Sys Ops - Mod 5-1a, 1b

Security mechanisms should be as simple as possible & Over-complexity can create issues

Automated testing tools handle simple tasks so you can focus on big ones

Protect a user’s sensitive data from being seen/used by cybercriminal

Techniques to enhance security at the coding level

User Education

Functions should be a separate as possible. Ex: 1 admin in charge of web server, 1 admin- database,Rights do not overlap

What are the three types of Application Security?

What threats need to be mitigated?

Ensure that info is authentic and unedited

Separation of Privilege

Log events to determine who did what, when they did it, and how.

What other action are necessary when Building a Secure Server?

What are the first three steps for Building a Secure Server?

Validate someone is who they say they are

Sec Training for Develop,Adopt a DevSecOps Approach,Automate, Update&Patch Regularly,Encrypt Your Data, &Use Pen-testing

A shift-left approach, Refers to a focus on finding and addressing security flaws on day one

Attackers who want to access information

Local - A disgruntled or untrained employee/Remote – A hacker from across the globe

Bugs in OS and software/Mistakes made by administrators

Designed for mobile environments & Focuses on unique ways attacker can leverage mobile OS and the apps running on them

Process of developing, adding, and testing security features within applications

Understand how much work it would take to compromise your network

User layers of security mechanisms. Example: A firewall, IPS , and proxy at the network boundary

Which are Security Testing Tools?

Classic model for information security

Why is application security important?

What are the Types of Application Security?

Validate what a user has permissions to do

Maintain Logs

Test the results of unexpected values or inputs

The most effective way of keeping software secure

Protect info from unauthorized access

Ex. of Automate: PowerShell will auto tell where a script failed & why & Software will automate the Fuzzing process

Analyze code at fixed points during its development & Allows developers to check code as they write it

Applications shld ALWAYS do this to sensitive user data & Data stored in plain text is vuln to man-in-the-middle attacks

What are the components of the CIA Triad?

What describes Risk Assessments?

Ensure the info is accessible

A copy of critical data should be maintained

Systems should fail in a secure manner & It’s better to lose functionality rather than security

Untrained developers can create unsecure programs

Each task, process, and user is only granted the min rights reqfor their job & Limits damage if an acct is compromised

An ethical attacker attempt to break an app & Gives insight into what an external threat may use to compromise your sys

Analyzes running code & Simulates attacks from an external source

Like a combination of static and dynamic testing & Monitor code while it’s being utilized by user or testing software