Chapter 9: Legal, Regulations, Compliance, and Investigations - Fraud and Abuse Attack Types

Salami - bunch of small crimes in hopes a larger one will be looked over.

Data Diddling - Altering data.

Password Sniffing - Trying to catch passwords being sent from place to place.

IP Spoofing - Changing IP address so that it is harder for criminal to get caught

Dumpster Diving - Looking through trash data in hopes of finding something valuable.

Wiretapping - Any form of eavesdropping that uses tech.

Cybersquatting - Good example is purchasing a domain name that is extremely similar to the company that the person wants to take away business from. Goal is to reduce traffic to real site and carry out extortion.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Investigations Continued

Just like traditional criminals, computer criminals have a reason for doing the bad things that they do. There are three terms that help better put criminal activity into perspective.

Motive-why the person is committing the crime. It could be for monetary gain, or simply because they get a rush by seeing if they can get away with it.

Opportunity-Where and when the crime happens. If a criminal sees that a companies firewall is down at a certain time, this is their time to attack.

Means-Does the criminal have what it takes to commit the crime they want to? This could include intellect and the hardware necessary to commit the crime.

Types of Evidence:
Best- primary; provides the most reliability
Secondary- unreliable evidence
Direct- fact proving evidence
Conclusive- cannot be contradicted
Circumstantial- proves intermediate facts
Corroborative- supporting that helps prove something else
Opinion- opinion rule; can only testify to the facts
Hearsay- written or oral; no firsthand proof

Chapter 9: Legal, Regulations, Compliance, and Investigations - Investigations

A lot of the time, the person that is done wrong in a computer crime is not even aware of it. There is a difference between an event and an incident concerning incident management. Events can be documented and observed. An incident is many of these negative events that hurt a company. The study guide makes a point to mention that most companies do not even have an incident management program. They just have a response process. The study guide goes even further stating that companies need to have an incident management process, because there is no sense in having a plan if you do not even know the bad things thats are going on. The definition of investigation from a computer security standpoint is pretty standard. You collect data, and analyze it to find out how bad the incident was/is and figure out how the incident happened.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Liability and Its Ramifications

Not only should lawmakers refine what a computer crime is and its consequences but corporations should as well. They have to take responsibility for the crimes that they might potentially be liable for, and take precautions and measures to prevent these types of things from happening. no company wants to be hit with a fine for something they did that they were not aware was against the law. This is why it is so important to stay on top of emerging computing laws and standards. When a company has done all that it can do to to prevent bad things from happening, it is known as due care. In other words, the company did everything it was supposed to do to prevent against crime. Due diligence is kind of opposite, in that it made sure that it was not in violation of any rules and regulations. Downstream liability means that companies are not unlawfully affecting other companies.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Privacy

Here I want to list what the study guide states is personally identifiable information. I did not know that there was a distinct list for this and I find it interesting.

-Full Name
-National Identification Number (SSN)
-Sometimes an IP address can be used here
- Tag number of a vehicle
- DL number
- Someone's face
-Fingerprints
-A person's handwriting
-Credit card numbers
-A digital id
-Birthdate
-place of birth
-Genetic code (DNA I'm assuming)

Privacy is always threatened these days since we are so reliant on technology. Privacy must be a main concern for three main reasons. More and more data centers are being built and maintained that include a plethora of valuable, personal info. Also, globalization is occurring at a rapid pace. All of your personal data can be transferred to foreign places in an instant! Finally, BI is big these days, and information like could be very valuable to certain individuals. Privacy laws are emerging at a rapid pace. This is why becoming a CISSP might be a great career choice as they will be needed more and more as time progresses.  

