SSCP · Domain 7
Systems and Application Security
About 15% of the exam
Malicious code
- Virus
- needs a host file
- Worm
- spreads with no user
- Trojan
- useful looking, malicious inside
- Rootkit
- hides at a privileged layer
- Ransomware
- encrypts and then extorts
- Spyware
- reports activity to someone
- Logic bomb
- waits for a trigger condition
- Fileless
- runs from memory and scripts
- Polymorphic
- changes signature with every copy
Malicious activity
- Insider misuse
- authorized access, unauthorized purpose
- Data exfiltration
- large or odd outbound transfers
- Privilege escalation
- gaining rights never granted
- Persistence
- tasks, services and startup entries
- Lateral movement
- reusing credentials on other hosts
- Living off the land
- abusing built-in administrative tools
- Social engineering
- the person is the target
Countermeasures
- Patch quickly and consistently
- Application allow lists on servers
- Least privilege for daily accounts
- Disable macros from the internet
- Segment so movement becomes visible
- Monitor script interpreters closely
- Keep backups offline and immutable
Endpoint security
- HIDS
- watches one host for attack
- Host firewall
- controls what the host accepts
- Allow list
- only approved software runs
- Full disk encryption
- protects a lost device
- TPM
- stores keys in hardware
- Secure boot
- verifies the boot chain
- EDR
- records behavior and enables response
- Patch agent
- reports and applies updates
Cloud security
Service models
- IaaS: you patch the operating system
- PaaS: you own code and data
- SaaS: you own data and access
- Functions: no servers, still your code
Deployment models
- Public, shared and multi-tenant
- Private, dedicated to one organization
- Hybrid links private and public
- Community, shared by similar bodies
Shared responsibility
- The provider secures the facility
- The customer always owns data
- Identity and access stay yours
- Misconfiguration is your fault
- Read the responsibility matrix first
Most cloud incidents come from customer misconfiguration, not from the provider losing control of the platform
Virtual environments
Hypervisor
- Type 1 runs on bare metal
- Type 2 runs on an operating system
- Patch the hypervisor promptly
- Restrict management interface access
Containers
- They share the host kernel
- Minimal base image, no shell
- Run as a non-root user
- Scan the image before deployment
- Ephemeral, so collect evidence quickly
Threats
- VM escape breaks the boundary
- Resource reuse leaks previous data
- Sprawl leaves unmanaged machines
- Snapshots hold sensitive memory contents
- Live migration exposes memory in transit
Mobile device management
- Enroll before the device gets data
- Enforce encryption and screen lock
- Separate work and personal containers
- Remote wipe the corporate profile
- Block jailbroken or rooted devices
- Restrict application installation sources
- Put BYOD terms in writing
Browsing and email
- Filter by category and reputation
- Isolate risky browsing remotely
- Block macros and executable attachments
- Check SPF, DKIM and DMARC
- Sandbox attachments before delivery
- Warn clearly on external mail
Application flaws
- Injection
- untrusted input reaches an interpreter
- Cross-site scripting
- script executes in the browser
- Broken access control
- authorization check simply missing
- Insecure deserialization
- objects rebuilt from hostile data
- Buffer overflow
- writes past the allocated memory
- Race condition
- check and use become separated
- Hardcoded secret
- credentials committed into code
- Vulnerable dependency
- flaw inherited from a library
Secure development
- Requirements
- Design and threat model
- Build
- Test and scan
- Review
- Deploy and monitor
- Validate every input on the server
- Use parameterized database queries
- Encode output for its context
- Keep secrets in a vault
- Scan code and dependencies automatically
Storing and moving data
- Data at rest
- encrypt disks, volumes or fields
- Data in transit
- TLS between every component
- Data in use
- enclaves or tightly scoped access
- Object storage
- check the access policy carefully
- Backups
- encrypted, immutable and tested
- Key storage
- hardware module or managed service
- Sanitization
- before reuse or disposal
Third parties and outsourcing
- Assess the provider before onboarding
- Require evidence, not assurances
- Set breach notification in the contract
- Know where the data physically resides
- Plan for exit and data return
- Monitor the service, not merely sign it
Rapid recall
- HIDS
- host based intrusion detection
- EDR
- endpoint detection and response
- TPM
- hardware key storage chip
- Allow list
- only approved software runs
- Hypervisor
- runs the virtual machines
- Container
- shares the host kernel
- Shared responsibility
- who secures which layer
- Sprawl
- unmanaged instances multiplying quietly
Know the order
- Hardening
- inventory, baseline, remove, restrict
- Development
- design, model, build, test
- Cloud onboarding
- assess, contract, configure, monitor
- Endpoint incident
- isolate, collect, clean, restore
- Images
- scan, sign, deploy, rebuild
Reference strip: malware, endpoints, cloud, code
Malware
- Virus, worm, trojan, rootkit
- Ransomware, spyware, logic bomb
- Fileless and polymorphic techniques
- Living off the land binaries
Endpoints
- HIDS, host firewall, EDR
- Allow lists and disk encryption
- TPM, secure boot, measured boot
- Patch agents and configuration baselines
Mobile
- MDM enrollment and profiles
- Containerization of work data
- Remote wipe and lock
- BYOD, COPE and CYOD models
Cloud and virtual
- IaaS, PaaS, SaaS responsibilities
- Public, private, hybrid, community
- Hypervisors, containers, snapshots
- VM escape, sprawl, resource reuse
Applications
- Injection, scripting, access control
- Deserialization and overflow flaws
- Secrets management and dependencies
- Threat modeling and secure review
Quick exam traps
- Trap: Containers isolate as strongly as virtual machines
- Trap: Moving to SaaS transfers responsibility for your data
- Trap: Antivirus signatures stop fileless attacks
- Trap: A snapshot is a safe place for sensitive memory
- Trap: Remote wipe always removes only corporate data
- Trap: Scanning an image once makes it safe forever
- Trap: A dependency flaw is the library author's problem
cybercertprep.com · original revision sheet written from the public body of knowledge