foreign [Music]
okay good evening everybody and welcome to this review session
the topic tonight is internet encryption part two all right and we are going to start with pop3s
okay so um I'll go ahead and read the question give everybody a little bit of time to take a
look at the responses and then we're going to go ahead and see what you think is the right answer
we'll move on and proceed that way okay you have just interviewed for a new position and you got
the job the HR manager told you to check with your to check your email with instructions on the
next steps so you log into your email account once connected to your email server what does pop3s do
please take a moment look over these responses and then we will see what you think
you can go ahead and put responses in the chat or you can use your microphone if you wish
okay so we have some coming in responses coming in and we have a vote for a and
two votes for C it looks like um so looking at the responses take a look at the port numbers
does that help you
yes okay all right now let's see another vote it's definitely not
D because pop3s is not called secure post office protocol okay and another vote for C
Okay so pop3s uses the TCP protocol on port number which we have two choices here
I was thinking it wasn't 110 because POP3 uses 110 so if it's s it would use a different port that is
absolutely correct it is TCP over Port 995 okay um so that's your first step in sort of you know
discarding at least one of the answers and then we want to look at the other three choices which
you know the first one kind of stands out because Port 995 is what we're looking for but you still
want to read the other choices and make sure that there's nothing in there and of course you
want to read the first choice so pop3s enables a client to securely access email messages stored
in a mailbox on a remote server via TCP Port 995 by default okay all right in the second
pop3s client application securely deletes the contents of his or her mailbox for improved
processing on the local PC before the user is authenticated what do you think about that choice
I was thinking it's a little extreme because of the question about checking
a mailbox yeah so Choice B is eliminated as well as Choice C that really leaves us
with A and D or the first and the last the secure post office protocol version three
receives email message from an email server to store on a cloud application
does that do anything to change everybody's thinking
okay what do you think first choice or Last Choice
okay yeah we got votes for a and that is in fact the correct answer okay so once again
the importance of knowing port numbers and a little bit about the protocols involved as well
um also you should know that pop three
not not secure but pop three does not synchronize between sender and receiver
so once pop tree retrieves emails from an email server the email server will delete the emails
okay and they're probably throwing that in there to use this one as a misdirector okay
all right
next question
remote access VM okay what type of connection concentrator would
you use to gain remote access to your Cloud VMS from your corporate Network
so you don't need to give your Cloud VMS public IP addresses and in this one you're asked to choose
all of the answers that apply please take take a moment and look over the responses
okay all right let's see what everybody's thinking here so we've got responses in the chat
okay so looks like we have a lot of VPN responses okay all right so we can check that um
what do you think about HSM what is HSN
anybody
is it a Hardware security module yes it is
Okay so probably doesn't really qualify it as a connection concentrator that leaves
forward web proxy or jump box
okay all right so if we don't think it's the second choice
that leaves us with the first and fourth so what are you thinking
since it's a choose all that apply obviously you know there's going to be more than one choice
um sometimes in fact most of the time I think it's
important to remember that you're looking for the best answer or best answers okay
personally I'm not familiar with a jump box okay so this is jump box the same as like um
um Bastion not exactly no the jump box also is sometimes known as a jump server
allows access to endpoints on a remote land from a local connection Where You Are
how about the forward proxy
because that's going to retrieve data right perhaps hold on to it so that really doesn't
fit the description of a connection concentrator and that really leaves us with the two best
answers being jump box and VPN Hardware security module is a network device okay Let's see we have
another response here jump box yeah okay so the correct answers here are VPN and jump ups
all right let's move on
okay server configuration oh boy this is one of those long ones
um this is also probably a good time to remind everybody to a read questions very carefully
be read them twice It's always important to know what you're being asked for
okay you have your critical customer web servers running Linux in your DMZ open to the internet
and the web admin group insists on being able to log into these systems as root by
a SSH from home over the internet [Music] also customer data is stored unencrypted on a disk
as the corporate security lead you've been tasked with ensuring that these servers are hardened
which of the following server config ideas could you propose to be enforced
to increase the security profile of these web servers and mitigate against customer
data loss from many intrusions and this time we're asked to take to choose two answers okay
okay so what do you see that can be eliminated fairly straight away
second answer
this one
hey anybody else
Okay so
if I look at these proposed answers when I see Port map SSH Port 23 to a non-standard court
etc etc I really don't need to read much Beyond Port 23 why is that