Chapter 9: Legal, Regulations, Compliance, and Investigations - Intellectual Property Laws

There are four main intellectual property laws. The first is a trade secret.  These are proprietary to a company, and are vital to the success of it. Non-disclosure agreements are common if you go to work for a company with trade secrets. An example of a trade secret is the formula used in a soft drink. Second, there is copyright law. It protects an author or maker of something. The author controls the distribution, replication, and changes to their work. Even computer programs can be copyrighted. The third type is a trademark. The trademark is essentially used to protect the identity of something. This is why you see the small c or TM next to logos. The last type of intellectual property law is a patent. They are used to protect a company's or individual's inventions. After an invention is patented, others cannot make, use, or sell the invention without permission from the original inventor, or until the patent expires.

Chapter 9: Legal, Regulations, Compliance, and Investigations - Types of Legal Systems

Civil (Code) Law System
- Used in Eurpoe
- Based on rules not precedence

Common Law System
- Based on previous interpretations of the law. Uses judges and juries - what we have in the U.S.
- Broken down into criminal and civil law.
  -Criminal law: behavior that hurts other people
  -Civil law: Here, the wrongdoer "owes" the victim restitution.

Customary Law System
- Used in countries such as China or India
- Based on the traditions of a place
- Looks at a person's behavioral pattern

Religious Law System
- Laws are not created, they are "uncovered" based on particular religions
- Morality is usually included in this type of system
- Laws and rules are from God, not made and implemented by humans.
- Is often used in Islamic countries based on the Koran.

Mixed Law System
- Two or more systems are used together
- Different types of law will often be associated with different kinds of crimes
- Countries that use this type are Canada and Holland

Chapter 9: Legal, Regulations, Compliance, and Investigations - Cyber Legalities Overview

There are three distinct types of computer crime laws:

1. Computer assisted crime - Criminal uses a computer to commit the actual crime or wrongdoing.

2. Computer targeted crime - Crime in which a computer is the actual victim because the criminal intended to cause harm to the computer or the computer's owner.

3. Computer is incidental crime - When a computer happens to be involved in criminal activity.

The main point to take away from this is that computer assisted crimes are crimes in which people use computer to carry out what some would call "regular" crimes such as theft and destruction. Also, computer targeted crimes absolutely cannot take place without a computer, whereas a computer assisted crime could. An example of a computer is incidental crime would be a crime in which a computer does not cause harm to another machine, a computer is not being attacked, but a computer is still used in some way to commit a crime.

Chapter 8: Business Continuity and Disaster Recovery - Recovery and Restoration

When it comes to trying to recover from a harmful event to business processes, there should always be a restoration team and a salvage team. The restoration team will get the offsite facility ready to go, while the salvage team will begin to fix the site that was effected by the disaster. After something negative has happened that effects the continuity of business, the effects of the disaster should be analyzed. This is where the damage assessment team comes in. After there two things have been accomplished, the business is then in a state known as recovery phase. All of these processes should already be in place. That is what the BCP is for. If a company is in these states, the BCP is in action and should be carried out explicitly. After all has calmed down, the company is then in a state known as the restitution phase. They will either move back into the original site, or move to a new one.

Chapter 8: Business Continuity and Disaster Recovery - Data Backup

When backing up data, a company should use disk shadowing instead of disk mirroring because data can be stored on multiple disks. Electronic vaulting is another method of data backup that companies should use. Files are copied as they are changed, and from time to time they are sent away to a backup facility. Remote journaling can also be used. It is similar to electronic vaulting, but only the changes are backed up, not the individual files. The data can later be restored based on the changes that were saved. Another method, known is tape vaulting, is when the data is backed up on site, and then an individual physically transports the backup to offsite locations. When data is backed up in real-time it is a type of replication known as synchronous. On the other hand, when the backup up does not occur in real-time, or replicates later, it os known as asynchronous. High Availability means that a bunch of different technologies are used in order to ensure that databases and servers are always up and running, even after disaster strikes.

Chapter 8: Business Continuity and Disaster Recovery - Preventative Measures and Recovery Strategies

Hot Site - Place that is all the way ready to go for operation
Advantage - Ready and highly available.
Disadvantage- Costs a lot and equipment choice is usually limited.

Warm Site - A Hot site without the hardware.
Advantage - Less expensive
Disadvantage - Takes a little more time to get up and running.

