Securing Spaces · ⁨אבטחת מקומות⁩

Learning Objective 2.1.A: Identify social engineering attacks.

• 2.1.A.1 Social engineers use psychological tactics to manipulate targets into taking a desired action.
• 2.1.A.2 Pretexting is when adversaries create a believable reason to contact a target.
• 2.1.A.3 Authority is when adversaries impersonate someone with power over a target or pretend to relay instructions from that person.
• 2.1.A.4 Intimidation is when adversaries state negative consequences if demands aren’t met.
• 2.1.A.5 Consensus is when adversaries create social pressure by making a target believe everyone else is doing a desired action.
• 2.1.A.6 Scarcity is when adversaries create a sense of limited availability.
• 2.1.A.7 Familiarity is when adversaries pretend to be or know someone close to a target to establish trust.
• 2.1.A.8 Urgency is when adversaries create a deadline that requires quick action by a target to avert negative consequences.

Learning Objective 2.1.B: Identify types of adversaries.

• 2.1.B.1 Script kiddies are low-skilled adversaries who use tools developed by others without understanding how the tools work. They are often motivated by greed or a desire for recognition.
• 2.1.B.2 Hacktivists are motivated by social, political, or personal causes. They compromise computers and networks to support their cause or stop perceived harm, believing their goals justify their illegal methods.
• 2.1.B.3 Insider adversaries are unique threats because they have legitimate credentials and access to systems and data. They can be recruited by malicious third parties and can be motivated by greed or revenge.
• 2.1.B.4 Cyberterrorists are motivated by politics or beliefs and seek to disrupt entire communities, regions, or nations through cyberattacks (e.g., attacking a power grid, water treatment plant, or other civil infrastructure). They can act independently or on behalf of governments or criminal organizations.
• 2.1.B.5 Transnational criminal organizations seek financial gain primarily by deploying ransomware and stealing corporate intellectual property (IP) to sell in illegal markets.

Learning Objective 2.1.C: Describe the phases of a cyberattack.

• 2.1.C.1 Cyberattacks aim to disrupt, harm, steal, or destroy devices, networks, or data. Adversaries work in phases, which may not all be used in every attack. The phases are:
  • i. Reconnaissance
  • ii. Initial access
  • iii. Persistence
  • iv. Lateral movement
  • v. Taking action
  • vi. Evading detection
• 2.1.C.2 In the reconnaissance phase of an attack, adversaries gather as much information as possible about their target, often using open source intelligence (OSINT), which is freely available information.
• 2.1.C.3 In the initial-access phase of an attack, adversaries establish a foothold on the target’s computer, often through social engineering or compromised or weak credentials.
• 2.1.C.4 After gaining access during an attack, adversaries establish persistence to maintain access without needing to regain it. They may use a command and control (C2) protocol to send commands to the device and receive output, often through malware like a remote access trojan (RAT) or rootkit.
• 2.1.C.5 In the lateral-movement phase of an attack, adversaries try to escalate their privileges by accessing computers and user accounts with elevated permissions to services and data.
• 2.1.C.6 In the taking-action phase of an attack, adversaries act on their objectives by collecting targeted data, exfiltrating it, and disrupting services or destroying data.
• 2.1.C.7 In the final phase of an attack, many adversaries try to evade detection by removing or editing log files and erasing other files they may have planted on devices (e.g., malware).

Learning Objective 2.1.D: Describe the risk assessment process.

