Defence in depth, multiple lines of defence. MFA / segregation
Separation of duties. Eg windows admins / network admins / backup admins. No one has full control of the org. We can also look at it like having 3 team members if one gets sick the team is still up
Fix security issues, do root cause analysis and fix for good.
If we opeerate in the EU and take CC payment then we need to comply with GDPR and PCIDSS.
The SIEM takes in all the logs from multiple sources. It will create dashboards / graphs / timelines etc.
Servers are the servers hosting the service s that the clients want to use.
Instead of having all the network devices and servers on site, companies can move their servers and network devices into the cloud and pay a cloud service provider (CSP).
Some benefits include on demand storage and processing power scaling. Cloud analytics (very useful for ops and security teams)
Just like normal infrastrucre, everything sits on top of the network and servers. None of the apps etc can work unless the infrastructure is working.
Basic unit of information that travels from one device to another over the network
- Application (HTTP, SMTP etc)
- Presentation (data translation / encryption / compression TLS)
- Session (Session manages open/active connections / reconnection them etc)
- Transport (transport, breaking up data into packets TCP/UDP)
- Network (get frames from data link and send them where to do, routing)
- Data link (macs and frames, NCP HDLC SDLC)
- Physical (cables etc)
TCP/IP model is real world. OSI is more theoretical. Need to be familiar with both.
IPv4 address
19.117.63.126
IPv6 address (32 characters)
684D:111:222:3333:444:555:6:77
All IPv4 addresses were being used up. We had to make IPv6 so there would be enough addresses for ever. So far it seems to have been adopted by service providers. I've not seen IPv6 on the LAN in most orgs. IPv6 addresses are much harder for humans to read and spot in logs.
Types of addresses:
- Public IP - on the internet
- Private IP - On the LAN
- MAC address - hardware address of the network card
Format of IPv4 packet
header 20-60
total 20 - 65535 bytes
- Version (VER): This 4 bit component tells receiving devices what protocol the packet is using. The packet used in the illustration above is an IPv4 packet.
- IP Header Length (HLEN or IHL): HLEN is the packet’s header length. This value indicates where the packet header ends and the data segment begins.
- Type of Service (ToS): Routers prioritize packets for delivery to maintain quality of service on the network. The ToS field provides the router with this information.
- Total Length: This field communicates the total length of the entire IP packet, including the header and data. The maximum size of an IPv4 packet is 65,535 bytes.
- Identification: IPv4 packets can be up to 65, 535 bytes, but most networks have a smaller limit. In these cases, the packets are divided, or fragmented, into smaller IP packets. The identification field provides a unique identifier for all the fragments of the original IP packet so that they can be reassembled once they reach their destination.
- Flags: This field provides the routing device with more information about whether the original packet has been fragmented and if there are more fragments in transit.
- Fragmentation Offset: The fragment offset field tells routing devices where in the original packet the fragment belongs.
- Time to Live (TTL): TTL prevents data packets from being forwarded by routers indefinitely. It contains a counter that is set by the source. The counter is decremented by one as it passes through each router along its path. When the TTL counter reaches zero, the router currently holding the packet will discard the packet and return an ICMP Time Exceeded error message to the sender.
- Protocol: The protocol field tells the receiving device which protocol will be used for the data portion of the packet.
- Header Checksum: The header checksum field contains a checksum that can be used to detect corruption of the IP header in transit. Corrupted packets are discarded.
- Source IP Address: The source IP address is the IPv4 address of the sending device.
- Destination IP Address: The destination IP address is the IPv4 address of the destination device.
- Options: The options field allows for security options to be applied to the packet if the HLEN value is greater than five. The field communicates these options to the routing devices.
Network protocols
A sample flow of a basic connection to a website.
- DNS - lookup IP to domain name www.website.com
- ARP - Find where next hope gateway is towards internet
- TCP - Make a connection to the website IP
- TLS - Setup secure connection between client and server
- HTTPS - Display the webpage in the browser over the TLS connection
WIFI security
IEEE 802.11 is WIFI
WEP (broken) > WPA (transitional) > WPA2 (KRACK attacks still work) > WPA3 (more secure, more complex)
Firewalls
Allow/block traffic based on their rules. The rules are configured by admin.