Cold Site - A site that has basic utilities but no equipment.
Advantage - Available for a long time because it is so much cheaper than other options
Disadvantage - Takes time for operations to resume here.

I thought that this was really neat because I never knew that companies actually have these in case of a disaster.

Chapter 8: Business Continuity and Disaster Recovery - BCP Project Components

Scope of the project: Important to note that the scope of such a project is not as clear as it might appear. Big companies usually only outline the scope of a BCP for large threats.

BCP Policy: The framework of the BCP. Outlines the actual purpose of the BCP and helps people understand how it is important and why it is so important.

Project Management: SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis is useful here. Each objective of the BCP can be analyzed using this method and is potentially very helpful when designing and implementing a BCP.

Business Continuity Planning Requirements: Companies need to identify the real threats that are there and not ignore them. Failure to do so could lead to greater consequences. The "That will never happen to us" attitude can be detrimental to an organization.

Business Impact Analysis (BIA): Data is collected about business functions is examined and prioritized. A company does this to see which are most critical and valuable in case of a disaster.

Chapter 8: Business Continuity and Disaster Recovery - Intro

Regarding disaster recovery, the main goal is to is to minimize the effects of the disaster. However, the good news is that there are standards and best practices for such a disaster.

1. Develop a continuity planning policy statement - Construct a policy that gives insight on how to develop a BCP. Assign roles that will support it and can carry out the tasks.

2. Conduct a BIA (Business Impact Analysis) - Prioritize critical functions and systems. Calculate risks that have to do with threats and vulnerabilities.

3. Identify Preventative Controls - Implement measures that will counter the risks.

4. Develop Recovery Strategies - Find ways that will bring systems and functions back to operating level.

5. Develop a Contingency Plan - Develop ways that the organization can remain functional in the event of a disaster.

6. Test the plan and conduct training - Test the plan in order to identify and correct flaws. Train employees so that they know exactly what to do in case of a disaster.

7. Maintain the plan - Make sure that the plan is prevalent and that people know about it. Make sure that it is updated when it needs to be.

Chapter 7: Cryptography - Types of Attacks

Ciphertext only Attacks - attacker has the ciphertext of many messages, and each is encrypted using the same encryption algorithm. Most common attack, but hardest to be successful.

Known Plaintext Attacks - Attacker has the plaintext and the ciphertext to messages.

Chosen Plaintext Attacks - attacker has plaintext and ciphertext, but chooses the palintext that gets encrypted to view the ciphertext.

Chosen Ciphertext Attacks - chooses ciphertext to be decrypted and then gains access to the plaintext

*Goal is to figure out the key

Social Engineering - Manipulating others in order to get them to provide information.

Chapter 7: Cryptography - Internet Security

The very first sentence of this section of the study guide is extremely important. The Web is not the Internet. The Web basically runs on the Internet. I have a pretty good understanding of how HTTP works, and that it is stateless by design. It is up to the web developer to handle data persistence. Data can be persisted in one use case, in one session, using cookies, or using a database. HTTP is more secure when running over Secure Sockets Layer. The reason the exchange of credit card information is secure is because of Secure Electronic Transaction technology. It is also to point out the difference between Secure HTTP and HTTP Secure. The first protects each message sent from computer to computer, where the latter protects the channel in which the messages are sent.

Chapter 7: Cryptography - Email Standards

The book describes three main email standards when it comes to cryptography. The first one is the Multipurpose Internet Mail Extension. It's acronym is MIME, and it specifies how file types in email should be transferred and the handled by the recipient of the email. From my understanding, MIME is the reason that when you receive an email with an attachment, the file type is shown before even opening it most of the time. There is an extension to MIME, known as S/MIME where the S stands for secure. At a basic level, it allows for encryption of email and its attachments. It follows the Public Key Cryptography Standards and its algorithms. A second email standard is the PGP, or Pretty Good Privacy. A quote from the study guide describes it best: "I don't know you, but my buddy says you are all right, so I will trust you". It has become the de facto standard for the Internet. The third one is way more complex than the previous two...Quantum Cryptography. Photon polarization is used to represents bits for encryption.

