the process of proactively and iteratively searching through networks to detect and isolate
Advanced threats that evade existing Security Solutions now vulnerability assessment is the
process of identifying quantifying and ranking the vulnerabilities in a system it's a common
security procedure as it provides a detailed view of the security risks an organization May face
enabling them to better protect their information technology and sensitive data from cyber threats
and finally finally the vulnerability scanner is an automated vulnerability testing tool that
monitors or misconfigurations or coding flows cause pose cyber security threats
vulnerability scanners either rely on a database of known vulnerabilities or probe or common law
types to discover other types of vulnerabilities the best answer here is penetration test
okay
all right moving on to the next question dark net
which of the following is an example of a dark net
okay
let's see what you're thinking
okay so we have some votes for Choice B and D
okay one for all d okay so in this situation the correct answer is D all choices all answer choices
are correct okay so freenet peer-to-peer platform for censorship resistant Anonymous communication
it uses a decentralized distributed data store to keep and deliver information and
has a suite of free software for publishing and communicating on the web without clear censorship
pre-net is considered a part of the dark web it is a decentralized network
that allows for the chain exchange and encrypted data giving users more anonymity okay it's
important to note that not all content on freenet is illegal or harmful and it may be used by people
who want to communicate Anonymous anonymously and securely for legitimate reasons tour is what
anybody
I think most people know what tour is okay we have some responses is
it like a browser oh yeah it's a browser okay what else is it
or what does it use
okay [Music]
that's ipvpn okay so first of all it's short for or an acronym for the onion router free open
source web browser um and allows you of course to use the internet anonymously it is open source
and um the technique used is called onion routing which involves encrypting your data multiple times
then passing it through a network of volunteer run servers so Tor is a critical part of the dark web
um it is often used to create and access the dark web however it is important to
note that not all content on tour is illegal or harmful and again people
could be using it for perfectly legitimate reasons and then i2p who knows what that is
foreign
so i2p the invisible internet project is an anonymous Network layer that allows for
censorship resistance peer-to-peer Communications it is a peer-to-peer distributed communication
layer designed to run any traditional internet service like Usenet IRC file sharing
Etc as well as more traditional distributed applications okay so this also can provide an
encrypted entrance to the dark web and therefore it makes up a part of the dark web ecosystem
okay um I guess also to note the i2p has stayed somewhat clear of criminal and malicious activity
it is still an important data source for Security Professionals and you should be aware of it
okay all right okay good let's move on
[Music]
okay data rules let's see is that the one we're doing we are doing
trying to do these in order so maybe this is a yes here's the first one okay
so which role is primarily responsible for data quality
okay I have one response
two responses for Choice B
okay anybody else have some input into this
may be an a
okay so the correct answer here is data steward now a data Steward is an oversight or data
governance role within an organization and is responsible for ensuring the quality and Fitness
for purpose of the organization's data assets including the metadata for those
they create processes that allow members of the company to interact with data
for example they may create processes for how to collect data how to enter it in databases
and how to share it between databases data stewards use their problem solving skills to
detect the causes of errors in the data and to determine solutions that protect the Integrity
of the data they may also solve problems by creating policies and processes that help
prevent issues that may occur during data collection and maintenance okay
all right so we have several questions involving data roles and responsibilities
let's go to the next one foreign that's [Music] right here okay ready
so what is the data owner primarily responsible for
okay okay so I've heard a and yeah
maintaining the confidentiality integrity and availability of an information asset
um so if you do some research including in your textbook or other places like infosec
the data owner has basically several responsibilities including establishing the
rules for data usage and protection cooperating with information system owners on the security
requirements and security controls for the systems on which the data exists the data owner
also determines how data is classified managed and secured which plays an important role in
the company's cyber security controls a data owner holds accountability for a specific data set okay
all right
let's move on to the next question
okay customer email data is sold to a third party that then gets inadvertently used by spammers
which data role is responsible for this data leak
okay votes for B D and B in the chat okay anybody else want to weigh in on this
okay so the correct answer here is data controller and the data controller is an
individual organization that manages how the data is processed and is responsible for complying
with data protection regulations they manage data processors dictating how the organization
analyzes and uses personal data such as contact information addresses and identification numbers
okay
let's move on to the next one
that will be here okay good your data controller picks a vendor to handle their marketing campaign
but sensitive user information is leaked what role is the third party plane
B okay so you think data privacy officer
or did you say deed data controller I said uh b b okay all right anyone else
I was thinking D because assembly to the last one okay
the email scenario the response in the chat
d okay so the correct answer here is a data processor okay
so um I I think you're seeing that or maybe uh it's feeling like there's some overlap
in the roles and um again especially when preparing for um as part of the
exam you want to be clear on the roles that are related to each other but interact differently
so the role that data processor is to be responsible for carrying out
the actual processing of the data Under The Specific Instructions of the data controller
okay the duties of the data processor may include design create and implement it processes and
systems that would enable the data controller to gather personal data use tools and strategies to
gather personal data and Implement security measures that would Safeguard personal data
the processor must ensure that the people processing the data are subject to the duty
of confidentiality appropriate measures need to be taken to ensure the security of the processing
under a written contract the processor must only engage a sub-processor
with the controller's prior approval so there's a relationship there
but they are different and they do have different responsibilities okay so we have here
yeah and and I see your point they are all similar and vague is there a way to distinguish them