- Hardware - physical device has its own memory/CPU
- Software - Software imagine which can run in your virtualization infra
- Cloud - Cloud hosted software firewall
stateless - Just applies its rules to traffic but doesn't keep track of connections (less secure
stateful - keeps track of connections and filters threats
ngfw - Does everything stateful does and more (DPI, IPS, Threat intel, content filtering etc)
Firewalls are often the headend for dial in VPNs (remote access for users)
VPNs (virtual private networks)
- Site links are expensive, we can make VPN across the public internet but keep them secure
- S2S VPNs - connect two sites via an encrypted tunnel
- dial in or RA VPNS - remote access VPNs for end users to work from home etc
Security Zones
Before we had interfaces
Now we can have zones where we have multiple interfaces in one zone
Zones are used as part of network segmentation
Outside/internet - uncontroller
Ideally
Internet > firewall > DMZ > firewall > LAN > firewall > Restricted zone
We can have multiple DMZ's / LANs / WIFIs / Restricted zones
Often to cut costs we will just have one firewall with each zone as an interface off the firewall
Internet > firewall > DMZ/LAN/WIFI/Restricted
The firewall controls access between the zones.
To do some network segmentaiton
- Firewall interface (with firewall rules applied)
- Assign it to the inside security zone
- Attach interface to the LAN vlan on the switch
- Create an IP subnet for the LAN network
Proxy servers
The proxy server forwards requests on.
The most common was a web proxy or forward proxy.
user > web proxy > internet
Users never get direct internet access.
Reverse proxy (often socks5) take data from internet/dmz and forwards it to inside servers.
forward: user > proxy > internet
reverse: internet/dmz > proxy > server
Many left behind forward proxies for cisco umbrella / dns protection.
VPN protocols
Wireguard
- code base: 4K lines
- cryptography: fixed modern suite
- High speed vpn
- newer (2016)
- open source
- key-pairs but not built in identity system
IPsec (IKEV2)
- code base: 10K plus
- Earlier protocol (late 1990s)
- More complex
- cryptography: Negotiable, many cipher/algorithm
- Tried and tested, well supported
TLS/DTLS-based VPNs (OpenVPN, Cisco AnyConnect/DTLS, GlobalProtect)
- code base: 10K plus
- In the middle protocol (openvpn 2001, dtls 2006)
- More complex
- cryptography: Negotiable, many cipher/algorithm
- Tried and tested, well supported
Rule-of-thumb selection guidance
- Need it to work everywhere, even hostile networks > TLS/DTLS (OpenVPN-style)
- Need broad native client support with enterprise auth (RADIUS/certs/MFA) > IPsec/IKEv2
- Need maximum speed/efficiency and control both ends > WireGuard (often paired with an identity/ACL layer like Tailscale for enterprise use)
Security hardening
Just like our house we don't leave doors and windows opens, we might use CCTV cameras and have a house alarm.
In IT we patch/update our systems. We require passwords/MFA to get access, we encrypt data in transit. We monitor logs for suspicious activity
OS hardening
- OS updates/patches
- Application updates/patches
- Library, some applications make use of common public librarys/packages, usually covered by updating the application but not always
- Password policies and MFA
- Baseline config
Brute force attacks - trying every combination of password
Dictionary attacks - trying password lists of credentials from previous breachs
Rainbow table attack - If we have a hash of the users password we can see if the hash has been cracked already to the plain text password.
Hashing
We take a plain text "password" and hash it with give a string. It's a one way password > hash. Then we can store the hash in our database instead of the users password.
Salting
Involves adding salt to the dish. hash = H(password + salt).
The salt is the stored alongside the hash (it doesn't need to be secret).
Rainbow table attacks: Attackers precompute huge tables of hash values for common passwords. If your hash matches an entry, they instantly know the password. Salting defeats this because each password now hashes differently even if the underlying password is the same — a precomputed table would need to account for every possible salt, making the attack impractical.
Duplicate detection: Without salts, two users with the same password get the same hash — visibly revealing that they share a password. Salts make each hash unique even for identical passwords.