yeah eliminate B and C SSH is 22. that is correct that is correct so 23
is telnet okay so that really isn't going to do us any good here now you know it just so happens that
and I've seen this happen you know it does happen where uh perhaps you know two out of four answers
are eliminated right off the bat and if you have to choose more than one that leaves the other two
so portmap SSH ports 22 to a non-standard court on the DMZ firewall enforce long username passphrases
Force the move of customer files on disk into a locally encrypted database
so these all sound like techniques that meet the requirements put forth in the question
okay if you want the admins to be able to log in as root by SSH
the question says straight up customer data is stored unencrypted not the best of ideas probably
um you've been tasked with ensuring that the servers are hardened and you want to increase
the security profile and protect customer data so the First Choice ticks the boxes
The Last Choice on the DMZ firewall dnat the web admin home IPS to allow SSH only from those IPS
and that is destination net or network address translation enforce dual Factor authentication for
all server logons logins and migrate the customer files to a separate secure database server and
those suggestions tick the Box so we are left with the first and the fourth choices here
as the best answers or the best solutions to the scenario posed in this question
okay um just gonna put this up here for a moment
um and you can see it looks pretty much like a pretty standard options UI with choices for
protocol and ports and so forth I don't know that we necessarily need this to answer the question
so I'm going to get rid of that okay you are configuring a Wan slash land firewall router
to accept and forward all incoming email traffic
for your MX server traffic from the internet to your internal email server on 192.168.2.100
in your DMZ what originating port protocol and forward to court do you need to configure for
this to work okay please take a moment and look at these choices and when you're ready pick one
okay so what's the obvious one to eliminate
and response in a chat hey yes Port 80 not what we're looking for
okay so that leaves us with e c and d
okay let's see what we have in response okay and that's the one to eliminate okay so uh b c
and d remaining do you see any others that are obvious to eliminate or maybe not so obvious
well clearly this is going to take some knowledge of port numbers
so what are we talking about with Port 25
that's an MTP okay how about 143
foreign
we have some responses in the chat it's interviewing yeah 143 yes 143 with question marks
okay
so IMF yes okay so
one other thing to look at is the protocol can you eliminate another answer based on the protocol
well when can you eliminate B yeah it would eliminate the UDP is not used so once we've
gone through that little mental exercise that leaves us with choices C and D okay and when
email is delivered servers communicate using TCP over port 25. okay so as we've already
mentioned UDP is not going to be used Port 80 and also 143 which is IMAP is not used in the
context of an email Gateway okay so that really leaves us with Choice d as the correct answer
um
so there's mention here in the question of MX server traffic
um what do you think they're getting at
okay so if you kind of dig into this a little bit um at least my interpretation and I'm
is is that we're talking about records MX records as opposed to a records in DNS and so they are
useful because the MX record record differentiates between for example web and email servers okay
so further clue there okay
let's go on to the next question
okay fde nice
Jenny has a Windows laptop that contains a single disk that holds the system files and data
she would like to be to enable full disk encryption on her computer
but her TPM has been damaged what should Jenny configure if she is still required
to store the cryptographic key securely okay so um acronyms which never ever go away uh what is TPM
trusted platform module yes very good trusted platform module
however in the scenario the TPM has been damaged so now we have to figure out
how he goal can be accomplished of storing the cryptographic key securely
so the first thing again and I always tend to do this and I think most people would take the
test too you look at something that is either obviously wrong or probably wrong okay we got
responses in the chat Okay so I know VPN is not it yeah I know everybody in there
everybody had said to see and that's correct so apparently we have lots of Windows users
um BitLocker is is not going to work okay um let's see TPM 1.2 or better is required
um VPN not really making too much sense for what we're trying to do which is store cryptographic
Key securely and a firewall that will filter unauthorized people from accessing the key that's
kind of a silly answer so it really does leave us your choice scene okay all right doing good so far
let's move on to the next one
okay and it seems to be hiding somewhere
here we go okay iot device you need to allow internet connection and management of an embedded
iot device on your internal network but you don't want to expose standard ports to the
open internet what type of router slash firewall configuration allows for this
okay take a moment look at our choices let's see what you think
okay so once again we're looking for something that's
that can be easily eliminated or fairly at least easily eliminated
we have some responses in the chat and okay see two responses for C okay is that what
you think can be easily eliminated or is that what you think we need to do for this question
C is the answer okay all right
okay and let's see we have another response eliminate a okay that's that's very interesting
um if we were going to choose something obvious to eliminate anybody have a suggestion there
okay we have a response in the chat B okay oh that's really interesting
