Denial-of-service (DoS)

A denial-of-service (DoS) attack is a security threat that occurs when an attacker makes it impossible for legitimate users to access computer systems, network, services or other information technology (IT) resources.

Attackers in these types of attacks typically flood web servers, systems or networks with traffic and makes it difficult or impossible for anyone else to access them.

DoS attacks do not typically result in the theft or loss of significant information or other assets, they can cost the victim a great deal of time and money to handle.

The general methods of DoS attacks are known as flooding services or crashing services.

Flood attacks occur when the system receives too much traffic for the server to buffer, causing them to slow down and eventually stop. Some of flood attacks are:

Buffer overflow attacks – the most common DoS attack. The concept is to send more traffic to a network address than the programmers have built the system to handle.

ICMP (Internet Control Message Protocol) flood – leverages misconfigured network devices by sending spoofed packets that ping every computer on the targeted network, instead of just one specific machine. The network is then triggered to amplify the traffic. This attack is also known as the smurf attack or ping of death.

SYN flood – sends a request to connect to a server, but never completes the handshake. Continues until all open ports are saturated with requests and none are available for legitimate users to connect to.

Other DoS attacks simply exploit vulnerabilities that cause the target system or service to crash. In these attacks, input is sent that takes advantage of bugs in the target that subsequently crash or severely destabilize the system, so that it can’t be accessed or used.

Steps to overcome DoS

 There is no way to completely avoid becoming a target of a DoS but there are proactive steps administrators can take to reduce the effects of an attack on their network.

• Enroll in a DoS protection service that detects abnormal traffic flows and redirects traffic away from your network. The DoS traffic is filtered out, and clean traffic is passed on to your network.
• Create a disaster recovery plan to ensure successful and efficient communication, mitigation, and recovery in the event of an attack.

It is also important to take steps to strengthen the security posture of all of your internet-connected devices in order to prevent them from being compromised.

• Install and maintain antivirus software.
• Install a firewall and configure it to restrict traffic coming into and leaving your computer.
• Evaluate security settings and follow good security practices in order to minimize the access other people have to your information, as well as manage unwanted traffic

Detecting a DoS attack

The best way to detect and identify a DoS attack would be via network traffic monitoring and analysis. Network traffic can be monitored via a firewall or intrusion detection system. An administrator may even set up rules that create an alert upon the detection of an anomalous traffic load and identify the source of the traffic or drops network packets that meet a certain criteria.

The following symptoms could indicate a DoS attack:

• Unusually slow network performance (opening files or accessing websites),
• Unavailability of a particular website, or
• An inability to access any website.

Deception

Cyber security deception is a defense practice that aims to deceive attackers by distributing a collection of traps and decoys across system’s infrastructure to imitate genuine assets.

Aim of deception is to prevent a cyber criminal that has managed to infiltrate a network from doing significant damage.

Deception technology is a simple but effective approach to build security defenses that detect threats early with minimal performance impact on the network.

Decoys are realistic but fake assets (domains, databases, servers, apps ,files, credentials etc)

Decoys are deployed along legitimate assets. If an attacker breached the network, there is no way to differentiate the fake from real. The moment attacker interacts with a decoy, a silent alarm is raised and systems collect information on the attacker’s actions and intent.

Advantages of Deception Technology

The advantages of deception technology are:

1. Improved Threat Detection

‘periscope events’ — a behavior that, when detected, clearly indicates that an attacker is in the network. Deception’s periscope events highly accurate, but with broad threat coverage.

2. Business Risk Awareness

Deception is aligned with the current business threat perception. For example, a company can create deception around that product launch, aligning security controls tightly to areas where the organization perceives risk.

3. Greater Coverage

Deception can be applied across the enterprise, including environments that are often neglected blind spots.

Deception can detect threats at the perimeter, the endpoint, the network, Active Directory, and application layers, as well as offer coverage to more neglected environments such as IoT, and cloud.

Deception also covers the entire kill-chain; from pre-attack reconnaissance to exploitation, privilege escalation, lateral movement, and data-theft / destruction.