Network hardening- Updating software on network devices
- Using a firewall/ACLs to control access
- Port filtering
- network segmentation
- use latest encryption
- network log analysis
- IPS/IDS
Network security in the cloud
Cloud security we should use baseline OS images
You can think about cloud security like living in a house alone. You might leave everything unlocked because its just you there. However if you have roommates you might start locking your room. When you are in a public cloud you are in there with roommates. Then cloud vendor and other customers.
Keep in mind with cloud some aspects will be hidden to you. With on prem you would have access to everything.
CSP secures the cloud infra and OS patches etc.
hypervisor type1: run on hardware
hypervisor type2: software
security holes in hypervisor can lead to VM escapes.
Baselining all security settings
encryption on data in flow and at rest
TPM: chip in computer to store private keys
CLoudHSM: cloud hardware security module
Security groups are groups in cloud that limit exposre of N/S and E/W traffic.
BIOS chips boot the computer
UEFI chips replaced BIOS chips on modern computers
BIOS/UEFI chips have a list of checks to boot the computer hardware
The last instruction activates the bootloader.
Bootloader is a software program that boots the OS
Once the OS boots the user can interface with the computer/applications
There are many attacks on operating systems but keep in mind there are attacks on chips and bootloaders too.
The OS is like a conductor allocating resources when and where needed.
The computer has limited resources but lots of applications asking for memory/CPU/disk access
GUI vs CLI
Often you will need to work on CLI in linux in IT security
GUI: Icons and text
CLI: text based and commands
Using CLI is usually faster when you know what to do
history file is recorded so you can see what you have used
you may look at history file in a security incident
Linux in security
linux is open source
gnu public license so they can be used and improved
global group of people working on code
FSH - file system hierarchy
almalinux replaced centos
Package managers
apt and yum for installing applicaton
Types of shells
bourne again shell (bash)
c shell (csh)
korn shell (ksh)
enchanced c shell (tcsh)
z shell (zsh)
bash is default for most distros
standard input (info you input into the shell)
String data
echo hello
standard output
the computers response on the cli
standard error
any errors the computer needs to output
Linux shell
You will need to work with log files and set permissions via the cli
Bash shell is the default for most distros and often all that is available on older systems
- cat - output the full file
- more - output the file but paged
- head -n 5 - see the top of the file
- tail -n 5 - see the end of the file
The root directory is always at the top and its /
- /home - user directories
- /bin - binary executables (programs)
- /etc - config files
- /tmp - temp files
- /mnt - mounted media stores like USB drives or network shares
use the command "man heir" to learn more
Grep
grep OS updates.txt
We are looking for "OS" in the updates.txt file
Pipe |
Sends the output of one command to another command
ls /home | grep users
Filtering for certain information is important for cyber sec professionals
Fin search for directories and files and meet a criteria
find /home/analyst/projects
-name is case sensitive
-iname is not case sensitive
find /projects/ -iname log
-mtime 3 all files that have been modified in the last 3 days
-mtrime +1 all files modified more than 1 day ago
Deleting directory
rmdir oldreports
Deleting file
rm file.txt
delete a directory and everything under it
rm -rf oldproject
File editors
Nano is good for beginners
vi or vim is often on older systems, neovim is a newer version
emacs is also popular older editor
File permissions
Get more details on the files in the directory
ls -l
ls -lash
We will see the permissions listed on the left eg
-rw-rw-r--
first character is file type. We see - because its a file. We will see d if its a directory
rw- (user/owner)
r-- (group)
r-- (others, everyone else)
- Owner (rw-): can read and write, but not execute.
- Group (rw-): members of the file’s group can also read and write, but not execute.
- Others (r--): everyone else can only read.
Octal values
- rw- is 4 + 2 = 6
- rw- we know from above is 6
- r-- is 4
This files permissions are 664, we can set in a few ways:
chmod 664 filename
chmod u=rw,g=rw,o=r filename.