okay so I would have said D Port encapsulation when I think about encapsulating a court I think
of things like trunking encapsulations like 802.1 Q which really doesn't do much for us um
you know stateful packet inspection
um I don't think that fits the bill either
so let's say we're left with port forwarding and dnet
okay so destination that or network address translations translates destination IP addresses
uh usually of internal devices protected um by the device to public IP addresses hmm we want
to allow an internet connection and management of an embedded iot device on your internal Network
so what we're really talking about here is Let's see we have something in the chat we
is a port forwarding support forwarding Maps external IP addresses and ports to internal
IP addresses and ports allowing access to internal services from the internet
um there's a fairly popular example of this does anybody know what it is
maybe something you'd like to do in your spare time
which sadly I don't have enough of but if I did I might play a few more games
right and I might have to do some Port mapping there
report forwarding at least I think that's the the popular use of this as I said I haven't
had too much time to play lately but uh maybe this summer okay let's move on to the next one
okay so we have a question on reconnaissance a threat actor is looking for ways to penetrate
an organization's Network their first step is to perform reconnaissance where they try to discover
which network services are open that shouldn't be which tools should they use to carry out this step
okay so we got some responses in the chat pretty quickly okay so let's see what you're thinking
wow okay it looks like everybody's thinking Choice C so yes that is the overwhelming choice and it is
absolutely correct um protocol analyzer is not going to help right we are looking for
ports that are open and services that are open that should not be these represent vulnerabilities
that can be exploited um Port scanner is the tool you're looking for
protocol analyzers really just capture transmittent traffic
and open source intelligence that's not really what we're looking for here
um vulnerability scanners these can give us the information we're looking for they are sometimes
a bit more intrusive and because the question mentions reconnaissance
the implication is that the threat actor is at this point still trying
to remain unnoticed or at least as much as possum possible so really the best choice
the best answer for this question is Port scanner okay let's move to the next question
okay
SNMP version three encryption algorithm you are required to add encryption support to your SNMP
version 3 implementation which of the following encryption algorithms are you able to use
choose two
okay so what's what's obviously not a good choice here
maybe three days three days okay
see we have some responses in the chat C and D are the answers okay
I think the obvious one to eliminate is md5
why is that
because md5 is old compared to shots of 56. it is and it is very very easily broken it is as you as
you know uh yeah one-way hashing algorithm so we can eliminate that right off the bat
um we're talking about encryption so we have advanced encryption standard
maybe as an answer that sticks out as being correct what do you think
does anybody agree with that yes okay so we'll choose that one we'll
eliminate the second choice that leaves us with sha-256 and triple this foreign
256 because it's a hashing algorithm yeah secure hash algorithm yeah I've probably eliminated for
that when they specifically ask about encryption and also excuse me triple data encryption standard
is also widely used and it's a fact that currently SNMP version 3 supports both of these
um excuse me so yeah those would be my two choices and I believe they are the correct choices
um tell you what we can take a look at what cyber range thinks Let's test it out here oh yeah okay
we have chosen wisely
okay
SNMP question mark simple Network management protocol and in this case version three
very important protocol
okay
all right so let's move on to the next question
okay transport layer oh okay this is nice when this happens by the way you get nice
easy questions which of the following is true regarding the transport layer
I can tell you right now on the B and C are incorrect okay yeah it's not layer seven what
is layer seven in the OSI model application yeah and so yes that is not correct this choice is
not correct and the last choice that says no options are correct I don't buy that either
it's the first choice transport layer involves port numbers
um and I guess while we're we're on this um topic here um and and you can do this however you wish
for questions that involve memorization of several related items such as the OSI model
um it's nice to have a mnemonic device to help you with this
and you've probably heard this before but it Bears out mentioning uh if you're trying to remember
um the layers of the OSI model uh one of the ones used is is from the top down actually from
um layer seven to the bottom and that is all people seem to need data processing
and so the first letter of each of those happen excuse me application presentation
session transport network data link and physical
um and then let's see there's another one
that comes to mind please do not throw sausage pizza away
that's from the bottom up um but whatever works for you okay let's move on to the next question
okay this question involves registry access
okay
your developers have written an application called Finance one that runs on a domain joined
Windows Server called server 10. when Finance one runs it writes to a specific registry team
you need to allow this app to access writing to the registry how should you accomplish this
and of course the first thing that comes to my mind is very very carefully
okay take a look at choices and let's see what you're thinking
