CYS401 · Chapter 8 · Annotated SlidesSecurity Vulnerabilities, Threats and Countermeasures
Original
Overview

Security Vulnerabilities, Threats and Countermeasures

Vulnerabilities layer by layer: hardware (processors, protection rings, operating and process states), memory protection (MMU, paging, ASLR), storage, I/O, firmware, client and server systems, databases, the cloud (shared responsibility), IoT, web, mobile (BYOD) and OS protection mechanisms. Major 181 and Final 221 B asked about rings, states and emanations.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 50 slides
  1. 1 Security Vulnerabilities, Threats, and Countermeasures
  2. 2 Assess and Mitigate Security Vulnerabilities
  3. 3 Hardware Components
  4. 4 Hardware Components
  5. 5 Protection Mechanisms
  6. 6 1. HW level: Protection rings
  7. 7 2. HW level: Operating states
  8. 8 3. HW level: Process states
  9. 9 Memory Protection Mechanisms
  10. 10 Primary Memory (1/1)
  11. 11 Memory Protection Mechanisms
  12. 12 Memory Protection Mechanisms
  13. 13 Memory Protection Mechanisms
  14. 14 Secondary Memory 1/2
  15. 15 Input/Output Devices
  16. 16 Input/Output Devices - Key Protection Strategies
  17. 17 Firmware
  18. 18 Protecting Client and Server Based Systems
  19. 19 Protecting Client-Based System
  20. 20 Client-Side Protection Measures
  21. 21 Protecting Server Based Systems
  22. 22 Protecting Server Based Systems
  23. 23 Database Systems Security
  24. 24 Database Systems Security
  25. 25 Common Database Threats
  26. 26 • Apply Least Privilege: Grant users only the minimum access necessary for their job
  27. 27 Cloud Computing
  28. 28 Cloud-Based Systems & Cloud Computing
  29. 29 Cloud Security Components & Strategies
  30. 30 Misconfigurations: The leading cause of breaches, where cloud services are improperly secured.
  31. 31 Internet of Things (IoT)
  32. 32 Internet of Things (IoTs) Security
  33. 33 Key IoT Security Challenges & Threats
  34. 34 • Change Default Passwords: Immediately set strong, unique passwords for every device.
  35. 35 Web-Based Security
  36. 36 Assess and Mitigate Vulnerabilities in Web-Based Systems
  37. 37 Planning a
  38. 38 Assess and Mitigate Vulnerabilities in Web-Based Systems
  39. 39 Mobile Devices Security
  40. 40 Assess and Mitigate Vulnerabilities in Mobile Systems
  41. 41 Device Security
  42. 42 Application Security
  43. 43 Bring your own device (BYOD)
  44. 44 Data ownership
  45. 45 Operating System Security
  46. 46 Essential Security Protection Mechanisms
  47. 47 Technical Mechanisms
  48. 48 Policy Mechanisms
  49. 49 OS Hardening?
  50. 50 Slide 50
Slide 1 / 50

Security Vulnerabilities, Threats, and Countermeasures

Slide 1: Security Vulnerabilities, Threats, and Countermeasures
Slide 2 / 50

Assess and Mitigate Security Vulnerabilities

Slide 2: Assess and Mitigate Security Vulnerabilities
Slide 3 / 50

Hardware Components

Slide 3: Hardware Components
Slide 4 / 50

Hardware Components

Slide 4: Hardware Components

Notes

  1. Multithreading: several parts of a program run concurrently on one processor.

Exam angle

PredictionQ1

Running multiple concurrent parts of one program on a single processor is:

Slide 5 / 50

Protection Mechanisms

Slide 5: Protection Mechanisms
Slide 6 / 50

1. HW level: Protection rings

Slide 6: 1. HW level: Protection rings

Notes

  1. Seen again Ch 7, slide 23: Rings and authority levels

Exam angle

Slide 7 / 50

2. HW level: Operating states

Slide 7: 2. HW level: Operating states

Exam angle

PredictionQ1

The “problem state” of a processor is:

Slide 8 / 50

3. HW level: Process states

Slide 8: 3. HW level: Process states
Slide 9 / 50

Memory Protection Mechanisms

Slide 9: Memory Protection Mechanisms
Slide 10 / 50

Primary Memory (1/1)

Slide 10: Primary Memory (1/1)
Slide 11 / 50

Memory Protection Mechanisms

Slide 11: Memory Protection Mechanisms
Slide 12 / 50

Memory Protection Mechanisms

Slide 12: Memory Protection Mechanisms
Slide 13 / 50

Memory Protection Mechanisms

Slide 13: Memory Protection Mechanisms

Exam angle

PredictionQ1

Randomizing the memory addresses of processes to make exploits harder is:

Slide 14 / 50

Secondary Memory 1/2

Slide 14: Secondary Memory 1/2

Notes

  1. Secondary storage keeps data with power off → encrypt it, control access, sanitize before disposal.

  2. Seen again Ch 4, slide 38: Media sanitization

Slide 15 / 50

Input/Output Devices

Slide 15: Input/Output Devices

Notes

  1. I/O devices: keyboards, cameras, monitors, printers. Monitors leak emanations (TEMPEST).

Exam angle

Past exam · Major 181

MCQ · device most susceptible to emanation monitoring

Past exam · Major 181Q1

Which device is most susceptible to monitoring of its electromagnetic emanations (TEMPEST)?