Directories
r = lets you list contents of the directory
w lets you create or delete files inside the directory
x lets you enter the directory with cd or access files within it
Most common octal values
- 644 rw-r--r-- Standard for regular files: owner edits, everyone reads (config files, web content)
- 755 rwxr-xr-x Standard for directories and executable scripts/binaries: owner full control, others can read and run
- 600 rw------- Private files: SSH private keys, credentials, .env files
- 700 rwx------ Private directories (e.g. ~/.ssh) or private scripts
- 664 rw-rw-r-- Shared files where your group collaborates
- 775 rwxrwxr-x Shared directories or scripts for a group
- 770 rwxrwx--- Group-only shared directory: owner and group full access, outsiders locked out entirely
- 640 rw-r----- Files a service’s group needs to read but nobody else should (e.g. some log or config files)
- 400 r-------- Read-only even for the owner; AWS .pem keys often require this
Ones to avoid / watch out for:
Anything ending in 2, 3, 6 or 7 in the last digit means “others” can write. That’s the real thing to watch for, not just 777 specifically. You can find world-writable files with:
777 (rwxrwxrwx) is the classic one to avoid. Anyone on the system can read, modify, replace or execute the file. On a web server it’s a common path to compromise: an attacker who gets any foothold can rewrite your scripts. It’s usually a sign someone hit a permissions error and gave up debugging.
666 (rw-rw-rw-) has the same problem without execute. Anyone can overwrite or empty the file.
Seeing hidden files
ls -a
.hiddenfile
See the permissions on hidden files
ls -la
chmod - change mode
chmod g+w,o-r access.txt
Give group write permissions
Remove read permissions from others (everyone else)
Add and delete users
root user is like the administrator account on windows
its the most powerful account so needs to be managed carefully
It's common to not allow remote logins from the root account
root account has access to everything so accidental deletion of files is a risk
we also don't know who did what if we don't use named account we just know someone logged in as root did some action
sudo lets users run commands as an elevated account
users are given sudo via the sudoers file
this way they can login as named.account but run binary
sudo useradd user9 (adds the users, this will auto create a group of the same name too)
sudo userdel user9 (remove the user)
sudo groupdel user9 (you will need to remove the group created for the user too)
sudo usermod (with different switches changes users settings like home directory, login name and you can lock the account)
sudo chown (change the ownership of file or directory
sudo users will still be a target for attackers
The "man" or manual command gives detailed information about a command and its switches
man tail
whatis gives a shorted description
whatis tail
Find commands with certain works
apropos password
apropos -a change password
More help online:
https://unix.stackexchange.com/
Terms
- Absolute file path: The full file path, which starts from the root
- Argument (Linux): Specific information needed by a command
- Authentication: The process of verifying who someone is
- Authorization: The concept of granting access to specific resources in a system
- Bash: The default shell in most Linux distributions
- Command: An instruction telling the computer to do something
- File path: The location of a file or directory
- Filesystem Hierarchy Standard (FHS): The component of the Linux OS that organizes data
- Filtering: Selecting data that match a certain condition
- nano: A command-line file editor that is available by default in many Linux distributions
- Options: Input that modifies the behavior of a command
- Permissions: The type of access granted for a file or directory
- Principle of least privilege: The concept of granting only the minimal access and authorization required to complete a task or function
- Relative file path: A file path that starts from the user's current directory
- Root directory: The highest-level directory in Linux
- Root user (or superuser): A user with elevated privileges to modify the system
- Standard input: Information received by the OS via the command line
- Standard output: Information returned by the OS through the shell
Databases and SQL
Working in cybersecurity we will need to look through lots of data. This data will often be stored in databases so we will use SQL queries to search the data and pull out the information we need.
Example table "employees"
Tables have rows and columns. Columns are the top headings.
A row is some times called a record too. This is the single line entry
USERID, DEVICEID, USERNAME, DEPARTMENT, LOCATION
9, xxxxxxx, bob, marketing, NYC
Imagine this table has thousands of entries, many users with different details. We may need to pull out all the users in a certain location. Or find where a user is based off their device ID etc.
Two tables can be connected if they share a common column. For example we might have DEVICE is the employees table and the machine table. These are called keys
Primary key - a column where every row has a unique entry, eg USERID
No duplicates or empty values allowed.
Foreign key - a column in a table that points to a primary key in another table, eg DEVICE ID. Here we can have duplicates or null. For example two users may use the same DEVICEID or a new user may not have a device assigned yet so has NULL. It's allowed because its not the primary key in the current table.
Primary key
- A column (or group of columns) that uniquely identifies each row in a table, e.g.