4. Extremely Low False Positives

False positives cripple security team productivity. Deception has an intrinsic low false-positive property.

Most behavior-based systems try to establish a normal baseline and then classify any activity above the baseline as anomalous; this leads to a number of false positives. Deception establishes a zero-activity normal baseline, where any activity at all is worthy of investigation.

5. Orchestrated Response

Orchestrated / automated response is most useful only when the trigger event is 100% certain. Plenty of orchestration tooling is being built, not many real-world transformational orchestration use cases exist because there are very few alerts that are 100% certain.

In terms of containment / response use cases, deception alerts can integrate with:

• Network Access Control to Quarantine a compromised asset 
• Web gateways to disable the compromised asset’s Internet access, block phishing sites identified by email decoys.
• Endpoint protection to kill a suspicious process or quarantine the endpoint 
• Directory Services / Identity and Access Management to disable the user’s account, change a password, and enable/enforce two-factor authentication
• Firewalls  to dynamically deny access to network segments

Deception technology provides security teams with a number of tactics and resulting benefits to help:

• Decrease attacker dwell time on their network
• Expedite the average time to detect and remediate threats
• Reduce alert fatigue 
• Produce metrics surrounding indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).

Biometrics

Biometrics allows a person to be identified and authenticated based on recognizable and verifiable data, unique and specific. 

Biometrics is the most suitable means of identifying and authenticating individuals in a reliable and fast way through unique biological characteristics.

Biometrics are biological measurements — or physical characteristics — that can be used to identify individuals. For example, fingerprint mapping, facial recognition, and retina scans are all forms of biometrics.

Types of biometrics

The two main types of biometric identifiers are either physiological characteristics or behavioral characteristics.

Physiological identifiers relate to the composition of the user being authenticated and include the following:

• facial recognition
• fingerprints
• finger geometry (the size and position of fingers)
• iris recognition
• retina scanning
• voice recognition
• DNA (deoxyribonucleic acid) matching

 

Behavioral identifiers include the unique ways in which individuals act, including recognition of typing patterns, mouse and finger movements, website and social media engagement patterns, walking gait and other gestures.

Advantages and disadvantages of biometrics

Biometrics are beneficial for the following reasons:

• hard to fake or steal, unlike passwords;
• easy and convenient to use;
• generally, the same over the course of a user's life;
• nontransferable; and
• Efficient because templates take up less storage.

Disadvantages, however, include the following:

• It is costly to get a biometric system up and running.
• If the system fails to capture all of the biometric data, it can lead to failure in identifying a user.
• Databases holding biometric data can still be hacked.
• Errors such as false rejects and false accepts can still happen.
• If a user gets injured, then a biometric authentication system may not work -- for example, if a user burns their hand, then a fingerprint scanner may not be able to identify them.

Authentication

Authentication is the process of recognizing a user’s identity. Authentication keeps invalid users out of databases, networks, and other resources. These types of authentication use factors, a category of credential for verification, to confirm user identity.

Types of authentication

i. Single-Factor/Primary Authentication

The most common form of authentication, Single-Factor Authentication, is also the least secure, as it only requires one factor to gain full system access. It could be a username and password, pin-number or another simple code. While user-friendly, Single-Factor authenticated systems are relatively easy to infiltrate by phishing, key logging, or mere guessing.

ii. Two-Factor Authentication (2FA)

Two-factor authentication reinforces security efforts. It is an added layer that essentially double-checks that a user is, in reality, the user they’re attempting to log in as—making it much harder to break.

With this method, users enter their primary authentication credentials (like the username/password mentioned above) and then must input a secondary piece of identifying information.

Possible secondary factors are a one-time password from an authenticator app, a phone number, or device that can receive a push notification or SMS code, or a biometric like fingerprint (Touch ID) or facial (Face ID) or voice recognition.

iii. Multi-Factor Authentication (MFA)

Multi-factor authentication is a high-assurance method, as it uses more system-irrelevant factors to legitimize users. Like 2FA, MFA uses factors like biometrics, device-based confirmation, additional passwords, and even location or behavior-based information (e.g., keystroke pattern or typing speed) to confirm user identity. However, the difference is that while 2FA always utilizes only two factors, MFA could use two or three, with the ability to vary between sessions, adding an elusive element for invalid users.

