Sys Ops - Mod 5-1a, 1b

Each task, process, and user is only granted the min rights reqfor their job & Limits damage if an acct is compromised

Ensure the info is accessible

A copy of critical data should be maintained

Applications shld ALWAYS do this to sensitive user data & Data stored in plain text is vuln to man-in-the-middle attacks

Why is application security important?

Like a combination of static and dynamic testing & Monitor code while it’s being utilized by user or testing software

Log events to determine who did what, when they did it, and how.

Bugs in OS and software/Mistakes made by administrators

User Education

The most effective way of keeping software secure

What are the first three steps for Building a Secure Server?

Protect info from unauthorized access

Attackers who want to access information

Understand how much work it would take to compromise your network

A shift-left approach, Refers to a focus on finding and addressing security flaws on day one

Analyzes running code & Simulates attacks from an external source

Test the results of unexpected values or inputs

Separation of Privilege

An ethical attacker attempt to break an app & Gives insight into what an external threat may use to compromise your sys

Untrained developers can create unsecure programs

Designed for mobile environments & Focuses on unique ways attacker can leverage mobile OS and the apps running on them

Process of developing, adding, and testing security features within applications

What other action are necessary when Building a Secure Server?

Sec Training for Develop,Adopt a DevSecOps Approach,Automate, Update&Patch Regularly,Encrypt Your Data, &Use Pen-testing

User layers of security mechanisms. Example: A firewall, IPS , and proxy at the network boundary

What describes Risk Assessments?

Systems should fail in a secure manner & It’s better to lose functionality rather than security

Ex. of Automate: PowerShell will auto tell where a script failed & why & Software will automate the Fuzzing process

Maintain Logs

Validate someone is who they say they are

Classic model for information security

Functions should be a separate as possible. Ex: 1 admin in charge of web server, 1 admin- database,Rights do not overlap

What threats need to be mitigated?

Automated testing tools handle simple tasks so you can focus on big ones

What are the components of the CIA Triad?

What are the Types of Application Security?

Validate what a user has permissions to do

Ensure that info is authentic and unedited

Which are Security Testing Tools?

What are the three types of Application Security?

Local - A disgruntled or untrained employee/Remote – A hacker from across the globe

Security mechanisms should be as simple as possible & Over-complexity can create issues

Protect a user’s sensitive data from being seen/used by cybercriminal

Analyze code at fixed points during its development & Allows developers to check code as they write it

Techniques to enhance security at the coding level