Slide 16 / 50

Input/Output Devices - Key Protection Strategies

Slide 16: Input/Output Devices - Key Protection Strategies
Slide 17 / 50

Firmware

Slide 17: Firmware

Notes

  1. Firmware (microcode) is software in ROM; firmware attacks survive reinstalls.

Slide 18 / 50

Protecting Client and Server Based Systems

Slide 18: Protecting Client and Server Based Systems
Slide 19 / 50

Protecting Client-Based System

Slide 19: Protecting Client-Based System

Notes

  1. Client-side attacks harm the user endpoint (malicious applets, drive-by downloads).

Exam angle

Past exam · Quiz 1 · 222

Related question: Q4 · attacker exploiting plug-ins to install malware

Slide 20 / 50

Client-Side Protection Measures

Slide 20: Client-Side Protection Measures
Slide 21 / 50

Protecting Server Based Systems

Slide 21: Protecting Server Based Systems
Slide 22 / 50

Protecting Server Based Systems

Slide 22: Protecting Server Based Systems
Slide 23 / 50

Database Systems Security

Slide 23: Database Systems Security
Slide 24 / 50

Database Systems Security

Slide 24: Database Systems Security
Slide 25 / 50

Common Database Threats

Slide 25: Common Database Threats

Exam angle

PredictionQ1

Inserting malicious code into queries to manipulate a database is:

Slide 26 / 50

• Apply Least Privilege: Grant users only the minimum access necessary for their job

Slide 26: • Apply Least Privilege: Grant users only the minimum access necessary for their job

Notes

  1. Best practices: least privilege, encryption, parameterized queries, auditing, patching.

Slide 27 / 50

Cloud Computing

Slide 27: Cloud Computing
Slide 28 / 50

Cloud-Based Systems & Cloud Computing

Slide 28: Cloud-Based Systems & Cloud Computing
Slide 29 / 50

Cloud Security Components & Strategies

Slide 29: Cloud Security Components & Strategies

Notes

  1. Memory trick Provider = security OF the cloud. Customer = security IN the cloud.

Exam angle

PredictionQ1

In the shared responsibility model, who secures the customer’s data and access settings?

Slide 30 / 50

Misconfigurations: The leading cause of breaches, where cloud services are improperly secured.

Slide 30: Misconfigurations: The leading cause of breaches, where cloud services are improperly secured.

Notes

  1. Seen again Ch 4, slide 16: ASPs and third parties

Slide 31 / 50

Internet of Things (IoT)

Slide 31: Internet of Things (IoT)
Slide 32 / 50

Internet of Things (IoTs) Security

Slide 32: Internet of Things (IoTs) Security
Slide 33 / 50

Key IoT Security Challenges & Threats

Slide 33: Key IoT Security Challenges & Threats
Slide 34 / 50

• Change Default Passwords: Immediately set strong, unique passwords for every device.

Slide 34: • Change Default Passwords: Immediately set strong, unique passwords for every device.

Exam angle

PredictionQ1

The first thing to do with a new IoT camera is:

Slide 35 / 50

Web-Based Security

Slide 35: Web-Based Security
Slide 36 / 50

Assess and Mitigate Vulnerabilities in Web-Based Systems

Slide 36: Assess and Mitigate Vulnerabilities in Web-Based Systems
Slide 37 / 50

Planning a

Slide 37: Planning a
Slide 38 / 50

Assess and Mitigate Vulnerabilities in Web-Based Systems

Slide 38: Assess and Mitigate Vulnerabilities in Web-Based Systems

Notes

  1. Threats and defences: SQLi (parameterized queries), XSS (input validation, output encoding), CSRF (tokens)…

Exam angle

Past exam · Final 221 · B

Related question: MCQ · not a technique to protect web apps

Slide 39 / 50

Mobile Devices Security

Slide 39: Mobile Devices Security
Slide 40 / 50

Assess and Mitigate Vulnerabilities in Mobile Systems

Slide 40: Assess and Mitigate Vulnerabilities in Mobile Systems
Slide 41 / 50

Device Security

Slide 41: Device Security
Slide 42 / 50

Application Security

Slide 42: Application Security

Notes

  1. Application whitelisting: only approved apps run.

Slide 43 / 50

Bring your own device (BYOD)

Slide 43: Bring your own device (BYOD)
Slide 44 / 50

Data ownership

Slide 44: Data ownership
Slide 45 / 50

Operating System Security

Slide 45: Operating System Security
Slide 46 / 50

Essential Security Protection Mechanisms

Slide 46: Essential Security Protection Mechanisms
Slide 47 / 50

Technical Mechanisms

Slide 47: Technical Mechanisms
Slide 48 / 50

Policy Mechanisms

Slide 48: Policy Mechanisms
Slide 49 / 50

OS Hardening?

Slide 49: OS Hardening?

Notes

  1. OS hardening: remove unneeded services, patch, configure securely.

Slide 50 / 50

Slide 50

Slide 50: Slide 50

Notes

  1. End.