Author: admin

Posted on

Security Policy

A comprehensive security policy has a number of benefits, including the following:

  • Demonstrates an organization’s commitment to security
  • Sets the rules for expected behavior
  • Ensures consistency in system operations, software and hardware acquisition and use, and maintenance
  • Defines the legal consequences of violations
  • Gives security staff the backing of management

Security policies are used to inform users, staff, and managers of an organization’s requirements for protecting technology and information assets. A security policy also specifies the mechanisms that are needed to meet security requirements and provides a baseline from which to acquire, configure, and audit computer systems and networks for compliance.

The table lists policies that may be included in a security policy.

Policy Description
Identification and authentication policy Specifies authorized persons that can have access to network resources and identity verification procedures.
Password policies Ensures passwords meet minimum requirements and are changed regularly.
Acceptable Use Policy (AUP) Identifies network applications and uses that are acceptable to the organization. It may also identify ramifications if this policy is violated.
Remote access policy Identifies how remote users can access a network and what is accessible via remote connectivity.
Network maintenance policy Specifies network device operating systems and end user application update procedures.
Incident handling procedures Describes how security incidents are handled.

One of the most common security policy components is an AUP.

A BYOD (Bring Your Own Device) security policy should be developed to accomplish the following:

  • Specify the goals of the BYOD program.
  • Identify which employees can bring their own devices.
  • Identify which devices will be supported.
  • Identify the level of access employees are granted when using personal devices.
  • Describe the rights to access and activities permitted to security personnel on the device.
  • Identify which regulations must be adhered to when using employee devices.
  • Identify safeguards to put in place if a device is compromised.

The table lists BYOD security best practices to help mitigate BYOD vulnerabilities.

Best Practice Description
Password protected access Use unique passwords for each device and account.
Manually control wireless connectivity Turn off Wi-Fi and Bluetooth connectivity when not in use. Connect only to trusted networks.
Keep updated Always keep the device OS and other software updated. Updated software often contains security patches to mitigate against the latest threats or exploits.
Back up data Enable backup of the device in case it is lost or stolen.
Enable “Find my Device” Subscribe to a device locator service with remote wipe feature.
Provide antivirus software Provide antivirus software for approved BYOD devices.
Use Mobile Device Management (MDM) software MDM software enables IT teams to implement security settings and software configurations on all devices that connect to company networks.

Access Control Models

The table lists various types of access control methods.

Access Control Models Description
Discretionary access control (DAC)
  • This is the least restrictive model and allows users to control access to their data as owners of that data.
  • DAC may use ACLs or other methods to specify which users or groups of users have access to the information.
Mandatory access control (MAC)
  • This applies the strictest access control and is typically used in military or mission critical applications.
  • It assigns security level labels to information and enables users with access based on their security level clearance.
Role-based access control (RBAC)
  • Access decisions are based on an individual’s roles and responsibilities within the organization.
  • Different roles are assigned security privileges, and individuals are assigned to the RBAC profile for the role.
  • Roles may include different positions, job classifications or groups of job classifications.
  • Also known as a type of non-discretionary access control.
Attribute-based access control (ABAC) ABAC allows access based on attributes of the object (resource) to be accessed, the subject (user) accessing the resource, and environmental factors regarding how the object is to be accessed, such as time of day.
Rule-based access control (RBAC)
  • Network security staff specify sets of rules regarding or conditions that are associated with access to data or systems.
  • These rules may specify permitted or denied IP addresses, or certain protocols and other conditions.
  • Also known as Rule Based RBAC.
Time-based access control (TAC) TAC Allows access to network resources based on time and day.
AAA Component Description
Authentication
  • Users and administrators must prove that they are who they say they are.
  • Authentication can be established using username and password combinations, challenge and response questions, token cards, and other methods.
  • AAA authentication provides a centralized way to control access to the network.
Authorization
  • After the user is authenticated, authorization services determine which resources the user can access and which operations the user is allowed to perform.
  • An example is “User ‘student’ can access host server XYZ using SSH only.”
Accounting
  • Accounting records what the user does, including what is accessed, the amount of time the resource is accessed, and any changes that were made.
  • Accounting keeps track of how network resources are used.
  • An example is “User ‘student’ accessed host server XYZ using SSH for 15 minutes.”

The table lists the differences between the two protocols.