Authentication protocols

Authentication protocols are the designated rules for interaction and verification that endpoints (laptops, desktops, phones, servers, etc.) or systems use to communicate. 

Selecting the right authentication protocol for an organization is essential for ensuring secure operations.

i. Password Authentication Protocol (PAP)

PAP is the least secure protocol for validating users, due mostly to its lack of encryption. It is essentially a routine log in process that requires a username and password combination to access a given system, which validates the provided credentials.

ii. Challenge Handshake Authentication Protocol (CHAP)

CHAP is an identity verification protocol that verifies a user to a given network with a higher standard of encryption using a three-way exchange of a “secret.”

First, the local router sends a “challenge” to the remote host, which then sends a response with an MD5 hash function. The router matches against its expected response (hash value), and depending on whether the router determines a match, it establishes an authenticated connection—the “handshake”—or denies access.

It is inherently more secure than PAP, as the router can send a challenge at any point during a session, and PAP only operates on the initial authentication approval.

iii. Extensible Authentication Protocol (EAP)

This protocol supports many types of authentication, from one-time passwords to smart cards. When used for wireless communications, EAP is the highest level of security as it allows a given access point and remote device to perform mutual authentication with built-in encryption. It connects users to the access point that requests credentials, confirms identity via an authentication server, and then makes another request for an additional form of user identification to again confirm via the server—completing the process with all messages transmitted, encrypted.

Audit

A cyber security audit is a systematic and independent examination of an organization’s cyber security. An audit ensures that the proper security controls, policies, and procedures are in place and working effectively.

Audits play a critical role in helping organizations avoid cyber threats. They identify and test organizations security in order to highlight any weaknesses or vulnerabilities that could be exploited.

A cyber security audit focuses on cyber security standards, guidelines, and policies. Furthermore, it focuses on ensuring that all security controls are optimized, and all compliance requirements are met.

Cyber Security audit evaluates:

• Operational Security (a review of policies, procedures, and security controls)
• Data Security (a review of encryption use, network access control, data security during transmission and storage)
• System Security (a review of patching processes, hardening processes, role-based access, management of privileged accounts, etc.)
• Network Security (a review of network and security controls, anti-virus configurations, security monitoring capabilities)
• Physical Security (a review of role-based access controls, disk encryption, multifactor authentication, biometric data, etc.)

Benefits of a cyber security audit

A cyber security audit is the highest level of assurance service that an independent cyber security company offers.

An audit adds an independent line of sight that is uniquely equipped to evaluate as well as improve your security.

Some of benefits of performing an audit are:

• Identifying gaps in security
• Highlight weaknesses
• Compliance
• Reputational value
• Testing controls
• Improving security posture
• Staying ahead of bad actors
• Assurance to vendors, employees, and clients
• Confidence in your security controls
• Increased performance of your technology and security

Cybersecurity audits

There are four core cybersecurity audits:

1. Risk assessment
2. Vulnerability assessment
3. Penetration testing
4. Compliance audit

Risk assessment

Performing risk assessments will help recognise and prioritise risks and help identify different types of threats that your businesses could be vulnerable to.

Vulnerability assessment 

A vulnerabilities assessment works to identify weaknesses and possible risks. A vulnerabilities assessment will reveal areas that could be exploited to harm a business.

Penetration testing

Penetration testing simulates a hacking attempt. An expert will act as a ‘hacker’ and attempt to break into your company’s security system. By using different techniques, the hacker will attempt to bypass the security systems, which will highlight areas of the businesses IT security that needs improving/upgrading.

Compliance audit 

Compliance audits are necessary for businesses such as retail, finance, healthcare, or government who must comply with certain regulations. Compliance audits are to show that a company meets the laws required to conduct businesses safely in their industry.

Access Control

Access control is a data security process that enables organizations to manage who is authorized to access corporate data and resources. Secure access control uses policies that verify users are who they claim to be and ensures appropriate control access levels are granted to user.

Access control is used to verify the identity of users attempting to log in to digital resources.