UserID.
- Every value must be unique, so there are no duplicates.
- It can never be empty (NULL).
- A table has only one primary key, though that key can be made of more than one column (a composite key).
Foreign key
- A column that references a primary key (or a UNIQUE column like MAC address) in another table, e.g.
DeviceID in the Users table pointing to DeviceID in the Devices table.
- It links the two tables together.
- It can contain duplicates, because many rows can point to the same row in the other table (a one-to-many relationship).
- It can be NULL, meaning “not linked to anything,” unless the designer adds a
NOT NULL rule.
- Any value it does hold must exist in the referenced table, so you can’t point to a row that isn’t there (referential integrity).
- A table can have many foreign keys.
- It can reference its own table (self-referencing), e.g.
ManagerID pointing to EmployeeID.
The main idea
- The values a foreign key points to are unique in their own table. The foreign key column itself can repeat them or be empty.
SQL - Structured query language
A Query is a request for data
Many databases have adopted this query language for getting data from the database
Often accessed via the CLI (eg mysql or sqlite3) but some have web interfaces where we can run queries.
SQL is more efficient as we can select the relevant tables / columns etc so we are just looking at the relevant data.
Joining tables
Some security-related decisions require information from different tables. SQL allows the analyst to join multiple tables together when returning data. Linux doesn’t have that same functionality; it doesn’t allow data to be connected to other information on your computer. This is more restrictive for an analyst going through security logs.
Sometimes we will be using SQL databases sometimes we will be grep'ing text based logs like csv files etc.
Basic SQL queries
- select - what to look for
- from - from which table
- lines end with a semi colon;
- * - all
SELECT user_id, device_ic FROM employees;
SELECT * FROM employees;
We can add useful terms to the end of our select statements
LIMIT the output, useful when crafting a query before executing on a large dataset
LIMIT 100
Order by a specific column
SELECT * FROM log_in_attempts ORDER BY login_date, login_time
Filter dates and numbers
- strings - like usernames
- numeric - time and dates
In cybersecurity dates and numbers you may come across in logs.
- the number of login attempts
- the count of a specific type of log entry
- traffic tx
- traffic rx
- login dates
- login times
- dates for patches
- the duration of a connection
Operators
- = equals
- > greater than
- < less than
- <> not equal to
- >= greater than or equal to
- <= less than or equal to
Lets say we want to see all logins after business hours
SELECT *
FROM log_in_attempts
WHERE time > '18:00';
Between operator
Search for a range
WHERE OS_patch_date BETWEEN '2021-03-01' AND '2021-09-01';
Note about single quotations
For dates we use quotation marks but numbers we don't eg:
WHERE userid BETWEEN 8 and 9;
Filtering with AND, OR, NOT
AND - both conditions must be met. eg fresh AND red apples
SQL example
SELECT *
FROM machines
WHERE OS = 'OS1' AND email = 'outlook';
OR - either condition can be me. eg green or red apples
SQL example
SELECT *
FROM machines
WHERE os = 'os1' OR os = 'os3';
NOT - every entry that does not match our filter. eg all fruit that is not apples.
SQL example
SELECT *
FROM machines
WHERE NOT os = 'os1';
*** Note about NOT placement
When using NOT is needs to come after the WHERE
WHERE NOT country = 'USA'
Operator symbols in old code
You may have noticed some operators are words and others are symbols. SQL tried to use words to make it easier to use. They kept = < > because people would know these from basic maths. Later they added some symbols for C programmers but these are not deprecated so stick to using the words. You might come across it on older code / databases so something to be aware of.
AND - && - Deprecated, so avoid using it
OR- || - Deprecated, and means something different in standard SQL (joining strings)
NOT - ! - MySQL-specific and has a different precedence from NOT, as shown below
LIKE - (No symbol) - Uses the wildcard symbols % and _ within the pattern
SQL joins
When we are doing joins we are working with two tables. We need to tell sql which column we are working on.
When we have the same column name "model" in two tables we can define the table name first
cars.model
insurance.model
table.column
NULL is a missing value so e have to cater for it
SQL inner join example
As an example we may want to know what employees are accessing what machines. We can get this by joining the employees table and the machines table.