and my suggestion is to use more than one source of information and of course you want
to use trusted sources and read through and make notes um because you're right there there is some
there can be confusion here and again it's because when two roles like processor and controller
can easily be confused you really need to sort of delineate what each role does
and you'll see that one sort of either feeds into the other or manages the other and it
really boils down to again careful research and making some notes and the other thing
the other advice that I can give you that I know works is to try to come up with examples
or finding samples if you find these confusing um I have a few more notes Here that I want to
give you on some of these roles and since we're on data processor right now I would also like to say
that data processors is responsible for creating and implementing process implementing processes
that enable the data controller to gather data store it and transfer it if it's necessary
a processor may be more or less involved in the processing but the main differentiator
is the fact that the controller determines the overall purpose of the processing okay let's see
okay and as far as a data custodian um the data custodian is responsible for the implementation
and maintenance of security controls in a way that meets the requirements for security
has determined by the data owner the data custodian manages the technical environment where
data resides and ensures safe custody transport and storage of the data okay so are they like when
when someone is leaving a company and they have or someone has certain rules in the company do they
manage who has access to that like say you go on vacation and you're in control of certain parts
um you do like a specific job and someone's coming to take over that room light are they
in control over like they divvy out who has access while you're gone kind of yeah it kind
of flows from the owner to the controller and the processor so you know it's not exactly to correct
to say that you know one entity manages it all I really prefer to think of it as sort of the chain
of actions and again typically starting with the owner flowing through the controller the processor
um the custodian has some say for example is um that it was going to be stored on the cloud for
example so so that's like a technical environment where the data would reside and that falls in the
purview of the data custodium so again you know looking at the hierarchical flow could be very
helpful or understanding this um and then there's a question is there any flow chart of these roles
um let's see I mean I've I've looked through the text that these questions um are are developed
from um I don't exactly see or have not seen a flowchart but I think it'd be a great idea
if you made something akin to that it could be a flow chart of roles and responsibilities and
um or or some other hierarchical flow diagram that would you know sort of help you to delineate the
functions associated with each role and again examples usually help to clarify this as well
it can be kind of confusing so again careful notes and
um again a type of a flow chart or a hierarchical layout and organization
okay all right let's move on
let's see [Music] well yeah we've done that one okay all right embedded image is next
okay a detective believes that a terrorist has embedded top secret military information
in an image as a way to create a confidential message Channel with an anonymous user which
of the following techniques describes what the detective believes that terrorists had perpetrated
so
okay so you got lots of responses right away and I'm betting they're all going to
be a that's really good so everybody's on this and the correct answer is steganography okay so
if we look at the other options that are incorrect we should talk about those the key stretching it's
also known as key strengthening and it's a technique used to ensure that a weak key such
as a password is not or does not fall victim to a Brute Force attack um in key stretching a
special algorithm it's used to convert a weak credential or password into a stronger key
um and there are two common algorithms used to strengthen the key uh pbk dm2 and decrypt so pbk
df2 I just have to love these acronyms stands for password-based key derivation function two
um it's a key derivation function with a sliding computational cost used to reduce
vulnerability to Brute Force attacks pvkdf2 applies a pseudo-random function such as a hash
based message authentication code to the input password or passphrase along with the salt value
and we've talked about that in the past and repeats the process many times to produce a
derived clean which can then be used as a cryptographic key in subsequent operations
okay all right let's see clustering is a type of unsupervised machine learning that enables
companies to uncover hidden patterns and structures in large sets of data okay so not
what steganography is it's it's looking for these but steganography is actually doing this
to embed something within something else um let's see clustering means grouping together similar
or related data points that are found throughout the network making it possible to reveal unusual
patterns of activity and detect attacks that would not be detectable by analyzing a single point
clustering techniques can help to uncover the hidden patterns and structures from data sets
okay all right well this is good I think everybody got this very very quickly so good for you
all right and let's take the next question
okay the next question honey pots your organization's I.T specialist
has intentionally configured a honey pot on your network to make sure that your vulnerability
scans are accurate unfortunately the vulnerability scans are not accurate
because they did not report the honey pots as being vulnerable which of the following
is most likely a reason for this malfunction okay take a moment and look at the choices
okay so we have five responses pretty quickly
and they are for Choice D Choice D is correct all answer choices are correct okay
so the scan was not as administered as root so if performing a vulnerability scan you
should ensure that you're performing it um uh well first of all as an unauthenticated user
it's non-credentialed to find out what information is being exposed to unknown persons on the network
and then you should perform the scam as or logged in as an administrative account as
root for example and this way you're unable to collect as much system information as possible
information you couldn't get if you weren't using an administrative account or logged in as root
okay um let's see the vulnerability database needs
to be updated that's a possibility if you're using that and finally
nothing's perfect vulnerability scanners do not always catch everything and that's a fact um
on another note a vulnerability scanner is different from a port scanner the
vulnerability scanner will scan the system for known vulnerabilities and then report the problems
that have been found the vulnerability scanner bases the decisions on a vulnerability database
that is hopefully constantly updated when the vulnerability scanner compares the patch level
and configurations of the systems against the information contained in the database
then it enables you to know if you have been following for example best practices or if
in fact there are vulnerabilities okay all right so that covers those responses okay