TACACS+ RADIUS
Functionality It separates authentication, authorization, and accounting functions according to the AAA architecture. This allows modularity of the security server implementation. It combines authentication and authorization but separates accounting, which allows less flexibility in implementation than TACACS+
Standard Mostly Cisco supported Open/RFC standard
Transport TCP port 49 UDP ports 1812 and 1813, or 1645 and 1646
Protocol CHAP Bidirectional challenge and response as used in Challenge Handshake Authentication Protocol (CHAP) Unidirectional challenge and response from the RADIUS security server to the RADIUS client
Confidentiality Encrypts the entire body of the packet but leaves a standard TACACS+ header. Encrypts only the password in the access-request packet from the client to the server. The remainder of the packet is unencrypted, leaving the username, authorized services, and accounting unprotected.
Customization Provides authorization of router commands on a per-user or per-group basis Has no option to authorize router commands on a per-user or per-group basis
Accounting Limited Extensive
Type of Accounting Information Description
Network Accounting Network accounting captures information for all Point-to-Point Protocol (PPP) sessions, including packet and byte counts.
Connection Accounting Connection accounting captures information about all outbound connections that are made from the AAA client, such as by SSH.
EXEC Accounting EXEC accounting captures information about user EXEC terminal sessions (user shells) on the network access server, including username, date, start and stop times, and the access server IP address.
System Accounting System accounting captures information about all system-level events (for example, when the system reboots or when accounting is turned on or off).
Command Accounting Command accounting captures information about the EXEC shell commands for a specified privilege level, as well as the date and time each command was executed, and the user who executed it.
Resource Accounting The Cisco implementation of AAA accounting captures “start” and “stop” record support for connections that have passed user authentication. The additional feature of generating “stop” records for connections that fail to authenticate as part of user authentication is also supported. Such records are necessary for users employing accounting records to manage and monitor their networks.

The table lists a few important network security organizations.

Organization Description
SANS SysAdmin, Audit, Network, Security (SANS) Institute resources are largely free upon request and include:

  • The Internet Storm Center – the popular internet early warning system
  • NewsBites, the weekly digest of news articles about computer security.
  • @RISK, the weekly digest of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked
  • Flash security alerts
  • Reading Room – more than 1,200 award-winning, original research papers.
  • SANS also develops security courses.
Mitre The Mitre Corporation maintains a list of common vulnerabilities and exposures (CVE) used by prominent security organizations.
FIRST Forum of Incident Response and Security Teams (FIRST) is a security organization that brings together a variety of computer security incident response teams from government, commercial, and educational organizations to foster cooperation and coordination in information sharing, incident prevention and rapid reaction.
SecurityNewsWire A security news portal that aggregates the latest breaking news pertaining to alerts, exploits, and vulnerabilities.
(ISC)2 International Information Systems Security Certification Consortium (ISC2) provides vendor neutral education products and career services to more than 75,000+ industry professionals in more than 135 countries.
CIS The Center for Internet Security (CIS) is a focal point for cyber threat prevention, protection, response, and recovery for state, local, tribal, and territorial (SLTT) governments through the Multi-State Information Sharing and Analysis Center (MS-ISAC). The MS-ISAC offers 24×7 cyber threat warnings and advisories, vulnerability identification, and mitigation and incident response.

Cisco Annual Cybersecurity Report and the Mid-Year Cybersecurity Report.

Search the internet to locate and download Cisco Cybersecurity Reports from the Cisco website.

You can also subscribe to receive notifications of new blogs by email. Cisco Talos also offers a series of over 80 podcasts that can be played from the internet or downloaded to your device of choice.

Talos maintains the security incident detection rule sets for the Snort.org, ClamAV, and SpamCop network security tools.

FireEye offers SIEM and SOAR with the Helix Security Platform, which uses behavioral analysis and advanced threat detection and is supported by the FireEye Mandiant worldwide threat intelligence network.

The U.S. Department of Homeland Security (DHS) offers a free service called Automated Indicator Sharing (AIS).

The MITRE Corporation defines unique CVE Identifiers for publicly known information-security vulnerabilities to make it easier to share data.