• 2.1.D.1 Risk occurs when a threat can exploit a vulnerability to compromise an asset.
• 2.1.D.2 An asset is anything valuable. Assets include financial resources, intellectual property, data, digital infrastructure, physical property, and reputation.
• 2.1.D.3 Risk assessment considers two factors:
  • The likelihood of an attack against a specific vulnerability
  • The severity of the projected damage from an attack against a specific vulnerability
• 2.1.D.4 The likelihood of a vulnerability being exploited depends on many factors, including:
  • The value of the target: Adversaries are more likely to attack targets they perceive as valuable.
  • The level of skill required to exploit the vulnerability (i.e., the difficulty): Vulnerabilities with well-documented exploits often require less skill and can be carried out by more adversaries.
  • The motivation and capabilities of likely adversaries: Highly motivated and skilled adversaries are more likely to be able to perform more complex exploits.
• 2.1.D.5 The severity of an attack is often measured by financial cost, which can also include reputational and operational impacts.
  • Illustrative examples for 2.1.D.5:
    • A hacktivist is passionate about illegal fishing practices supported by a local food production company. The main webpage of this food production company would be a high-value target for this hacktivist; defacing the webpage to expose the company’s support of illegal fishing would provide no financial gain to the adversary, but would allow them to raise awareness about an issue that motivates them.
• 2.1.D.6 The result of a risk assessment can be quantitative or qualitative.
  • Quantitative risk assessment assigns a numeric value to a vulnerability based on a numeric scale (e.g., 1–10) or quantifiable impact, which could be financial (e.g., a $10,000 annual risk).
  • Illustrative examples for 2.1.D.6:
    • Low, medium, high, severe
    • Unlikely low impact, likely low impact, unlikely high impact, likely high impact
• 2.1.D.7 Risk assessment documentation should include:
  • Vulnerable assets and their value
  • Descriptions of likely threats to the assets
  • Details of specific vulnerabilities for specific assets and how they would be exploited
  • An explanation of the severity of damage (financial, operational, reputational, etc.) if a specific asset were compromised, and the likelihood of that compromise occurring
  • A final rating, quantitative or qualitative, for each risk identified
  • Illustrative examples for 2.1.D.7:
    • Scaled score (e.g., 1–10)
    • Monetary value (e.g., a $10,000 risk vs. a$100,000 risk)

Learning Objective 2.1.E: Identify strategies for managing risk.

• 2.1.E.1 Once a risk has been identified and assessed, an organization has four options for managing that risk:
  • i. Avoid
  • ii. Transfer
  • iii. Mitigate
  • iv. Accept
• 2.1.E.2 Risk avoidance stops the activity that is generating the risk. If the activity is a critical part of an organization’s mission or purpose, then avoidance is not possible.
• 2.1.E.3 Risk transference places the burden of the risk on another entity, such as an insurance company, a government, or consumers.
• 2.1.E.4 Risk mitigation implements security controls to reduce the likelihood or impact of a risk.
• 2.1.E.5 Residual risk is the risk that remains after an organization has gone through avoidance, transference, and mitigation. The residual risk is the level of risk that an organization is willing to accept. Risk acceptance acknowledges the fact that absolute security is unattainable.
• 2.1.E.6 To conserve financial resources and employee capacity, an organization will often favor solutions that are cost effective and easy to implement and maintain. Cost-effective solutions cost less to install and maintain than the expected loss from an attack.

Learning Objective 2.1.F: Identify types of security controls.

• 2.1.F.1 Security controls address at least one of the following principles:
  • Confidentiality ensures that only authorized individuals, systems, or processes can access data. Systems lacking confidentiality are vulnerable to data theft or destruction.
  • Integrity ensures data are accurate and trustworthy. Systems lacking integrity are vulnerable to data manipulation.
  • Availability ensures data and services are accessible to authorized individuals when needed. Systems lacking availability may experience unexpected downtime.
• 2.1.F.2 Security controls can be classified by type.
  • Physical controls provide security in the physical space and include locks, fences, and cameras, bollards, and security guards.
  • Technical controls provide security in the digital space and include firewalls, anti-malware software, and encryption.
  • Managerial controls provide rules, guidelines, policies, and procedures that specify what security should be in place and include password policies, regular access reviews, and incident response plans (IRPs).
• 2.1.F.3 Security controls can be classified by function.
  • Preventative controls address potential vulnerabilities with the goal of stopping an adversary from attacking and include locks and encryption.
  • Detective controls help identify attacks when they occur and include intrusion detection systems (IDSs), cameras, and security incident and event management (SIEM) systems.
  • Corrective controls fix problems and help restore systems to an operational state and include vulnerability patching, repairing a broken card reader, and intrusion prevention systems (IPSs).

Learning Objective 2.1.G: Explain why a defense-in-depth security strategy is necessary to optimally protect an organization.

• 2.1.G.1 A defense-in-depth strategy, or layered defense, uses multiple types of security controls to protect sensitive data and systems.
• 2.1.G.2 A defense-in-depth strategy allows an organization to address different types of threats, each with a security control most suited to mitigate it.
• 2.1.G.3 A defense-in-depth strategy allows for resilience in data protection so when one security control is bypassed by an adversary, another security control may still prevent access to the data or system or limit the damage done to the data or system.
• 2.1.G.4 Layers in a defense-in-depth strategy can include human, physical, network, device, application, and data.