Access control is crucial to helping organizations comply with various data privacy regulations.

Components of Access Control

Authentication

Authentication is the initial process of establishing the identity of a user. For example, when a user signs in to their email service or online banking account with a username and password combination, their identity has been authenticated. However, authentication alone is not sufficient to protect organizations’ data. 

Authorization

Authorization adds an extra layer of security to the authentication process. It specifies access rights and privileges to resources to determine whether the user should be granted access to data or make a specific transaction. 

Access

Once a user has completed the authentication and authorization steps, their identity will be verified. This grants them access to the resource they are attempting to log in to.

Manage

Organizations can manage their access control system by adding and removing the authentication and authorization of their users and systems. Managing these systems can become complex in modern IT environments that comprise cloud services and on-premises systems.

Audit

Organizations can enforce the principle of least privilege through the access control audit process. This enables them to gather data around user activity and analyze that information to discover potential access violations.

Access control can be categorized as

i. Physical Access Control: used to grant access to physical buildings and physical devices.

ii. Logical/Information Access Control: involves tools and protocols being used to identify, authenticate, and authorize users in computer systems. The access controller system enforces measures for data, processes, programs, and systems.

Types of Access Controls

There are several types of access controls that organizations can implement for access control. These include:

i. Attribute-based Access Control (ABAC)

ABAC provides access to users based on who they are rather than what they do. For example, the business unit they work in and how they were hired.

Attribute-based access control (ABAC) is an authorization system that defines access based on attributes associated with security principals, resources, and environment.

Attributes allow for an easier control structure because permissions can be based on the user’s type, location, department and so on, mirroring the physical aspects of the business.

ii. Discretionary Access Control (DAC)

DAC models allow the data owner to decide access control by assigning access rights to rules that users specify. When a user is granted access to a system, they can then provide access to other users as they see fit.

iii. Mandatory Access Control (MAC)

MAC places strict policies on individual users and the data, resources, and systems they want to access. The policies are managed by an organization’s administrator. Users are not able to alter, revoke, or set permissions.

iv. Role-Based Access Control (RBAC)

RBAC creates permissions based on groups of users, roles that users hold, and actions that users take. Users are able to perform any action enabled to their role and cannot change the access control level they are assigned.

v. Rule-based Access Control

A rule-based approach sees a system admin define rules that govern access to corporate resources. These rules are typically built around conditions, such as the location or time of day that users access resources. 

vi. Break-glass Access Control

Break-glass access control involves the creation of an emergency account that bypasses regular permissions. In the event of a critical emergency, the user is given immediate access to a system or account they would not usually be authorized to use.

Cyber Security safeguards

Cyber security safeguards are protective measures and controls prescribed to meet the security requirements specified for an information system.

Safeguards may include security features, management constraints, personnel security, and security of physical structures, areas, and devices.

The 3 categories for data protection safeguards are administrative, physical, and technical which are intended to ensure the confidentiality, integrity and availability of data files and records.

Administrative Safeguards

Administrative data protection safeguards or procedural controls refer to approved policies, procedures, standards and guidelines for running the business. From a security standpoint, they include access requests and approvals, periodic access reviews, supervision, and training.

Administrative safeguards are operational processes and procedures which are used to control an individual’s access to systems and data.

Physical Safeguards

Physical safeguards are physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment from natural and environmental hazards, and unauthorized intrusion. The standards under physical safeguards include facility access controls, workstation use, workstation security, and device and media controls. The Security Rule requires covered entities to implement physical safeguard standards for their electronic information systems whether such systems are housed on the covered entity’s premises or at another location.

Technical Safeguards

Technical data protection safeguards in a broader sense are the system controls and tools which are designed to protect data such as user authentication and passwords, account lockout during extended inactivity periods, and network intrusion prevention or detection controls. Another example of technical safeguard is system configuration to require strong passwords from our associates and lock the system down if too many unsuccessful attempts are made to gain entry to the system.

Technical Safeguards involve the hardware and software components of an information system, including:

• Identification and authentication
• Encryption
• Firewalls
• Malware protection
• Application design