Chapter 7: Cryptography - Public Key Infrastructure

I have found a website that explains PKI in a way that I understand a little better than the way the book puts it. Here is the link.

http://searchsecurity.techtarget.com/definition/PKI

Also, here is a diagram from the website that is helpful in describing whose key to use and what type of key to use.

To do this	Use whose	Kind of key
Send an encrypted message	Use the receiver's	Public key
Send an encrypted signature	Use the sender's	Private key
Decrypt an encrypted message	Use the receiver's	Private key
Decrypt an encrypted signature (and authenticate the sender)	Use the sender's	Public key

Below is another diagram that shows how PKI works in digital communication from http://www.asu.edu/ecure/2002/dollar/

Chapter 7: Cryptography - Message Integrity

One-Way Hash - Process that converts an amount of data and generates a fixed length value to protect integrity.

HMAC - Hashed message authentication code. Symmetric key concatenated with the message.

CBC-MAC - message gets encrypted with a symmetric block cipher.

CMAC - Cipher based message authentication code. Pretty much the same as CBC-MAC but a lot more secure mathematically.

I want to go ahead and point out the security services provided by each of these. A Hash function purely provides integrity. There is no confidentiality or authentication. Also, only unintentional modifications can be detected. HMAC lacks confidentiality, but it has integrity and data origin authentication. The same is true for CBC-MAC.

Chapter 7: Cryptography - Types of Asymmetric Systems

Just having symmetric key cryptography has many drawbacks. This is why asymmetric systems were developed. The first one developed is called the Diffie-Hellman Algorithm. Here, two different systems can make a symmetric key in a secure manner without first having established a relationship or agreement. It is however, vulnerable to man-in-the-middle attacks. Another asymmetric algorithm, RSA, is the standard used for digital signatures. It provides key encryption and is secure because it factors large numbers into their prime numbers. A third is El Gamal, which is an extension of Diffie-Hellman. It works by calculating discrete logs in a finite field. It is usually the slowest form.

Chapter 7: Cryptography - Types of Symmetric Systems

Data Encryption Standard (DES) - Algorithm is block symmetric. 56-bit true key bit. Block size is 64-bit. Has 16 rounds of computation.

3DES (Triple DES) - When encryption occurs, applies DES three times to each block of data.

Blowfish - Block size is 64-bit and keys can vary in length. Anyone can use it.

Rijndael - Chosen for AES. Block size is 128-bit and different key lengths are used (either 128 bits, 192 bits, or 256 bits).

International Data Encryption Algorithm (IDEA) - Block size is 64-bit and uses a 128-but key.

RC4 - This is a stream cipher. Key size can change. Simple, fast, but an easy target for attackers.

RC5 - Block cipher whose block sizes can be 32-bits, 64-bits, or 128-bits.Key has a limit of 2048-bits.Round limit is 255.

RC6 - Built upon RC5 and is the same for the most part. However, it is quicker than RC5.

Advanced Encryption Standard (AES) - Standard in the United States that replaced DES. 128 block size and key lengths vary from 128, 192, and 256.

Secure ans Fast Encryption Routine (SAFER) - Similar to DES but harder to break because of the size of the key is bigger. No known successful attacks as of now. It is also patented, so you have to pay to use it.

Chapter 7: Cryptography - Ciphers and Encryption Methods

There are two types of ciphers.

1. Substitution cipher - replaces characters with different characters.
2. Transposition cipher - Moves the values around. Does not replace values but hides the original meaning.

There are also two types of algorithms that are associated with cryptography:

1. Symmetric - user and sender use two instances of same key for encryption and decryption. Also known as secret keys. Equation to determine number of keys needed: N(N -1)/2. This method is a lot faster but must have secure mechanism to deliver keys the right way.