First lets identfy the shared column that we will use to connect the two tables. In this case we'll use primary key in employees "employee_id" which is a foreign key in the machines table.
We will use INNER JOIN
This returns rows matching on a specified column that exists in more than one table.
When we do the inner join if we find for example 1888 as an id in employees table and we see it in machines that is a match. That will be in the output of the joined tables. We will see all the columns from both tables in one output.
SQL example of INNER JOIN
SELECT username, office, operating_system
FROM employees
INNER JOIN machines ON employees.employee_id = machines.employee_id;
employees is the "left" table
machines is the "right" table
employee_id is the column to base the join on. It exists in both tables
Types of joins
- INNER JOIN
- LEFT JOIN
- RIGHT JOIN
- FULL OUTER JOIN
INNER JOIN
Returns rows matching on a specified column that exists in more than one table. It only returns the rows where there is a match, but like other types of joins, it returns all specified columns from all joined tables. Note: If a column exists in both of the tables, it is returned twice when SELECT * is used.
Only show entries that match in both tables and display that.
If you imagine two over lapping circles. The inner join this the overlapping data.
LEFT JOIN
Returns all of the records of the first table, but only returns rows of the second table that match on a specified column. We will see NULL entered in columns from the right table where there was no match in the left table.
Keep everything from the left table even if there is no match
If you imagine two over lapping circles. The left join is the overlapping data and all of the left circle
RIGHT JOIN
Returns all records from the right table, only returns rows from the first table that match on a specific column. Again we will see NULL values in columns where there was no match.
Keep everything on the right even if there is no match in the first table.
If you imagine two over lapping circles. The right join is the over lapping data and all of the right circle
FULL OUTER JOIN
Returns all columns from all tables. NULL values will be used where there is no value for that column. For example employees table doesn't have operating_system data so that will be NULL for those entries.
Keep everything and fill in null for columns where there is no value because it doesn't exist in that table.
If you imagine two over lapping circles. The full outer join is the over lapping data and the full two circles so everything selected.
Reality check
- You don't have to be a SQL expert but you need to know how to pull out the information you need.
- In reality you will most likely use inner join.
- In some cases you will use left or right join depending on need.
- Most SQL analysts only use left join. This is because they find the query easier to read/write that way. We read of left to right. If they want a right join they can just swap the table names around.
- It is much more intuitive to think: "I want everything from my primary list (Table A), and I’ll pull in whatever matches from the secondary list (Table B).
- FULL OUTER JOIN is more specialized and used to reconcile data between two systems.
- Some SQL databases don't allow a FULL OUTER JOIN but they will allow you to make a union on an left and right join.
Union example
SELECT * FROM customers c LEFT JOIN orders o ON c.id = o.customer_id
UNION
SELECT * FROM customers c RIGHT JOIN orders o ON c.id = o.customer_id;
Aggregate functions
In SQL, aggregate functions are functions that perform a calculation over multiple data points and return the result of the calculation. The actual data is not returned.
There are various aggregate functions that perform different calculations:
- COUNT returns a single number that represents the number of rows returned from your query.
- AVG returns a single number that represents the average of the numerical data in a column.
- SUM returns a single number that represents the sum of the numerical data in a column.
- GROUP BY returns grouped rows that share the same value (GROUP BY customer_id)
SQL example
SELECT COUNT(firstname)
FROM customers
WHERE country = 'USA';
Key terms
- Database: An organized collection of information or data
- Date and time data: Data representing a date and/or time
- Exclusive operator: An operator that does not include the value of comparison
- Filtering: Selecting data that match a certain condition
- Foreign key: A column in a table that is a primary key in another table
- Inclusive operator: An operator that includes the value of comparison
- Log: A record of events that occur within an organization's systems
- Numeric data: Data consisting of numbers
- Operator: A symbol or keyword that represents an operation
- Primary key: A column where every row has a unique entry
- Query: A request for data from a database table or a combination of tables
- Relational database: A structured database containing tables that are related to each other
- String data: Data consisting of an ordered sequence of characters
- SQL (Structured Query Language): A programming language used to create, interact with, and request information from a database
- Syntax: The rules that determine what is correctly structured in a computing language
- Wildcard: A special character that can be substituted with any other character
