Cybersecurity, Cyber Resilience, and Security testing

This guide covers essential concepts in Cybersecurity, Cyber resilience, and Security testing.

Introduction to Cybersecurity, Cyber resilience, and Security testing

• Cybersecurity is the application of technologies, processes, and controls to protect systems, networks, programs, devices, and data from cyberattacks. It aims to reduce the risk of cyberattacks and prevent the unauthorized exploitation of systems and data.
• Cyber resilience is an organization's ability to prepare for, respond to, and recover from cyber threats, enabling adaptation to known and unknown crises. The goal is to help the organization thrive when facing adverse conditions.
• Security testing involves various methodologies and tools designed to identify vulnerabilities and weaknesses in systems and applications. It helps ensure that security measures are effective and that the organization complies with relevant security standards.

Understanding Cybersecurity and Resilience

• Cybersecurity involves using technologies, processes, and controls to protect systems, networks, programs, devices, and data from cyberattacks. The goal is to lower the risk of attacks and prevent unauthorized exploitation.
• Cyber resilience is an organization's ability to prepare for, respond to, and recover from cyber threats, allowing it to adapt to both known and unknown crises.
• A cyber-resilient organization should aim to thrive when facing adverse conditions.
• Key elements of cyber resilience:
• Micro-segmentation for data centers.
• Zero Trust approach: "Don’t trust, always verify" and ensure the right people access the right information at the right time.
• Access rules based on usual/unusual timings, employing least privilege and just-in-time privilege.
• VPN access limited to specific apps or databases.
• Tracking hacker locations and using machine learning to observe patterns.
• Regular security auditing.
• Applying governance.

Causes and Prevention of Cyberattacks

• Weak Passwords: A primary entry point for cyberattacks; strong passwords can significantly reduce the risk of attack by 50%.
• Vaults: Use vaults to store sensitive data, as they are designed to prevent and detect cyberattacks.
• Security Best Practices: Focus on confidentiality, integrity, and availability.

Security Best Practices for APIs

• Implement pagination for results.
• Protect against SQL injection and cross-site scripting.
• Use Role-Based Access Controls (RBAC).
• Use Attribute-Based Access Controls (ABAC).

Contingency Planning and Incident Response

• Importance of Planning: Many organizations are unprepared for cyberattacks, with a significant percentage lacking a response plan.
• Contingency Plan: Essential for responding to security incidents or IT malfunctions. It should cover organizational, legal, and technical details.
• Golden Hour: Rapid response is crucial for recovery, similar to emergency medicine.
• Key Steps in a Contingency Plan:
• Record necessary measures for emergencies, with expert advice.
• Designate an IT security officer.
• Regularly check and implement the contingency plan, ensuring it is understandable.
• Test the plan in practice.
• Immediate Actions During a Cyberattack:
• Stay calm and act tactically.
• Determine the extent of the infection.
• Ensure IT operations by activating backup systems.
• Contain the infection by isolating affected systems.
• Secure evidence for law enforcement and insurance claims.
• Eliminate the infection using anti-malware software and analyze data packets.
• Address legal issues and reporting obligations, particularly under GDPR.
• Avoid paying ransom demands.
• Learn from attacks to improve defensive measures.
• Checklist During a Cyberattack:
• Prevent further damage.
• Take immediate measures without delay.
• Change login data immediately.
• Deactivate guest accesses and take the network offline.
• Disconnect and do not use or remove any storage media.
• Extra Tips for Enhanced Security:
• Automate the emergency plan where possible.
• Maintain comprehensive logging and documentation.
• Make regular backups on multiple external media and consider encrypted cloud storage.
• Use an Endpoint Detection & Response (EDR) tool for continuous monitoring.
• Regularly review and test the contingency plan.

Types of Cyberattacks

• Malware Attacks: Using malicious software to harm systems.
• Social Engineering Attacks: Manipulating individuals to gain access or information.
• Password Attacks: Trying various passwords to gain unauthorized access.
• Physical Attacks: Gaining physical access to assets to cause damage or theft.
• On-Path Attacks: Intercepting and manipulating data between two parties.
• Network Attacks: Gaining unauthorized network access to steal or alter data.
• Application Attacks: Exploiting software vulnerabilities.
• Cryptographic Attacks: Weakening cryptographic systems.
• Phishing: Deceptive attempts to acquire sensitive information.
• Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS): Overwhelming systems with traffic.
• Man-in-the-Middle (MITM) Attacks: Intercepting communication.
• SQL Injection: Exploiting SQL database vulnerabilities.
• Cross-Site Scripting (XSS): Injecting malicious scripts into webpages.
• Ransomware: Encrypting data and demanding ransom.
• Zero-Day Exploits: Exploiting unknown vulnerabilities.
• Insider Threats: Actions by trusted individuals.
• Supply Chain Attacks: Targeting vendors to compromise the supply chain.