as usual looking for something that's easily eliminated
at least one eliminate a because it's an executable file
um okay no I don't think I do that are you you're referring to using regedit.exe
yeah so now I wouldn't eliminate a okay um
B yeah yeah it kind of doesn't make sense uh for me
and maybe I've just been lucky enough to get burned a few times by um messing with the registry
not terribly bad though I always back it up of course um but the last answer d um set server
tends registry to be World writable I don't even like the way that sounds right yeah not even close
it is it does sound absolutely like a disaster waiting to happen
okay um let's see Choice C set up a scheduled job to drop all right access to the registry
for only the time that Finance one runs I mean that's that's impractical that's really
not a good choice so create a registry entry to store Finance one's password yeah I don't think
so the the correct answer here is in fact a create a service account for finance one and assign the
account the appropriate registry permissions and it is done using regenerative um it
it's it doesn't really necessarily have anything to do with you know you're using a Microsoft
operating system or whatever it is you're using but when you were going to do things that involved
changes to critical components especially of things like operating systems
um you always want to play by the rules um and typically the rules
of you know in this case Microsoft so yeah a is the correct answer here
okay and let's move on to the next question
okay I think it's this one no it is not
it's this one okay great okay ipsec how do the ipsec tunnel mode and transport mode
relate to each other take a moment look at your choices let's see what you're thinking
okay so we have some responses in the chat Let's see we have votes for answer C okay wow all right
tunnel mode encapsulates the original Ip packets and transport mode encrypts payload data
and this is the correct answer for this question
if we look at the first both utilized router implementation and that's really not true
um tunnel mode is commonly used between gateways transport mode is more of an end-to-end and you
know I suppose a Gateway could be involved if it was considered a host but that's not usual okay
and then um let's see both ad and authentication header after the IP header and that is incorrect
um actually the do a little research to remember this it's placed before the IP header
and then tunnel mode is used to secure Communications between hosts on a private Network
and transport is used for communication between VPN gateways and it's the opposite
so that's incorrect so yeah C is the correct answer here okay all right
okay
next question salting how would adding a salt to a stored password prostrate an attacker who's trying
to crack your password go ahead and take a couple of seconds or a minute here and look this over
and let's see what you think okay
thanks okay all right
we have more responses in the chat okay so uh looks like several folks have jumped
right out with the correct answer which is B by adding a random value to the plain text input
of a hashing algorithm so the attacker cannot use pre-computed tables or patches
okay um so slowing them down when you put oh go ahead yes I didn't mean to disrupt I was
just gonna ask you what does salting mean I don't know if I heard you explain what salty
wise so it is in fact the act of adding random values to the hashing algorithm so that okay you
know it just makes it that much more difficult for someone to try to crack what you're hashing okay
um in the First Choice slowing them down when you put an initial key that's generated from
a user password to thousands of rounds of hashing now that doesn't make sense
um combining the password hash with a shared Secret to strengthen the password and integrity
no no I'm not interested in shared Secrets here including signs and warnings of legal penalty
penalties so I guess at least this shows that the test makers have this sense of humor um the
correct answer which we've already said is B is in fact the definition of solving okay all right
okay and the next question
types of hardware
which type of Hardware is needed if you must perform centralized
public key infrastructure management for a network of devices
okay take a moment here and look over these choices
okay now we've got some responses in the chat okay and they are a a okay so overwhelmingly
the group has selected a and Hardware security module is correct it's a special trusted Network
computational device that performs cryptographic operations like key management or key exchange
it is not blockchain in fact the word centralized just completely blows that
out of the water neither sniper or password vaults okay all right let's get rid of this
and we have one more here to go over I believe this one is a rerun and oldie but a goody
oh inappropriate too which type of Hardware is needed if you decide to
store digital certificates and cryptographic keys
this one should be I think pretty easy especially after this session
okay lots of responses um I'm betting nobody said A or B let's take a look oh there it is okay it's
all right this is why we're here so we really really wouldn't do this um on a thumb drive the
correct answer is trusted platform module okay and um I wanted to bring this one back because
um if you know by now I mean I think we've seen HSM and TPM and at least uh three questions maybe
maybe some more and hopefully uh this is really solidifying the differences between the two
okay um so clearly one HSM is a network device and TPM is not
okay um on that subject especially since it may come up remember that BitLocker uses it
um and if I remember correctly I believe one of the requirements for upgrading to Windows 11 was
that you needed TPM 2.0 module if I remember correctly
um okay all right then so that's it for the questions on uh part two um okay