2. Asymmetric - each entity has different keys and are the two are related mathematically. For example, if one is used to encrypt the other must be used to decrypt. Public key is known to everyone, and only the owner uses the private key. There is better key distribution here, but is is much slower than the symmetric way.

Ofter good practice to use symmetric algorithms and asymmetric algorithms together. This is known as Hybrid Encryption.

Chapter 7: Cryptography - Cryptography Definitions and Concepts

Plaintext is the term used for readable data, whereas ciphertext is the data in its encrypted state. It is important to note that neither humans or machines should be able to properly read the data in its encrypted state. Only when the data is decrypted should it be able to be read by either human or machine. So, the process goes like this: plaintext is encrypted, and it becomes ciphertext. Then, in order to be read, the ciphertext is decrypted and becomes plaintext once again in order to read and used. Algorithms, a set of rules, are used to encrypt and decrypt data. A crptosystem is all of the things that make up an encryption and decryption process and should always be made up of software, protocols, algorithms, and keys. A key or crypto variable, is a single value that makes up a sequence of bits that are random. The algorithm that does the encryption and decryption should always be known, and only the keys should be kept secret. Bigger keyspaces allow for more possible keys, strengthening the encryption method. The one-time pad scheme is considered to be unbreakable if used in the right way. To work correctly, it must be constructed with truly random values, only used once, distributed securely, secured by the sender and the recipient, and must be as long as the message. This is a very basic description of how encryption works, and it does get more complicated than this.

Chapter 7: Cryptography - History of Cryptography

The first known use of cryptography can be dated back to 2000 B.C. in ancient Egypt. One of the earliest applications of cryptography was a hebrew method that replaced each letter of the alphabet with a different letter. We now have a term for this, and it is known as substitution cypher. Here is an example of this, with the letter 'A' being replaced with 'Z', 'B' being replaced with 'Y' and so on. So the word 'CRYPTOGRAPHY' would become 'XIBKGLTIZKSB'.  This is also known as a monoalphabetic substitution cypher because only one alphabet is used. If more than alphabet is used, it is then referred to as polyalphabetic. As time moved forward, algorithms were developed to improve methods of encryption. Today, there is the science of cryptanalysis, in which breaking down encryption is studied as well as reverse engineering the algorithms that encrypt data.

Chapter 6: Telecommunications and Network Security - OSI Layers

OSI stands for Open Systems Interconnection. There are various functions and protocols of the OSI model and the study guide states that if you want to take the exam, you will need be be pretty familiar with these.

Application - in charge of file transfer, network management, and fulfilling network requests. My favorite protocol example here is HTTP, because I am familiar with it and understand how it works for the most part.

Presentation - Handles data formats, and encryption. ASCII is one standard that is concerned with the presentation aspect of OSI.

Session - This layer sets up the connection of applications. A good protocol example here is SQL.

Transport - This is like an agreement between two computers. How much stuff will be sent is a concern, as well as how the receiving end will verify and handle the data.

Network -Main responsibility here is to tell the packet where it needs to go, and to get it to its correct destination. An IP address is a good example for this one.

Data Link - Changes the data into LAN or WAN frames for transfer and sets up how a computer will gain access to a network. Ethernet is one protocol that is associated with this layer.

Physical - The conversion of bits to actual electrical signals for transmission. A familiar term that you is in use here would be a digital subscriber line (DSL).

http://compnetworking.about.com/od/basicnetworkingconcepts/l/blbasics_osimod.htm

Chapter 6: Telecommunications and Network Security - Intro

At our day in age, networking has become increasingly complex. A network used to have boundaries, but now, since we basically have a computer in our pocket that is capable of networking, there is no clear cut boundary of individual networks. As technology increases, so do threats from attackers. Because of this, the security professionals of today must understand networks on various levels. Telecommunications is the transmission of data through systems. The data can be carried through cables, or it can be wireless. There are two main organizations that govern telecommunications. The International Telecommunications Union (ITU) and the International Standards Organization (ISO).