The table below outlines the OSI (Open Systems Interconnection) model, its protocols/components, and the associated security threats.

Security Testing Methodologies

• Vulnerability Scanning: Use automated tools to identify known vulnerabilities. Example tools: Nessus, Qualys, OpenVAS.
• Penetration Testing (Pen Testing): Simulate real-world attacks to find exploitable vulnerabilities. Conducted manually or with tools like Metasploit, Burp Suite.
• Static Application Security Testing (SAST): Analyze source code for vulnerabilities without execution. Example tools: SonarQube, Checkmarx.
• Dynamic Application Security Testing (DAST): Examine a running application for vulnerabilities. Example tools: OWASP ZAP, WebInspect.
• Security Scanning: Identify system weaknesses and suggest mitigation.
• Risk Assessment: Evaluate security risks and suggest countermeasures.
• Compliance Testing: Ensure compliance with security standards.

 Common Security Vulnerabilities to Test For

• SQL Injection.
• Cross-Site Scripting (XSS).
• Cross-Site Request Forgery (CSRF).
• Broken Authentication and Session Management.
• Insecure Direct Object References (IDOR).
• Insecure Deserialization.
• Weak Cryptography.
• Insufficient Logging and Monitoring.

OWASP Top 10 Web Application Security Risks (2021)

• Introduction: The OWASP Top 10 is a list of the most critical security risks to web applications, compiled and maintained by the Open Web Application Security Project (OWASP). It helps developers, security professionals, and organizations prioritize security measures to protect web applications from common threats. The list is updated periodically to reflect the most prevalent and dangerous risks at the time. The OWASP Top 10 is not a security tool, but a guideline that highlights critical security risks to web applications. It serves as a reference for understanding common vulnerabilities and security flaws.
• The most recent version (as of 2021) includes the following categories:
• Broken Access Control: Improper access controls can allow attackers to gain unauthorized access to systems or data.
• Cryptographic Failures: Inadequate protection of sensitive data, often due to poor implementation of cryptography.
• Injection: Occurs when untrusted data is sent to an interpreter as part of a command or query, such as SQL injection or command injection.
• Insecure Design: Refers to flaws in the design of the application, which make it vulnerable to attacks.
• Security Misconfiguration: Happens when security settings are improperly configured or left with default settings, making applications easier to exploit.
• Vulnerable and Outdated Components: Using outdated or unpatched software components, including libraries and frameworks, can introduce vulnerabilities.
• Identification and Authentication Failures: Weaknesses in authentication mechanisms, such as poor password policies, which can lead to unauthorized access.
• Software and Data Integrity Failures: Lack of verification of data and software integrity, leading to attacks such as code injection or corruption.
• Security Logging and Monitoring Failures: Inadequate logging or monitoring of application activities, which makes it harder to detect and respond to breaches.
• Server-Side Request Forgery (SSRF): Occurs when an attacker tricks the server into making unintended requests, potentially allowing access to internal systems.

OWASP Tools

• OWASP ZAP (Zed Attack Proxy): A free security tool that helps in finding security vulnerabilities in web applications by simulating various attacks.
• OWASP Dependency-Check: A tool that identifies project dependencies and checks if there are any known publicly disclosed vulnerabilities in those components.
• OWASP Security Knowledge Framework: An open-source application that provides developers with security guidelines during software development.

Other Security Testing Tools

• Burp Suite: It is widely used by security professionals, particularly for performing penetration testing and vulnerability assessment.
• Fiddler: Fiddler can be used to identify security vulnerabilities by intercepting and manipulating requests to test for issues like insecure communication, cookie tampering, or injection flaws.
• SonarQube: SonarQube helps identify potential security vulnerabilities such as SQL injection, cross-site scripting (XSS), hard-coded credentials, and others. It highlights security weaknesses early in the development process to prevent breaches.