  • Structured Threat Information Expression (STIX) – This is a set of specifications for exchanging cyber threat information between organizations. The Cyber Observable Expression (CybOX) standard has been incorporated into STIX.
  • Trusted Automated Exchange of Indicator Information (TAXII) – This is the specification for an application layer protocol that allows the communication of CTI over HTTPS. TAXII is designed to support STIX.
  • CybOX – This is a set of standardized schema for specifying, capturing, characterizing, and communicating events and properties of network operations that supports many cybersecurity functions.

The Malware Information Sharing Platform (MISP) is an open source platform for sharing indicators of compromise for newly discovered threats.

Posted on

Evolution of Security Tools

Understanding network security requires you to understand the following terms: threat, vulnerability, attack surface, exploit, and risk. Risk management is the process that balances the operational costs of providing protective measures with the gains achieved by protecting the asset. Four common ways to manage risk are risk acceptance, risk avoidance, risk reduction, and risk transfer. Hacker is a term used to describe a threat actor. White hat hackers are ethical hackers using their skills for good, ethical, and legal purposes. Grey hat hackers are individuals who commit crimes and do unethical things, but not for personal gain or to cause damage. Black hat hackers are criminals who violate computer and network security for personal gain, or for malicious reasons, such as attacking networks. Threat actors include script kiddies, vulnerability brokers, hacktivists, cybercriminals, and state-sponsored hackers. Many network attacks can be prevented by sharing information about indicators of compromise (IOC). Many governments are promoting cybersecurity. CISA and NCSA are examples of such organizations.

 

Categories of Tools Description
password crackers Passwords are the most vulnerable security threat. Password cracking tools are often referred to as password recovery tools and can be used to crack or recover the password. This is accomplished either by removing the original password, after bypassing the data encryption, or by outright discovery of the password. Password crackers repeatedly make guesses in order to crack the password and access the system. Examples of password cracking tools include John the Ripper, Ophcrack, L0phtCrack, THC Hydra, RainbowCrack, and Medusa.
wireless hacking tools Wireless networks are more susceptible to network security threats. Wireless hacking tools are used to intentionally hack into a wireless network to detect security vulnerabilities. Examples of wireless hacking tools include Aircrack-ng, Kismet, InSSIDer, KisMAC, Firesheep, and NetStumbler.
network scanning and hacking tools Network scanning tools are used to probe network devices, servers, and hosts for open TCP or UDP ports. Examples of scanning tools include Nmap, SuperScan, Angry IP Scanner, and NetScanTools.
packet crafting tools Packet crafting tools are used to probe and test a firewall’s robustness using specially crafted forged packets. Examples of such tools include Hping, Scapy, Socat, Yersinia, Netcat, Nping, and Nemesis.
packet sniffers Packet sniffers tools are used to capture and analyze packets within traditional Ethernet LANs or WLANs. Tools include Wireshark, Tcpdump, Ettercap, Dsniff, EtherApe, Paros, Fiddler, Ratproxy, and SSLstrip.
rootkit detectors A rootkit detector is a directory and file integrity checker used by white hats to detect installed root kits. Example tools include AIDE, Netfilter, and PF: OpenBSD Packet Filter.
fuzzers to search vulnerabilities Fuzzers are tools used by threat actors when attempting to discover a computer system’s security vulnerabilities. Examples of fuzzers include Skipfish, Wapiti, and W3af.
forensic tools White hat hackers use forensic tools to sniff out any trace of evidence existing in a particular computer system. Example of tools include Sleuth Kit, Helix, Maltego, and Encase.
debuggers Debugger tools are used by black hats to reverse engineer binary files when writing exploits. They are also used by white hats when analyzing malware. Debugging tools include GDB, WinDbg, IDA Pro, and Immunity Debugger.
hacking operating systems Hacking operating systems are specially designed operating systems preloaded with tools and technologies optimized for hacking. Examples of specially designed hacking operating systems include Kali Linux, SELinux, Knoppix, Parrot OS, and BackBox Linux.
encryption tools These tools safeguard the contents of an organization’s data when it is stored or transmitted. Encryption tools use algorithm schemes to encode the data to prevent unauthorized access to the data. Examples of these tools include VeraCrypt, CipherShed, Open SSH, OpenSSL, OpenVPN, and Stunnel.
vulnerability exploitation tools These tools identify whether a remote host is vulnerable to a security attack. Examples of vulnerability exploitation tools include Metasploit, Core Impact, Sqlmap, Social Engineer Tool Kit, and Netsparker.
vulnerability scanners These tools scan a network or system to identify open ports. They can also be used to scan for known vulnerabilities and scan VMs, BYOD devices, and client databases. Examples of these tools include Nipper, Securia PSI, Core Impact, Nessus, SAINT, and Open VAS.