Learning Objective 2.2.A: Identify common physical attacks.

• 2.2.A.1 Adversaries often use social engineering when conducting a physical attack.
• 2.2.A.2 Piggybacking is the name for an attack where an adversary uses social engineering to manipulate an authorized individual to grant the adversary access to a restricted area. Common piggybacking tactics include carrying something large to entice an authorized person to hold the door open, pretending to be an authorized person who has forgotten their access token, or pretending to be a maintenance person who needs to get into a certain area to perform an inspection or repair.
• 2.2.A.3 Tailgating is the name for an attack where an adversary gains unauthorized access to a restricted area by following close behind an authorized individual without that individual’s awareness or knowledge.
• 2.2.A.4 Shoulder surfing is the name for an attack where an adversary watches as a user accesses sensitive information so the adversary can use it later. Sometimes adversaries use a camera to record the target accessing the sensitive information for later analysis.
• 2.2.A.5 Dumpster diving is the name for an attack where an adversary goes through a target’s physical trash to look for information that could be used to help the adversary reach their goal.
• 2.2.A.6 Card cloning is the name for an attack where an adversary makes a copy of an authorized user’s access card so they can gain access to all the resources the user is authorized to access.

Learning Objective 2.2.B: Explain how threats can exploit common physical vulnerabilities to cause loss, damage, disruption, or destruction to assets.

• 2.2.B.1 Threats include human adversaries seeking to cause harm or disruption as well as natural disasters. Natural disasters can cause physical damage or destruction to computers and data as well as disruption of digital services provided by computers.
• 2.2.B.2 Vulnerabilities are weaknesses or flaws that could allow an asset to be compromised. Common compromises include:
  • Unauthorized access to sensitive data or restricted physical spaces
  • Disruption of services
  • Theft or destruction of digital or physical resources
  • Unauthorized modification of data
• 2.2.B.3 When adversaries disrupt power to a device, the device and any services it provides become unavailable. To disrupt power, adversaries may damage fuses or breakers in an electrical box, unplug or cut electrical wiring, or damage power distribution systems like substations and transformers.
• 2.2.B.4 When adversaries gain access to an area with sensitive information, they can steal or copy sensitive information.
• 2.2.B.5 When adversaries gain physical access to a device and its ports, they can plug in a keylogger or external drive containing malware, which could allow them to collect data from a user or possibly even to gain control of the device. With direct physical access adversaries can also physically destroy a device, making the device itself, any data stored on it, and any services it provides unavailable.

Learning Objective 2.2.C: Assess and document risks from physical vulnerabilities.

• 2.2.C.1 Physical access to devices can allow adversaries to bypass many technical controls and layers of security.
• 2.2.C.2 High risks from physical vulnerabilities arise when sensitive information or systems are exposed in physical spaces without sufficiently restricted and controlled access.
  • Illustrative examples for 2.2.C.2:
    • A server that stores customer data is in a room with no lock which is accessed via an unmonitored hallway.
• 2.2.C.3 Moderate risks from physical vulnerabilities arise when a noncritical or nonsensitive part of an organization is left unprotected in a way that it could act as a foothold for an adversary to gain initial access to other resources.
  • Illustrative examples for 2.2.C.3:
    • An office has a reception area beyond which access is controlled; the receptionist has a computer that connects to the office’s internal wireless network and the computer has exposed USB ports.
• 2.2.C.4 Low risks from physical vulnerabilities arise when a vulnerable asset is of low value and the vulnerability is unlikely to be exploited.
  • Illustrative examples for 2.2.C.4:
    • Employees in an office that requires badge access have laptop computers that they leave on their desks unattended when they all go to lunch together. The computers do not contain any sensitive information, but there are no cables securing the devices to the desks.

Learning Objective 2.3.A: Identify managerial controls related to physical security.