Note: There are many tools available on the internet to create ARP MiTM attacks including dsniff, Cain & Abel, ettercap, Yersinia, and others.

Posted on

L’ammostamento – Concetti base

L’ammostamento (in inglese Mashing, da to mash, che significa impastare o miscelare), e’ la fase del procedimento all grain che permette di disgregare le eventuali proteine presenti nel malto e produrre zuccheri, definendo il rapporto tra maltosio e destrosio. Senza addentrarci troppo in caratteri tecnici, bastera’ sapere che ammostando a temperature diverse otterremo risultati leggermente diversi: questo e’ per esempio un vantaggio della birra all grain. Ecco per esempio alcune temperature e i rispettivi risultati:

Tra 50 e 52 gradi disgreghiamo le proteine, questo serve per rendere piu’ limpida e stabile la birra, e per migliorare la schiuma: di solito questo step si usa in all grain per il malto Pilsner e dura dai 15 ai 30 minuti.

Tra 60 e 65 gradi si ottiene piu’ maltosio e in pratica si ottiene leggermente piu’ alcol rispetto a temperature piu’ elevate; il tempo di ammostamento per i malti moderni si aggira tra i 30 e i 60 minuti.

Tra 68 e 70 gradi si produce piu’ destrosio che in concreto si traduce con un maggior corpo nella birra; anche qui l’ammostamento puo’ variare dai 30 ai 60 minuti.

A 78 gradi invece di routine facciamo il Mash-Out (questo passaggio sarebbe meglio farlo sempre, anche quando non viene specificato nella ricetta), questo step serve a finire il processo di mash e di solito dura 15 minuti.

Posted on

Directly Connected and Remote Network Routes

The destination network entries in the routing table can be added in several ways:

  • Local Route interfaces – These are added when an interface is configured and active. This entry is only displayed in IOS 15 or newer for IPv4 routes, and all IOS releases for IPv6 routes.
  • Directly connected interfaces – These are added to the routing table when an interface is configured and active.
  • Static routes – These are added when a route is manually configured and the exit interface is active.
  • Dynamic routing protocol – This is added when routing protocols that dynamically learn about the network, such as EIGRP or OSPF, are implemented and networks are identified.

Dynamic routing protocols exchange network reachability information between routers and dynamically adapt to network changes. Each routing protocol uses routing algorithms to determine the best paths between different segments in the network, and updates routing tables with these paths.

Dynamic routing protocols have been used in networks since the late 1980s. One of the first routing protocols was RIP. RIPv1 was released in 1988. As networks evolved and became more complex, new routing protocols emerged. The RIP protocol was updated to RIPv2 to accommodate growth in the network environment. However, RIPv2 still does not scale to the larger network implementations of today. To address the needs of larger networks, two advanced routing protocols were developed: Open Shortest Path First (OSPF) and Intermediate System-to-Intermediate System (IS-IS). Cisco developed the Interior Gateway Routing Protocol (IGRP) and Enhanced IGRP (EIGRP), which also scales well in larger network implementations.

Additionally, there was the need to connect different internetworks and provide routing between them. The Border Gateway Protocol (BGP) is now used between Internet Service Providers (ISPs). BGP is also used between ISPs and their larger private clients to exchange routing information.

The table classifies the protocols. Routers configured with these protocols will periodically send messages to other routers. As a cybersecurity analyst, you will see these messages in various logs and packet captures.

Protocol Interior Gateway Protocols Exterior Gateway Protocols
Distance Vector Link State Path Vector
IPv4 RIPv2 EIGRP OSPFv2 IS-IS BGP-4
IPv6 RIPng EIGRP for IPv6 OSPFv3 IS-IS for IPv6 BGP-MP
Posted on

Run script with jenkins as root

create the script with jenkins group : /pathtoscript.sh

vim /etc/sudoers

add the following row to the conf sudoers file

jenkins    ALL=(ALL)  NOPASSWD: /pathtoscript.sh

be carefull only root can read write execute , jenkins can read and execute not write

chmod 750 /pathtoscript.sh