• 2.3.A.1 Organizations should conduct employee security awareness training to educate employees about how they can contribute to the organization’s security by:
  • Detecting social engineering attempts like phishing
  • Not badging other people into restricted areas
  • Preventing device theft
• 2.3.A.2 Organizations should have a workstation security policy that outlines the measures necessary to protect a physical workplace. The policy may have tiers of workstation security based on the type of data handled at a workstation. Workstation policies often require:
  • Locking devices before leaving workstations unattended to prevent unauthorized access
  • Clearing sensitive documents off workstations before leaving them unattended (sometimes called a clean desk policy)
  • Using a privacy screen filter or other physical barrier to prevent others from viewing information on the screen
  • Connecting devices to surge protectors or uninterruptible power supplies (UPS)

Learning Objective 2.3.B: Determine mitigation strategies for risks from physical vulnerabilities.

• 2.3.B.1 To determine a relevant control, a cyber defender considers how an adversary could take advantage of a vulnerability to attack a system and how to prevent, detect, or correct the attack.
• 2.3.B.2 Installing physical controls like fencing, gates, and bollards around a building can deter adversaries from trying to physically access an organization’s buildings.
• 2.3.B.3 Locks on doors, server cabinets, and computers can prevent devices from being accessed or stolen.
• 2.3.B.4 Card readers can record which employee badges are being used to access different entries at specific times and deny access to unauthorized badges.
• 2.3.B.5 Access control vestibules and turnstiles can prevent an authorized person from intentionally or accidentally admitting an unauthorized person into a restricted area.
• 2.3.B.6 Organizations can disable USB ports to prevent external drives from loading malware onto a computer.
• 2.3.B.7 An uninterruptible power supply (UPS) provides a backup power source for a device in the event of a power outage. Organizations can also use power generators to provide power at a larger scale to a building or set of critical devices.
• 2.3.B.8 Organizations prioritize risk mitigations based on the severity of the risks and the cost of the recommended mitigations.

Learning Objective 2.4.A: Identify ways security controls can detect physical attacks.

• 2.4.A.1 Cameras can capture a visual record of an adversary’s malicious activity. The feed from a camera should be recorded and monitored for maximum effect. Recordings can be especially helpful in after-incident investigations.
• 2.4.A.2 Security guards can monitor activity in an area and respond to suspicious activity once detected.
• 2.4.A.3 Motion sensors can alert security to movement in an area.
• 2.4.A.4 Employees that work in a physical space are often the first to notice the presence of an unauthorized person and can alert security.

Learning Objective 2.4.B: Determine effective placement of security controls for detecting physical attacks.

• 2.4.B.1 When placing cameras, consideration should be given to visual coverage, angle, and the ability to be tampered with by an adversary. Consideration should also be given to what a camera in a specific area could capture an adversary doing and how that information would be helpful. Points of ingress and egress are often monitored by camera.
• 2.4.B.2 Motion sensors should be placed in areas where traffic is unexpected, like server rooms, or areas where sensitive materials are stored and few people have access. Motion sensors in high-traffic areas create many false alarms, making the alarms less likely to be taken seriously when there is a real security event.
• 2.4.B.3 Locks should be placed on all entries to areas containing sensitive information or systems. For areas with particularly sensitive information or systems, an organization could use an access control vestibule at the entry point to prevent piggybacking or tailgating.
• 2.4.B.4 Security guards can be stationary or patrolling. Stationary guards can provide constant protection for a specific area, entrance, or high-value item. Patrolling guards are more difficult for an adversary to plan around and can create time pressure for an adversary. Placing stationary guards at places that funnel traffic (e.g., entry gates, main entrances or lobbies, and entrances to more secure access areas) can be highly effective, while patrolling guards are better suited for perimeters and exterior areas.

Learning Objective 2.4.C: Apply detection techniques to identify physical attacks.

• 2.4.C.1 Cameras provide visual monitoring and a visual record of activity within a designated space. Cameras can be paired with facial recognition software that can provide alerts when unauthorized individuals enter controlled areas. Once a physical breach has been detected, defenders can use live and recorded camera footage to track an adversary’s path and actions.
• 2.4.C.2 Motion detectors work best when paired with cameras. When a security alert is raised because a motion detector has been activated, defenders can use cameras to check the space visually and verify a physical security breach.
• 2.4.C.3 When employees are required to use an electronic badge to unlock a door to a restricted area, a sensor can record how long the door was open. In reviewing entry logs for the door, potential piggybacking or tailgating can be detected by doors being open for longer than normal lengths of time.